summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
Diffstat (limited to 'extensions')
-rw-r--r--extensions/libnetfilter_conntrack_icmp.c24
-rw-r--r--extensions/libnetfilter_conntrack_sctp.c32
-rw-r--r--extensions/libnetfilter_conntrack_tcp.c31
-rw-r--r--extensions/libnetfilter_conntrack_udp.c32
4 files changed, 115 insertions, 4 deletions
diff --git a/extensions/libnetfilter_conntrack_icmp.c b/extensions/libnetfilter_conntrack_icmp.c
index a6cfe77..a69f43d 100644
--- a/extensions/libnetfilter_conntrack_icmp.c
+++ b/extensions/libnetfilter_conntrack_icmp.c
@@ -15,6 +15,7 @@
#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_icmp.h>
static void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple)
{
@@ -51,12 +52,35 @@ static int print_proto(char *buf, struct nfct_tuple *t)
ntohs(t->l4src.icmp.id)));
}
+static int compare(struct nfct_conntrack *ct1,
+ struct nfct_conntrack *ct2,
+ unsigned int flags)
+{
+ int ret = 1;
+
+ if (flags & ICMP_TYPE)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.type !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.type)
+ ret = 0;
+ if (flags & ICMP_CODE)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.code !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.code)
+ ret = 0;
+ if (flags & ICMP_ID)
+ if (ct1->tuple[NFCT_DIR_REPLY].l4src.icmp.id !=
+ ct2->tuple[NFCT_DIR_REPLY].l4src.icmp.id)
+ ret = 0;
+
+ return ret;
+}
+
static struct nfct_proto icmp = {
.name = "icmp",
.protonum = IPPROTO_ICMP,
.parse_proto = parse_proto,
.build_tuple_proto = build_tuple_proto,
.print_proto = print_proto,
+ .compare = compare,
.version = VERSION
};
diff --git a/extensions/libnetfilter_conntrack_sctp.c b/extensions/libnetfilter_conntrack_sctp.c
index 81a2467..aa06f6d 100644
--- a/extensions/libnetfilter_conntrack_sctp.c
+++ b/extensions/libnetfilter_conntrack_sctp.c
@@ -15,6 +15,7 @@
#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
static void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple)
{
@@ -38,9 +39,9 @@ static void build_tuple_proto(struct nfnlhdr *req, int size,
struct nfct_tuple *t)
{
nfnl_addattr_l(&req->nlh, size, CTA_PROTO_SRC_PORT,
- &t->l4src.tcp.port, sizeof(u_int16_t));
+ &t->l4src.sctp.port, sizeof(u_int16_t));
nfnl_addattr_l(&req->nlh, size, CTA_PROTO_DST_PORT,
- &t->l4dst.tcp.port, sizeof(u_int16_t));
+ &t->l4dst.sctp.port, sizeof(u_int16_t));
}
static int print_protoinfo(char *buf, union nfct_protoinfo *protoinfo)
@@ -55,6 +56,32 @@ static int print_proto(char *buf, struct nfct_tuple *tuple)
htons(tuple->l4dst.sctp.port)));
}
+static int compare(struct nfct_conntrack *ct1,
+ struct nfct_conntrack *ct2,
+ unsigned int flags)
+{
+ int ret = 1;
+
+ if (flags & SCTP_ORIG_SPORT)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4src.sctp.port !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4src.sctp.port)
+ ret = 0;
+ if (flags & SCTP_ORIG_DPORT)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.sctp.port !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.sctp.port)
+ ret = 0;
+ if (flags & SCTP_REPL_SPORT)
+ if (ct1->tuple[NFCT_DIR_REPLY].l4src.sctp.port !=
+ ct2->tuple[NFCT_DIR_REPLY].l4src.sctp.port)
+ ret = 0;
+ if (flags & SCTP_REPL_DPORT)
+ if (ct1->tuple[NFCT_DIR_REPLY].l4dst.sctp.port !=
+ ct2->tuple[NFCT_DIR_REPLY].l4dst.sctp.port)
+ ret = 0;
+
+ return ret;
+}
+
static struct nfct_proto sctp = {
.name = "sctp",
.protonum = IPPROTO_SCTP,
@@ -63,6 +90,7 @@ static struct nfct_proto sctp = {
.build_tuple_proto = build_tuple_proto,
.print_proto = print_proto,
.print_protoinfo = print_protoinfo,
+ .compare = compare,
.version = VERSION
};
diff --git a/extensions/libnetfilter_conntrack_tcp.c b/extensions/libnetfilter_conntrack_tcp.c
index 95503ec..dc50315 100644
--- a/extensions/libnetfilter_conntrack_tcp.c
+++ b/extensions/libnetfilter_conntrack_tcp.c
@@ -15,6 +15,7 @@
#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
static const char *states[] = {
"NONE",
@@ -93,6 +94,35 @@ static int print_proto(char *buf, struct nfct_tuple *tuple)
htons(tuple->l4dst.tcp.port)));
}
+static int compare(struct nfct_conntrack *ct1,
+ struct nfct_conntrack *ct2,
+ unsigned int flags)
+{
+ int ret = 1;
+
+ if (flags & TCP_ORIG_SPORT)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4src.tcp.port !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4src.tcp.port)
+ ret = 0;
+ if (flags & TCP_ORIG_DPORT)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.tcp.port !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.tcp.port)
+ ret = 0;
+ if (flags & TCP_REPL_SPORT)
+ if (ct1->tuple[NFCT_DIR_REPLY].l4src.tcp.port !=
+ ct2->tuple[NFCT_DIR_REPLY].l4src.tcp.port)
+ ret = 0;
+ if (flags & TCP_REPL_DPORT)
+ if (ct1->tuple[NFCT_DIR_REPLY].l4dst.tcp.port !=
+ ct2->tuple[NFCT_DIR_REPLY].l4dst.tcp.port)
+ ret = 0;
+ if (flags & TCP_STATE)
+ if (ct1->protoinfo.tcp.state != ct2->protoinfo.tcp.state)
+ ret = 0;
+
+ return ret;
+}
+
static struct nfct_proto tcp = {
.name = "tcp",
.protonum = IPPROTO_TCP,
@@ -102,6 +132,7 @@ static struct nfct_proto tcp = {
.build_protoinfo = build_protoinfo,
.print_protoinfo = print_protoinfo,
.print_proto = print_proto,
+ .compare = compare,
.version = VERSION
};
diff --git a/extensions/libnetfilter_conntrack_udp.c b/extensions/libnetfilter_conntrack_udp.c
index 21c599a..bd33280 100644
--- a/extensions/libnetfilter_conntrack_udp.c
+++ b/extensions/libnetfilter_conntrack_udp.c
@@ -15,6 +15,7 @@
#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_udp.h>
static void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple)
{
@@ -36,9 +37,35 @@ static void build_tuple_proto(struct nfnlhdr *req, int size,
struct nfct_tuple *t)
{
nfnl_addattr_l(&req->nlh, size, CTA_PROTO_SRC_PORT,
- &t->l4src.tcp.port, sizeof(u_int16_t));
+ &t->l4src.udp.port, sizeof(u_int16_t));
nfnl_addattr_l(&req->nlh, size, CTA_PROTO_DST_PORT,
- &t->l4dst.tcp.port, sizeof(u_int16_t));
+ &t->l4dst.udp.port, sizeof(u_int16_t));
+}
+
+static int compare(struct nfct_conntrack *ct1,
+ struct nfct_conntrack *ct2,
+ unsigned int flags)
+{
+ int ret = 1;
+
+ if (flags & UDP_ORIG_SPORT)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4src.udp.port !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4src.udp.port)
+ ret = 0;
+ if (flags & UDP_ORIG_DPORT)
+ if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.udp.port !=
+ ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.udp.port)
+ ret = 0;
+ if (flags & UDP_REPL_SPORT)
+ if (ct1->tuple[NFCT_DIR_REPLY].l4src.udp.port !=
+ ct2->tuple[NFCT_DIR_REPLY].l4src.udp.port)
+ ret = 0;
+ if (flags & UDP_REPL_DPORT)
+ if (ct1->tuple[NFCT_DIR_REPLY].l4dst.udp.port !=
+ ct2->tuple[NFCT_DIR_REPLY].l4dst.udp.port)
+ ret = 0;
+
+ return ret;
}
static struct nfct_proto udp = {
@@ -47,6 +74,7 @@ static struct nfct_proto udp = {
.build_tuple_proto = build_tuple_proto,
.parse_proto = parse_proto,
.print_proto = print_proto,
+ .compare = compare,
.version = VERSION,
};