summaryrefslogtreecommitdiffstats
path: root/src/conntrack
Commit message (Collapse)AuthorAgeFilesLines
* conntrack: support flush filteringHEADmasterFelix Huettner2024-01-242-0/+12
| | | | | | | | | | | | | | flushing already supports filtering on the kernel side for value like mark, l3num or zone. This patch extends the userspace code to also support this. To reduce code duplication the `nfct_filter_dump` struct and associated logic is reused. Note that filtering by tuple is not supported, since `CTA_FILTER` is not yet supported on the kernel side for flushing. Trying to use it returns ENOTSUP. Signed-off-by: Felix Huettner <felix.huettner@mail.schwarz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: mnl: clean up check for mismatching l3num and tuple filterPablo Neira Ayuso2024-01-241-3/+4
| | | | | | | Remove boolean, directly check for NFCT_FILTER_DUMP_L3NUM and make sure it is consistent to what has been described in NFCT_FILTER_DUMP_STATUS. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: api: bail out if setting up filter for flush/dump failsPablo Neira Ayuso2024-01-241-2/+4
| | | | | | | | Instead of asserting or simply ignoring the filter, bail out if setting up filter fails. Fixes: c2136262802f ("Adding NFCT_FILTER_DUMP_TUPLE in filter_dump_attr, using kernel CTA_FILTER API") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* dump: support filtering by zoneFelix Huettner2024-01-243-0/+24
| | | | | | | | | | | | based on a kernel side extension of the conntrack api, this patch brings this extension to userspace. When dumping the conntrack table we can now filter based on the conntrack zone directly in kernel space. If the kernel does not yet support this feature this filtering is ignored. Signed-off-by: Felix Huettner <felix.huettner@mail.schwarz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: reverse calloc() invocationPablo Neira Ayuso2023-10-023-6/+6
| | | | | | | | Swap object size and number of elements, so number of elements is the first argument, then object size is the second argument. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix BPF for filtering IPv6 addressesJeremy Sowden2023-09-141-4/+4
| | | | | | | | | | | | | | | | Each address in the filter is matched one 32-bit word at a time. If any of the first three words don't match, we jump to the end of the filter. If the last word does match, we jump to the end of the filter. However, this is not right: it means that if any of the first three words of an address don't match, all subsequent addresses will be skipped. Instead, jump to the next address. Fix formatting of `nfct_bsf_cmp_k_stack`. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690676 Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1062 Fixes: dd73e5708cc2 ("bsf: add support for IPv6 address filtering") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* Adding NFCT_FILTER_DUMP_TUPLE in filter_dump_attr, using kernel CTA_FILTER APIRomain Bellan2023-09-143-4/+84
| | | | | | | | | | | | | Following kernel side new conntrack filtering API, this patch implements userspace part. This patch: * Update headers to get new flag value from kernel * Use a conntrack struct to configure filtering * Set netlink flags according to values set in conntrack struct Signed-off-by: Romain Bellan <romain.bellan@wifirst.fr> Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add sanity check to netlink socket filter APIPablo Neira Ayuso2023-03-281-2/+15
| | | | | | | Validate that filtering by layer 4 protocol number and protocol state fits into the existing maps that is used internally. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: simplify calculation of `struct sock_fprog` lengthJeremy Sowden2023-01-021-1/+1
| | | | | | | | | | | | | When assigning the length to the `struct sock_fprog` object, we calculate it by multiplying the number of `struct sock_filter` objects, `j`, by `sizeof(struct sock_filter)` and then dividing by `sizeof(bsf[0])`, which, since `bsf[0]` is a `struct sock_filter`, is equal to `sizeof(struct sock_filter)`. Remove the `sizeof` expressions and just assign `j`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix BPF code for filtering on big-endian architecturesJeremy Sowden2023-01-021-1/+6
| | | | | | | | | | | | | The BPF for checking the subsystem ID looks for it in the righthand byte of `nlh->nlmsg_type`. However, it will only be there on little-endian archi- tectures. The result is that on big-endian architectures the subsystem ID doesn't match, all packets are immediately accepted, and all filters are ignored. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896716 Fixes: b245e4092c5a ("src: allow to use nfct handler for conntrack and expectations at the same time") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect/conntrack: Avoid spurious covscan overrun warningPhil Sutter2022-03-292-3/+3
| | | | | | | | | It doesn't like how memset() is called for a struct nfnlhdr pointer with large size value. Pass void pointers instead. This also removes the call from __build_{expect,conntrack}() which is duplicate in __build_query_{exp,ct}() code-path. Signed-off-by: Phil Sutter <phil@nwl.cc>
* conntrack: don't cancel nest on unknown layer 4 protocolsPablo Neira Ayuso2021-12-101-2/+1
| | | | | | | | It is valid to specify CTA_PROTO_NUM with a protocol that is not natively supported by conntrack. Do not cancel the CTA_TUPLE_PROTO nest in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add nfct_nlmsg_build_filter() helperPablo Neira Ayuso2021-11-142-16/+24
| | | | | | | This helper function builds the payload of the netlink dump request including the filtering criteria. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix invmap_icmpv6 entriesKen-ichirou MATSUZAWA2021-10-111-2/+2
| | | | | | | Incorrect mapping of the expected reply message. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for status dump filterFlorian Westphal2021-08-051-0/+17
| | | | | | | | | | | This tells kernel to suppress conntrack entries that do not match the status bits/bitmask filter. This is useful to e.g. only list entries that are not assured (value 0, mask == ASSUED) or entries that only saw one-way traffic (value 0, mask == SEEN_REPLY). Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: Don't use ICMP attrs in decision to build repl tupleLuuk Paulussen2021-03-191-4/+1
| | | | | | | | | conntrack-tools doesn't set the REPL attributes by default for updates, so for ICMP flows, the update won't be sent as building the repl tuple will fail. Signed-off-by: Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add flush filter commandPablo Neira Ayuso2020-10-291-0/+3
| | | | | | | | The NFCT_Q_FLUSH command flushes both IPv4 and IPv6 conntrack tables. Add new command NFCT_Q_FLUSH_FILTER that allows to flush based on the family to retain backward compatibility on NFCT_Q_FLUSH. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: sctp: update statesFlorian Westphal2020-08-141-0/+2
| | | | | | | | with more recent kernels "conntrack -L" prints NONE instead of HEARTBEAT_SENT/RECEIVED because the state is unknown in userspace. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: dccp print function should use dccp stateFlorian Westphal2020-08-141-1/+1
| | | | | | Found while reading code, compile tested only. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: Fix buffer overflows in __snprintf_protoinfo* like in *2str fnsDaniel Gröber2020-07-011-15/+39
| | | | | Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Fix buffer overflow in protocol related snprintf functionsDaniel Gröber2020-07-012-10/+24
| | | | | Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Move icmp request>reply type mapping to common fileDaniel Gröber2020-07-014-65/+42
| | | | | | | | | | | Currently the invmap_icmp* arrays are duplicated in setter.c and grp_setter.c. This moves them to a new module 'proto'. Instead of having the code access the arrays directly we provide new wrapper functions __icmp{,v6}_reply_type. Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Fix buffer overflow on invalid icmp type in settersDaniel Gröber2020-07-012-7/+12
| | | | | | | | | When type is out of range for the invmap_icmp{,v6} array we leave rtype at zero which will map to type=255 just like other error cases in this function. Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Fix incorrect snprintf size calculationDaniel Gröber2020-07-011-1/+1
| | | | | | | | | | The previous BUFFER_SIZE() call already updated the remaining 'len'. So there is no need to subtract 'size' again. While this just makes the buffer appear smaller than it is, which is mostly harmless, the subtraction might underflow as 'size > len' is not checked like BUFFER_SIZE() does. Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Replace strncpy with snprintf to improve null byte handlingDaniel Gröber2020-07-013-7/+5
| | | | | | | | | | | | | | We currently use strncpy in a bunch of places which has this weird quirk where it doesn't write a terminating null byte if the input string is >= the max length. To mitigate this we write a null byte to the last character manually. While this works it is easy to forget. Instead we should just be using snprintf which has more sensible behaviour as it always writes a null byte even when truncating the string. Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Handle negative snprintf return values properlyDaniel Gröber2020-07-012-3/+6
| | | | | | | | | Currently the BUFFER_SIZE macro doesn't take negative 'ret' values into account. A negative return should just be passed through to the caller, snprintf will already have set 'errno' properly. Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add IPS_HW_OFFLOAD flagPablo Neira Ayuso2020-04-281-1/+3
| | | | | | This flags specifies that this conntrack entry is in hardware. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support for IPS_OFFLOADPablo Neira Ayuso2019-08-091-2/+4
| | | | | | Print [OFFLOAD] tag when listing entries via snprintf() interface. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: api: use libmnl API to build the netlink headersPablo Neira Ayuso2019-05-031-5/+28
| | | | | | Replace libnfnetlink's nfnl_fill_hdr() by more modern libmnl code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace old libnfnetlink builderPablo Neira Ayuso2019-05-021-588/+14
| | | | | | Use the new libmnl version, remove duplicated code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace old libnfnetlink parserPablo Neira Ayuso2019-05-023-640/+20
| | | | | | Use the new libmnl version, remove duplicated code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce abi_breakage()Pablo Neira Ayuso2019-05-021-25/+24
| | | | | | | | | Changes in the netlink attribute layout is considered to be a kernel ABI breakage, so report this immediately and stop execution, instead of lazy error back to the client application, which cannot do anything with this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add synproxy supportPablo Neira Ayuso2018-03-247-0/+179
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* labels: don't crash on NULL labelmapMarcos Paulo de Souza2017-07-251-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When CONNLABEL_CFG isn't available (/etc/xtables/connlabel.conf), conntrack tool crashes: [marcos@Icarus ~]$ conntrack -l something nfct_labelmap_new: No such file or directory Segmentation fault (core dumped) I can see this problem in Fedora 26, because connlabel.conf does not come along the conntrack/libnetfilter packages. This problem happens because conntrack calls nfct_labelmap_new, which resides on libnetfilter_conntrack. So this lib returns NULL because CONNLABEL_CFG is not present, and then NULL is assigned to the global var called labelmap on conntrack. Later, get_label is called, passing NULL to the library, and __label_get_bit is called and deferences labelmap without check, which leads to a crash. With this patch the crash does not happen anymore, and an error message is displayed: conntrack -l something nfct_labelmap_new: No such file or directory conntrack v1.4.4 (conntrack-tools): unknown label 'something' Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: revert getobjopt_is_nat() conditionKen-ichirou MATSUZAWA2017-03-031-8/+4
| | | | | | | | | | getobjopt_is_nat() used to work even if no status bits where set, by checking if addresses don't match. Restore this behaviour for compatibility reasons. Fixes: 73ad642ba462 ("src: add support for IPv6 NAT") Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix missing break in setobjopt_undo_dnat()Ken-ichirou MATSUZAWA2017-02-281-0/+1
| | | | | | | Otherwise we fall into the IPv6 case. Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Make the library compile under clangKevin Cernekee2016-08-171-2/+2
| | | | | | | | | | | | clang treats "char buffer[size]" inside a union as VLAIS unless |size| is const: src/conntrack/api.c:992:8: error: fields must have a constant size: 'variable length array in structure' extension will never be supported char buffer[size]; ^ Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: labels: add function to fetch default config file locationFlorian Westphal2016-08-082-0/+16
| | | | | | Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for IPv6 NATArturo Borrero2016-05-206-2/+148
| | | | | | | | | | The conntrackd daemon lacks support for syncing IPv6 NATed connections. This patch adds support for managing the IPv6 part of struct __nfct_nat, also updating the corresponsing symbols. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for IPv6 to struct __nfct_natArturo Borrero2016-05-206-44/+89
| | | | | | | | | | | | The conntrackd daemon lacks support for syncing IPv6 NATed connections. This patch prepares the ground to give support to such operations: * replace uint32_t with union __nfct_address in struct __nfct_nat. * update all users of the former uint32_t to support the new struct A follow-up patch gives support to actually manage the IPv6 NAT. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* setter: don't touch snat.max_ip in set_attr_dnat_ipv4Florian Westphal2016-01-121-1/+1
| | | | | | | looks like copy & paste bug. Reported-by: Sargun Dhillon <sargun@sargun.me> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add zone attribute to tupleDaniel Borkmann2015-09-2910-20/+198
| | | | | | | | This patch adds the front-end to the recent ctnetlink interface changes that add the zone attribute into the tuple. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix stop timestamp assignmentKen-ichirou MATSUZAWA2015-07-071-1/+1
| | | | | Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Use stdint types everywhereFelix Janda2015-05-2511-183/+183
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add mark event filterKen-ichirou MATSUZAWA2015-03-132-0/+86
| | | | | | | | This patch adds mark filter for event listener, using same struct nfct_filter_dump_mark at dump. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: fix symbol name typo in commentKen-ichirou MATSUZAWA2014-10-081-3/+3
| | | | | Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: api: add two new bitmask functionsKen-ichirou MATSUZAWA2014-09-111-0/+29
| | | | | | | | This patch adds two functions, useful for ulogd IPFIX output module. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: compare: relax MARK/ZONE attribute comparisionFlorian Westphal2014-06-241-42/+45
| | | | | | | | | | | | | | | | Relax checking for MARK and ZONE to treat 'attribute not set' like 'attribute is set to 0'. This matches kernel behaviour, conntracks are always in zone 0, except if specified differently. Same for connmark. The kernel will also not include the zone/mark attributes in dumps unless they have non-zero values. This makes qa/test_api pass again with the updated test cases. Reported-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: remove duplicate codeKen-ichirou MATSUZAWA2014-06-211-2/+0
| | | | | | | nfct_filter_dump_set_attr() will set the bit. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: labels: remove dead codeFlorian Westphal2014-02-181-1/+1
| | | | | | unsigned, < 0 is always false. Signed-off-by: Florian Westphal <fw@strlen.de>