diff options
author | Rich Fought <rmf.aero@gmail.com> | 2014-02-27 00:02:13 (GMT) |
---|---|---|
committer | Thomas Haller <thaller@redhat.com> | 2014-04-14 17:20:53 (GMT) |
commit | 8ff199947ffa4f7d4f6b0b878fde68d8ffcf7f0f (patch) | |
tree | 620d165c676873f08b600759cb64be3623e662e1 /src | |
parent | cb319e22f5680b49fad62dc7f0eb35b7d737cb3b (diff) | |
download | libnl-8ff199947ffa4f7d4f6b0b878fde68d8ffcf7f0f.zip libnl-8ff199947ffa4f7d4f6b0b878fde68d8ffcf7f0f.tar.gz libnl-8ff199947ffa4f7d4f6b0b878fde68d8ffcf7f0f.tar.bz2 |
netfilter/ct: expand CT parameters that can be used in add/delete operations
This expands functionality for manipulating conntracks over netlink by
adding other attributes to nfnl_ct_build_message(). Added a command link
program to add conntracks.
https://github.com/thom311/libnl/pull/55
[thaller@redhat.com: cleaned up whitespace from original patch]
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Diffstat (limited to 'src')
-rw-r--r-- | src/Makefile.am | 3 | ||||
-rw-r--r-- | src/lib/ct.c | 6 | ||||
-rw-r--r-- | src/nf-ct-add.c | 142 |
3 files changed, 150 insertions, 1 deletions
diff --git a/src/Makefile.am b/src/Makefile.am index b2b7fc7..f8ac4ca 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -23,7 +23,7 @@ sbin_PROGRAMS = \ nl-link-list noinst_PROGRAMS = \ - nf-ct-list nf-log nf-queue nf-monitor \ + nf-ct-list nf-ct-add nf-log nf-queue nf-monitor \ nf-exp-list nf-exp-add nf-exp-delete \ nl-addr-add nl-addr-delete nl-addr-list \ nl-link-set nl-link-stats \ @@ -44,6 +44,7 @@ noinst_PROGRAMS = \ genl_ctrl_list_SOURCES = genl-ctrl-list.c nf_ct_list_SOURCES = nf-ct-list.c +nf_ct_add_SOURCES = nf-ct-add.c nf_log_SOURCES = nf-log.c nf_queue_SOURCES = nf-queue.c nf_monitor_SOURCES = nf-monitor.c diff --git a/src/lib/ct.c b/src/lib/ct.c index 5bab08f..c903878 100644 --- a/src/lib/ct.c +++ b/src/lib/ct.c @@ -137,6 +137,12 @@ void nl_cli_ct_parse_status(struct nfnl_ct *ct, char *arg) nfnl_ct_set_status(ct, status); } +void nl_cli_ct_parse_zone(struct nfnl_ct *ct, char *arg) +{ + uint32_t zone = nl_cli_parse_u32(arg); + nfnl_ct_set_zone(ct, zone); +} + #if 0 } else if (arg_match("origicmpid")) { if (argc > ++idx) diff --git a/src/nf-ct-add.c b/src/nf-ct-add.c new file mode 100644 index 0000000..8ad4c53 --- /dev/null +++ b/src/nf-ct-add.c @@ -0,0 +1,142 @@ +/* + * src/nf-ct-list.c List Conntrack Entries + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation version 2.1 + * of the License. + * + * Copyright (c) 2003-2009 Thomas Graf <tgraf@suug.ch> + * Copyright (c) 2007 Philip Craig <philipc@snapgear.com> + * Copyright (c) 2007 Secure Computing Corporation + */ + +#include <netlink/cli/utils.h> +#include <netlink/cli/ct.h> + +static int quiet = 0; + +static void print_usage(void) +{ + printf( + "Usage: nf-ct-add [OPTION]... [CONNTRACK ENTRY]\n" + "\n" + "Options\n" + " -q, --quiet Do not print informal notifications.\n" + " -h, --help Show this help\n" + " -v, --version Show versioning information\n" + "\n" + "Conntrack Selection\n" + " -p, --proto=PROTOCOL Protocol\n" + " --orig-src=ADDR Original source address\n" + " --orig-sport=PORT Original source port\n" + " --orig-dst=ADDR Original destination address\n" + " --orig-dport=PORT Original destination port\n" + " --reply-src=ADDR Reply source address\n" + " --reply-sport=PORT Reply source port\n" + " --reply-dst=ADDR Reply destination address\n" + " --reply-dport=PORT Reply destination port\n" + " -F, --family=FAMILY Address family\n" + " --mark=NUM Mark value\n" + " --timeout=NUM Timeout value\n" + " --status Bitset representing status of connection.\n" + " --zone=NUM Zone value\n" + ); + exit(0); +} + +int main(int argc, char *argv[]) +{ + struct nl_sock *sock; + struct nfnl_ct *ct; + struct nl_dump_params params = { + .dp_type = NL_DUMP_LINE, + .dp_fd = stdout, + }; + int err, nlflags = NLM_F_CREATE; + + ct = nl_cli_ct_alloc(); + + for (;;) { + int c, optidx = 0; + enum { + ARG_ORIG_SRC = 257, + ARG_ORIG_SPORT = 258, + ARG_ORIG_DST, + ARG_ORIG_DPORT, + ARG_REPLY_SRC, + ARG_REPLY_SPORT, + ARG_REPLY_DST, + ARG_REPLY_DPORT, + ARG_MARK, + ARG_TIMEOUT, + ARG_STATUS, + ARG_ZONE, + }; + static struct option long_opts[] = { + { "quiet", 0, 0, 'q' }, + { "help", 0, 0, 'h' }, + { "version", 0, 0, 'v' }, + { "proto", 1, 0, 'p' }, + { "orig-src", 1, 0, ARG_ORIG_SRC }, + { "orig-sport", 1, 0, ARG_ORIG_SPORT }, + { "orig-dst", 1, 0, ARG_ORIG_DST }, + { "orig-dport", 1, 0, ARG_ORIG_DPORT }, + { "reply-src", 1, 0, ARG_REPLY_SRC }, + { "reply-sport", 1, 0, ARG_REPLY_SPORT }, + { "reply-dst", 1, 0, ARG_REPLY_DST }, + { "reply-dport", 1, 0, ARG_REPLY_DPORT }, + { "family", 1, 0, 'F' }, + { "mark", 1, 0, ARG_MARK }, + { "timeout", 1, 0, ARG_TIMEOUT }, + { "status", 1, 0, ARG_STATUS }, + { "zone", 1, 0, ARG_ZONE }, + { 0, 0, 0, 0 } + }; + + c = getopt_long(argc, argv, "46q:hv:p:F:", long_opts, &optidx); + if (c == -1) + break; + + switch (c) { + case '?': exit(NLE_INVAL); + case 'q': quiet = 1; break; + case '4': nfnl_ct_set_family(ct, AF_INET); break; + case '6': nfnl_ct_set_family(ct, AF_INET6); break; + case 'h': print_usage(); break; + case 'v': nl_cli_print_version(); break; + case 'p': nl_cli_ct_parse_protocol(ct, optarg); break; + case ARG_ORIG_SRC: nl_cli_ct_parse_src(ct, 0, optarg); break; + case ARG_ORIG_SPORT: nl_cli_ct_parse_src_port(ct, 0, optarg); break; + case ARG_ORIG_DST: nl_cli_ct_parse_dst(ct, 0, optarg); break; + case ARG_ORIG_DPORT: nl_cli_ct_parse_dst_port(ct, 0, optarg); break; + case ARG_REPLY_SRC: nl_cli_ct_parse_src(ct, 1, optarg); break; + case ARG_REPLY_SPORT: nl_cli_ct_parse_src_port(ct, 1, optarg); break; + case ARG_REPLY_DST: nl_cli_ct_parse_dst(ct, 1, optarg); break; + case ARG_REPLY_DPORT: nl_cli_ct_parse_dst_port(ct, 1, optarg); break; + case 'F': nl_cli_ct_parse_family(ct, optarg); break; + case ARG_MARK: nl_cli_ct_parse_mark(ct, optarg); break; + case ARG_TIMEOUT: nl_cli_ct_parse_timeout(ct, optarg); break; + case ARG_STATUS: nl_cli_ct_parse_status(ct, optarg); break; + case ARG_ZONE: nl_cli_ct_parse_zone(ct, optarg); break; + } + } + + if (!quiet) { + printf("Adding "); + nl_object_dump(OBJ_CAST(ct), ¶ms); + } + + sock = nl_cli_alloc_socket(); + nl_cli_connect(sock, NETLINK_NETFILTER); + + if ((err = nfnl_ct_add(sock, ct, nlflags)) < 0) + nl_cli_fatal(err, "Unable to add conntrack: %s", nl_geterror(err)); + + if (!quiet) { + printf("Added "); + nl_object_dump(OBJ_CAST(ct), ¶ms); + } + + return 0; +} |