api.c

/*
 * (C) 2006 by Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This software may be used and distributed according to the terms
 * of the GNU General Public License, incorporated herein by reference.
 */

#include <stdlib.h>
#include <string.h> /* for memset */
#include <errno.h>
#include <assert.h>

#include "internal/internal.h"

struct nf_conntrack *nfct_new(void)
{
        struct nf_conntrack *ct;

        ct = malloc(sizeof(struct nf_conntrack));
        if (!ct)
                return NULL;

        memset(ct, 0, sizeof(struct nf_conntrack));

        return ct;
}

void nfct_destroy(struct nf_conntrack *ct)
{
        assert(ct != NULL);
        if (ct->secctx)
                free(ct->secctx);
        free(ct);
        ct = NULL; /* bugtrap */
}

size_t nfct_sizeof(const struct nf_conntrack *ct)
{
        assert(ct != NULL);
        return sizeof(*ct);
}

size_t nfct_maxsize(void)
{
        return sizeof(struct nf_conntrack);
}

struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct)
{
        struct nf_conntrack *clone;

        assert(ct != NULL);

        if ((clone = nfct_new()) == NULL)
                return NULL;
        memcpy(clone, ct, sizeof(*ct));

        return clone;
}

int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
{
        assert(ct != NULL);

        if (unlikely(option > NFCT_SOPT_MAX)) {
                errno = EOPNOTSUPP;
                return -1;
        }

        return __setobjopt(ct, option);
}

int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option)
{
        assert(ct != NULL);

        if (unlikely(option > NFCT_GOPT_MAX)) {
                errno = EOPNOTSUPP;
                return -1;
        }

        return __getobjopt(ct, option);
}

int nfct_callback_register(struct nfct_handle *h,
                           enum nf_conntrack_msg_type type,
                           int (*cb)(enum nf_conntrack_msg_type type,
                                     struct nf_conntrack *ct, 
                                     void *data),
                           void *data)
{
        struct __data_container *container;

        assert(h != NULL);

        container = malloc(sizeof(struct __data_container));
        if (!container)
                return -1;
        memset(container, 0, sizeof(struct __data_container));

        h->cb = cb;
        container->h = h;
        container->type = type;
        container->data = data;

        h->nfnl_cb_ct.call = __callback;
        h->nfnl_cb_ct.data = container;
        h->nfnl_cb_ct.attr_count = CTA_MAX;

        nfnl_callback_register(h->nfnlssh_ct, 
                               IPCTNL_MSG_CT_NEW,
                               &h->nfnl_cb_ct);

        nfnl_callback_register(h->nfnlssh_ct,
                               IPCTNL_MSG_CT_DELETE,
                               &h->nfnl_cb_ct);

        return 0;
}

void nfct_callback_unregister(struct nfct_handle *h)
{
        assert(h != NULL);

        nfnl_callback_unregister(h->nfnlssh_ct, IPCTNL_MSG_CT_NEW);
        nfnl_callback_unregister(h->nfnlssh_ct, IPCTNL_MSG_CT_DELETE);

        h->cb = NULL;
        free(h->nfnl_cb_ct.data);

        h->nfnl_cb_ct.call = NULL;
        h->nfnl_cb_ct.data = NULL;
        h->nfnl_cb_ct.attr_count = 0;
}

int nfct_callback_register2(struct nfct_handle *h,
                            enum nf_conntrack_msg_type type,
                            int (*cb)(const struct nlmsghdr *nlh,
                                      enum nf_conntrack_msg_type type,
                                      struct nf_conntrack *ct, 
                                      void *data),
                           void *data)
{
        struct __data_container *container;

        assert(h != NULL);

        container = calloc(sizeof(struct __data_container), 1);
        if (container == NULL)
                return -1;

        h->cb2 = cb;
        container->h = h;
        container->type = type;
        container->data = data;

        h->nfnl_cb_ct.call = __callback;
        h->nfnl_cb_ct.data = container;
        h->nfnl_cb_ct.attr_count = CTA_MAX;

        nfnl_callback_register(h->nfnlssh_ct, 
                               IPCTNL_MSG_CT_NEW,
                               &h->nfnl_cb_ct);

        nfnl_callback_register(h->nfnlssh_ct,
                               IPCTNL_MSG_CT_DELETE,
                               &h->nfnl_cb_ct);

        return 0;
}

void nfct_callback_unregister2(struct nfct_handle *h)
{
        assert(h != NULL);

        nfnl_callback_unregister(h->nfnlssh_ct, IPCTNL_MSG_CT_NEW);
        nfnl_callback_unregister(h->nfnlssh_ct, IPCTNL_MSG_CT_DELETE);

        h->cb2 = NULL;
        free(h->nfnl_cb_ct.data);

        h->nfnl_cb_ct.call = NULL;
        h->nfnl_cb_ct.data = NULL;
        h->nfnl_cb_ct.attr_count = 0;
}

void nfct_set_attr(struct nf_conntrack *ct,
                   const enum nf_conntrack_attr type, 
                   const void *value)
{
        assert(ct != NULL);
        assert(value != NULL);

        if (unlikely(type >= ATTR_MAX))
                return;

        if (set_attr_array[type]) {
                set_attr_array[type](ct, value);
                set_bit(type, ct->set);
        }
}

void nfct_set_attr_u8(struct nf_conntrack *ct,
                      const enum nf_conntrack_attr type, 
                      u_int8_t value)
{
        nfct_set_attr(ct, type, &value);
}

void nfct_set_attr_u16(struct nf_conntrack *ct,
                       const enum nf_conntrack_attr type, 
                       u_int16_t value)
{
        nfct_set_attr(ct, type, &value);
}

void nfct_set_attr_u32(struct nf_conntrack *ct,
                       const enum nf_conntrack_attr type, 
                       u_int32_t value)
{
        nfct_set_attr(ct, type, &value);
}

void nfct_set_attr_u64(struct nf_conntrack *ct,
                       const enum nf_conntrack_attr type, 
                       u_int64_t value)
{
        nfct_set_attr(ct, type, &value);
}

const void *nfct_get_attr(const struct nf_conntrack *ct,
                          const enum nf_conntrack_attr type)
{
        assert(ct != NULL);

        if (unlikely(type >= ATTR_MAX)) {
                errno = EINVAL;
                return NULL;
        }

        if (!test_bit(type, ct->set)) {
                errno = ENODATA;
                return NULL;
        }

        assert(get_attr_array[type]);

        return get_attr_array[type](ct);
}

u_int8_t nfct_get_attr_u8(const struct nf_conntrack *ct,
                          const enum nf_conntrack_attr type)
{
        const u_int8_t *ret = nfct_get_attr(ct, type);
        return ret == NULL ? 0 : *ret;
}

u_int16_t nfct_get_attr_u16(const struct nf_conntrack *ct,
                            const enum nf_conntrack_attr type)
{
        const u_int16_t *ret = nfct_get_attr(ct, type);
        return ret == NULL ? 0 : *ret;
}

u_int32_t nfct_get_attr_u32(const struct nf_conntrack *ct,
                            const enum nf_conntrack_attr type)
{
        const u_int32_t *ret = nfct_get_attr(ct, type);
        return ret == NULL ? 0 : *ret;
}

u_int64_t nfct_get_attr_u64(const struct nf_conntrack *ct,
                            const enum nf_conntrack_attr type)
{
        const u_int64_t *ret = nfct_get_attr(ct, type);
        return ret == NULL ? 0 : *ret;
}

int nfct_attr_is_set(const struct nf_conntrack *ct,
                     const enum nf_conntrack_attr type)
{
        assert(ct != NULL);

        if (unlikely(type >= ATTR_MAX)) {
                errno = EINVAL;
                return -1;
        }
        return test_bit(type, ct->set);
}

int nfct_attr_is_set_array(const struct nf_conntrack *ct,
                           const enum nf_conntrack_attr *type_array,
                           int size)
{
        int i;

        assert(ct != NULL);

        for (i=0; i<size; i++) {
                if (unlikely(type_array[i] >= ATTR_MAX)) {
                        errno = EINVAL;
                        return -1;
                }
                if (!test_bit(type_array[i], ct->set))
                        return 0;
        }
        return 1;
}

int nfct_attr_unset(struct nf_conntrack *ct,
                    const enum nf_conntrack_attr type)
{
        assert(ct != NULL);

        if (unlikely(type >= ATTR_MAX)) {
                errno = EINVAL;
                return -1;
        }
        unset_bit(type, ct->set);

        return 0;
}

void nfct_set_attr_grp(struct nf_conntrack *ct,
                       const enum nf_conntrack_attr_grp type,
                       const void *data)
{
        assert(ct != NULL);

        if (unlikely(type >= ATTR_GRP_MAX))
                return;

        if (set_attr_grp_array[type]) {
                set_attr_grp_array[type](ct, data);
                set_bitmask_u32(ct->set, attr_grp_bitmask[type], __NFCT_BITSET);
        }
}

int nfct_get_attr_grp(const struct nf_conntrack *ct,
                      const enum nf_conntrack_attr_grp type,
                      void *data)
{
        assert(ct != NULL);

        if (unlikely(type >= ATTR_GRP_MAX)) {
                errno = EINVAL;
                return -1;
        }
        if (!test_bitmask_u32(ct->set, attr_grp_bitmask[type], __NFCT_BITSET)) {
                errno = ENODATA;
                return -1;
        }
        assert(get_attr_grp_array[type]);
        get_attr_grp_array[type](ct, data);
        return 0;
}

int nfct_attr_grp_is_set(const struct nf_conntrack *ct,
                         const enum nf_conntrack_attr_grp type)
{
        assert(ct != NULL);

        if (unlikely(type >= ATTR_GRP_MAX)) {
                errno = EINVAL;
                return -1;
        }
        return test_bitmask_u32(ct->set, attr_grp_bitmask[type], __NFCT_BITSET);
}

int nfct_attr_grp_unset(struct nf_conntrack *ct,
                        const enum nf_conntrack_attr_grp type)
{
        assert(ct != NULL);

        if (unlikely(type >= ATTR_GRP_MAX)) {
                errno = EINVAL;
                return -1;
        }
        unset_bitmask_u32(ct->set, attr_grp_bitmask[type], __NFCT_BITSET);

        return 0;
}

int nfct_build_conntrack(struct nfnl_subsys_handle *ssh,
                         void *req,
                         size_t size,
                         u_int16_t type,
                         u_int16_t flags,
                         const struct nf_conntrack *ct)
{
        assert(ssh != NULL);
        assert(req != NULL);
        assert(ct != NULL);

        return __build_conntrack(ssh, req, size, type, flags, ct);
}

int nfct_build_query(struct nfnl_subsys_handle *ssh,
                     const enum nf_conntrack_query qt,
                     const void *data,
                     void *buffer,
                     unsigned int size)
{
        struct nfnlhdr *req = buffer;
        const u_int32_t *family = data;

        assert(ssh != NULL);
        assert(data != NULL);
        assert(req != NULL);

        memset(req, 0, size);

        switch(qt) {
        case NFCT_Q_CREATE:
                nfct_build_conntrack(ssh, req, size, IPCTNL_MSG_CT_NEW, NLM_F_REQUEST|NLM_F_CREATE|NLM_F_ACK|NLM_F_EXCL, data);
                break;
        case NFCT_Q_UPDATE:
                nfct_build_conntrack(ssh, req, size, IPCTNL_MSG_CT_NEW, NLM_F_REQUEST|NLM_F_ACK, data);
                break;
        case NFCT_Q_DESTROY:
                nfct_build_conntrack(ssh, req, size, IPCTNL_MSG_CT_DELETE, NLM_F_REQUEST|NLM_F_ACK, data);
                break;
        case NFCT_Q_GET:
                nfct_build_conntrack(ssh, req, size, IPCTNL_MSG_CT_GET, NLM_F_REQUEST|NLM_F_ACK, data);
                break;
        case NFCT_Q_FLUSH:
                nfnl_fill_hdr(ssh, &req->nlh, 0, *family, 0, IPCTNL_MSG_CT_DELETE, NLM_F_REQUEST|NLM_F_ACK);
                break;
        case NFCT_Q_DUMP:
                nfnl_fill_hdr(ssh, &req->nlh, 0, *family, 0, IPCTNL_MSG_CT_GET, NLM_F_REQUEST|NLM_F_DUMP);
                break;
        case NFCT_Q_DUMP_RESET:
                nfnl_fill_hdr(ssh, &req->nlh, 0, *family, 0, IPCTNL_MSG_CT_GET_CTRZERO, NLM_F_REQUEST|NLM_F_DUMP);
                break;
        case NFCT_Q_CREATE_UPDATE:
                nfct_build_conntrack(ssh, req, size, IPCTNL_MSG_CT_NEW, NLM_F_REQUEST|NLM_F_CREATE|NLM_F_ACK, data);
                break;

        default:
                errno = ENOTSUP;
                return -1;
        }
        return 1;
}

int nfct_parse_conntrack(enum nf_conntrack_msg_type type,
                         const struct nlmsghdr *nlh,
                         struct nf_conntrack *ct)
{
        unsigned int flags;
        int len = nlh->nlmsg_len;
        struct nfgenmsg *nfhdr = NLMSG_DATA(nlh);
        struct nfattr *cda[CTA_MAX];

        assert(nlh != NULL);
        assert(ct != NULL);

        len -= NLMSG_LENGTH(sizeof(struct nfgenmsg));
        if (len < 0) {
                errno = EINVAL;
                return NFCT_T_ERROR;
        }

        flags = __parse_message_type(nlh);
        if (!(flags & type))
                return 0;

        nfnl_parse_attr(cda, CTA_MAX, NFA_DATA(nfhdr), len);

        __parse_conntrack(nlh, cda, ct);

        return flags;
}

int nfct_query(struct nfct_handle *h,
               const enum nf_conntrack_query qt,
               const void *data)
{
        size_t size = 4096;     /* enough for now */
        union {
                char buffer[size];
                struct nfnlhdr req;
        } u;

        assert(h != NULL);
        assert(data != NULL);

        if (nfct_build_query(h->nfnlssh_ct, qt, data, &u.req, size) == -1)
                return -1;

        return nfnl_query(h->nfnlh, &u.req.nlh);
}

int nfct_send(struct nfct_handle *h,
              const enum nf_conntrack_query qt,
              const void *data)
{
        size_t size = 4096;     /* enough for now */
        union {
                char buffer[size];
                struct nfnlhdr req;
        } u;

        assert(h != NULL);
        assert(data != NULL);

        if (nfct_build_query(h->nfnlssh_ct, qt, data, &u.req, size) == -1)
                return -1;

        return nfnl_send(h->nfnlh, &u.req.nlh);
}


int nfct_catch(struct nfct_handle *h)
{
        assert(h != NULL);

        return nfnl_catch(h->nfnlh);
}

int nfct_snprintf(char *buf,
                  unsigned int size,
                  const struct nf_conntrack *ct,
                  unsigned int msg_type,
                  unsigned int out_type,
                  unsigned int flags) 
{
        assert(buf != NULL);
        assert(size > 0);
        assert(ct != NULL);

        return __snprintf_conntrack(buf, size, ct, msg_type, out_type, flags);
}

int nfct_compare(const struct nf_conntrack *ct1, 
                 const struct nf_conntrack *ct2)
{
        assert(ct1 != NULL);
        assert(ct2 != NULL);

        return __compare(ct1, ct2, NFCT_CMP_ALL);
}

int nfct_cmp(const struct nf_conntrack *ct1, 
             const struct nf_conntrack *ct2,
             unsigned int flags)
{
        assert(ct1 != NULL);
        assert(ct2 != NULL);

        return __compare(ct1, ct2, flags);
}

void nfct_copy(struct nf_conntrack *ct1,
               const struct nf_conntrack *ct2,
               unsigned int flags)
{
        int i;

        assert(ct1 != NULL);
        assert(ct2 != NULL);

        if (flags == NFCT_CP_ALL) {
                for (i=0; i<ATTR_MAX; i++) {
                        if (test_bit(i, ct2->set)) {
                                assert(copy_attr_array[i]);
                                copy_attr_array[i](ct1, ct2);
                                set_bit(i, ct1->set);
                        }
                }
                return;
        }

        static const int cp_orig_mask[] = {
                ATTR_ORIG_IPV4_SRC,
                ATTR_ORIG_IPV4_DST,
                ATTR_ORIG_IPV6_SRC,
                ATTR_ORIG_IPV6_DST,
                ATTR_ORIG_PORT_SRC,
                ATTR_ORIG_PORT_DST,
                ATTR_ICMP_TYPE,
                ATTR_ICMP_CODE,
                ATTR_ICMP_ID,
                ATTR_ORIG_L3PROTO,
                ATTR_ORIG_L4PROTO,
        };
        #define __CP_ORIG_MAX sizeof(cp_orig_mask)/sizeof(int)

        if (flags & NFCT_CP_ORIG) {
                for (i=0; i<__CP_ORIG_MAX; i++) {
                        if (test_bit(cp_orig_mask[i], ct2->set)) {
                                assert(copy_attr_array[i]);
                                copy_attr_array[cp_orig_mask[i]](ct1, ct2);
                                set_bit(cp_orig_mask[i], ct1->set);
                        }
                }
        }

        static const int cp_repl_mask[] = {
                ATTR_REPL_IPV4_SRC,
                ATTR_REPL_IPV4_DST,
                ATTR_REPL_IPV6_SRC,
                ATTR_REPL_IPV6_DST,
                ATTR_REPL_PORT_SRC,
                ATTR_REPL_PORT_DST,
                ATTR_REPL_L3PROTO,
                ATTR_REPL_L4PROTO,
        };
        #define __CP_REPL_MAX sizeof(cp_repl_mask)/sizeof(int)

        if (flags & NFCT_CP_REPL) {
                for (i=0; i<__CP_REPL_MAX; i++) {
                        if (test_bit(cp_repl_mask[i], ct2->set)) {
                                assert(copy_attr_array[i]);
                                copy_attr_array[cp_repl_mask[i]](ct1, ct2);
                                set_bit(cp_repl_mask[i], ct1->set);
                        }
                }
        }

        if (flags & NFCT_CP_META) {
                for (i=ATTR_TCP_STATE; i<ATTR_MAX; i++) {
                        if (test_bit(i, ct2->set)) {
                                assert(copy_attr_array[i]),
                                copy_attr_array[i](ct1, ct2);
                                set_bit(i, ct1->set);
                        }
                }
        }
}

void nfct_copy_attr(struct nf_conntrack *ct1,
                    const struct nf_conntrack *ct2,
                    const enum nf_conntrack_attr type)
{
        if (test_bit(type, ct2->set)) {
                assert(copy_attr_array[type]);
                copy_attr_array[type](ct1, ct2);
                set_bit(type, ct1->set);
        }
}

struct nfct_filter *nfct_filter_create(void)
{
        return calloc(sizeof(struct nfct_filter), 1);
}

void nfct_filter_destroy(struct nfct_filter *filter)
{
        assert(filter != NULL);
        free(filter);
        filter = NULL;
}

void nfct_filter_add_attr(struct nfct_filter *filter,
                          const enum nfct_filter_attr type, 
                          const void *value)
{
        assert(filter != NULL);
        assert(value != NULL);

        if (unlikely(type >= NFCT_FILTER_MAX))
                return;

        if (filter_attr_array[type]) {
                filter_attr_array[type](filter, value);
                set_bit(type, filter->set);
        }
}

void nfct_filter_add_attr_u32(struct nfct_filter *filter,
                              const enum nfct_filter_attr type,
                              u_int32_t value)
{
        nfct_filter_add_attr(filter, type, &value);
}

int nfct_filter_set_logic(struct nfct_filter *filter,
                          const enum nfct_filter_attr type,
                          const enum nfct_filter_logic logic)
{
        if (unlikely(type >= NFCT_FILTER_MAX)) {
                errno = ENOTSUP;
                return -1;
        }

        if (filter->logic[type]) {
                errno = EBUSY;
                return -1;
        }

        filter->logic[type] = logic;

        return 0;
}

int nfct_filter_attach(int fd, struct nfct_filter *filter)
{
        assert(filter != NULL);

        return __setup_netlink_socket_filter(fd, filter);
}

int nfct_filter_detach(int fd)
{
        int val = 0;

        return setsockopt(fd, SOL_SOCKET, SO_DETACH_FILTER, &val, sizeof(val));
}