libnetfilter_conntrack 1.0.9
expect_create_nat.c
1#include <stdio.h>
2#include <stdlib.h>
3#include <string.h>
4#include <errno.h>
5#include <arpa/inet.h>
6
7#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
8#include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
9
10/*
11 * WARNING: This test file creates an expectation for the FTP helper.
12 * Therefore, make sure you have load nf_conntrack_ftp before executing it.
13 */
14
15int main(void)
16{
17 int ret;
18 struct nfct_handle *h;
19 struct nf_conntrack *master, *expected, *mask, *nat;
20 struct nf_expect *exp;
21
22 /*
23 * Step 1: Setup master conntrack
24 */
25
26 master = nfct_new();
27 if (!master) {
28 perror("nfct_new");
29 exit(EXIT_FAILURE);
30 }
31
32 nfct_set_attr_u8(master, ATTR_L3PROTO, AF_INET);
33 nfct_set_attr_u32(master, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
34 nfct_set_attr_u32(master, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
35
36 nfct_set_attr_u8(master, ATTR_L4PROTO, IPPROTO_TCP);
37 nfct_set_attr_u16(master, ATTR_PORT_SRC, htons(1025));
38 nfct_set_attr_u16(master, ATTR_PORT_DST, htons(21));
39
40 nfct_setobjopt(master, NFCT_SOPT_SETUP_REPLY);
41
42 nfct_set_attr_u8(master, ATTR_TCP_STATE, TCP_CONNTRACK_ESTABLISHED);
43 nfct_set_attr_u32(master, ATTR_TIMEOUT, 200);
44 nfct_set_attr(master, ATTR_HELPER_NAME, "ftp");
45
46 h = nfct_open(CONNTRACK, 0);
47 if (!h) {
48 perror("nfct_open");
49 nfct_destroy(master);
50 return -1;
51 }
52
53 ret = nfct_query(h, NFCT_Q_CREATE, master);
54
55 printf("TEST: add master conntrack ");
56 if (ret == -1)
57 printf("(%d)(%s)\n", ret, strerror(errno));
58 else
59 printf("(OK)\n");
60
61 nfct_close(h);
62
63 expected = nfct_new();
64 if (!expected) {
65 perror("nfct_new");
66 exit(EXIT_FAILURE);
67 }
68
69 nfct_set_attr_u8(expected, ATTR_L3PROTO, AF_INET);
70 nfct_set_attr_u32(expected, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
71 nfct_set_attr_u32(expected, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
72
73 nfct_set_attr_u8(expected, ATTR_L4PROTO, IPPROTO_TCP);
74 nfct_set_attr_u16(expected, ATTR_PORT_SRC, 0);
75 nfct_set_attr_u16(expected, ATTR_PORT_DST, htons(10241));
76
77 mask = nfct_new();
78 if (!mask) {
79 perror("nfct_new");
80 nfct_destroy(master);
81 nfct_destroy(expected);
82 exit(EXIT_FAILURE);
83 }
84
85 nfct_set_attr_u8(mask, ATTR_L3PROTO, AF_INET);
86 nfct_set_attr_u32(mask, ATTR_IPV4_SRC, 0xffffffff);
87 nfct_set_attr_u32(mask, ATTR_IPV4_DST, 0xffffffff);
88
89 nfct_set_attr_u8(mask, ATTR_L4PROTO, IPPROTO_TCP);
90 nfct_set_attr_u16(mask, ATTR_PORT_SRC, 0x0000);
91 nfct_set_attr_u16(mask, ATTR_PORT_DST, 0xffff);
92
93 nat = nfct_new();
94 if (!nat) {
95 perror("nfct_new");
96 nfct_destroy(mask);
97 nfct_destroy(master);
98 nfct_destroy(expected);
99 exit(EXIT_FAILURE);
100 }
101
102 nfct_set_attr_u8(nat, ATTR_L3PROTO, AF_INET);
103 nfct_set_attr_u32(nat, ATTR_IPV4_SRC, inet_addr("3.3.3.3"));
104 nfct_set_attr_u32(nat, ATTR_IPV4_DST, 0);
105
106 nfct_set_attr_u8(nat, ATTR_L4PROTO, IPPROTO_TCP);
107 nfct_set_attr_u16(nat, ATTR_PORT_SRC, 12345);
108 nfct_set_attr_u16(nat, ATTR_PORT_DST, 0);
109
110 /*
111 * Step 2: Setup expectation
112 */
113
114 exp = nfexp_new();
115 if (!exp) {
116 perror("nfexp_new");
117 nfct_destroy(master);
118 nfct_destroy(expected);
119 nfct_destroy(mask);
120 exit(EXIT_FAILURE);
121 }
122
123 nfexp_set_attr(exp, ATTR_EXP_MASTER, master);
124 nfexp_set_attr(exp, ATTR_EXP_EXPECTED, expected);
125 nfexp_set_attr(exp, ATTR_EXP_MASK, mask);
126 nfexp_set_attr(exp, ATTR_EXP_NAT_TUPLE, nat);
127 nfexp_set_attr_u32(exp, ATTR_EXP_NAT_DIR, 0);
128 nfexp_set_attr_u32(exp, ATTR_EXP_TIMEOUT, 200);
129
130 nfct_destroy(master);
131 nfct_destroy(expected);
132 nfct_destroy(mask);
133 nfct_destroy(nat);
134
135 h = nfct_open(EXPECT, 0);
136 if (!h) {
137 perror("nfct_open");
138 return -1;
139 }
140
141 ret = nfexp_query(h, NFCT_Q_CREATE, exp);
142
143 printf("TEST: create expectation ");
144 if (ret == -1)
145 printf("(%d)(%s)\n", ret, strerror(errno));
146 else
147 printf("(OK)\n");
148
149 nfct_close(h);
150
151 ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS);
152}
struct nfct_handle * nfct_open(uint8_t, unsigned)
Definition: main.c:84
int nfct_close(struct nfct_handle *cth)
Definition: main.c:105
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition: expect/api.c:695
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
void nfct_destroy(struct nf_conntrack *ct)
Definition: conntrack/api.c:93
void nfct_set_attr(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value)
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
struct nf_conntrack * nfct_new(void)
Definition: conntrack/api.c:76
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
Definition: expect/api.c:357
struct nf_expect * nfexp_new(void)
Definition: expect/api.c:29
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
Definition: expect/api.c:309