Conntrack object handling

## Functions

struct nf_conntrack * | nfct_new (void)
void | nfct_destroy (struct nf_conntrack *ct)
size_t | nfct_sizeof (const struct nf_conntrack *ct)
size_t | nfct_maxsize (void)
struct nf_conntrack * | nfct_clone (const struct nf_conntrack *ct)
int | nfct_setobjopt (struct nf_conntrack *ct, unsigned int option)
int | nfct_getobjopt (const struct nf_conntrack *ct, unsigned int option)
void | nfct_set_attr_l (struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value, size_t len)
void | nfct_set_attr (struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value)
void | nfct_set_attr_u8 (struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
void | nfct_set_attr_u16 (struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
void | nfct_set_attr_u32 (struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
void | nfct_set_attr_u64 (struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint64_t value)
const void * | nfct_get_attr (const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
uint8_t | nfct_get_attr_u8 (const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
uint16_t | nfct_get_attr_u16 (const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
uint32_t | nfct_get_attr_u32 (const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
uint64_t | nfct_get_attr_u64 (const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int | nfct_attr_is_set (const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int | nfct_attr_is_set_array (const struct nf_conntrack *ct, const enum nf_conntrack_attr *type_array, int size)
int | nfct_attr_unset (struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void | nfct_set_attr_grp (struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, const void *data)
int | nfct_get_attr_grp (const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, void *data)
int | nfct_attr_grp_is_set (const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
int | nfct_attr_grp_unset (struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
int | nfct_snprintf (char *buf, unsigned int size, const struct nf_conntrack *ct, unsigned int msg_type, unsigned int out_type, unsigned int flags)
int | nfct_snprintf_labels (char *buf, unsigned int size, const struct nf_conntrack *ct, unsigned int msg_type, unsigned int out_type, unsigned int flags, struct nfct_labelmap *map)
int | nfct_compare (const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
int | nfct_cmp (const struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags)
void | nfct_copy (struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags)
void | nfct_copy_attr (struct nf_conntrack *ct1, const struct nf_conntrack *ct2, const enum nf_conntrack_attr type)

## Detailed Description

## Function Documentation

## nfct_attr_grp_is_set()

int nfct_attr_grp_is_set | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr_grp | type )

nfct_attr_grp_is_set - check if an attribute group is set

Parameters

  ct | pointer to a valid conntrack object
  type | attribute group (see ATTR_GRP_*)

If the attribute group is set, this function returns 1, otherwise 0.

Definition at line 695 of file conntrack/api.c.

## nfct_attr_grp_unset()

int nfct_attr_grp_unset | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr_grp | type )

nfct_attr_grp_unset - unset an attribute group

Parameters

  ct | pointer to a valid conntrack object
  type | attribute group (see ATTR_GRP_*)

On error, it returns -1 and errno is appropriately set. On success, this function returns 0.

Definition at line 731 of file conntrack/api.c.

## nfct_attr_is_set()

int nfct_attr_is_set | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type )

nfct_attr_is_set - check if a certain attribute is set

Parameters

  ct | pointer to a valid conntrack object
  type | attribute type

On error, -1 is returned and errno is set appropiately, otherwise the value of the attribute is returned.

Definition at line 559 of file conntrack/api.c.

## nfct_attr_is_set_array()

int nfct_attr_is_set_array | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr * | type_array,
|  | int | size )

nfct_attr_is_set_array - check if an array of attribute types is set

Parameters

  ct | pointer to a valid conntrack object
  array | attribute type array
  size | size of the array

On error, -1 is returned and errno is set appropiately, otherwise the value of the attribute is returned.

Definition at line 580 of file conntrack/api.c.

## nfct_attr_unset()

int nfct_attr_unset | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type )

nfct_attr_unset - unset a certain attribute

Parameters

  type | attribute type
  ct | pointer to a valid conntrack object

On error, -1 is returned and errno is set appropiately, otherwise 0 is returned.

Definition at line 607 of file conntrack/api.c.

## nfct_clone()

struct nf_conntrack * nfct_clone | ( | const struct nf_conntrack * | ct | ) |

nfct_clone - clone a conntrack object

Parameters

  ct | pointer to a valid conntrack object

On error, NULL is returned and errno is appropiately set. Otherwise, a valid pointer to the clone conntrack is returned.

Definition at line 148 of file conntrack/api.c.

## nfct_cmp()

int nfct_cmp | ( | const struct nf_conntrack * | ct1,
|  | const struct nf_conntrack * | ct2,
|  | unsigned int | flags )

nfct_cmp - compare two conntrack objects

Parameters

  ct1 | pointer to a valid conntrack object
  ct2 | pointer to a valid conntrack object
  flags | flags

This function only compare attribute set in both objects, by default the comparison is not strict, ie. if a certain attribute is not set in one of the objects, then such attribute is not used in the comparison. If you want more strict comparisons, you can use the appropriate flags to modify this behaviour (see NFCT_CMP_STRICT and NFCT_CMP_MASK).

The available flags are:

        - NFCT_CMP_STRICT: the compared objects must have the same attributes
        and the same values, otherwise it returns that the objects are
        different.
        - NFCT_CMP_MASK: the first object is used as mask, this means that
        if an attribute is present in ct1 but not in ct2, this function
        returns that the objects are different.
        - NFCT_CMP_ALL: full comparison of both objects
        - NFCT_CMP_ORIG: it only compares the source and destination address;
        source and destination ports; the layer 3 and 4 protocol numbers
        of the original direction; and the id (if present).
        - NFCT_CMP_REPL: like NFCT_CMP_REPL but it compares the flow
        information that goes in the reply direction.
        - NFCT_CMP_TIMEOUT_EQ: timeout(ct1) == timeout(ct2)
        - NFCT_CMP_TIMEOUT_GT: timeout(ct1) > timeout(ct2)
        - NFCT_CMP_TIMEOUT_LT: timeout(ct1) < timeout(ct2)
        - NFCT_CMP_TIMEOUT_GE: timeout(ct1) >= timeout(ct2)
        - NFCT_CMP_TIMEOUT_LE: timeout(ct1) <= timeout(ct2)

The status bits comparison is status(ct1) & status(ct2) == status(ct1).

If both conntrack object are equal, this function returns 1, otherwise 0 is returned.

Definition at line 1212 of file conntrack/api.c.

## nfct_compare()

int nfct_compare | ( | const struct nf_conntrack * | ct1,
|  | const struct nf_conntrack * | ct2 )

nfct_compare - compare two conntrack objects

Parameters

  ct1 | pointer to a valid conntrack object
  ct2 | pointer to a valid conntrack object

This function only compare attribute set in both objects, ie. if a certain attribute is not set in ct1 but it is in ct2, then the value of such attribute is not used in the comparison.

If both conntrack object are equal, this function returns 1, otherwise 0 is returned.

NOTICE: The use nfct_cmp is preferred.

Definition at line 1166 of file conntrack/api.c.

## nfct_copy()

void nfct_copy | ( | struct nf_conntrack * | ct1,
|  | const struct nf_conntrack * | ct2,
|  | unsigned int | flags )

nfct_copy - copy part of one source object to another

Parameters

  ct1 | destination object
  ct2 | source object
  flags | flags

This function copies one part of the source object to the target. It behaves like clone but:

1) You have to pass an already allocated space for the target object 2) You can copy only a part of the source object to the target

The current supported flags are:

- NFCT_CP_ALL: that copies the object entirely.
- NFCT_CP_ORIG and NFCT_CP_REPL: that can be used to copy the information that identifies a flow in the original and the reply direction. This information is usually composed of: source and destination IP address; source and destination ports; layer 3 and 4 protocol number.
- NFCT_CP_META: that copies the metainformation (all the attributes >= ATTR_TCP_STATE)

NFCT_CP_OVERRIDE: changes the default behaviour of nfct_copy() since it overrides the destination object. After the copy, the destination is a clone of the origin. This flag provides faster copying.

Definition at line 1247 of file conntrack/api.c.

## nfct_copy_attr()

void nfct_copy_attr | ( | struct nf_conntrack * | ct1,
|  | const struct nf_conntrack * | ct2,
|  | const enum nf_conntrack_attr | type )

nfct_copy_attr - copy an attribute of one source object to another

Parameters

  ct1 | destination object
  ct2 | source object
  flags | flags

This function copies one attribute (if present) to another object.

Definition at line 1337 of file conntrack/api.c.

## nfct_destroy()

void nfct_destroy | ( | struct nf_conntrack * | ct | ) |

nf_conntrack_destroy - release a conntrack object

Parameters

  ct | pointer to the conntrack object

Definition at line 93 of file conntrack/api.c.

## nfct_get_attr()

const void * nfct_get_attr | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type )

nfct_get_attr - get a conntrack attribute

Parameters

  ct | pointer to a valid conntrack
  type | attribute type

In case of success a valid pointer to the attribute requested is returned, on error NULL is returned and errno is set appropiately.

Definition at line 467 of file conntrack/api.c.

## nfct_get_attr_grp()

int nfct_get_attr_grp | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr_grp | type,
|  | void * | data )

nfct_get_attr_grp - get an attribute group

Parameters

  ct | pointer to a valid conntrack object
  type | attribute group (see ATTR_GRP_*)
  data | pointer to struct (see struct nfct_attr_grp_*)

On error, it returns -1 and errno is appropriately set. On success, the data pointer contains the attribute group.

Definition at line 655 of file conntrack/api.c.

## nfct_get_attr_u16()

uint16_t nfct_get_attr_u16 | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type )

nfct_get_attr_u16 - get attribute of unsigned 16-bits long

Parameters

  ct | pointer to a valid conntrack
  type | attribute type

Returns the value of the requested attribute, if the attribute is not set, 0 is returned. In order to check if the attribute is set or not, use nfct_attr_is_set.

Definition at line 512 of file conntrack/api.c.

## nfct_get_attr_u32()

uint32_t nfct_get_attr_u32 | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type )

nfct_get_attr_u32 - get attribute of unsigned 32-bits long

Parameters

  ct | pointer to a valid conntrack
  type | attribute type

Returns the value of the requested attribute, if the attribute is not set, 0 is returned. In order to check if the attribute is set or not, use nfct_attr_is_set.

Definition at line 528 of file conntrack/api.c.

## nfct_get_attr_u64()

uint64_t nfct_get_attr_u64 | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type )

nfct_get_attr_u64 - get attribute of unsigned 32-bits long

Parameters

  ct | pointer to a valid conntrack
  type | attribute type

Returns the value of the requested attribute, if the attribute is not set, 0 is returned. In order to check if the attribute is set or not, use nfct_attr_is_set.

Definition at line 544 of file conntrack/api.c.

## nfct_get_attr_u8()

uint8_t nfct_get_attr_u8 | ( | const struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type )

nfct_get_attr_u8 - get attribute of unsigned 8-bits long

Parameters

  ct | pointer to a valid conntrack
  type | attribute type

Returns the value of the requested attribute, if the attribute is not set, 0 is returned. In order to check if the attribute is set or not, use nfct_attr_is_set.

Definition at line 496 of file conntrack/api.c.

## nfct_getobjopt()

int nfct_getobjopt | ( | const struct nf_conntrack * | ct,
|  | unsigned int | option )

nfct_getobjopt - get a certain option for a conntrack object

Parameters

  ct | conntrack object
  option | option parameter

In case of error, -1 is returned and errno is appropiately set. On success, 0 is returned.

Definition at line 189 of file conntrack/api.c.

## nfct_maxsize()

size_t nfct_maxsize | ( | void |  | ) |

nfct_maxsize - return the maximum size in bytes of a conntrack object

Use this function if you want to allocate a conntrack object in the stack instead of the heap. For example:

            char buf[nfct_maxsize()];
            struct nf_conntrack *ct = (struct nf_conntrack *) buf;
            memset(ct, 0, nfct_maxsize());

Note: As for now this function returns the same size that nfct_sizeof(ct) does although this could change in the future. Therefore, do not assume that nfct_sizeof(ct) == nfct_maxsize().

This function is DEPRECATED, don't use it in your code.

Definition at line 136 of file conntrack/api.c.

## nfct_new()

struct nf_conntrack * nfct_new | ( | void |  | ) |

nfct_conntrack_new - allocate a new conntrack

In case of success, this function returns a valid pointer to a memory blob, otherwise NULL is returned and errno is set appropiately.

Definition at line 76 of file conntrack/api.c.

## nfct_set_attr()

void nfct_set_attr | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type,
|  | const void * | value )

nfct_set_attr - set the value of a certain conntrack attribute

Parameters

  ct | pointer to a valid conntrack
  type | attribute type
  value | pointer to the attribute value

Note that certain attributes are unsettable:

- ATTR_USE
- ATTR_ID
- ATTR_*_COUNTER_*

ATTR_SECCTX

- ATTR_TIMESTAMP_* The call of this function for such attributes do nothing.

Definition at line 399 of file conntrack/api.c.

## nfct_set_attr_grp()

void nfct_set_attr_grp | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr_grp | type,
|  | const void * | data )

nfct_set_attr_grp - set a group of attributes

Parameters

  ct | pointer to a valid conntrack object
  type | attribute group (see ATTR_GRP_*)
  data | pointer to struct (see struct nfct_attr_grp_*)

Note that calling this function for ATTR_GRP_COUNTER_* and ATTR_GRP_ADDR_* have no effect.

Definition at line 630 of file conntrack/api.c.

## nfct_set_attr_l()

void nfct_set_attr_l | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type,
|  | const void * | value,
|  | size_t | len )

nfct_set_attr_l - set the value of a certain conntrack attribute

Parameters

  ct | pointer to a valid conntrack
  type | attribute type
  pointer | to attribute value
  length | of attribute value (in bytes)

Definition at line 370 of file conntrack/api.c.

## nfct_set_attr_u16()

void nfct_set_attr_u16 | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type,
|  | uint16_t | value )

nfct_set_attr_u16 - set the value of a certain conntrack attribute

Parameters

  ct | pointer to a valid conntrack
  type | attribute type
  value | unsigned 16 bits attribute value

Definition at line 426 of file conntrack/api.c.

## nfct_set_attr_u32()

void nfct_set_attr_u32 | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type,
|  | uint32_t | value )

nfct_set_attr_u32 - set the value of a certain conntrack attribute

Parameters

  ct | pointer to a valid conntrack
  type | attribute type
  value | unsigned 32 bits attribute value

Definition at line 439 of file conntrack/api.c.

## nfct_set_attr_u64()

void nfct_set_attr_u64 | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type,
|  | uint64_t | value )

nfct_set_attr_u64 - set the value of a certain conntrack attribute

Parameters

  ct | pointer to a valid conntrack
  type | attribute type
  value | unsigned 64 bits attribute value

Definition at line 452 of file conntrack/api.c.

## nfct_set_attr_u8()

void nfct_set_attr_u8 | ( | struct nf_conntrack * | ct,
|  | const enum nf_conntrack_attr | type,
|  | uint8_t | value )

nfct_set_attr_u8 - set the value of a certain conntrack attribute

Parameters

  ct | pointer to a valid conntrack
  type | attribute type
  value | unsigned 8 bits attribute value

Definition at line 413 of file conntrack/api.c.

## nfct_setobjopt()

int nfct_setobjopt | ( | struct nf_conntrack * | ct,
|  | unsigned int | option )

nfct_setobjopt - set a certain option for a conntrack object

Parameters

  ct | conntrack object
  option | option parameter

In case of error, -1 is returned and errno is appropiately set. On success, 0 is returned.

Definition at line 169 of file conntrack/api.c.

## nfct_sizeof()

size_t nfct_sizeof | ( | const struct nf_conntrack * | ct | ) |

nf_sizeof - return the size in bytes of a certain conntrack object

Parameters

  ct | pointer to the conntrack object

This function is DEPRECATED, don't use it in your code.

Definition at line 114 of file conntrack/api.c.

## nfct_snprintf()

int nfct_snprintf | ( | char * | buf,
|  | unsigned int | size,
|  | const struct nf_conntrack * | ct,
|  | unsigned int | msg_type,
|  | unsigned int | out_type,
|  | unsigned int | flags )

nfct_snprintf - print a conntrack object to a buffer

Parameters

  buf | buffer used to build the printable conntrack
  size | size of the buffer
  ct | pointer to a valid conntrack object
  message_type | print message type (NFCT_T_UNKNOWN, NFCT_T_NEW,...)
  output_type | print type (NFCT_O_DEFAULT, NFCT_O_XML, ...)
  flags | extra flags for the output type (NFCT_OF_LAYER3)

If you are listening to events, probably you want to display the message type as well. In that case, set the message type parameter to any of the known existing types, ie. NFCT_T_NEW, NFCT_T_UPDATE, NFCT_T_DESTROY. If you pass NFCT_T_UNKNOWN, the message type will not be output.

Currently, the output available are:

- NFCT_O_DEFAULT: default /proc-like output
- NFCT_O_XML: XML output

The output flags are:

- NFCT_OF_SHOW_LAYER3: include layer 3 information in the output, this is only required by NFCT_O_DEFAULT.
- NFCT_OF_TIME: display current time.
- NFCT_OF_ID: display the ID number.
- NFCT_OF_TIMESTAMP: display creation and (if exists) deletion time.

To use NFCT_OF_TIMESTAMP, you have to:

     *  $ echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp

This requires a Linux kernel >= 2.6.38.

Note that NFCT_OF_TIME displays the current time when nfct_snprintf() has been called. Thus, it can be used to know when a flow was destroy if you print the message just after you receive the destroy event. If you want more accurate timestamping, use NFCT_OF_TIMESTAMP.

On error, -1 is returned and errno is set appropiately. Otherwise the size of what would be written is returned, even if the size of the buffer is insufficient. This behaviour is similar to snprintf.

Definition at line 1113 of file conntrack/api.c.

## nfct_snprintf_labels()

int nfct_snprintf_labels | ( | char * | buf,
|  | unsigned int | size,
|  | const struct nf_conntrack * | ct,
|  | unsigned int | msg_type,
|  | unsigned int | out_type,
|  | unsigned int | flags,
|  | struct nfct_labelmap * | map )

nfct_snprintf_labels - print a bitmask object to a buffer including labels

Parameters

  buf | buffer used to build the printable conntrack
  size | size of the buffer
  ct | pointer to a valid conntrack object
  message_type | print message type (NFCT_T_UNKNOWN, NFCT_T_NEW,...)
  output_type | print type (NFCT_O_DEFAULT, NFCT_O_XML, ...)
  flags | extra flags for the output type (NFCT_OF_LAYER3)
  map | nfct_labelmap describing the connlabel translation, or NULL.

When map is NULL, the function is equal to nfct_snprintf(). Otherwise, if the conntrack object has a connlabel attribute, the active labels are translated using the label map and added to the buffer.

Definition at line 1141 of file conntrack/api.c.