1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <string.h>
4 #include <errno.h>
5 #include <arpa/inet.h>
6
7 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
8 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
9
10 /*
11 * WARNING: This test file creates an expectation for the FTP helper.
12 * Therefore, make sure you have load nf_conntrack_ftp before executing it.
13 */
14
main(void)15 int main(void)
16 {
17 int ret;
18 struct nfct_handle *h;
19 struct nf_conntrack *master, *expected, *mask;
20 struct nf_expect *exp;
21
22 /*
23 * Step 1: Setup master conntrack
24 */
25
26 master = nfct_new();
27 if (!master) {
28 perror("nfct_new");
29 exit(EXIT_FAILURE);
30 }
31
32 nfct_set_attr_u8(master, ATTR_L3PROTO, AF_INET);
33 nfct_set_attr_u32(master, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
34 nfct_set_attr_u32(master, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
35
36 nfct_set_attr_u8(master, ATTR_L4PROTO, IPPROTO_TCP);
37 nfct_set_attr_u16(master, ATTR_PORT_SRC, htons(1025));
38 nfct_set_attr_u16(master, ATTR_PORT_DST, htons(21));
39
40 nfct_setobjopt(master, NFCT_SOPT_SETUP_REPLY);
41
42 nfct_set_attr_u8(master, ATTR_TCP_STATE, TCP_CONNTRACK_ESTABLISHED);
43 nfct_set_attr_u32(master, ATTR_TIMEOUT, 200);
44 nfct_set_attr(master, ATTR_HELPER_NAME, "ftp");
45
46 h = nfct_open(CONNTRACK, 0);
47 if (!h) {
48 perror("nfct_open");
49 nfct_destroy(master);
50 return -1;
51 }
52
53 ret = nfct_query(h, NFCT_Q_CREATE, master);
54
55 printf("TEST: add master conntrack ");
56 if (ret == -1)
57 printf("(%d)(%s)\n", ret, strerror(errno));
58 else
59 printf("(OK)\n");
60
61 nfct_close(h);
62
63 expected = nfct_new();
64 if (!expected) {
65 perror("nfct_new");
66 exit(EXIT_FAILURE);
67 }
68
69 nfct_set_attr_u8(expected, ATTR_L3PROTO, AF_INET);
70 nfct_set_attr_u32(expected, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
71 nfct_set_attr_u32(expected, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
72
73 nfct_set_attr_u8(expected, ATTR_L4PROTO, IPPROTO_TCP);
74 nfct_set_attr_u16(expected, ATTR_PORT_SRC, 0);
75 nfct_set_attr_u16(expected, ATTR_PORT_DST, htons(10241));
76
77 mask = nfct_new();
78 if (!mask) {
79 perror("nfct_new");
80 nfct_destroy(master);
81 nfct_destroy(expected);
82 exit(EXIT_FAILURE);
83 }
84
85 nfct_set_attr_u8(mask, ATTR_L3PROTO, AF_INET);
86 nfct_set_attr_u32(mask, ATTR_IPV4_SRC, 0xffffffff);
87 nfct_set_attr_u32(mask, ATTR_IPV4_DST, 0xffffffff);
88
89 nfct_set_attr_u8(mask, ATTR_L4PROTO, IPPROTO_TCP);
90 nfct_set_attr_u16(mask, ATTR_PORT_SRC, 0x0000);
91 nfct_set_attr_u16(mask, ATTR_PORT_DST, 0xffff);
92
93 /*
94 * Step 2: Setup expectation
95 */
96
97 exp = nfexp_new();
98 if (!exp) {
99 perror("nfexp_new");
100 nfct_destroy(master);
101 nfct_destroy(expected);
102 nfct_destroy(mask);
103 exit(EXIT_FAILURE);
104 }
105
106 nfexp_set_attr(exp, ATTR_EXP_MASTER, master);
107 nfexp_set_attr(exp, ATTR_EXP_EXPECTED, expected);
108 nfexp_set_attr(exp, ATTR_EXP_MASK, mask);
109 nfexp_set_attr_u32(exp, ATTR_EXP_TIMEOUT, 200);
110
111 nfct_destroy(master);
112 nfct_destroy(expected);
113 nfct_destroy(mask);
114
115 h = nfct_open(EXPECT, 0);
116 if (!h) {
117 perror("nfct_open");
118 return -1;
119 }
120
121 ret = nfexp_query(h, NFCT_Q_CREATE, exp);
122
123 printf("TEST: create expectation ");
124 if (ret == -1)
125 printf("(%d)(%s)\n", ret, strerror(errno));
126 else
127 printf("(OK)\n");
128
129 nfct_close(h);
130
131 ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS);
132 }
133