| Message ID | 20151015043925.GB18814@gmail.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
On Thu, Oct 15, 2015 at 01:39:25PM +0900, Ken-ichirou MATSUZAWA wrote: > diff --git a/utils/nf-log.c b/utils/nf-log.c > index 5f2a192..006d4b0 100644 > --- a/utils/nf-log.c > +++ b/utils/nf-log.c > @@ -3,15 +3,109 @@ > #include <stdlib.h> > #include <arpa/inet.h> > > -#include <linux/netfilter/nfnetlink_log.h> > +#include <libnetfilter_log/linux_nfnetlink_log.h> > > #include <libmnl/libmnl.h> > #include <libnetfilter_log/libnetfilter_log.h> > > +#include "../config.h" I think you can update configure.ac to update CFLAGS, like this: CFLAGS="$CFLAGS -DBUILD_NFCT" so we can skip this include. I think it would be good if people can take the examples out of the tree and compile them by hand through, eg. gcc -lnetfilter_log -lnetfilter_conntrack -lmnl -DBUILD_NFCT nf-log.c -o nf-log Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi, sorry for so much late. On Fri, Oct 16, 2015 at 06:59:08PM +0200, Pablo Neira Ayuso wrote: > I think you can update configure.ac to update CFLAGS, like this: > > CFLAGS="$CFLAGS -DBUILD_NFCT" > > so we can skip this include. We can avoid to (re)run autogen.sh without lnf-conntrack at first then install it after, but > gcc -lnetfilter_log -lnetfilter_conntrack -lmnl -DBUILD_NFCT nf-log.c -o nf-log this make a sense, I follow your advice. I have met another issue related to lnf-conntrack, could you give me some advice? The following patch is compile error: In file included from nf-log.c:14:0: /usr/include/libnetfilter_conntrack/libnetfilter_conntrack.h:729:6: error: nested redefinition of ‘enum ip_conntrack_status’ enum ip_conntrack_status { ^ /usr/include/libnetfilter_conntrack/libnetfilter_conntrack.h:729:6: error: redeclaration of ‘enum ip_conntrack_status’ In file included from nf-log.c:12:0: /usr/include/linux/netfilter/nf_conntrack_common.h:37:6: note: originally defined here enum ip_conntrack_status { since both libnetfilter_conntrack.h and nf_conntrack_common.h defines ip_conntrack_status. Could you tell me how do I avoid such a error when using ip_conntrack_status and ip_conntrack_info? # It seems that the prev 2 patches I posted with this # has not applied yet? Thanks, -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, Nov 15, 2016 at 04:36:02PM +0900, Ken-ichirou MATSUZAWA wrote: > Hi, sorry for so much late. > > On Fri, Oct 16, 2015 at 06:59:08PM +0200, Pablo Neira Ayuso wrote: > > I think you can update configure.ac to update CFLAGS, like this: > > > > CFLAGS="$CFLAGS -DBUILD_NFCT" > > > > so we can skip this include. > > We can avoid to (re)run autogen.sh without lnf-conntrack at first > then install it after, but > > > gcc -lnetfilter_log -lnetfilter_conntrack -lmnl -DBUILD_NFCT nf-log.c -o nf-log > > this make a sense, I follow your advice. > > I have met another issue related to lnf-conntrack, could you give me > some advice? The following patch is compile error: > > In file included from nf-log.c:14:0: > /usr/include/libnetfilter_conntrack/libnetfilter_conntrack.h:729:6: error: nested redefinition of ‘enum ip_conntrack_status’ > enum ip_conntrack_status { > ^ > /usr/include/libnetfilter_conntrack/libnetfilter_conntrack.h:729:6: error: redeclaration of ‘enum ip_conntrack_status’ > In file included from nf-log.c:12:0: > /usr/include/linux/netfilter/nf_conntrack_common.h:37:6: note: originally defined here > enum ip_conntrack_status { > > since both libnetfilter_conntrack.h and nf_conntrack_common.h > defines ip_conntrack_status. Could you tell me how do I avoid such a > error when using ip_conntrack_status and ip_conntrack_info? I have just fixed this on the repository: commit 9833df6abd4d5ef381354e32b2d7d7afa7a616fe Author: Pablo Neira Ayuso <pablo@netfilter.org> Date: Thu Nov 24 14:09:34 2016 +0100 include: expose a copy of nf_conntrack_common.h Copy and rename nf_conntrack_common.h to linux_nf_conntrack_common.h, then include it from libnetfilter_conntrack.h Please, let me know if you see any problem with such update, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/configure.ac b/configure.ac index ead9399..7d58f09 100644 --- a/configure.ac +++ b/configure.ac @@ -4,6 +4,7 @@ AC_INIT([libnetfilter_log], [1.0.1]) AC_CONFIG_AUX_DIR([build-aux]) AC_CANONICAL_HOST AC_CONFIG_MACRO_DIR([m4]) +AC_CONFIG_HEADERS([config.h]) AM_INIT_AUTOMAKE([-Wall foreign subdir-objects tar-pax no-dist-gzip dist-bzip2 1.6]) @@ -31,6 +32,10 @@ AM_CONDITIONAL([BUILD_IPULOG], [test "x$with_ipulog" != xno]) dnl Dependencies PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 0.0.41]) PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3]) +PKG_CHECK_MODULES([LIBNETFILTER_CONNTRACK], [libnetfilter_conntrack >= 1.0.2], + [AC_DEFINE([BUILD_NFCT], [1], [building nfct integration example]) HAVE_LNFCT=1], + [HAVE_LNFCT=0]) +AM_CONDITIONAL([BUILD_NFCT], [test "$HAVE_LNFCT" -eq 1]) dnl Output the makefile AC_CONFIG_FILES([Makefile src/Makefile include/Makefile diff --git a/utils/Makefile.am b/utils/Makefile.am index dfe5f34..baef81a 100644 --- a/utils/Makefile.am +++ b/utils/Makefile.am @@ -9,6 +9,9 @@ nfulnl_test_LDFLAGS = -dynamic nf_log_SOURCES = nf-log.c nf_log_LDADD = ../src/libnetfilter_log.la nf_log_LDFLAGS = -dynamic -lmnl +if BUILD_NFCT +nf_log_LDFLAGS += $(LIBNETFILTER_CONNTRACK_LIBS) +endif if BUILD_IPULOG check_PROGRAMS += ulog_test diff --git a/utils/nf-log.c b/utils/nf-log.c index 5f2a192..006d4b0 100644 --- a/utils/nf-log.c +++ b/utils/nf-log.c @@ -3,15 +3,109 @@ #include <stdlib.h> #include <arpa/inet.h> -#include <linux/netfilter/nfnetlink_log.h> +#include <libnetfilter_log/linux_nfnetlink_log.h> #include <libmnl/libmnl.h> #include <libnetfilter_log/libnetfilter_log.h> +#include "../config.h" +#ifdef BUILD_NFCT +#include <linux/netfilter/nf_conntrack_common.h> +#include <linux/netfilter/nf_conntrack_tuple_common.h> +#include <libnetfilter_conntrack/libnetfilter_conntrack.h> +#endif + +#ifdef BUILD_NFCT +static int print_ctinfo(const struct nlattr *const attr) +{ + uint32_t ctinfo; + + if (attr == NULL) + return MNL_CB_OK; + + ctinfo = ntohl(mnl_attr_get_u32(attr)); + printf(" ip_conntrack_info:"); + + switch (CTINFO2DIR(ctinfo)) { + case IP_CT_DIR_ORIGINAL: + printf(" ORIGINAL /"); + break; + case IP_CT_DIR_REPLY: + printf(" REPLY /"); + break; + default: + printf(" unknown dir: %d\n", CTINFO2DIR(ctinfo)); + return MNL_CB_ERROR; + } + + switch (ctinfo) { + case IP_CT_ESTABLISHED: + case IP_CT_ESTABLISHED_REPLY: + printf(" ESTABLISHED\n"); + break; + case IP_CT_RELATED: + case IP_CT_RELATED_REPLY: + printf(" RELATED\n"); + break; + case IP_CT_NEW: + case IP_CT_NEW_REPLY: + printf(" NEW\n"); + break; + default: + printf(" unknown ctinfo: %d\n", ctinfo); + return MNL_CB_ERROR; + } + + return MNL_CB_OK; +} + +static int print_nfct(uint8_t family, + const struct nlattr *const info_attr, + const struct nlattr *const ct_attr) +{ + char buf[4096]; + struct nf_conntrack *ct = NULL; + + if (info_attr != NULL) + print_ctinfo(info_attr); + + if (ct_attr == NULL) + return MNL_CB_OK; + + ct = nfct_new(); + if (ct == NULL) { + perror("nfct_new"); + return MNL_CB_ERROR; + } + + if (nfct_payload_parse(mnl_attr_get_payload(ct_attr), + mnl_attr_get_payload_len(ct_attr), + family, ct) < 0) { + perror("nfct_payload_parse"); + nfct_destroy(ct); + return MNL_CB_ERROR; + } + + nfct_snprintf(buf, sizeof(buf), ct, 0, NFCT_O_DEFAULT, 0); + printf(" %s\n", buf); + nfct_destroy(ct); + + return MNL_CB_OK; +} +#else +static int print_nfct(uint8_t family, + const struct nlattr *const info_attr, + const struct nlattr *const ct_attr) +{ + return MNL_CB_OK; +} +#endif + static int log_cb(const struct nlmsghdr *nlh, void *data) { struct nlattr *attrs[NFULA_MAX + 1] = { NULL }; struct nfulnl_msg_packet_hdr *ph = NULL; + struct nfgenmsg *nfg; const char *prefix = NULL; uint32_t mark = 0; char buf[4096]; @@ -21,6 +115,8 @@ static int log_cb(const struct nlmsghdr *nlh, void *data) if (ret != MNL_CB_OK) return ret; + nfg = mnl_nlmsg_get_payload(nlh); + if (attrs[NFULA_PACKET_HDR]) ph = mnl_attr_get_payload(attrs[NFULA_PACKET_HDR]); if (attrs[NFULA_PREFIX]) @@ -38,6 +134,8 @@ static int log_cb(const struct nlmsghdr *nlh, void *data) return MNL_CB_ERROR; printf("%s (ret=%d)\n", buf, ret); + print_nfct(nfg->nfgen_family, attrs[NFULA_CT_INFO], attrs[NFULA_CT]); + return MNL_CB_OK; } @@ -108,6 +206,10 @@ int main(int argc, char *argv[]) exit(EXIT_FAILURE); } +#ifdef BUILD_NFCT + mnl_attr_put_u16(nlh, NFULA_CFG_FLAGS, htons(NFULNL_CFG_F_CONNTRACK)); +#endif + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { perror("mnl_socket_sendto"); exit(EXIT_FAILURE);
This patch enables nf-log in utils directory to show conntrack information if libnetfilter_conntrack exists. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> --- configure.ac | 5 +++ utils/Makefile.am | 3 ++ utils/nf-log.c | 104 +++++++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 111 insertions(+), 1 deletion(-)