nfct-expect-create-userspace

#!/usr/bin/lua
--[[
Rewrite of expect_create_userspace.c from libnetfilter_conntrack.

This example shows how to setup a user-space expectation. This requires
a Linux kernel >= 2.6.38.
]]

require"nfct"

function usage(k)
    if arg[k] then
        return
    end
    print("arg '"..k.."' not provided")
    print("usage "..arg[0].." expect=port src=ip dst=ip sport=port dport=port [timeout=seconds] [flag=permanent]")
    os.exit(1)
end

for i,a in ipairs(arg) do
    local s,e,k,v = a:find("^([^=]+)=(.*)$")
    arg[k] = v
end

for _,k in ipairs{"expect", "src", "dst", "sport", "dport", "timeout"} do
    usage(k)
end

local assert = function(value, emsg, enum)
    if value then
        return value
    end
    error(emsg.." ["..(enum or "?").."]")
end

local function ctprint(ct, name, ...)
    print("ct="..nfct.tostring(ct).." -- "..name, ...)
end

local function expprint(exp, name, ...)
    print("exp="..nfct.exp_tostring(exp).." -- "..name, ...)
end

-- Setup master

master = assert(nfct.new())

assert(nfct.set_attr_pf      (master, "l3proto",     "inet"))
assert(nfct.set_attr_ipv4    (master, "ipv4-src",    arg.src))
assert(nfct.set_attr_ipv4    (master, "ipv4-dst",    arg.dst))

assert(nfct.set_attr_ipproto (master, "l4proto",     "tcp"))
assert(nfct.set_attr_port    (master, "port-src",    arg.sport))
assert(nfct.set_attr_port    (master, "port-dst",    arg.dport))

ctprint(master, "master")

-- Setup expected

expected = assert(nfct.new())

assert(nfct.set_attr_pf      (expected, "l3proto",     "inet"))
assert(nfct.set_attr_ipv4    (expected, "ipv4-src",    arg.src))
assert(nfct.set_attr_ipv4    (expected, "ipv4-dst",    arg.dst))

assert(nfct.set_attr_ipproto (expected, "l4proto",     "tcp"))
assert(nfct.set_attr_port    (expected, "port-dst",    arg.expect))

ctprint(expected, "expected")

-- Setup mask

mask = assert(nfct.new())

-- this mask value MUST be AF_INET or exp_query fails with ENOENT
assert(nfct.set_attr_pf      (mask, "l3proto",     "inet"))
assert(nfct.set_attr_u32     (mask, "ipv4-src",    0xffffffff))
assert(nfct.set_attr_u32     (mask, "ipv4-dst",    0xffffffff))

-- this mask value SHOULD be IPPROTO_TCP or ct object cannot be printed in full
assert(nfct.set_attr_ipproto (mask, "l4proto",     "tcp"))
assert(nfct.set_attr_port    (mask, "port-dst",    0xffff))

ctprint(mask, "mask")

-- Create expectation

exp = assert(nfct.exp_new(master, expected, mask, arg.timeout, arg.flag))

nfct.destroy(master)
nfct.destroy(expected)
nfct.destroy(mask)

expprint(exp, "expectation")

h = assert(nfct.open"expect")

-- FIXME this can fail if conntrack hasn't tracked the master... but is
-- that possible? we just got data from nfq, the connection must exist
local _, emsg, eno = nfct.exp_query(h, "create", exp)

if eno == 17 then
    -- expectation already exists... normal?
else
    assert(_, emsg)
end

nfct.close(h)