conntrack_linux.go 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344
  1. package netlink
  2. import (
  3. "bytes"
  4. "encoding/binary"
  5. "errors"
  6. "fmt"
  7. "net"
  8. "syscall"
  9. "github.com/vishvananda/netlink/nl"
  10. )
  11. // ConntrackTableType Conntrack table for the netlink operation
  12. type ConntrackTableType uint8
  13. const (
  14. // ConntrackTable Conntrack table
  15. // https://github.com/torvalds/linux/blob/master/include/uapi/linux/netfilter/nfnetlink.h -> #define NFNL_SUBSYS_CTNETLINK 1
  16. ConntrackTable = 1
  17. // ConntrackExpectTable Conntrack expect table
  18. // https://github.com/torvalds/linux/blob/master/include/uapi/linux/netfilter/nfnetlink.h -> #define NFNL_SUBSYS_CTNETLINK_EXP 2
  19. ConntrackExpectTable = 2
  20. )
  21. const (
  22. // backward compatibility with golang 1.6 which does not have io.SeekCurrent
  23. seekCurrent = 1
  24. )
  25. // InetFamily Family type
  26. type InetFamily uint8
  27. // -L [table] [options] List conntrack or expectation table
  28. // -G [table] parameters Get conntrack or expectation
  29. // -I [table] parameters Create a conntrack or expectation
  30. // -U [table] parameters Update a conntrack
  31. // -E [table] [options] Show events
  32. // -C [table] Show counter
  33. // -S Show statistics
  34. // ConntrackTableList returns the flow list of a table of a specific family
  35. // conntrack -L [table] [options] List conntrack or expectation table
  36. func ConntrackTableList(table ConntrackTableType, family InetFamily) ([]*ConntrackFlow, error) {
  37. return pkgHandle.ConntrackTableList(table, family)
  38. }
  39. // ConntrackTableFlush flushes all the flows of a specified table
  40. // conntrack -F [table] Flush table
  41. // The flush operation applies to all the family types
  42. func ConntrackTableFlush(table ConntrackTableType) error {
  43. return pkgHandle.ConntrackTableFlush(table)
  44. }
  45. // ConntrackDeleteFilter deletes entries on the specified table on the base of the filter
  46. // conntrack -D [table] parameters Delete conntrack or expectation
  47. func ConntrackDeleteFilter(table ConntrackTableType, family InetFamily, filter *ConntrackFilter) (uint, error) {
  48. return pkgHandle.ConntrackDeleteFilter(table, family, filter)
  49. }
  50. // ConntrackTableList returns the flow list of a table of a specific family using the netlink handle passed
  51. // conntrack -L [table] [options] List conntrack or expectation table
  52. func (h *Handle) ConntrackTableList(table ConntrackTableType, family InetFamily) ([]*ConntrackFlow, error) {
  53. res, err := h.dumpConntrackTable(table, family)
  54. if err != nil {
  55. return nil, err
  56. }
  57. // Deserialize all the flows
  58. var result []*ConntrackFlow
  59. for _, dataRaw := range res {
  60. result = append(result, parseRawData(dataRaw))
  61. }
  62. return result, nil
  63. }
  64. // ConntrackTableFlush flushes all the flows of a specified table using the netlink handle passed
  65. // conntrack -F [table] Flush table
  66. // The flush operation applies to all the family types
  67. func (h *Handle) ConntrackTableFlush(table ConntrackTableType) error {
  68. req := h.newConntrackRequest(table, syscall.AF_INET, nl.IPCTNL_MSG_CT_DELETE, syscall.NLM_F_ACK)
  69. _, err := req.Execute(syscall.NETLINK_NETFILTER, 0)
  70. return err
  71. }
  72. // ConntrackDeleteFilter deletes entries on the specified table on the base of the filter using the netlink handle passed
  73. // conntrack -D [table] parameters Delete conntrack or expectation
  74. func (h *Handle) ConntrackDeleteFilter(table ConntrackTableType, family InetFamily, filter *ConntrackFilter) (uint, error) {
  75. res, err := h.dumpConntrackTable(table, family)
  76. if err != nil {
  77. return 0, err
  78. }
  79. var matched uint
  80. for _, dataRaw := range res {
  81. flow := parseRawData(dataRaw)
  82. if match := filter.MatchConntrackFlow(flow); match {
  83. req2 := h.newConntrackRequest(table, family, nl.IPCTNL_MSG_CT_DELETE, syscall.NLM_F_ACK)
  84. // skip the first 4 byte that are the netfilter header, the newConntrackRequest is adding it already
  85. req2.AddRawData(dataRaw[4:])
  86. req2.Execute(syscall.NETLINK_NETFILTER, 0)
  87. matched++
  88. }
  89. }
  90. return matched, nil
  91. }
  92. func (h *Handle) newConntrackRequest(table ConntrackTableType, family InetFamily, operation, flags int) *nl.NetlinkRequest {
  93. // Create the Netlink request object
  94. req := h.newNetlinkRequest((int(table)<<8)|operation, flags)
  95. // Add the netfilter header
  96. msg := &nl.Nfgenmsg{
  97. NfgenFamily: uint8(family),
  98. Version: nl.NFNETLINK_V0,
  99. ResId: 0,
  100. }
  101. req.AddData(msg)
  102. return req
  103. }
  104. func (h *Handle) dumpConntrackTable(table ConntrackTableType, family InetFamily) ([][]byte, error) {
  105. req := h.newConntrackRequest(table, family, nl.IPCTNL_MSG_CT_GET, syscall.NLM_F_DUMP)
  106. return req.Execute(syscall.NETLINK_NETFILTER, 0)
  107. }
  108. // The full conntrack flow structure is very complicated and can be found in the file:
  109. // http://git.netfilter.org/libnetfilter_conntrack/tree/include/internal/object.h
  110. // For the time being, the structure below allows to parse and extract the base information of a flow
  111. type ipTuple struct {
  112. SrcIP net.IP
  113. DstIP net.IP
  114. Protocol uint8
  115. SrcPort uint16
  116. DstPort uint16
  117. }
  118. type ConntrackFlow struct {
  119. FamilyType uint8
  120. Forward ipTuple
  121. Reverse ipTuple
  122. }
  123. func (s *ConntrackFlow) String() string {
  124. // conntrack cmd output:
  125. // udp 17 src=127.0.0.1 dst=127.0.0.1 sport=4001 dport=1234 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=1234 dport=4001
  126. return fmt.Sprintf("%s\t%d src=%s dst=%s sport=%d dport=%d\tsrc=%s dst=%s sport=%d dport=%d",
  127. nl.L4ProtoMap[s.Forward.Protocol], s.Forward.Protocol,
  128. s.Forward.SrcIP.String(), s.Forward.DstIP.String(), s.Forward.SrcPort, s.Forward.DstPort,
  129. s.Reverse.SrcIP.String(), s.Reverse.DstIP.String(), s.Reverse.SrcPort, s.Reverse.DstPort)
  130. }
  131. // This method parse the ip tuple structure
  132. // The message structure is the following:
  133. // <len, [CTA_IP_V4_SRC|CTA_IP_V6_SRC], 16 bytes for the IP>
  134. // <len, [CTA_IP_V4_DST|CTA_IP_V6_DST], 16 bytes for the IP>
  135. // <len, NLA_F_NESTED|nl.CTA_TUPLE_PROTO, 1 byte for the protocol, 3 bytes of padding>
  136. // <len, CTA_PROTO_SRC_PORT, 2 bytes for the source port, 2 bytes of padding>
  137. // <len, CTA_PROTO_DST_PORT, 2 bytes for the source port, 2 bytes of padding>
  138. func parseIpTuple(reader *bytes.Reader, tpl *ipTuple) {
  139. for i := 0; i < 2; i++ {
  140. _, t, _, v := parseNfAttrTLV(reader)
  141. switch t {
  142. case nl.CTA_IP_V4_SRC, nl.CTA_IP_V6_SRC:
  143. tpl.SrcIP = v
  144. case nl.CTA_IP_V4_DST, nl.CTA_IP_V6_DST:
  145. tpl.DstIP = v
  146. }
  147. }
  148. // Skip the next 4 bytes nl.NLA_F_NESTED|nl.CTA_TUPLE_PROTO
  149. reader.Seek(4, seekCurrent)
  150. _, t, _, v := parseNfAttrTLV(reader)
  151. if t == nl.CTA_PROTO_NUM {
  152. tpl.Protocol = uint8(v[0])
  153. }
  154. // Skip some padding 3 bytes
  155. reader.Seek(3, seekCurrent)
  156. for i := 0; i < 2; i++ {
  157. _, t, _ := parseNfAttrTL(reader)
  158. switch t {
  159. case nl.CTA_PROTO_SRC_PORT:
  160. parseBERaw16(reader, &tpl.SrcPort)
  161. case nl.CTA_PROTO_DST_PORT:
  162. parseBERaw16(reader, &tpl.DstPort)
  163. }
  164. // Skip some padding 2 byte
  165. reader.Seek(2, seekCurrent)
  166. }
  167. }
  168. func parseNfAttrTLV(r *bytes.Reader) (isNested bool, attrType, len uint16, value []byte) {
  169. isNested, attrType, len = parseNfAttrTL(r)
  170. value = make([]byte, len)
  171. binary.Read(r, binary.BigEndian, &value)
  172. return isNested, attrType, len, value
  173. }
  174. func parseNfAttrTL(r *bytes.Reader) (isNested bool, attrType, len uint16) {
  175. binary.Read(r, nl.NativeEndian(), &len)
  176. len -= nl.SizeofNfattr
  177. binary.Read(r, nl.NativeEndian(), &attrType)
  178. isNested = (attrType & nl.NLA_F_NESTED) == nl.NLA_F_NESTED
  179. attrType = attrType & (nl.NLA_F_NESTED - 1)
  180. return isNested, attrType, len
  181. }
  182. func parseBERaw16(r *bytes.Reader, v *uint16) {
  183. binary.Read(r, binary.BigEndian, v)
  184. }
  185. func parseRawData(data []byte) *ConntrackFlow {
  186. s := &ConntrackFlow{}
  187. // First there is the Nfgenmsg header
  188. // consume only the family field
  189. reader := bytes.NewReader(data)
  190. binary.Read(reader, nl.NativeEndian(), &s.FamilyType)
  191. // skip rest of the Netfilter header
  192. reader.Seek(3, seekCurrent)
  193. // The message structure is the following:
  194. // <len, NLA_F_NESTED|CTA_TUPLE_ORIG> 4 bytes
  195. // <len, NLA_F_NESTED|CTA_TUPLE_IP> 4 bytes
  196. // flow information of the forward flow
  197. // <len, NLA_F_NESTED|CTA_TUPLE_REPLY> 4 bytes
  198. // <len, NLA_F_NESTED|CTA_TUPLE_IP> 4 bytes
  199. // flow information of the reverse flow
  200. for reader.Len() > 0 {
  201. nested, t, l := parseNfAttrTL(reader)
  202. if nested && t == nl.CTA_TUPLE_ORIG {
  203. if nested, t, _ = parseNfAttrTL(reader); nested && t == nl.CTA_TUPLE_IP {
  204. parseIpTuple(reader, &s.Forward)
  205. }
  206. } else if nested && t == nl.CTA_TUPLE_REPLY {
  207. if nested, t, _ = parseNfAttrTL(reader); nested && t == nl.CTA_TUPLE_IP {
  208. parseIpTuple(reader, &s.Reverse)
  209. // Got all the useful information stop parsing
  210. break
  211. } else {
  212. // Header not recognized skip it
  213. reader.Seek(int64(l), seekCurrent)
  214. }
  215. }
  216. }
  217. return s
  218. }
  219. // Conntrack parameters and options:
  220. // -n, --src-nat ip source NAT ip
  221. // -g, --dst-nat ip destination NAT ip
  222. // -j, --any-nat ip source or destination NAT ip
  223. // -m, --mark mark Set mark
  224. // -c, --secmark secmark Set selinux secmark
  225. // -e, --event-mask eventmask Event mask, eg. NEW,DESTROY
  226. // -z, --zero Zero counters while listing
  227. // -o, --output type[,...] Output format, eg. xml
  228. // -l, --label label[,...] conntrack labels
  229. // Common parameters and options:
  230. // -s, --src, --orig-src ip Source address from original direction
  231. // -d, --dst, --orig-dst ip Destination address from original direction
  232. // -r, --reply-src ip Source addres from reply direction
  233. // -q, --reply-dst ip Destination address from reply direction
  234. // -p, --protonum proto Layer 4 Protocol, eg. 'tcp'
  235. // -f, --family proto Layer 3 Protocol, eg. 'ipv6'
  236. // -t, --timeout timeout Set timeout
  237. // -u, --status status Set status, eg. ASSURED
  238. // -w, --zone value Set conntrack zone
  239. // --orig-zone value Set zone for original direction
  240. // --reply-zone value Set zone for reply direction
  241. // -b, --buffer-size Netlink socket buffer size
  242. // --mask-src ip Source mask address
  243. // --mask-dst ip Destination mask address
  244. // Filter types
  245. type ConntrackFilterType uint8
  246. const (
  247. ConntrackOrigSrcIP = iota // -orig-src ip Source address from original direction
  248. ConntrackOrigDstIP // -orig-dst ip Destination address from original direction
  249. ConntrackNatSrcIP // -src-nat ip Source NAT ip
  250. ConntrackNatDstIP // -dst-nat ip Destination NAT ip
  251. ConntrackNatAnyIP // -any-nat ip Source or destination NAT ip
  252. )
  253. type ConntrackFilter struct {
  254. ipFilter map[ConntrackFilterType]net.IP
  255. }
  256. // AddIP adds an IP to the conntrack filter
  257. func (f *ConntrackFilter) AddIP(tp ConntrackFilterType, ip net.IP) error {
  258. if f.ipFilter == nil {
  259. f.ipFilter = make(map[ConntrackFilterType]net.IP)
  260. }
  261. if _, ok := f.ipFilter[tp]; ok {
  262. return errors.New("Filter attribute already present")
  263. }
  264. f.ipFilter[tp] = ip
  265. return nil
  266. }
  267. // MatchConntrackFlow applies the filter to the flow and returns true if the flow matches the filter
  268. // false otherwise
  269. func (f *ConntrackFilter) MatchConntrackFlow(flow *ConntrackFlow) bool {
  270. if len(f.ipFilter) == 0 {
  271. // empty filter always not match
  272. return false
  273. }
  274. match := true
  275. // -orig-src ip Source address from original direction
  276. if elem, found := f.ipFilter[ConntrackOrigSrcIP]; found {
  277. match = match && elem.Equal(flow.Forward.SrcIP)
  278. }
  279. // -orig-dst ip Destination address from original direction
  280. if elem, found := f.ipFilter[ConntrackOrigDstIP]; match && found {
  281. match = match && elem.Equal(flow.Forward.DstIP)
  282. }
  283. // -src-nat ip Source NAT ip
  284. if elem, found := f.ipFilter[ConntrackNatSrcIP]; match && found {
  285. match = match && elem.Equal(flow.Reverse.SrcIP)
  286. }
  287. // -dst-nat ip Destination NAT ip
  288. if elem, found := f.ipFilter[ConntrackNatDstIP]; match && found {
  289. match = match && elem.Equal(flow.Reverse.DstIP)
  290. }
  291. // -any-nat ip Source or destination NAT ip
  292. if elem, found := f.ipFilter[ConntrackNatAnyIP]; match && found {
  293. match = match && (elem.Equal(flow.Reverse.SrcIP) || elem.Equal(flow.Reverse.DstIP))
  294. }
  295. return match
  296. }