net/netlink: Add NETLINK_NETFILTER's CONNTRACK support

Now we only supports conntrack info from NAT entries, to let our apps in user space know the mapping status in NAT.

Signed-off-by: Zhe Weng <wengzhe@xiaomi.com>

include/netpacket/netlink.h

@@ -437,6 +437,160 @@
 
 #define RTM_F_CLONED  0x200  /* This route is cloned */
 
+/* Attribute definitions for struct nfattr **********************************/
+
+/* Macros to handle attribute lists */
+
+#define NFNL_NFA_NEST         0x8000
+#define NFA_TYPE(attr)        ((attr)->nfa_type & 0x7fff)
+
+#define NFA_MASK              (sizeof(uint32_t) - 1)
+#define NFA_ALIGN(n)          (((n) + NFA_MASK) & ~NFA_MASK)
+#define NFA_OK(nfa, n) \
+  ((n) >= (int)sizeof(struct nfattr) && \
+   (nfa)->nfa_len >= sizeof(struct nfattr) && \
+   (nfa)->nfa_len <= (n))
+#define NFA_NEXT(nfa, attrlen) \
+  ((attrlen) -= NFA_ALIGN((nfa)->nfa_len), \
+   (FAR struct nfattr *)(((FAR char *)(nfa)) + NFA_ALIGN((nfa)->nfa_len)))
+#define NFA_LENGTH(len)       ((sizeof(struct nfattr)) + (len))
+#define NFA_SPACE(len)        NFA_ALIGN(NFA_LENGTH(len))
+#define NFA_DATA(nfa)         ((FAR void *)(((FAR char *)(nfa)) + NFA_LENGTH(0)))
+#define NFA_PAYLOAD(nfa)      ((int)((nfa)->nfa_len) - NFA_LENGTH(0))
+
+/* Definitions for struct nfgenmsg ******************************************/
+
+#define NFM_NFA(n)           ((FAR struct nfattr *) \
+                              (((FAR char *)(n)) + \
+                              NLMSG_ALIGN(sizeof(struct nfgenmsg))))
+#define NFM_PAYLOAD(n)        NLMSG_PAYLOAD(n, sizeof(struct nfgenmsg))
+
+/* Definitions for NETLINK_NETFILTER ****************************************/
+
+#define NFNETLINK_V0          0
+
+/* netfilter netlink message types are split in two pieces:
+ * 8 bit subsystem, 8bit operation.
+ */
+
+#define NFNL_SUBSYS_ID(x)     (((x) & 0xff00) >> 8)
+#define NFNL_MSG_TYPE(x)      ((x) & 0x00ff)
+
+/* subsystems */
+
+#define NFNL_SUBSYS_NONE              0
+#define NFNL_SUBSYS_CTNETLINK         1
+#define NFNL_SUBSYS_CTNETLINK_EXP     2
+#define NFNL_SUBSYS_QUEUE             3
+#define NFNL_SUBSYS_ULOG              4
+#define NFNL_SUBSYS_OSF               5
+#define NFNL_SUBSYS_IPSET             6
+#define NFNL_SUBSYS_ACCT              7
+#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
+#define NFNL_SUBSYS_CTHELPER          9
+#define NFNL_SUBSYS_NFTABLES          10
+#define NFNL_SUBSYS_NFT_COMPAT        11
+#define NFNL_SUBSYS_HOOK              12
+#define NFNL_SUBSYS_COUNT             13
+
+/* NETLINK_NETFILTER: subsystem CTNL (ip conntrack netlink) message types */
+
+#define IPCTNL_MSG_CT_NEW             0
+#define IPCTNL_MSG_CT_GET             1
+#define IPCTNL_MSG_CT_DELETE          2
+#define IPCTNL_MSG_CT_GET_CTRZERO     3
+#define IPCTNL_MSG_CT_GET_STATS_CPU   4
+#define IPCTNL_MSG_CT_GET_STATS       5
+#define IPCTNL_MSG_CT_GET_DYING       6
+#define IPCTNL_MSG_CT_GET_UNCONFIRMED 7
+#define IPCTNL_MSG_MAX                8
+
+/* NETLINK_NETFILTER: Conntrack attributes */
+
+#define CTA_UNSPEC            0
+#define CTA_TUPLE_ORIG        1
+#define CTA_TUPLE_REPLY       2
+#define CTA_STATUS            3
+#define CTA_PROTOINFO         4
+#define CTA_HELP              5
+#define CTA_NAT_SRC           6
+#define CTA_TIMEOUT           7
+#define CTA_MARK              8
+#define CTA_COUNTERS_ORIG     9
+#define CTA_COUNTERS_REPLY    10
+#define CTA_USE               11
+#define CTA_ID                12
+#define CTA_NAT_DST           13
+#define CTA_TUPLE_MASTER      14
+#define CTA_SEQ_ADJ_ORIG      15
+#define CTA_NAT_SEQ_ADJ_ORIG  CTA_SEQ_ADJ_ORIG
+#define CTA_SEQ_ADJ_REPLY     16
+#define CTA_NAT_SEQ_ADJ_REPLY CTA_SEQ_ADJ_REPLY
+#define CTA_ZONE              18
+#define CTA_SECCTX            19
+#define CTA_TIMESTAMP         20
+#define CTA_MARK_MASK         21
+#define CTA_LABELS            22
+#define CTA_LABELS_MASK       23
+#define CTA_SYNPROXY          24
+#define CTA_FILTER            25
+#define CTA_STATUS_MASK       26
+#define CTA_MAX               26
+
+/* NETLINK_NETFILTER: Conntrack tuple attributes */
+
+#define CTA_TUPLE_UNSPEC      0
+#define CTA_TUPLE_IP          1
+#define CTA_TUPLE_PROTO       2
+#define CTA_TUPLE_ZONE        3
+#define CTA_TUPLE_MAX         3
+
+/* NETLINK_NETFILTER: Conntrack IP attributes */
+
+#define CTA_IP_UNSPEC         0
+#define CTA_IP_V4_SRC         1
+#define CTA_IP_V4_DST         2
+#define CTA_IP_V6_SRC         3
+#define CTA_IP_V6_DST         4
+#define CTA_IP_MAX            4
+
+/* NETLINK_NETFILTER: Conntrack protocol attributes */
+
+#define CTA_PROTO_UNSPEC      0
+#define CTA_PROTO_NUM         1
+#define CTA_PROTO_SRC_PORT    2
+#define CTA_PROTO_DST_PORT    3
+#define CTA_PROTO_ICMP_ID     4
+#define CTA_PROTO_ICMP_TYPE   5
+#define CTA_PROTO_ICMP_CODE   6
+#define CTA_PROTO_ICMPV6_ID   7
+#define CTA_PROTO_ICMPV6_TYPE 8
+#define CTA_PROTO_ICMPV6_CODE 9
+#define CTA_PROTO_MAX         9
+
+/* NFnetlink multicast groups (userspace) */
+
+#define NF_NETLINK_CONNTRACK_NEW         0x00000001
+#define NF_NETLINK_CONNTRACK_UPDATE      0x00000002
+#define NF_NETLINK_CONNTRACK_DESTROY     0x00000004
+#define NF_NETLINK_CONNTRACK_EXP_NEW     0x00000008
+#define NF_NETLINK_CONNTRACK_EXP_UPDATE  0x00000010
+#define NF_NETLINK_CONNTRACK_EXP_DESTROY 0x00000020
+
+/* NFnetlink multicast groups */
+
+#define NFNLGRP_NONE                  0
+#define NFNLGRP_CONNTRACK_NEW         1
+#define NFNLGRP_CONNTRACK_UPDATE      2
+#define NFNLGRP_CONNTRACK_DESTROY     3
+#define NFNLGRP_CONNTRACK_EXP_NEW     4
+#define NFNLGRP_CONNTRACK_EXP_UPDATE  5
+#define NFNLGRP_CONNTRACK_EXP_DESTROY 6
+#define NFNLGRP_NFTABLES              7
+#define NFNLGRP_ACCT_QUOTA            8
+#define NFNLGRP_NFTRACE               9
+#define NFNLGRP_MAX                   9
+
 /****************************************************************************
  * Public Type Definitions
  ****************************************************************************/
@@ -584,6 +738,25 @@ struct nla_bitfield32
   uint32_t selector;
 };
 
+/* NETLINK_NETFILTER Message Structures *************************************/
+
+/* These attributes should be manipulated using only the NFA_* */
+
+struct nfattr
+{
+  uint16_t nfa_len;
+  uint16_t nfa_type;
+};
+
+/* General form of address family dependent message. */
+
+struct nfgenmsg
+{
+  uint8_t  nfgen_family; /* AF_xxx */
+  uint8_t  version;      /* nfnetlink version */
+  uint16_t res_id;       /* resource id */
+};
+
 /****************************************************************************
  *              Neighbor Discovery userland options
  */

net/nat/ipv4_nat_entry.c

@@ -33,6 +33,7 @@
 #include <nuttx/nuttx.h>
 
 #include "nat/nat.h"
+#include "netlink/netlink.h"
 
 #ifdef CONFIG_NET_NAT44
 
@@ -145,6 +146,10 @@ ipv4_nat_entry_create(uint8_t protocol,
   hashtable_add(g_nat44_outbound, &entry->hash_outbound,
                 ipv4_nat_outbound_key(local_ip, local_port, protocol));
 
+#ifdef CONFIG_NETLINK_NETFILTER
+  netlink_conntrack_notify(IPCTNL_MSG_CT_NEW, PF_INET, entry);
+#endif
+
   return entry;
 }
 
@@ -175,6 +180,10 @@ static void ipv4_nat_entry_delete(FAR ipv4_nat_entry_t *entry)
                                          entry->local_port,
                                          entry->protocol));
 
+#ifdef CONFIG_NETLINK_NETFILTER
+  netlink_conntrack_notify(IPCTNL_MSG_CT_DELETE, PF_INET, entry);
+#endif
+
   kmm_free(entry);
 }
 

net/nat/ipv6_nat_entry.c

@@ -34,6 +34,7 @@
 
 #include "inet/inet.h"
 #include "nat/nat.h"
+#include "netlink/netlink.h"
 
 #ifdef CONFIG_NET_NAT66
 
@@ -135,6 +136,10 @@ ipv6_nat_entry_create(uint8_t protocol, const net_ipv6addr_t external_ip,
   hashtable_add(g_nat66_outbound, &entry->hash_outbound,
                 ipv6_nat_hash_key(local_ip, local_port, protocol));
 
+#ifdef CONFIG_NETLINK_NETFILTER
+  netlink_conntrack_notify(IPCTNL_MSG_CT_NEW, PF_INET6, entry);
+#endif
+
   return entry;
 }
 
@@ -168,6 +173,10 @@ static void ipv6_nat_entry_delete(FAR ipv6_nat_entry_t *entry)
                                      entry->local_port,
                                      entry->protocol));
 
+#ifdef CONFIG_NETLINK_NETFILTER
+  netlink_conntrack_notify(IPCTNL_MSG_CT_DELETE, PF_INET6, entry);
+#endif
+
   kmm_free(entry);
 }
 

net/netlink/CMakeLists.txt

@@ -27,5 +27,9 @@ if(CONFIG_NET_NETLINK)
     list(APPEND SRCS netlink_route.c netlink_attr.c)
   endif()
 
+  if(CONFIG_NETLINK_NETFILTER)
+    list(APPEND SRCS netlink_netfilter.c)
+  endif()
+
   target_sources(net PRIVATE ${SRCS})
 endif()

net/netlink/Kconfig

@@ -117,6 +117,15 @@ config NETLINK_VALIDATE_POLICY
 		you pass in are valid.
 
 endif # NETLINK_ROUTE
+
+config NETLINK_NETFILTER
+	bool "Netlink Netfilter protocol"
+	default n
+	depends on NET_NAT
+	---help---
+		Support the NETLINK_NETFILTER protocol option, mainly
+		for conntrack with NAT.
+
 endmenu # Netlink Protocols
 endif # NET_NETLINK
 endmenu # Netlink Socket Support

net/netlink/Make.defs

@@ -29,6 +29,10 @@ ifeq ($(CONFIG_NETLINK_ROUTE),y)
 NET_CSRCS += netlink_route.c netlink_attr.c
 endif
 
+ifeq ($(CONFIG_NETLINK_NETFILTER),y)
+NET_CSRCS += netlink_netfilter.c
+endif
+
 # Include netlink build support
 
 DEPPATH += --dep-path netlink

net/netlink/netlink.h

@@ -543,7 +543,40 @@ int nla_parse(FAR struct nlattr **tb, int maxtype,
               FAR const struct nlattr *head,
               int len, FAR const struct nla_policy *policy,
               FAR struct netlink_ext_ack *extack);
-#endif
+#endif /* CONFIG_NETLINK_ROUTE */
+
+/****************************************************************************
+ * Name: netlink_netfilter_sendto
+ *
+ * Description:
+ *   Perform the sendto() operation for the NETLINK_NETFILTER protocol.
+ *
+ ****************************************************************************/
+
+#ifdef CONFIG_NETLINK_NETFILTER
+ssize_t netlink_netfilter_sendto(NETLINK_HANDLE handle,
+                                 FAR const struct nlmsghdr *nlmsg,
+                                 size_t len, int flags,
+                                 FAR const struct sockaddr_nl *to,
+                                 socklen_t tolen);
+
+/****************************************************************************
+ * Name: netlink_conntrack_notify
+ *
+ * Description:
+ *   Perform the conntrack broadcast for the NETLINK_NETFILTER protocol.
+ *
+ * Input Parameters:
+ *   type      - The type of the message, IPCTNL_MSG_CT_*
+ *   domain    - The domain of the message
+ *   nat_entry - The NAT entry
+ *
+ ****************************************************************************/
+
+void netlink_conntrack_notify(uint8_t type, uint8_t domain,
+                              FAR const void *nat_entry);
+
+#endif /* CONFIG_NETLINK_NETFILTER */
 
 #undef EXTERN
 #ifdef __cplusplus

net/netlink/netlink_sockif.c

@@ -129,6 +129,11 @@ static int netlink_setup(FAR struct socket *psock)
         break;
 #endif
 
+#ifdef CONFIG_NETLINK_NETFILTER
+      case NETLINK_NETFILTER:
+        break;
+#endif
+
       default:
         return -EPROTONOSUPPORT;
     }
@@ -621,6 +626,15 @@ static ssize_t netlink_sendmsg(FAR struct socket *psock,
         break;
 #endif
 
+#ifdef CONFIG_NETLINK_NETFILTER
+      case NETLINK_NETFILTER:
+        ret = netlink_netfilter_sendto(conn, nlmsg,
+                                       msg->msg_iov->iov_len, flags,
+                                       (FAR const struct sockaddr_nl *)to,
+                                       tolen);
+        break;
+#endif
+
       default:
        ret = -EOPNOTSUPP;
        break;