* libnetfilter_conntrack: notification on established/finished connection?
@ 2010-04-21 23:15 Morgon J. Kanter
2010-04-22 7:35 ` Jan Engelhardt
2010-04-26 12:27 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Morgon J. Kanter @ 2010-04-21 23:15 UTC (permalink / raw)
To: netfilter
Hi,
Apologies if I'm on the incorrect list, but this isn't a patch for netfilter
so I believe this to be the appropriate one.
I'm in the process of writing an application that requires notification when a
new TCP connection to a specific destination is established, and finished /
timed out. I've never used libnetfilter_conntrack (or anything netfilter at
all, for that matter), so I've been investigating using libnetfilter_conntrack
for this purpose. My question is: is this possible to do with this library?
My question is so basic because I'm not really sure what nfct_catch() actually
fires on. I noticed the filter infrastructure -- to get such an application to
work, would I create a filter for TCP, and that destination, and then do
something like:
nfct_filter_attach(nfct_fd(conntrack_handle), filter);
nfct_callback_register(conntrack_handle, NFCT_T_NEW, new_connection_callback,
NULL);
nfct_callback_register(conntrack_handle, NFCT_T_DESTROY,
dead_connection_callback, NULL);
nfct_catch(conntrack_handle);
Is this the right track for what I want to do? My issue is I just don't really
understand exactly what nfct_catch does -- what is a conntrack event, exactly?
And what does it mean to steal one, as per the callback returning
NFCT_CB_STOLEN.
Thanks,
-- Morgon
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: libnetfilter_conntrack: notification on established/finished connection?
2010-04-21 23:15 libnetfilter_conntrack: notification on established/finished connection? Morgon J. Kanter
@ 2010-04-22 7:35 ` Jan Engelhardt
2010-04-26 12:27 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Jan Engelhardt @ 2010-04-22 7:35 UTC (permalink / raw)
To: Morgon J. Kanter; +Cc: netfilter
On Thursday 2010-04-22 01:15, Morgon J. Kanter wrote:
>
>I'm in the process of writing an application that requires
>notification when a new TCP connection to a specific destination is
>established, and finished / timed out. [...] I've been investigating
>using libnetfilter_conntrack for this purpose. My question is: is
>this possible to do with this library?
That seems to be the case, as `conntrack -E` builds upon it.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: libnetfilter_conntrack: notification on established/finished connection?
2010-04-21 23:15 libnetfilter_conntrack: notification on established/finished connection? Morgon J. Kanter
2010-04-22 7:35 ` Jan Engelhardt
@ 2010-04-26 12:27 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2010-04-26 12:27 UTC (permalink / raw)
To: Morgon J. Kanter; +Cc: netfilter
Morgon J. Kanter wrote:
> Hi,
>
> Apologies if I'm on the incorrect list, but this isn't a patch for netfilter
> so I believe this to be the appropriate one.
>
> I'm in the process of writing an application that requires notification when a
> new TCP connection to a specific destination is established, and finished /
> timed out. I've never used libnetfilter_conntrack (or anything netfilter at
> all, for that matter), so I've been investigating using libnetfilter_conntrack
> for this purpose. My question is: is this possible to do with this library?
Look at utils/conntrack_events.c, I think that example is more or less
what you need.
> My question is so basic because I'm not really sure what nfct_catch() actually
> fires on. I noticed the filter infrastructure -- to get such an application to
> work, would I create a filter for TCP, and that destination, and then do
> something like:
>
> nfct_filter_attach(nfct_fd(conntrack_handle), filter);
> nfct_callback_register(conntrack_handle, NFCT_T_NEW, new_connection_callback,
> NULL);
> nfct_callback_register(conntrack_handle, NFCT_T_DESTROY,
> dead_connection_callback, NULL);
> nfct_catch(conntrack_handle);
The filter infrastructure is there to attach filters in kernel-space.
> Is this the right track for what I want to do? My issue is I just don't really
> understand exactly what nfct_catch does -- what is a conntrack event, exactly?
> And what does it mean to steal one, as per the callback returning
> NFCT_CB_STOLEN.
nfct_catch() receives conntrack events from kernel-space, by default it
blocks waiting for events. NFCT_CB_STOLEN means that the conntrack
object is not released after the callback.
Good luck with it.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-04-26 12:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-04-21 23:15 libnetfilter_conntrack: notification on established/finished connection? Morgon J. Kanter
2010-04-22 7:35 ` Jan Engelhardt
2010-04-26 12:27 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.