c - 如何使用 libnetfilter_conntrack 查询 conntrack？

Question

这是一个conntrack，我可以从“cat/proc/net/nf_conntrack”得到它:

root@raspberrypi:~# cat /proc/net/nf_conntrack|grep 192.168.6.18|grep 33 |grep 192.168.6.231

ipv4     2 tcp      6 426361 ESTABLISHED src=192.168.6.231 dst=192.168.6.18 sport=60299 dport=33 src=192.168.6.10 dst=192.168.6.231 sport=22 dport=60299 [ASSURED] mark=0 zone=0 use=2

问题: 我想通过使用 libnetfilter_conntrack 获得这个特别的 conntrack ，但是当我尝试这样做时我没有得到任何东西，在这里下面是我的代码:

#include <stdio.h>
#include <stdlib.h>    
#include <string.h>    
#include <errno.h>    
#include <unistd.h>    
#include <arpa/inet.h>         

#include <libnetfilter_conntrack/libnetfilter_conntrack.h>    
#include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>         

int cb(enum nf_conntrack_msg_type type,struct nf_conntrack *ct,void *data)    
{          
        char buf[1024];               

        nfct_snprintf(buf, sizeof(buf), ct, NFCT_T_UNKNOWN, NFCT_O_DEFAULT, NFCT_OF_SHOW_LAYER3);    
        printf("%s\n", buf);

        return NFCT_CB_CONTINUE;    
}         

int get()    
{    
        int ret;    
        struct nfct_handle *h;    
        struct nf_conntrack *ct;    

        ct = nfct_new();

        if (!ct) {    
                perror("nfct_new");    
                return 0;    
        }    

        nfct_set_attr_u8(ct, ATTR_REPL_L3PROTO, AF_INET);    
        nfct_set_attr_u32(ct, ATTR_REPL_IPV4_SRC, inet_addr("192.168.6.10"));    
        nfct_set_attr_u32(ct, ATTR_REPL_IPV4_DST, inet_addr("192.168.6.231"));             
        nfct_set_attr_u8(ct, ATTR_REPL_L4PROTO, IPPROTO_TCP);    
        nfct_set_attr_u16(ct, ATTR_REPL_PORT_SRC, htons(22));    
        nfct_set_attr_u16(ct, ATTR_REPL_PORT_DST, htons(60299));         

        h = nfct_open(CONNTRACK, 0);    
        if (!h) {    
                perror("nfct_open");    
                nfct_destroy(ct);    
                return -1;    
        }         

        nfct_callback_register(h, NFCT_T_ALL, cb, NULL);             
        ret = nfct_query(h, NFCT_Q_GET, ct);

        if (ret == -1)    
                printf("(%d)(%s)\n", ret, strerror(errno));    
        else    
                printf("(OK)\n");

        nfct_close(h);
        nfct_destroy(ct);

        return -1;
}

int main()
{    
    get();
    return 1;
}

代码有问题吗？

非常感谢大家帮助我

Answer 1

尝试使用 NFCT_Q_DUMP 而不是 NFCT_Q_GET。

--- orig.c  2017-06-12 21:11:09.724364635 +0900
+++ dest.c  2017-06-12 21:11:37.568363970 +0900
@@ -15,7 +15,11 @@
 int cb(enum nf_conntrack_msg_type type,struct nf_conntrack *ct,void *data)    
 {          
    char buf[1024];               
+   struct nf_conntrack *obj = data;

+   if (!nfct_cmp(obj, ct, NFCT_CMP_ALL | NFCT_CMP_MASK))
+       return NFCT_CB_CONTINUE;
+
    nfct_snprintf(buf, sizeof(buf), ct, NFCT_T_UNKNOWN, NFCT_O_DEFAULT, NFCT_OF_SHOW_LAYER3);    
    printf("%s\n", buf);

@@ -27,6 +31,7 @@ int get()
    int ret;    
    struct nfct_handle *h;    
    struct nf_conntrack *ct;    
+   int family = AF_INET;

    ct = nfct_new();

@@ -49,8 +54,8 @@ int get()
        return -1;    
    }         

-   nfct_callback_register(h, NFCT_T_ALL, cb, NULL);             
-   ret = nfct_query(h, NFCT_Q_GET, ct);
+   nfct_callback_register(h, NFCT_T_ALL, cb, ct);             
+   ret = nfct_query(h, NFCT_Q_DUMP, &family);

    if (ret == -1)    
        printf("(%d)(%s)\n", ret, strerror(errno));