libnetfilter_conntrack: notification on established/finished connection?

libnetfilter_conntrack: notification on established/finished connection?

[Morgon J. Kanter]

Hi,

Apologies if I'm on the incorrect list, but this isn't a patch for netfilter 
so I believe this to be the appropriate one.

I'm in the process of writing an application that requires notification when a 
new TCP connection to a specific destination is established, and finished / 
timed out. I've never used libnetfilter_conntrack (or anything netfilter at 
all, for that matter), so I've been investigating using libnetfilter_conntrack 
for this purpose. My question is: is this possible to do with this library?

My question is so basic because I'm not really sure what nfct_catch() actually 
fires on. I noticed the filter infrastructure -- to get such an application to 
work, would I create a filter for TCP, and that destination, and then do 
something like:

nfct_filter_attach(nfct_fd(conntrack_handle), filter);
nfct_callback_register(conntrack_handle, NFCT_T_NEW, new_connection_callback, 
NULL);
nfct_callback_register(conntrack_handle, NFCT_T_DESTROY, 
dead_connection_callback, NULL);
nfct_catch(conntrack_handle);

Is this the right track for what I want to do? My issue is I just don't really 
understand exactly what nfct_catch does -- what is a conntrack event, exactly? 
And what does it mean to steal one, as per the callback returning 
NFCT_CB_STOLEN.

Thanks,
-- Morgon

Re: libnetfilter_conntrack: notification on established/finished connection?

[Jan Engelhardt]

On Thursday 2010-04-22 01:15, Morgon J. Kanter wrote:
>
>I'm in the process of writing an application that requires
>notification when a new TCP connection to a specific destination is
>established, and finished / timed out. [...] I've been investigating
>using libnetfilter_conntrack for this purpose. My question is: is
>this possible to do with this library?

That seems to be the case, as `conntrack -E` builds upon it.

Re: libnetfilter_conntrack: notification on established/finished connection?

[Pablo Neira Ayuso]

Morgon J. Kanter wrote:
> Hi,
> 
> Apologies if I'm on the incorrect list, but this isn't a patch for netfilter 
> so I believe this to be the appropriate one.
> 
> I'm in the process of writing an application that requires notification when a 
> new TCP connection to a specific destination is established, and finished / 
> timed out. I've never used libnetfilter_conntrack (or anything netfilter at 
> all, for that matter), so I've been investigating using libnetfilter_conntrack 
> for this purpose. My question is: is this possible to do with this library?

Look at utils/conntrack_events.c, I think that example is more or less
what you need.

> My question is so basic because I'm not really sure what nfct_catch() actually 
> fires on. I noticed the filter infrastructure -- to get such an application to 
> work, would I create a filter for TCP, and that destination, and then do 
> something like:
> 
> nfct_filter_attach(nfct_fd(conntrack_handle), filter);
> nfct_callback_register(conntrack_handle, NFCT_T_NEW, new_connection_callback, 
> NULL);
> nfct_callback_register(conntrack_handle, NFCT_T_DESTROY, 
> dead_connection_callback, NULL);
> nfct_catch(conntrack_handle);

The filter infrastructure is there to attach filters in kernel-space.

> Is this the right track for what I want to do? My issue is I just don't really 
> understand exactly what nfct_catch does -- what is a conntrack event, exactly? 
> And what does it mean to steal one, as per the callback returning 
> NFCT_CB_STOLEN.

nfct_catch() receives conntrack events from kernel-space, by default it
blocks waiting for events. NFCT_CB_STOLEN means that the conntrack
object is not released after the callback.

Good luck with it.