- add warning note to ctnl_test.c: old API is deprecated

- split expect_api_test.c into small example files expect_*.c
- introduce alias tags for original tuple attributes
- introduce nfexp_sizeof and nfexp_maxsize
- build expectation attributes iif they are set
- fix l3num setting in expect/build.c

5 files changed, 191 insertions, 283 deletions

diff --git a/extensions/Makefile.am b/extensions/Makefile.am
index 5366ee3..db97c4d 100644
--- a/extensions/Makefile.am
+++ b/extensions/Makefile.am
@@ -4,7 +4,7 @@ AM_CFLAGS=-fPIC -Wall
 LIBS=
 
 pkglib_LTLIBRARIES = ct_proto_tcp.la ct_proto_udp.la		\
-		     ct_proto_icmp.la ct_proto_sctp.la
+		     ct_proto_icmp.la
 
 ct_proto_tcp_la_SOURCES = libct_proto_tcp.c
 ct_proto_tcp_la_LDFLAGS = -module -avoid-version
@@ -12,5 +12,3 @@ ct_proto_udp_la_SOURCES = libct_proto_udp.c
 ct_proto_udp_la_LDFLAGS = -module -avoid-version
 ct_proto_icmp_la_SOURCES = libct_proto_icmp.c
 ct_proto_icmp_la_LDFLAGS = -module -avoid-version
-ct_proto_sctp_la_SOURCES = libct_proto_sctp.c
-ct_proto_sctp_la_LDFLAGS = -module -avoid-version
diff --git a/extensions/libct_proto_icmp.c b/extensions/libct_proto_icmp.c
index e7cb04d..7b02dec 100644
--- a/extensions/libct_proto_icmp.c
+++ b/extensions/libct_proto_icmp.c
@@ -1,6 +1,6 @@
 /*
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
- *	       Harald Welte <laforge@netfilter.org>
+ * (C) 2005-2007 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *     2005 by Harald Welte <laforge@netfilter.org>
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
@@ -43,35 +43,42 @@ static u_int8_t invmap[]
 	    [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1};
 
 static int parse(char c, char *argv[], 
-		 struct nfct_tuple *orig,
-		 struct nfct_tuple *reply,
-		 struct nfct_tuple *exptuple,
-		 struct nfct_tuple *mask,
-		 union nfct_protoinfo *proto,
+		 struct nf_conntrack *ct,
+		 struct nf_conntrack *exptuple,
+		 struct nf_conntrack *mask,
 		 unsigned int *flags)
 {
 	switch(c) {
 		case '1':
-			if (optarg) {
-				orig->l4dst.icmp.type = atoi(optarg);
-				reply->l4dst.icmp.type =
-					invmap[orig->l4dst.icmp.type] - 1;
-				*flags |= ICMP_TYPE;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u8(ct, 
+					 ATTR_ICMP_TYPE,
+					 atoi(optarg));
+			/* FIXME: 
+			reply->l4dst.icmp.type =
+				invmap[orig->l4dst.icmp.type] - 1;
+			*/
+			*flags |= ICMP_TYPE;
 			break;
 		case '2':
-			if (optarg) {
-				orig->l4dst.icmp.code = atoi(optarg);
-				reply->l4dst.icmp.code = 0;
-				*flags |= ICMP_CODE;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u8(ct, 
+					 ATTR_ICMP_CODE,
+					 atoi(optarg));
+			*flags |= ICMP_CODE;
 			break;
 		case '3':
-			if (optarg) {
-				orig->l4src.icmp.id = htons(atoi(optarg));
-				reply->l4dst.icmp.id = 0;
-				*flags |= ICMP_ID;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct,
+					  ATTR_ICMP_ID,
+					  htons(atoi(optarg)));
+			*flags |= ICMP_ID;
 			break;
 	}
 	return 1;
@@ -79,8 +86,7 @@ static int parse(char c, char *argv[],
 
 static int final_check(unsigned int flags,
 		       unsigned int command,
-		       struct nfct_tuple *orig,
-		       struct nfct_tuple *reply)
+		       struct nf_conntrack *ct)
 {
 	if (!(flags & ICMP_TYPE))
 		return 0;
diff --git a/extensions/libct_proto_sctp.c b/extensions/libct_proto_sctp.c
deleted file mode 100644
index 1c8f0d1..0000000
--- a/extensions/libct_proto_sctp.c
+++ /dev/null
@@ -1,164 +0,0 @@
-/*
- * (C) 2005 by Harald Welte <laforge@netfilter.org>
- *     2006 by Pablo Neira Ayuso <pablo@netfilter.org>
- *
- *      This program is free software; you can redistribute it and/or modify
- *      it under the terms of the GNU General Public License as published by
- *      the Free Software Foundation; either version 2 of the License, or
- *      (at your option) any later version.
- *
- */
-#include <stdio.h>
-#include <getopt.h>
-#include <stdlib.h>
-#include <string.h>
-#include <netinet/in.h> /* For htons */
-#include "conntrack.h"
-#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
-#include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
-
-static struct option opts[] = {
-	{"orig-port-src", 1, 0, '1'},
-	{"orig-port-dst", 1, 0, '2'},
-	{"reply-port-src", 1, 0, '3'},
-	{"reply-port-dst", 1, 0, '4'},
-	{"state", 1, 0, '5'},
-	{"tuple-port-src", 1, 0, '6'},
-	{"tuple-port-dst", 1, 0, '7'},
-	{0, 0, 0, 0}
-};
-
-static const char *states[] = {
-	"NONE",
-	"CLOSED",
-	"COOKIE_WAIT",
-	"COOKIE_ECHOED",
-	"ESTABLISHED",
-	"SHUTDOWN_SENT",
-	"SHUTDOWN_RECV",
-	"SHUTDOWN_ACK_SENT",
-};
-
-static void help()
-{
-	fprintf(stdout, "--orig-port-src        original source port\n");
-	fprintf(stdout, "--orig-port-dst        original destination port\n");
-	fprintf(stdout, "--reply-port-src       reply source port\n");
-	fprintf(stdout, "--reply-port-dst       reply destination port\n");
-	fprintf(stdout, "--state                SCTP state, fe. ESTABLISHED\n");
-	fprintf(stdout, "--tuple-port-src	expectation tuple src port\n");
-	fprintf(stdout, "--tuple-port-src	expectation tuple dst port\n");
-}
-
-static int parse_options(char c, char *argv[], 
-			 struct nfct_tuple *orig,
-			 struct nfct_tuple *reply,
-			 struct nfct_tuple *exptuple,
-			 struct nfct_tuple *mask,
-			 union nfct_protoinfo *proto,
-			 unsigned int *flags)
-{
-	switch(c) {
-		case '1':
-			if (optarg) {
-				orig->l4src.sctp.port = htons(atoi(optarg));
-				*flags |= SCTP_ORIG_SPORT;
-			}
-			break;
-		case '2':
-			if (optarg) {
-				orig->l4dst.sctp.port = htons(atoi(optarg));
-				*flags |= SCTP_ORIG_DPORT;
-			}
-			break;
-		case '3':
-			if (optarg) {
-				reply->l4src.sctp.port = htons(atoi(optarg));
-				*flags |= SCTP_REPL_SPORT;
-			}
-			break;
-		case '4':
-			if (optarg) {
-				reply->l4dst.sctp.port = htons(atoi(optarg));
-				*flags |= SCTP_REPL_DPORT;
-			}
-			break;
-		case '5':
-			if (optarg) {
-				int i;
-				for (i=0; i<10; i++) {
-					if (strcmp(optarg, states[i]) == 0) {
-						/* FIXME: Add state to
-						 * nfct_protoinfo
-						proto->sctp.state = i; */
-						break;
-					}
-				}
-				if (i == 10) {
-					printf("doh?\n");
-					return 0;
-				}
-				*flags |= SCTP_STATE;
-			}
-			break;
-		case '6':
-			if (optarg) {
-				exptuple->l4src.sctp.port = htons(atoi(optarg));
-				*flags |= SCTP_EXPTUPLE_SPORT;
-			}
-			break;
-		case '7':
-			if (optarg) {
-				exptuple->l4dst.sctp.port = htons(atoi(optarg));
-				*flags |= SCTP_EXPTUPLE_DPORT;
-			}
-
-	}
-	return 1;
-}
-
-static int final_check(unsigned int flags,
-		       unsigned int command,
-		       struct nfct_tuple *orig,
-		       struct nfct_tuple *reply)
-{
-	int ret = 0;
-	
-	if ((flags & (SCTP_ORIG_SPORT|SCTP_ORIG_DPORT)) 
-	    && !(flags & (SCTP_REPL_SPORT|SCTP_REPL_DPORT))) {
-		reply->l4src.sctp.port = orig->l4dst.sctp.port;
-		reply->l4dst.sctp.port = orig->l4src.sctp.port;
-		ret = 1;
-	} else if (!(flags & (SCTP_ORIG_SPORT|SCTP_ORIG_DPORT))
-	            && (flags & (SCTP_REPL_SPORT|SCTP_REPL_DPORT))) {
-		orig->l4src.sctp.port = reply->l4dst.sctp.port;
-		orig->l4dst.sctp.port = reply->l4src.sctp.port;
-		ret = 1;
-	}
-	if ((flags & (SCTP_ORIG_SPORT|SCTP_ORIG_DPORT)) 
-	    && ((flags & (SCTP_REPL_SPORT|SCTP_REPL_DPORT))))
-		ret = 1;
-
-	/* --state is missing and we are trying to create a conntrack */
-	if (ret && (command & CT_CREATE) && (!(flags & SCTP_STATE)))
-		ret = 0;
-
-	return ret;
-}
-
-static struct ctproto_handler sctp = {
-	.name 			= "sctp",
-	.protonum		= IPPROTO_SCTP,
-	.parse_opts		= parse_options,
-	.final_check		= final_check,
-	.help			= help,
-	.opts			= opts,
-	.version		= VERSION,
-};
-
-static void __attribute__ ((constructor)) init(void);
-
-static void init(void)
-{
-	register_proto(&sctp);
-}
diff --git a/extensions/libct_proto_tcp.c b/extensions/libct_proto_tcp.c
index ee24206..736bcff 100644
--- a/extensions/libct_proto_tcp.c
+++ b/extensions/libct_proto_tcp.c
@@ -1,5 +1,5 @@
 /*
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
+ * (C) 2005-2007 by Pablo Neira Ayuso <pablo@netfilter.org>
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
@@ -56,78 +56,112 @@ static void help()
 	fprintf(stdout, "--state                TCP state, fe. ESTABLISHED\n");
 }
 
-static int parse_options(char c, char *argv[], 
-			 struct nfct_tuple *orig,
-			 struct nfct_tuple *reply,
-			 struct nfct_tuple *exptuple,
-			 struct nfct_tuple *mask,
-			 union nfct_protoinfo *proto,
+static int parse_options(char c, char *argv[],
+			 struct nf_conntrack *ct,
+			 struct nf_conntrack *exptuple,
+			 struct nf_conntrack *mask,
 			 unsigned int *flags)
 {
+	int i;
+
 	switch(c) {
 		case '1':
-			if (optarg) {
-				orig->l4src.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_ORIG_SPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_ORIG_PORT_SRC, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_ORIG_SPORT;
 			break;
 		case '2':
-			if (optarg) {
-				orig->l4dst.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_ORIG_DPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_ORIG_PORT_DST, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_ORIG_DPORT;
 			break;
 		case '3':
-			if (optarg) {
-				reply->l4src.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_REPL_SPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_REPL_PORT_SRC, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_REPL_SPORT;
 			break;
 		case '4':
-			if (optarg) {
-				reply->l4dst.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_REPL_DPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_REPL_PORT_DST, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_REPL_DPORT;
 			break;
 		case '5':
-			if (optarg) {
-				mask->l4src.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_MASK_SPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(mask, 
+					  ATTR_ORIG_PORT_SRC, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_MASK_SPORT;
 			break;
 		case '6':
-			if (optarg) {
-				mask->l4dst.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_MASK_DPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(mask, 
+					  ATTR_ORIG_PORT_DST, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_MASK_DPORT;
 			break;
 		case '7':
-			if (optarg) {
-				int i;
-				for (i=0; i<10; i++) {
-					if (strcmp(optarg, states[i]) == 0) {
-						proto->tcp.state = i;
-						break;
-					}
-				}
-				if (i == 10) {
-					printf("doh?\n");
-					return 0;
+			if (!optarg)
+				break;
+
+			for (i=0; i<10; i++) {
+				if (strcmp(optarg, states[i]) == 0) {
+					nfct_set_attr_u8(ct,
+							 ATTR_TCP_STATE,
+							 i);
+					break;
 				}
-				*flags |= TCP_STATE;
 			}
+			if (i == 10) {
+				printf("doh?\n");
+				return 0;
+			}
+			*flags |= TCP_STATE;
 			break;
 		case '8':
-			if (optarg) {
-				exptuple->l4src.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_EXPTUPLE_SPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(exptuple, 
+					  ATTR_ORIG_PORT_SRC, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_EXPTUPLE_SPORT;
 			break;
 		case '9':
-			if (optarg) {
-				exptuple->l4dst.tcp.port = htons(atoi(optarg));
-				*flags |= TCP_EXPTUPLE_DPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(exptuple, 
+					  ATTR_ORIG_PORT_DST, 
+					  htons(atoi(optarg)));
+
+			*flags |= TCP_EXPTUPLE_DPORT;
 			break;
 	}
 	return 1;
@@ -135,20 +169,27 @@ static int parse_options(char c, char *argv[],
 
 static int final_check(unsigned int flags,
 		       unsigned int command,
-		       struct nfct_tuple *orig,
-		       struct nfct_tuple *reply)
+		       struct nf_conntrack *ct)
 {
 	int ret = 0;
-	
+
 	if ((flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT)) 
 	    && !(flags & (TCP_REPL_SPORT|TCP_REPL_DPORT))) {
-		reply->l4src.tcp.port = orig->l4dst.tcp.port;
-		reply->l4dst.tcp.port = orig->l4src.tcp.port;
+	    	nfct_set_attr_u16(ct,
+				  ATTR_REPL_PORT_SRC, 
+				  nfct_get_attr_u16(ct, ATTR_ORIG_PORT_DST));
+		nfct_set_attr_u16(ct,
+				  ATTR_REPL_PORT_DST,
+				  nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC));
 		ret = 1;
 	} else if (!(flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT))
 	            && (flags & (TCP_REPL_SPORT|TCP_REPL_DPORT))) {
-		orig->l4src.tcp.port = reply->l4dst.tcp.port;
-		orig->l4dst.tcp.port = reply->l4src.tcp.port;
+	    	nfct_set_attr_u16(ct,
+				  ATTR_ORIG_PORT_SRC, 
+				  nfct_get_attr_u16(ct, ATTR_REPL_PORT_DST));
+		nfct_set_attr_u16(ct,
+				  ATTR_ORIG_PORT_DST,
+				  nfct_get_attr_u16(ct, ATTR_REPL_PORT_SRC));
 		ret = 1;
 	}
 	if ((flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT)) 
diff --git a/extensions/libct_proto_udp.c b/extensions/libct_proto_udp.c
index 48079e0..1bc70d4 100644
--- a/extensions/libct_proto_udp.c
+++ b/extensions/libct_proto_udp.c
@@ -1,5 +1,5 @@
 /*
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
+ * (C) 2005-2007 by Pablo Neira Ayuso <pablo@netfilter.org>
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
@@ -10,11 +10,13 @@
 #include <stdio.h>
 #include <getopt.h>
 #include <stdlib.h>
+#include <string.h>
 #include <netinet/in.h> /* For htons */
-#include "conntrack.h"
 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
 #include <libnetfilter_conntrack/libnetfilter_conntrack_udp.h>
 
+#include "conntrack.h"
+
 static struct option opts[] = {
 	{"orig-port-src", 1, 0, '1'},
 	{"orig-port-dst", 1, 0, '2'},
@@ -39,38 +41,54 @@ static void help()
 	fprintf(stdout, "--tuple-port-src	expectation tuple dst port\n");
 }
 
-static int parse_options(char c, char *argv[], 
-			 struct nfct_tuple *orig,
-			 struct nfct_tuple *reply,
+static int parse_options(char c, char *argv[],
+			 struct nf_conntrack *ct,
 			 struct nfct_tuple *exptuple,
 			 struct nfct_tuple *mask,
-			 union nfct_protoinfo *proto,
 			 unsigned int *flags)
 {
+	int i;
+
 	switch(c) {
 		case '1':
-			if (optarg) {
-				orig->l4src.udp.port = htons(atoi(optarg));
-				*flags |= UDP_ORIG_SPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_ORIG_PORT_SRC, 
+					  htons(atoi(optarg)));
+
+			*flags |= UDP_ORIG_SPORT;
 			break;
 		case '2':
-			if (optarg) {
-				orig->l4dst.udp.port = htons(atoi(optarg));
-				*flags |= UDP_ORIG_DPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_ORIG_PORT_DST, 
+					  htons(atoi(optarg)));
+
+			*flags |= UDP_ORIG_DPORT;
 			break;
 		case '3':
-			if (optarg) {
-				reply->l4src.udp.port = htons(atoi(optarg));
-				*flags |= UDP_REPL_SPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_REPL_PORT_SRC, 
+					  htons(atoi(optarg)));
+
+			*flags |= UDP_REPL_SPORT;
 			break;
 		case '4':
-			if (optarg) {
-				reply->l4dst.udp.port = htons(atoi(optarg));
-				*flags |= UDP_REPL_DPORT;
-			}
+			if (!optarg)
+				break;
+
+			nfct_set_attr_u16(ct, 
+					  ATTR_REPL_PORT_DST, 
+					  htons(atoi(optarg)));
+
+			*flags |= UDP_REPL_DPORT;
 			break;
 		case '5':
 			if (optarg) {
@@ -95,32 +113,41 @@ static int parse_options(char c, char *argv[],
 				exptuple->l4dst.udp.port = htons(atoi(optarg));
 				*flags |= UDP_EXPTUPLE_DPORT;
 			}
-
+			break;
 	}
 	return 1;
 }
 
 static int final_check(unsigned int flags,
 		       unsigned int command,
-		       struct nfct_tuple *orig,
-		       struct nfct_tuple *reply)
+		       struct nf_conntrack *ct)
 {
+	int ret = 0;
+	
 	if ((flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT)) 
 	    && !(flags & (UDP_REPL_SPORT|UDP_REPL_DPORT))) {
-		reply->l4src.udp.port = orig->l4dst.udp.port;
-		reply->l4dst.udp.port = orig->l4src.udp.port;
-		return 1;
+	    	nfct_set_attr_u16(ct,
+				  ATTR_REPL_PORT_SRC, 
+				  nfct_get_attr_u16(ct, ATTR_ORIG_PORT_DST));
+		nfct_set_attr_u16(ct,
+				  ATTR_REPL_PORT_DST,
+				  nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC));
+		ret = 1;
 	} else if (!(flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT))
 	            && (flags & (UDP_REPL_SPORT|UDP_REPL_DPORT))) {
-		orig->l4src.udp.port = reply->l4dst.udp.port;
-		orig->l4dst.udp.port = reply->l4src.udp.port;
-		return 1;
+	    	nfct_set_attr_u16(ct,
+				  ATTR_ORIG_PORT_SRC, 
+				  nfct_get_attr_u16(ct, ATTR_REPL_PORT_DST));
+		nfct_set_attr_u16(ct,
+				  ATTR_ORIG_PORT_DST,
+				  nfct_get_attr_u16(ct, ATTR_REPL_PORT_SRC));
+		ret = 1;
 	}
 	if ((flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT)) 
 	    && ((flags & (UDP_REPL_SPORT|UDP_REPL_DPORT))))
-		return 1;
+		ret = 1;
 
-	return 0;
+	return ret;
 }
 
 static struct ctproto_handler udp = {