All of lore.kernel.org
 help / color / mirror / Atom feed
From: Florian Westphal <fw@strlen.de>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: "Asbjørn Sloth Tønnesen" <ast@fiberby.dk>,
	netfilter-devel@vger.kernel.org, fw@strlen.de
Subject: Re: [PATCH conntrack 1/5] conntrack: support delete by label
Date: Mon, 1 Feb 2016 12:20:47 +0100	[thread overview]
Message-ID: <20160201112047.GB540@breakpoint.cc> (raw)
In-Reply-To: <20160201110222.GE8095@salvia>

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Mon, Jan 25, 2016 at 11:15:44AM +0000, Asbjørn Sloth Tønnesen wrote:
> > This option was already silently allowed by 991fc4ae,
> > but didn't have any effect.
> > 
> > This patch adds the check and documents it.
> 
> Applied, thanks.
> 
> > Cc: Clemence Faure <clemence.faure@sophos.com>
> > Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk>
> > ---
> > 
> > Notes:
> >     I tried to create a test case, as well but I didn't
> >     seam to be able to get --label-add to work with
> >     create.

It only works if a -m connlabel rule exists on the system at the moment.

https://patchwork.ozlabs.org/patch/553363/

extends it to nftables.

> Cc'ing Florian. I think it would be good to have a test for this label
> support for conntrack.

Right.  We could just add

nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);

When attempting to add a label via ctnetlink and label support
isn't active.

However, unlike the nft/xtables path this would be one-way:

When you have a ruleset that uses -m connlabel, then flush/delete the
ruleset the extension will not be added to new conntracks anymore
since ->destroy() hook invocation will _put the connlabel extension
usage count.

For ctnetlink there is no such thing unfortunately (unless we'd add
refcnts to the individual conntracks but thats something I don't want
to do since it seems ridiculously expensive with no real gain).
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

      reply	other threads:[~2016-02-01 11:20 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-25 11:15 [PATCH conntrack 1/5] conntrack: support delete by label Asbjørn Sloth Tønnesen
2016-01-25 11:15 ` [PATCH conntrack 2/5] conntrack: consolidate filtering Asbjørn Sloth Tønnesen
2016-02-01 11:02   ` Pablo Neira Ayuso
2016-01-25 11:15 ` [PATCH conntrack 3/5] conntrack: cleanup: use switch statements for family checks Asbjørn Sloth Tønnesen
2016-02-01 11:02   ` Pablo Neira Ayuso
2016-01-25 11:15 ` [PATCH conntrack 4/5 v2] conntrack: add support for netmask filtering Asbjørn Sloth Tønnesen
2016-02-01 11:04   ` Pablo Neira Ayuso
2016-02-01 12:17     ` Asbjørn Sloth Tønnesen
2016-02-01 17:56       ` Pablo Neira Ayuso
2016-02-02 15:55         ` Asbjørn Sloth Tønnesen
2016-02-02 16:34           ` Pablo Neira Ayuso
2016-02-16 18:18   ` Pablo Neira Ayuso
2016-01-25 11:15 ` [PATCH conntrack 5/5 v2] tests: conntrack: add netmask tests Asbjørn Sloth Tønnesen
2016-02-16 18:18   ` Pablo Neira Ayuso
2016-02-01 11:02 ` [PATCH conntrack 1/5] conntrack: support delete by label Pablo Neira Ayuso
2016-02-01 11:20   ` Florian Westphal [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160201112047.GB540@breakpoint.cc \
    --to=fw@strlen.de \
    --cc=ast@fiberby.dk \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.