* [PATCH v2 nf-next] netfilter: nft_ct: allow to set ctnetlink event types of a connection
@ 2017-04-15 10:26 Florian Westphal
2017-04-15 13:21 ` Liping Zhang
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2017-04-15 10:26 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
By default the kernel emits all ctnetlink events for a connection.
This allows to select the types of events to generate.
This can be used to e.g. only send DESTROY events but no NEW/UPDATE ones
and will work even if sysctl net.netfilter.nf_conntrack_events is set to 0.
This was already possible via iptables' CT target, but the nft version has
the advantage that it can also be used with already-established conntracks.
The added nf_ct_is_template() check isn't a bug fix as we only support
mark and labels (and unlike ecache the conntrack core doesn't copy those).
Signed-off-by: Florian Westphal <fw@strlen.de>
---
Changes since v1:
- use nft_reg_load16() helper
- add extension if its not there and ct isn't confirmed yet.
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_ct.c | 25 ++++++++++++++++++++++++-
2 files changed, 26 insertions(+), 1 deletion(-)
NFT_CT_EXPMASK is still missing, adding it should be very simple, its
essentially copy&paste of this and the two ctevent userspace patches
(nft/libnftnl).
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 8f3842690d17..683f6f88fcac 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -901,6 +901,7 @@ enum nft_rt_attributes {
* @NFT_CT_BYTES: conntrack bytes
* @NFT_CT_AVGPKT: conntrack average bytes per packet
* @NFT_CT_ZONE: conntrack zone
+ * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
*/
enum nft_ct_keys {
NFT_CT_STATE,
@@ -921,6 +922,7 @@ enum nft_ct_keys {
NFT_CT_BYTES,
NFT_CT_AVGPKT,
NFT_CT_ZONE,
+ NFT_CT_EVENTMASK,
};
/**
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 6c6fd48b024c..1d0a24b3b020 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -264,7 +264,7 @@ static void nft_ct_set_eval(const struct nft_expr *expr,
struct nf_conn *ct;
ct = nf_ct_get(skb, &ctinfo);
- if (ct == NULL)
+ if (ct == NULL || nf_ct_is_template(ct))
return;
switch (priv->key) {
@@ -284,6 +284,22 @@ static void nft_ct_set_eval(const struct nft_expr *expr,
NF_CT_LABELS_MAX_SIZE / sizeof(u32));
break;
#endif
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+ case NFT_CT_EVENTMASK: {
+ struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
+ u16 ctmask = nft_reg_load16(®s->data[priv->sreg]);
+
+ if (e) {
+ if (e->ctmask != ctmask)
+ e->ctmask = ctmask;
+ break;
+ }
+
+ if (ctmask && !nf_ct_is_confirmed(ct))
+ nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
+ break;
+ }
+#endif
default:
break;
}
@@ -539,6 +555,13 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
len = sizeof(u16);
break;
#endif
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+ case NFT_CT_EVENTMASK:
+ if (tb[NFTA_CT_DIRECTION])
+ return -EINVAL;
+ len = sizeof(u32);
+ break;
+#endif
default:
return -EOPNOTSUPP;
}
--
2.10.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2 nf-next] netfilter: nft_ct: allow to set ctnetlink event types of a connection
2017-04-15 10:26 [PATCH v2 nf-next] netfilter: nft_ct: allow to set ctnetlink event types of a connection Florian Westphal
@ 2017-04-15 13:21 ` Liping Zhang
2017-04-15 16:53 ` Florian Westphal
0 siblings, 1 reply; 3+ messages in thread
From: Liping Zhang @ 2017-04-15 13:21 UTC (permalink / raw)
To: Florian Westphal; +Cc: Netfilter Developer Mailing List
Hi Florian,
2017-04-15 18:26 GMT+08:00 Florian Westphal <fw@strlen.de>:
[...]
> +#ifdef CONFIG_NF_CONNTRACK_EVENTS
> + case NFT_CT_EVENTMASK: {
> + struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
> + u16 ctmask = nft_reg_load16(®s->data[priv->sreg]);
Hmm, I find that in nft utility, this ctmask is defined as a 32 bit value.
So using nft_reg_load16 maybe wrong. In order to avoid ambiguity,
I think it's better to convert it to "u32 ctmask = regs->data[priv->sreg];".
Referring to http://patchwork.ozlabs.org/patch/751013/:
+static const struct datatype ct_event_type = {
+ .type = TYPE_CT_EVENTBIT,
+ .name = "ct_event",
+ .desc = "conntrack event bits",
+ .byteorder = BYTEORDER_HOST_ENDIAN,
+ .size = 4 * BITS_PER_BYTE,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> +
> + if (e) {
> + if (e->ctmask != ctmask)
> + e->ctmask = ctmask;
> + break;
> + }
> +
> + if (ctmask && !nf_ct_is_confirmed(ct))
> + nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
> + break;
> + }
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2 nf-next] netfilter: nft_ct: allow to set ctnetlink event types of a connection
2017-04-15 13:21 ` Liping Zhang
@ 2017-04-15 16:53 ` Florian Westphal
0 siblings, 0 replies; 3+ messages in thread
From: Florian Westphal @ 2017-04-15 16:53 UTC (permalink / raw)
To: Liping Zhang; +Cc: Florian Westphal, Netfilter Developer Mailing List
Liping Zhang <zlpnobody@gmail.com> wrote:
> 2017-04-15 18:26 GMT+08:00 Florian Westphal <fw@strlen.de>:
> [...]
> > +#ifdef CONFIG_NF_CONNTRACK_EVENTS
> > + case NFT_CT_EVENTMASK: {
> > + struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
> > + u16 ctmask = nft_reg_load16(®s->data[priv->sreg]);
>
> Hmm, I find that in nft utility, this ctmask is defined as a 32 bit value.
Right, it was deliberate to not have to extend it later on in case we
get more event values in future.
> So using nft_reg_load16 maybe wrong. In order to avoid ambiguity,
> I think it's better to convert it to "u32 ctmask = regs->data[priv->sreg];".
Agree, thats what I'll do, thanks Liping.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-04-15 16:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-15 10:26 [PATCH v2 nf-next] netfilter: nft_ct: allow to set ctnetlink event types of a connection Florian Westphal
2017-04-15 13:21 ` Liping Zhang
2017-04-15 16:53 ` Florian Westphal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.