| Message ID | 20170415102604.29236-1-fw@strlen.de |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
Hi Florian, 2017-04-15 18:26 GMT+08:00 Florian Westphal <fw@strlen.de>: [...] > +#ifdef CONFIG_NF_CONNTRACK_EVENTS > + case NFT_CT_EVENTMASK: { > + struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct); > + u16 ctmask = nft_reg_load16(®s->data[priv->sreg]); Hmm, I find that in nft utility, this ctmask is defined as a 32 bit value. So using nft_reg_load16 maybe wrong. In order to avoid ambiguity, I think it's better to convert it to "u32 ctmask = regs->data[priv->sreg];". Referring to http://patchwork.ozlabs.org/patch/751013/: +static const struct datatype ct_event_type = { + .type = TYPE_CT_EVENTBIT, + .name = "ct_event", + .desc = "conntrack event bits", + .byteorder = BYTEORDER_HOST_ENDIAN, + .size = 4 * BITS_PER_BYTE, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > + > + if (e) { > + if (e->ctmask != ctmask) > + e->ctmask = ctmask; > + break; > + } > + > + if (ctmask && !nf_ct_is_confirmed(ct)) > + nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC); > + break; > + } -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Liping Zhang <zlpnobody@gmail.com> wrote: > 2017-04-15 18:26 GMT+08:00 Florian Westphal <fw@strlen.de>: > [...] > > +#ifdef CONFIG_NF_CONNTRACK_EVENTS > > + case NFT_CT_EVENTMASK: { > > + struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct); > > + u16 ctmask = nft_reg_load16(®s->data[priv->sreg]); > > Hmm, I find that in nft utility, this ctmask is defined as a 32 bit value. Right, it was deliberate to not have to extend it later on in case we get more event values in future. > So using nft_reg_load16 maybe wrong. In order to avoid ambiguity, > I think it's better to convert it to "u32 ctmask = regs->data[priv->sreg];". Agree, thats what I'll do, thanks Liping. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 8f3842690d17..683f6f88fcac 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -901,6 +901,7 @@ enum nft_rt_attributes { * @NFT_CT_BYTES: conntrack bytes * @NFT_CT_AVGPKT: conntrack average bytes per packet * @NFT_CT_ZONE: conntrack zone + * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack */ enum nft_ct_keys { NFT_CT_STATE, @@ -921,6 +922,7 @@ enum nft_ct_keys { NFT_CT_BYTES, NFT_CT_AVGPKT, NFT_CT_ZONE, + NFT_CT_EVENTMASK, }; /** diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 6c6fd48b024c..1d0a24b3b020 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -264,7 +264,7 @@ static void nft_ct_set_eval(const struct nft_expr *expr, struct nf_conn *ct; ct = nf_ct_get(skb, &ctinfo); - if (ct == NULL) + if (ct == NULL || nf_ct_is_template(ct)) return; switch (priv->key) { @@ -284,6 +284,22 @@ static void nft_ct_set_eval(const struct nft_expr *expr, NF_CT_LABELS_MAX_SIZE / sizeof(u32)); break; #endif +#ifdef CONFIG_NF_CONNTRACK_EVENTS + case NFT_CT_EVENTMASK: { + struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct); + u16 ctmask = nft_reg_load16(®s->data[priv->sreg]); + + if (e) { + if (e->ctmask != ctmask) + e->ctmask = ctmask; + break; + } + + if (ctmask && !nf_ct_is_confirmed(ct)) + nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC); + break; + } +#endif default: break; } @@ -539,6 +555,13 @@ static int nft_ct_set_init(const struct nft_ctx *ctx, len = sizeof(u16); break; #endif +#ifdef CONFIG_NF_CONNTRACK_EVENTS + case NFT_CT_EVENTMASK: + if (tb[NFTA_CT_DIRECTION]) + return -EINVAL; + len = sizeof(u32); + break; +#endif default: return -EOPNOTSUPP; }
By default the kernel emits all ctnetlink events for a connection. This allows to select the types of events to generate. This can be used to e.g. only send DESTROY events but no NEW/UPDATE ones and will work even if sysctl net.netfilter.nf_conntrack_events is set to 0. This was already possible via iptables' CT target, but the nft version has the advantage that it can also be used with already-established conntracks. The added nf_ct_is_template() check isn't a bug fix as we only support mark and labels (and unlike ecache the conntrack core doesn't copy those). Signed-off-by: Florian Westphal <fw@strlen.de> --- Changes since v1: - use nft_reg_load16() helper - add extension if its not there and ct isn't confirmed yet. include/uapi/linux/netfilter/nf_tables.h | 2 ++ net/netfilter/nft_ct.c | 25 ++++++++++++++++++++++++- 2 files changed, 26 insertions(+), 1 deletion(-) NFT_CT_EXPMASK is still missing, adding it should be very simple, its essentially copy&paste of this and the two ctevent userspace patches (nft/libnftnl).