@@ -4,7 +4,9 @@
#include <linux/types.h>
#include <linux/in6.h>
+#include <linux/bits.h>
#include <uapi/linux/if_ether.h>
+#include <uapi/linux/netfilter/xt_connlabel.h>
/**
* struct flow_dissector_key_control:
@@ -199,6 +201,19 @@ struct flow_dissector_key_ip {
__u8 ttl;
};
+/**
+ * struct flow_dissector_key_ct:
+ */
+struct flow_dissector_key_ct {
+ __u16 zone;
+ __u8 state;
+ __u32 mark;
+ /* FIXME: Use nf_conn_labels instead? But it pulls all netfilter */
+#define NF_CT_LABELS_MAX_SIZE ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)
+ unsigned long label[NF_CT_LABELS_MAX_SIZE / sizeof(long)];
+#undef NF_CT_LABELS_MAX_SIZE
+};
+
enum flow_dissector_key_id {
FLOW_DISSECTOR_KEY_CONTROL, /* struct flow_dissector_key_control */
FLOW_DISSECTOR_KEY_BASIC, /* struct flow_dissector_key_basic */
@@ -224,6 +239,7 @@ enum flow_dissector_key_id {
FLOW_DISSECTOR_KEY_CVLAN, /* struct flow_dissector_key_flow_vlan */
FLOW_DISSECTOR_KEY_ENC_IP, /* struct flow_dissector_key_ip */
FLOW_DISSECTOR_KEY_ENC_OPTS, /* struct flow_dissector_key_enc_opts */
+ FLOW_DISSECTOR_KEY_CT, /* struct flow_dissector_key_ct */
FLOW_DISSECTOR_KEY_MAX,
};
@@ -254,6 +270,7 @@ struct flow_keys {
#define FLOW_KEYS_HASH_START_FIELD basic
struct flow_dissector_key_basic basic;
struct flow_dissector_key_tags tags;
+ struct flow_dissector_key_ct ct;
struct flow_dissector_key_vlan vlan;
struct flow_dissector_key_vlan cvlan;
struct flow_dissector_key_keyid keyid;
@@ -1,4 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _NF_CONNTRACK_CONNLABEL_H
+#define _NF_CONNTRACK_CONNLABEL_H
+
#include <linux/types.h>
#define XT_CONNLABEL_MAXBIT 127
@@ -11,3 +14,5 @@ struct xt_connlabel_mtinfo {
__u16 bit;
__u16 options;
};
+
+#endif
@@ -26,6 +26,8 @@
#include <scsi/fc/fc_fcoe.h>
#include <uapi/linux/batadv_packet.h>
#include <linux/bpf.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_labels.h>
static DEFINE_MUTEX(flow_dissector_mutex);
@@ -798,6 +800,29 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
}
rcu_read_unlock();
+ if (dissector_uses_key(flow_dissector,
+ FLOW_DISSECTOR_KEY_CT)) {
+ struct flow_dissector_key_ct *key_ct;
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn_labels *labels;
+ struct nf_conn *ct;
+
+ ct = nf_ct_get(skb, &ctinfo);
+ if (ct) {
+ key_ct = skb_flow_dissector_target(flow_dissector,
+ FLOW_DISSECTOR_KEY_CT,
+ target_container);
+ key_ct->zone = ct->zone.id;
+ key_ct->state = ctinfo;
+ key_ct->mark = ct->mark;
+ labels = nf_ct_labels_find(ct);
+ /* FIXME: should this be a new key then? */
+ if (labels)
+ memcpy(key_ct->label, labels->bits,
+ sizeof(key_ct->label));
+ }
+ }
+
if (dissector_uses_key(flow_dissector,
FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
struct ethhdr *eth = eth_hdr(skb);
This a preliminary patch to add support on flow dissector for matching on ConnTrack information. 2 FIXMEs in place: - reusing nf_conn_labels may not be feasible, as we don't want to pull too much of ConnTrack into flow dissector. - CT may be there, but it may not be using labels. As hashing zeroes is different than not having the information, it should either be handled as a new dissector key or have an extra bit in flow_dissector_key_ct indicating its presence. Having it as an extra key may speed searches not using labels. Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com> --- include/net/flow_dissector.h | 17 ++++++++++++++ include/uapi/linux/netfilter/xt_connlabel.h | 5 +++++ net/core/flow_dissector.c | 25 +++++++++++++++++++++ 3 files changed, 47 insertions(+)