mbox series

[nf-next,0/2] netfilter: nf_tables: include conntrack state in trace messages

Message ID 20250508150855.6902-1-fw@strlen.de
Headers show
Series netfilter: nf_tables: include conntrack state in trace messages | expand

Message

Florian Westphal May 8, 2025, 3:08 p.m. UTC 
Add the minimal relevant info needed for userspace ("nftables monitor
trace") to provide the conntrack view of the packet:

- state (new, related, established)
- direction (original, reply)
- status (e.g., if connection is subject to dnat)
- id (allows to query ctnetlink for remaining conntrack state info)

Example:
trace id a62 inet filter PRE_RAW packet: iif "enp0s3" ether [..]
  [..]
trace id a62 inet filter PRE_MANGLE conntrack: ct direction original ct state new ct id 32
trace id a62 inet filter PRE_MANGLE packet: [..]
 [..]
trace id a62 inet filter IN conntrack: ct direction original ct state new ct status dnat-done ct id 32
 [..]

First patch is a needed prerequisite to avoid a module dependency.
Second patch adds the needed info.

Patches for libnftnl and nftables will follow shortly.