Skip to content

Commit 7b621c1

Browse files
ummakynesDavid S. Miller
ummakynes
authored and
David S. Miller
committed
[NETFILTER]: ctnetlink: rework conntrack fields dumping logic on events
 | NEW | UPDATE | DESTROY | ----------------------------------------| tuples | Y | Y | Y | status | Y | Y | N | timeout | Y | Y | N | protoinfo | S | S | N | helper | S | S | N | mark | S | S | N | counters | F | F | Y | Leyend: Y: yes N: no S: iif the field is set F: iif overflow This patch also replace IPCT_HELPINFO by IPCT_HELPER since we want to track the helper assignation process, not the changes in the private information held by the helper. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
1 parent bbb3357 commit 7b621c1

File tree

2 files changed

+54
-44
lines changed

2 files changed

+54
-44
lines changed

‎net/ipv4/netfilter/ip_conntrack_netlink.c‎

Lines changed: 27 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -320,8 +320,6 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
320320
} else if (events & (IPCT_NEW | IPCT_RELATED)) {
321321
type = IPCTNL_MSG_CT_NEW;
322322
flags = NLM_F_CREATE|NLM_F_EXCL;
323-
/* dump everything */
324-
events = ~0UL;
325323
group = NFNLGRP_CONNTRACK_NEW;
326324
} else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
327325
type = IPCTNL_MSG_CT_NEW;
@@ -356,28 +354,35 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
356354
if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
357355
goto nfattr_failure;
358356
NFA_NEST_END(skb, nest_parms);
359-
360-
/* NAT stuff is now a status flag */
361-
if ((events & IPCT_STATUS || events & IPCT_NATINFO)
362-
&& ctnetlink_dump_status(skb, ct) < 0)
363-
goto nfattr_failure;
364-
if (events & IPCT_REFRESH
365-
&& ctnetlink_dump_timeout(skb, ct) < 0)
366-
goto nfattr_failure;
367-
if (events & IPCT_PROTOINFO
368-
&& ctnetlink_dump_protoinfo(skb, ct) < 0)
369-
goto nfattr_failure;
370-
if (events & IPCT_HELPINFO
371-
&& ctnetlink_dump_helpinfo(skb, ct) < 0)
372-
goto nfattr_failure;
373357

374-
if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
375-
ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
376-
goto nfattr_failure;
358+
if (events & IPCT_DESTROY) {
359+
if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
360+
ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
361+
goto nfattr_failure;
362+
} else {
363+
if (ctnetlink_dump_status(skb, ct) < 0)
364+
goto nfattr_failure;
377365

378-
if (events & IPCT_MARK
379-
&& ctnetlink_dump_mark(skb, ct) < 0)
380-
goto nfattr_failure;
366+
if (ctnetlink_dump_timeout(skb, ct) < 0)
367+
goto nfattr_failure;
368+
369+
if (events & IPCT_PROTOINFO
370+
&& ctnetlink_dump_protoinfo(skb, ct) < 0)
371+
goto nfattr_failure;
372+
373+
if ((events & IPCT_HELPER || ct->helper)
374+
&& ctnetlink_dump_helpinfo(skb, ct) < 0)
375+
goto nfattr_failure;
376+
377+
if ((events & IPCT_MARK || ct->mark)
378+
&& ctnetlink_dump_mark(skb, ct) < 0)
379+
goto nfattr_failure;
380+
381+
if (events & IPCT_COUNTER_FILLING &&
382+
(ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
383+
ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
384+
goto nfattr_failure;
385+
}
381386

382387
nlh->nlmsg_len = skb->tail - b;
383388
nfnetlink_send(skb, 0, group, 0);

‎net/netfilter/nf_conntrack_netlink.c‎

Lines changed: 27 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -331,8 +331,6 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
331331
} else if (events & (IPCT_NEW | IPCT_RELATED)) {
332332
type = IPCTNL_MSG_CT_NEW;
333333
flags = NLM_F_CREATE|NLM_F_EXCL;
334-
/* dump everything */
335-
events = ~0UL;
336334
group = NFNLGRP_CONNTRACK_NEW;
337335
} else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
338336
type = IPCTNL_MSG_CT_NEW;
@@ -367,28 +365,35 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
367365
if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
368366
goto nfattr_failure;
369367
NFA_NEST_END(skb, nest_parms);
370-
371-
/* NAT stuff is now a status flag */
372-
if ((events & IPCT_STATUS || events & IPCT_NATINFO)
373-
&& ctnetlink_dump_status(skb, ct) < 0)
374-
goto nfattr_failure;
375-
if (events & IPCT_REFRESH
376-
&& ctnetlink_dump_timeout(skb, ct) < 0)
377-
goto nfattr_failure;
378-
if (events & IPCT_PROTOINFO
379-
&& ctnetlink_dump_protoinfo(skb, ct) < 0)
380-
goto nfattr_failure;
381-
if (events & IPCT_HELPINFO
382-
&& ctnetlink_dump_helpinfo(skb, ct) < 0)
383-
goto nfattr_failure;
384368

385-
if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
386-
ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
387-
goto nfattr_failure;
369+
if (events & IPCT_DESTROY) {
370+
if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
371+
ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
372+
goto nfattr_failure;
373+
} else {
374+
if (ctnetlink_dump_status(skb, ct) < 0)
375+
goto nfattr_failure;
388376

389-
if (events & IPCT_MARK
390-
&& ctnetlink_dump_mark(skb, ct) < 0)
391-
goto nfattr_failure;
377+
if (ctnetlink_dump_timeout(skb, ct) < 0)
378+
goto nfattr_failure;
379+
380+
if (events & IPCT_PROTOINFO
381+
&& ctnetlink_dump_protoinfo(skb, ct) < 0)
382+
goto nfattr_failure;
383+
384+
if ((events & IPCT_HELPER || nfct_help(ct))
385+
&& ctnetlink_dump_helpinfo(skb, ct) < 0)
386+
goto nfattr_failure;
387+
388+
if ((events & IPCT_MARK || ct->mark)
389+
&& ctnetlink_dump_mark(skb, ct) < 0)
390+
goto nfattr_failure;
391+
392+
if (events & IPCT_COUNTER_FILLING &&
393+
(ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
394+
ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
395+
goto nfattr_failure;
396+
}
392397

393398
nlh->nlmsg_len = skb->tail - b;
394399
nfnetlink_send(skb, 0, group, 0);

0 commit comments

Comments
 (0)