ct: add conntrack event mask support

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/doc/nft.xml b/doc/nft.xml
index 57cf5cf113524d79fd330f4eb1e703b3de6ec2e0..4d0e89cd2054ca8067d2247611d3ad8c6185b1e1 100644 (file)
--- a/doc/nft.xml
+++ b/doc/nft.xml
@@ -3864,6 +3864,7 @@ ip6 filter output log flags all
                                        <command>ct</command>
                                        <group choice="req">
                                                <arg>mark</arg>
+                                               <arg>eventmask</arg>
                                                <arg>label</arg>
                                                <arg>zone</arg>
                                        </group>
@@ -3893,6 +3894,12 @@ ip6 filter output log flags all
                                                        </row>
                                                </thead>
                                                <tbody>
+                                                       <row>
+                                                               <entry>eventmask</entry>
+                                                               <entry>conntrack event bits</entry>
+                                                               <entry>bitmask, integer (32 bit)</entry>
+                                                       </row>
+
                                                        <row>
                                                                <entry>helper</entry>
                                                                <entry>name of ct helper object to assign to the connection</entry>
@@ -3940,6 +3947,14 @@ table inet raw {
 }
                                </programlisting>
                        </example>
+                       <example>
+                                       <title>restrict events reported by ctnetlink</title>
+                               <programlisting>
+ct eventmask set new or related or destroy
+                               </programlisting>
+                       </example>
+
+
                        </para>
                </refsect2>
                <refsect2>

diff --git a/include/datatype.h b/include/datatype.h
index e614b96e880bfa712ccb47e97026ad3e1d2a2d44..04b7d8808cea72dfec4314544fd0154cf4cba539 100644 (file)
--- a/include/datatype.h
+++ b/include/datatype.h
@@ -83,6 +83,7 @@ enum datatypes {
        TYPE_ECN,
        TYPE_FIB_ADDR,
        TYPE_BOOLEAN,
+       TYPE_CT_EVENTBIT,
        __TYPE_MAX
 };
 #define TYPE_MAX               (__TYPE_MAX - 1)

diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index 27a1895218db70c7decdd0d9c75b982b0fc27d62..768ff251308b110aa84c25089c1f58f76b180aba 100644 (file)
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -79,73 +79,25 @@ enum ip_conntrack_status {
        IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
 };
 
-/* Connection tracking event bits */
-enum ip_conntrack_events
-{
-       /* New conntrack */
-       IPCT_NEW_BIT = 0,
-       IPCT_NEW = (1 << IPCT_NEW_BIT),
-
-       /* Expected connection */
-       IPCT_RELATED_BIT = 1,
-       IPCT_RELATED = (1 << IPCT_RELATED_BIT),
-
-       /* Destroyed conntrack */
-       IPCT_DESTROY_BIT = 2,
-       IPCT_DESTROY = (1 << IPCT_DESTROY_BIT),
-
-       /* Timer has been refreshed */
-       IPCT_REFRESH_BIT = 3,
-       IPCT_REFRESH = (1 << IPCT_REFRESH_BIT),
-
-       /* Status has changed */
-       IPCT_STATUS_BIT = 4,
-       IPCT_STATUS = (1 << IPCT_STATUS_BIT),
-
-       /* Update of protocol info */
-       IPCT_PROTOINFO_BIT = 5,
-       IPCT_PROTOINFO = (1 << IPCT_PROTOINFO_BIT),
-
-       /* Volatile protocol info */
-       IPCT_PROTOINFO_VOLATILE_BIT = 6,
-       IPCT_PROTOINFO_VOLATILE = (1 << IPCT_PROTOINFO_VOLATILE_BIT),
-
-       /* New helper for conntrack */
-       IPCT_HELPER_BIT = 7,
-       IPCT_HELPER = (1 << IPCT_HELPER_BIT),
-
-       /* Update of helper info */
-       IPCT_HELPINFO_BIT = 8,
-       IPCT_HELPINFO = (1 << IPCT_HELPINFO_BIT),
-
-       /* Volatile helper info */
-       IPCT_HELPINFO_VOLATILE_BIT = 9,
-       IPCT_HELPINFO_VOLATILE = (1 << IPCT_HELPINFO_VOLATILE_BIT),
-
-       /* NAT info */
-       IPCT_NATINFO_BIT = 10,
-       IPCT_NATINFO = (1 << IPCT_NATINFO_BIT),
-
-       /* Counter highest bit has been set, unused */
-       IPCT_COUNTER_FILLING_BIT = 11,
-       IPCT_COUNTER_FILLING = (1 << IPCT_COUNTER_FILLING_BIT),
-
-       /* Mark is set */
-       IPCT_MARK_BIT = 12,
-       IPCT_MARK = (1 << IPCT_MARK_BIT),
-
-       /* NAT sequence adjustment */
-       IPCT_NATSEQADJ_BIT = 13,
-       IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),
-
-       /* Secmark is set */
-       IPCT_SECMARK_BIT = 14,
-       IPCT_SECMARK = (1 << IPCT_SECMARK_BIT),
+/* Connection tracking event types */
+enum ip_conntrack_events {
+       IPCT_NEW,               /* new conntrack */
+       IPCT_RELATED,           /* related conntrack */
+       IPCT_DESTROY,           /* destroyed conntrack */
+       IPCT_REPLY,             /* connection has seen two-way traffic */
+       IPCT_ASSURED,           /* connection status has changed to assured */
+       IPCT_PROTOINFO,         /* protocol information has changed */
+       IPCT_HELPER,            /* new helper has been set */
+       IPCT_MARK,              /* new mark has been set */
+       IPCT_SEQADJ,            /* sequence adjustment has changed */
+       IPCT_NATSEQADJ = IPCT_SEQADJ,
+       IPCT_SECMARK,           /* new security mark has been set */
+       IPCT_LABEL,             /* new connlabel has been set */
 };
 
 enum ip_conntrack_expect_events {
-       IPEXP_NEW_BIT = 0,
-       IPEXP_NEW = (1 << IPEXP_NEW_BIT),
+       IPEXP_NEW,              /* new expectation */
+       IPEXP_DESTROY,          /* destroyed expectation */
 };
 
 

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 8f3842690d176bb6d847e4a157dfc404d0e6f0f1..683f6f88fcacefa0898e3898cd75f31422fc0f9a 100644 (file)
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -901,6 +901,7 @@ enum nft_rt_attributes {
  * @NFT_CT_BYTES: conntrack bytes
  * @NFT_CT_AVGPKT: conntrack average bytes per packet
  * @NFT_CT_ZONE: conntrack zone
+ * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
  */
 enum nft_ct_keys {
        NFT_CT_STATE,
@@ -921,6 +922,7 @@ enum nft_ct_keys {
        NFT_CT_BYTES,
        NFT_CT_AVGPKT,
        NFT_CT_ZONE,
+       NFT_CT_EVENTMASK,
 };
 
 /**

diff --git a/src/ct.c b/src/ct.c
index fd8ca87a21fb0007b26db8db68920be0033440ff..5014265a3427afe3af503d29baa293ede6028a5a 100644 (file)
--- a/src/ct.c
+++ b/src/ct.c
@@ -100,6 +100,34 @@ static const struct datatype ct_status_type = {
        .sym_tbl        = &ct_status_tbl,
 };
 
+static const struct symbol_table ct_events_tbl = {
+       .base           = BASE_HEXADECIMAL,
+       .symbols        = {
+               SYMBOL("new",           1 << IPCT_NEW),
+               SYMBOL("related",       1 << IPCT_RELATED),
+               SYMBOL("destroy",       1 << IPCT_DESTROY),
+               SYMBOL("reply",         1 << IPCT_REPLY),
+               SYMBOL("assured",       1 << IPCT_ASSURED),
+               SYMBOL("protoinfo",     1 << IPCT_PROTOINFO),
+               SYMBOL("helper",        1 << IPCT_HELPER),
+               SYMBOL("mark",          1 << IPCT_MARK),
+               SYMBOL("seqadj",        1 << IPCT_SEQADJ),
+               SYMBOL("secmark",       1 << IPCT_SECMARK),
+               SYMBOL("label",         1 << IPCT_LABEL),
+               SYMBOL_LIST_END
+       },
+};
+
+static const struct datatype ct_event_type = {
+       .type           = TYPE_CT_EVENTBIT,
+       .name           = "ct_event",
+       .desc           = "conntrack event bits",
+       .byteorder      = BYTEORDER_HOST_ENDIAN,
+       .size           = 4 * BITS_PER_BYTE,
+       .basetype       = &bitmask_type,
+       .sym_tbl        = &ct_events_tbl,
+};
+
 static struct symbol_table *ct_label_tbl;
 
 #define CT_LABEL_BIT_SIZE 128
@@ -236,6 +264,8 @@ static const struct ct_template ct_templates[] = {
                                              BYTEORDER_HOST_ENDIAN, 64),
        [NFT_CT_ZONE]           = CT_TEMPLATE("zone", &integer_type,
                                              BYTEORDER_HOST_ENDIAN, 16),
+       [NFT_CT_EVENTMASK]      = CT_TEMPLATE("eventmask", &ct_event_type,
+                                             BYTEORDER_HOST_ENDIAN, 32),
 };
 
 static void ct_print(enum nft_ct_keys key, int8_t dir)

diff --git a/tests/py/any/ct.t b/tests/py/any/ct.t
index 6f32d29c0c4094c6f348ef478143a669dde163c0..96a80f84a218218a0240f5337cc0066338c9ccce 100644 (file)
--- a/tests/py/any/ct.t
+++ b/tests/py/any/ct.t
@@ -96,6 +96,12 @@ ct original mark 42;fail
 # swapped key and direction
 ct mark original;fail
 
+ct eventmask set new;ok
+ct eventmask set new or related or destroy or foobar;fail
+ct eventmask set 'new | related | destroy | label';ok;ct eventmask set new | related | destroy | label
+ct eventmask set 1;ok;ct eventmask set new
+ct eventmask set 0x0;ok
+
 ct label 127;ok
 ct label set 127;ok
 ct label 128;fail

diff --git a/tests/py/any/ct.t.payload b/tests/py/any/ct.t.payload
index e4c7f62b69f5c348cdea9612ebb2fc5e53e940bb..6077e5da63b8a304027ebe95972fce2ebf0ff517 100644 (file)
--- a/tests/py/any/ct.t.payload
+++ b/tests/py/any/ct.t.payload
@@ -391,6 +391,26 @@ ip test-ip4 output
   [ bitwise reg 1 = (reg=1 & 0x00000020 ) ^ 0x00000000 ]
   [ cmp neq reg 1 0x00000000 ]
 
+# ct eventmask set new
+ip test-ip4 output
+  [ immediate reg 1 0x00000001 ]
+  [ ct set eventmask with reg 1 ]
+
+# ct eventmask set 'new | related | destroy | label'
+ip test-ip4 output
+  [ immediate reg 1 0x00000407 ]
+  [ ct set eventmask with reg 1 ]
+
+# ct eventmask set 1
+ip test-ip4 output
+  [ immediate reg 1 0x00000001 ]
+  [ ct set eventmask with reg 1 ]
+
+# ct eventmask set 0x0
+ip test-ip4 output
+  [ immediate reg 1 0x00000000 ]
+  [ ct set eventmask with reg 1 ]
+
 # ct label 127
 ip test-ip4 output
   [ ct load label => reg 1 ]