netfilter: ctnetlink: deliver labels to userspace

Introduce CTA_LABELS attribute to send a bit-vector of currently active labels to userspace. Future patch will permit userspace to also set/delete active labels.

Florian Westphal committed 13 years ago

Commit 0ceabd81 parent c539f014 files · +44 −1Browse files

Unified · Split

4 files

include/uapi/linux/netfilter/nf_conntrack_common.h +1 −0
include/uapi/linux/netfilter/nfnetlink_conntrack.h +1 −0
net/netfilter/nf_conntrack_labels.c +1 −1
net/netfilter/nf_conntrack_netlink.c +41 −0

include/uapi/linux/netfilter/nf_conntrack_common.h+1−0

@@ -101,6 +101,7 @@ enum ip_conntrack_events { · 100 unmodified lines
101	101	IPCT_MARK, /* new mark has been set */
102	102	IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103	103	IPCT_SECMARK, /* new security mark has been set */
	104	+ IPCT_LABEL, /* new connlabel has been set */
104	105	};
105	106
106	107	enum ip_conntrack_expect_events {

include/uapi/linux/netfilter/nfnetlink_conntrack.h+1−0

@@ -49,6 +49,7 @@ enum ctattr_type { · 48 unmodified lines
49	49	CTA_SECCTX,
50	50	CTA_TIMESTAMP,
51	51	CTA_MARK_MASK,
	52	+ CTA_LABELS,
52	53	__CTA_MAX
53	54	};
54	55	#define CTA_MAX (__CTA_MAX - 1)

net/netfilter/nf_conntrack_labels.c+1−1

@@ -46,7 +46,7 @@ int nf_connlabel_set(struct nf_conn *ct, u16 bit) · 45 unmodified lines
46	46	return 0;
47	47
48	48	if (test_and_set_bit(bit, labels->bits))
49		− return 0;
	49	+ nf_conntrack_event_cache(IPCT_LABEL, ct);
50	50
51	51	return 0;
52	52	}

net/netfilter/nf_conntrack_netlink.c+41−0

@@ -324,6 +324,40 @@ nla_put_failure: · 323 unmodified lines
324	324	#define ctnetlink_dump_secctx(a, b) (0)
325	325	#endif
326	326
	327	+#ifdef CONFIG_NF_CONNTRACK_LABELS
	328	+static int ctnetlink_label_size(const struct nf_conn *ct)
	329	+{
	330	+ struct nf_conn_labels *labels = nf_ct_labels_find(ct);
	331	+
	332	+ if (!labels)
	333	+ return 0;
	334	+ return nla_total_size(labels->words * sizeof(long));
	335	+}
	336	+
	337	+static int
	338	+ctnetlink_dump_labels(struct sk_buff skb, const struct nf_conn ct)
	339	+{
	340	+ struct nf_conn_labels *labels = nf_ct_labels_find(ct);
	341	+ unsigned int len, i;
	342	+
	343	+ if (!labels)
	344	+ return 0;
	345	+
	346	+ len = labels->words * sizeof(long);
	347	+ i = 0;
	348	+ do {
	349	+ if (labels->bits[i] != 0)
	350	+ return nla_put(skb, CTA_LABELS, len, labels->bits);
	351	+ i++;
	352	+ } while (i < labels->words);
	353	+
	354	+ return 0;
	355	+}
	356	+#else
	357	+#define ctnetlink_dump_labels(a, b) (0)
	358	+#define ctnetlink_label_size(a) (0)
	359	+#endif
	360	+
327	361	#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
328	362
329	363	static inline int
@@ -464,6 +498,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, · 134 unmodified lines
464	498	ctnetlink_dump_helpinfo(skb, ct) < 0 \|\|
465	499	ctnetlink_dump_mark(skb, ct) < 0 \|\|
466	500	ctnetlink_dump_secctx(skb, ct) < 0 \|\|
	501	+ ctnetlink_dump_labels(skb, ct) < 0 \|\|
467	502	ctnetlink_dump_id(skb, ct) < 0 \|\|
468	503	ctnetlink_dump_use(skb, ct) < 0 \|\|
469	504	ctnetlink_dump_master(skb, ct) < 0 \|\|
@@ -562,6 +597,7 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct) · 92 unmodified lines
562	597	+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
563	598	#endif
564	599	+ ctnetlink_proto_size(ct)
	600	+ + ctnetlink_label_size(ct)
565	601	;
566	602	}
567	603
@@ -663,6 +699,9 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) · 95 unmodified lines
663	699	&& ctnetlink_dump_secctx(skb, ct) < 0)
664	700	goto nla_put_failure;
665	701	#endif
	702	+ if (events & (1 << IPCT_LABEL) &&
	703	+ ctnetlink_dump_labels(skb, ct) < 0)
	704	+ goto nla_put_failure;
666	705
667	706	if (events & (1 << IPCT_RELATED) &&
668	707	ctnetlink_dump_master(skb, ct) < 0)
@@ -1986,6 +2025,8 @@ ctnetlink_nfqueue_build(struct sk_buff skb, struct nf_conn ct) · 1317 unmodified lines
1986	2025	if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)
1987	2026	goto nla_put_failure;
1988	2027	#endif
	2028	+ if (ctnetlink_dump_labels(skb, ct) < 0)
	2029	+ goto nla_put_failure;
1989	2030	rcu_read_unlock();
1990	2031	return 0;
1991	2032

netfilter: ctnetlink: deliver labels to userspace

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code