netfilter: ctnetlink: deliver labels to userspace

Introduce CTA_LABELS attribute to send a bit-vector of currently active labels to userspace. Future patch will permit userspace to also set/delete active labels.

Florian Westphal committed 13 years ago

Commit 0ceabd81 parent c539f014 files · +44 −1Browse files

Unified · Split

4 files

include/uapi/linux/netfilter/nf_conntrack_common.h +1 −0
include/uapi/linux/netfilter/nfnetlink_conntrack.h +1 −0
net/netfilter/nf_conntrack_labels.c +1 −1
net/netfilter/nf_conntrack_netlink.c +41 −0

include/uapi/linux/netfilter/nf_conntrack_common.h+1−0

@@ -101,6 +101,7 @@ enum ip_conntrack_events { · 100 unmodified lines
101	IPCT_MARK, /* new mark has been set */	101	IPCT_MARK, /* new mark has been set */
102	IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */	102	IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103	IPCT_SECMARK, /* new security mark has been set */	103	IPCT_SECMARK, /* new security mark has been set */
		104	IPCT_LABEL, /* new connlabel has been set */
104	};	105	};
105		106
106	enum ip_conntrack_expect_events {	107	enum ip_conntrack_expect_events {

include/uapi/linux/netfilter/nfnetlink_conntrack.h+1−0

@@ -49,6 +49,7 @@ enum ctattr_type { · 48 unmodified lines
49	CTA_SECCTX,	49	CTA_SECCTX,
50	CTA_TIMESTAMP,	50	CTA_TIMESTAMP,
51	CTA_MARK_MASK,	51	CTA_MARK_MASK,
		52	CTA_LABELS,
52	__CTA_MAX	53	__CTA_MAX
53	};	54	};
54	#define CTA_MAX (__CTA_MAX - 1)	55	#define CTA_MAX (__CTA_MAX - 1)

net/netfilter/nf_conntrack_labels.c+1−1

@@ -46,7 +46,7 @@ int nf_connlabel_set(struct nf_conn *ct, u16 bit) · 45 unmodified lines
46	return 0;	46	return 0;
47		47
48	if (test_and_set_bit(bit, labels->bits))	48	if (test_and_set_bit(bit, labels->bits))
49	return 0;	49	nf_conntrack_event_cache(IPCT_LABEL, ct);
50		50
51	return 0;	51	return 0;
52	}	52	}

net/netfilter/nf_conntrack_netlink.c+41−0

@@ -324,6 +324,40 @@ nla_put_failure: · 323 unmodified lines
324	#define ctnetlink_dump_secctx(a, b) (0)	324	#define ctnetlink_dump_secctx(a, b) (0)
325	#endif	325	#endif
326		326
		327	#ifdef CONFIG_NF_CONNTRACK_LABELS
		328	static int ctnetlink_label_size(const struct nf_conn *ct)
		329	{
		330	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
		331
		332	if (!labels)
		333	return 0;
		334	return nla_total_size(labels->words * sizeof(long));
		335	}
		336
		337	static int
		338	ctnetlink_dump_labels(struct sk_buff skb, const struct nf_conn ct)
		339	{
		340	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
		341	unsigned int len, i;
		342
		343	if (!labels)
		344	return 0;
		345
		346	len = labels->words * sizeof(long);
		347	i = 0;
		348	do {
		349	if (labels->bits[i] != 0)
		350	return nla_put(skb, CTA_LABELS, len, labels->bits);
		351	i++;
		352	} while (i < labels->words);
		353
		354	return 0;
		355	}
		356	#else
		357	#define ctnetlink_dump_labels(a, b) (0)
		358	#define ctnetlink_label_size(a) (0)
		359	#endif
		360
327	#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)	361	#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
328		362
329	static inline int	363	static inline int
@@ -464,6 +498,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, · 134 unmodified lines
464	ctnetlink_dump_helpinfo(skb, ct) < 0 \|\|	498	ctnetlink_dump_helpinfo(skb, ct) < 0 \|\|
465	ctnetlink_dump_mark(skb, ct) < 0 \|\|	499	ctnetlink_dump_mark(skb, ct) < 0 \|\|
466	ctnetlink_dump_secctx(skb, ct) < 0 \|\|	500	ctnetlink_dump_secctx(skb, ct) < 0 \|\|
		501	ctnetlink_dump_labels(skb, ct) < 0 \|\|
467	ctnetlink_dump_id(skb, ct) < 0 \|\|	502	ctnetlink_dump_id(skb, ct) < 0 \|\|
468	ctnetlink_dump_use(skb, ct) < 0 \|\|	503	ctnetlink_dump_use(skb, ct) < 0 \|\|
469	ctnetlink_dump_master(skb, ct) < 0 \|\|	504	ctnetlink_dump_master(skb, ct) < 0 \|\|
@@ -562,6 +597,7 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct) · 92 unmodified lines
562	+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */	597	+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
563	#endif	598	#endif
564	+ ctnetlink_proto_size(ct)	599	+ ctnetlink_proto_size(ct)
		600	+ ctnetlink_label_size(ct)
565	;	601	;
566	}	602	}
567		603
@@ -663,6 +699,9 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) · 95 unmodified lines
663	&& ctnetlink_dump_secctx(skb, ct) < 0)	699	&& ctnetlink_dump_secctx(skb, ct) < 0)
664	goto nla_put_failure;	700	goto nla_put_failure;
665	#endif	701	#endif
		702	if (events & (1 << IPCT_LABEL) &&
		703	ctnetlink_dump_labels(skb, ct) < 0)
		704	goto nla_put_failure;
666		705
667	if (events & (1 << IPCT_RELATED) &&	706	if (events & (1 << IPCT_RELATED) &&
668	ctnetlink_dump_master(skb, ct) < 0)	707	ctnetlink_dump_master(skb, ct) < 0)
@@ -1986,6 +2025,8 @@ ctnetlink_nfqueue_build(struct sk_buff skb, struct nf_conn ct) · 1317 unmodified lines
1986	if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)	2025	if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)
1987	goto nla_put_failure;	2026	goto nla_put_failure;
1988	#endif	2027	#endif
		2028	if (ctnetlink_dump_labels(skb, ct) < 0)
		2029	goto nla_put_failure;
1989	rcu_read_unlock();	2030	rcu_read_unlock();
1990	return 0;	2031	return 0;
1991		2032

netfilter: ctnetlink: deliver labels to userspace

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code