History

netfilter: nft_ct: allow to set ctnetlink event types of a connection

By default the kernel emits all ctnetlink events for a connection. This allows to select the types of events to generate. This can be used to e.g. only send DESTROY events but no NEW/UPDATE ones and will work even if sysctl net.netfilter.nf_conntrack_events is set to 0. This was already possible via iptables' CT target, but the nft version has the advantage that it can also be used with already-established conntracks. The added nf_ct_is_template() check isn't a bug fix as we only support mark and labels (and unlike ecache the conntrack core doesn't copy those).

Florian Westphal committed 9 years ago

Commit 694a0051 parent ab8bc7e2 files · +26 −1Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -901,6 +901,7 @@ enum nft_rt_attributes { · 900 unmodified lines
901 * @NFT_CT_BYTES: conntrack bytes901 * @NFT_CT_BYTES: conntrack bytes
902 * @NFT_CT_AVGPKT: conntrack average bytes per packet902 * @NFT_CT_AVGPKT: conntrack average bytes per packet
903 * @NFT_CT_ZONE: conntrack zone903 * @NFT_CT_ZONE: conntrack zone
904 * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
904 */905 */
905enum nft_ct_keys {906enum nft_ct_keys {
906 NFT_CT_STATE,907 NFT_CT_STATE,
@@ -921,6 +922,7 @@ enum nft_ct_keys { · 14 unmodified lines
921 NFT_CT_BYTES,922 NFT_CT_BYTES,
922 NFT_CT_AVGPKT,923 NFT_CT_AVGPKT,
923 NFT_CT_ZONE,924 NFT_CT_ZONE,
925 NFT_CT_EVENTMASK,
924};926};
925 927
926/**928/**