Conntrack dump does not support kernel side filtering (only get exists, but it returns only one entry. And user has to give a full valid tuple) It means that userspace has to implement filtering after receiving many irrelevant entries, consuming resources (conntrack table is sometimes very huge, much more than a routing table for example). This patch adds filtering in kernel side. To achieve this goal, we: * Add a new CTA_FILTER netlink attributes, actually a flag list to parametize filtering * Convert some *nlattr_to_tuple() functions, to allow a partial parsing of CTA_TUPLE_ORIG and CTA_TUPLE_REPLY (so nf_conntrack_tuple it not fully set) Filtering is now possible on: * IP SRC/DST values * Ports for TCP and UDP flows * IMCP(v6) codes types and IDs Filtering is done as an "AND" operator. For example, when flags PROTO_SRC_PORT, PROTO_NUM and IP_SRC are sets, only entries matching all values are dumped. Changes since v1: Set NLM_F_DUMP_FILTERED in nlm flags if entries are filtered Changes since v2: Move several constants to nf_internals.h Move a fix on netlink values check in a separate patch Add a check on not-supported flags Return EOPNOTSUPP if CDA_FILTER is set in ctnetlink_flush_conntrack (not yet implemented) Code style issues Changes since v3: Fix compilation warning reported by kbuild test robot Changes since v4: Fix a regression introduced in v3 (returned EINVAL for valid netlink messages without CTA_MARK) Changes since v5: Change definition of CTA_FILTER_F_ALL Fix a regression when CTA_TUPLE_ZONE is not set
Showing the changes to include/uapi/linux (1 of 7 files). Show all
Unified · Split
| @@ -55,6 +55,7 @@ enum ctattr_type { · 54 unmodified lines | |||
| 55 | CTA_LABELS, | 55 | CTA_LABELS, |
| 56 | CTA_LABELS_MASK, | 56 | CTA_LABELS_MASK, |
| 57 | CTA_SYNPROXY, | 57 | CTA_SYNPROXY, |
| 58 | CTA_FILTER, | ||
| 58 | __CTA_MAX | 59 | __CTA_MAX |
| 59 | }; | 60 | }; |
| 60 | #define CTA_MAX (__CTA_MAX - 1) | 61 | #define CTA_MAX (__CTA_MAX - 1) |
| @@ -276,4 +277,12 @@ enum ctattr_expect_stats { · 215 unmodified lines | |||
| 276 | }; | 277 | }; |
| 277 | #define CTA_STATS_EXP_MAX (__CTA_STATS_EXP_MAX - 1) | 278 | #define CTA_STATS_EXP_MAX (__CTA_STATS_EXP_MAX - 1) |
| 278 | 279 | ||
| 280 | enum ctattr_filter { | ||
| 281 | CTA_FILTER_UNSPEC, | ||
| 282 | CTA_FILTER_ORIG_FLAGS, | ||
| 283 | CTA_FILTER_REPLY_FLAGS, | ||
| 284 | __CTA_FILTER_MAX | ||
| 285 | }; | ||
| 286 | #define CTA_FILTER_MAX (__CTA_FILTER_MAX - 1) | ||
| 287 | |||
| 279 | #endif /* _IPCONNTRACK_NETLINK_H */ | 288 | #endif /* _IPCONNTRACK_NETLINK_H */ |