conntrack: add support for CTA_MARK_MASK and filtered dumping

This patch adds the infrastructure to allow filtered dumping.

See utils/conntrack_dump_filter.c for instance.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2 files changed, 31 insertions, 1 deletions

diff --git a/include/libnetfilter_conntrack/libnetfilter_conntrack.h b/include/libnetfilter_conntrack/libnetfilter_conntrack.h
index 538dc2d..a4a60cb 100644
--- a/include/libnetfilter_conntrack/libnetfilter_conntrack.h
+++ b/include/libnetfilter_conntrack/libnetfilter_conntrack.h
@@ -392,6 +392,8 @@ enum nf_conntrack_query {
 	NFCT_Q_DUMP,
 	NFCT_Q_DUMP_RESET,
 	NFCT_Q_CREATE_UPDATE,
+	NFCT_Q_DUMP_FILTER,
+	NFCT_Q_DUMP_FILTER_RESET,
 };
 
 extern int nfct_query(struct nfct_handle *h,
@@ -421,7 +423,7 @@ extern void nfct_copy_attr(struct nf_conntrack *ct1,
 			   const struct nf_conntrack *ct2,
 			   const enum nf_conntrack_attr type);
 
-/* filter */
+/* event filtering */
 
 struct nfct_filter;
 
@@ -472,6 +474,33 @@ extern int nfct_filter_set_logic(struct nfct_filter *filter,
 extern int nfct_filter_attach(int fd, struct nfct_filter *filter);
 extern int nfct_filter_detach(int fd);
 
+/* dump filtering */
+
+struct nfct_filter_dump;
+
+struct nfct_filter_dump_mark {
+	u_int32_t val;
+	u_int32_t mask;
+};
+
+enum nfct_filter_dump_attr {
+	NFCT_FILTER_DUMP_MARK = 0,	/* struct nfct_filter_dump_mark */
+	NFCT_FILTER_DUMP_L3NUM,		/* u_int8_t */
+	NFCT_FILTER_DUMP_MAX
+};
+
+struct nfct_filter_dump *nfct_filter_dump_create(void);
+
+void nfct_filter_dump_destroy(struct nfct_filter_dump *filter);
+
+void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump,
+			       const enum nfct_filter_dump_attr type,
+			       const void *data);
+
+void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump,
+				  const enum nfct_filter_dump_attr type,
+				  u_int8_t data);
+
 /* low level API: netlink functions */
 
 extern __attribute__((deprecated)) int
diff --git a/include/libnetfilter_conntrack/linux_nfnetlink_conntrack.h b/include/libnetfilter_conntrack/linux_nfnetlink_conntrack.h
index 2175799..1cf938b 100644
--- a/include/libnetfilter_conntrack/linux_nfnetlink_conntrack.h
+++ b/include/libnetfilter_conntrack/linux_nfnetlink_conntrack.h
@@ -47,6 +47,7 @@ enum ctattr_type {
 	CTA_ZONE,
 	CTA_SECCTX,
 	CTA_TIMESTAMP,
+	CTA_MARK_MASK,
 	__CTA_MAX
 };
 #define CTA_MAX (__CTA_MAX - 1)