diff options
| author | Florian Westphal <fw@strlen.de> | 2021-08-02 11:12:29 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2021-08-05 13:58:18 +0200 |
| commit | 5f823f8fd90dc77b4256fc6cc296834cbe5c0f21 (patch) | |
| tree | 9f4825137debfee7b3ee4773d868207708528dc5 /include | |
| parent | 5f6a7f009687f9790411e8e94b41423dcbe205b1 (diff) | |
src: add support for status dump filter
This tells kernel to suppress conntrack entries that do not match
the status bits/bitmask filter.
This is useful to e.g. only list entries that are not assured
(value 0, mask == ASSUED) or entries that only saw one-way traffic
(value 0, mask == SEEN_REPLY).
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'include')
| -rw-r--r-- | include/internal/object.h | 1 | ||||
| -rw-r--r-- | include/libnetfilter_conntrack/libnetfilter_conntrack.h | 5 |
2 files changed, 4 insertions, 2 deletions
diff --git a/include/internal/object.h b/include/internal/object.h index 3f6904f..75ffdbe 100644 --- a/include/internal/object.h +++ b/include/internal/object.h @@ -287,6 +287,7 @@ struct nfct_filter { struct nfct_filter_dump { struct nfct_filter_dump_mark mark; + struct nfct_filter_dump_mark status; uint8_t l3num; uint32_t set; }; diff --git a/include/libnetfilter_conntrack/libnetfilter_conntrack.h b/include/libnetfilter_conntrack/libnetfilter_conntrack.h index f02d827..6233434 100644 --- a/include/libnetfilter_conntrack/libnetfilter_conntrack.h +++ b/include/libnetfilter_conntrack/libnetfilter_conntrack.h @@ -137,11 +137,11 @@ enum nf_conntrack_attr { ATTR_HELPER_INFO, /* variable length */ ATTR_CONNLABELS, /* variable length */ ATTR_CONNLABELS_MASK, /* variable length */ - ATTR_ORIG_ZONE, /* u16 bits */ + ATTR_ORIG_ZONE = 68, /* u16 bits */ ATTR_REPL_ZONE, /* u16 bits */ ATTR_SNAT_IPV6, /* u128 bits */ ATTR_DNAT_IPV6, /* u128 bits */ - ATTR_SYNPROXY_ISN, /* u32 bits */ + ATTR_SYNPROXY_ISN = 72, /* u32 bits */ ATTR_SYNPROXY_ITS, /* u32 bits */ ATTR_SYNPROXY_TSOFF, /* u32 bits */ ATTR_MAX @@ -546,6 +546,7 @@ struct nfct_filter_dump_mark { enum nfct_filter_dump_attr { NFCT_FILTER_DUMP_MARK = 0, /* struct nfct_filter_dump_mark */ NFCT_FILTER_DUMP_L3NUM, /* uint8_t */ + NFCT_FILTER_DUMP_STATUS, /* struct nfct_filter_dump_mark */ NFCT_FILTER_DUMP_MAX }; |