conntrack: add support for CTA_MARK_MASK and filtered dumping

This patch adds the infrastructure to allow filtered dumping.

See utils/conntrack_dump_filter.c for instance.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

3 files changed, 129 insertions, 2 deletions

diff --git a/src/conntrack/Makefile.am b/src/conntrack/Makefile.am
index fb6b048..3f7fb64 100644
--- a/src/conntrack/Makefile.am
+++ b/src/conntrack/Makefile.am
@@ -10,6 +10,6 @@ libnfconntrack_la_SOURCES = api.c \
 			    objopt.c \
 			    compare.c \
 			    copy.c \
-			    filter.c bsf.c \
+			    filter.c bsf.c filter_dump.c \
 			    grp.c grp_getter.c grp_setter.c \
 			    stack.c
diff --git a/src/conntrack/api.c b/src/conntrack/api.c
index d3d9bdb..683b2ce 100644
--- a/src/conntrack/api.c
+++ b/src/conntrack/api.c
@@ -766,7 +766,14 @@ __build_query_ct(struct nfnl_subsys_handle *ssh,
 	case NFCT_Q_CREATE_UPDATE:
 		__build_conntrack(ssh, req, size, IPCTNL_MSG_CT_NEW, NLM_F_REQUEST|NLM_F_CREATE|NLM_F_ACK, data);
 		break;
-
+	case NFCT_Q_DUMP_FILTER:
+		nfnl_fill_hdr(ssh, &req->nlh, 0, AF_UNSPEC, 0, IPCTNL_MSG_CT_GET, NLM_F_REQUEST|NLM_F_DUMP);
+		__build_filter_dump(req, size, data);
+		break;
+	case NFCT_Q_DUMP_FILTER_RESET:
+		nfnl_fill_hdr(ssh, &req->nlh, 0, AF_UNSPEC, 0, IPCTNL_MSG_CT_GET_CTRZERO, NLM_F_REQUEST|NLM_F_DUMP);
+		__build_filter_dump(req, size, data);
+		break;
 	default:
 		errno = ENOTSUP;
 		return -1;
@@ -802,6 +809,8 @@ __build_query_ct(struct nfnl_subsys_handle *ssh,
  * 	- NFCT_Q_FLUSH: flush the conntrack table
  * 	- NFCT_Q_DUMP: dump the conntrack table
  * 	- NFCT_Q_DUMP_RESET: dump the conntrack table and reset counters
+ * 	- NFCT_Q_DUMP_FILTER: dump the conntrack table
+ * 	- NFCT_Q_DUMP_FILTER_RESET: dump the conntrack table and reset counters
  *
  * Pass a valid pointer to the protocol family (u_int32_t)
  *
@@ -1356,3 +1365,72 @@ int nfct_filter_detach(int fd)
 /**
  * @}
  */
+
+/**
+ * \defgroup dumpfilter Kernel-space filtering for dumping
+ *
+ * @{
+ */
+
+/**
+ * nfct_filter_dump_create - create a dump filter
+ *
+ * This function returns a valid pointer on success, otherwise NULL is
+ * returned and errno is appropriately set.
+ */
+struct nfct_filter_dump *nfct_filter_dump_create(void)
+{
+	return calloc(sizeof(struct nfct_filter_dump), 1);
+}
+
+/**
+ * nfct_filter_dump_destroy - destroy a dump filter
+ * \param filter filter that we want to destroy
+ *
+ * This function releases the memory that is used by the filter object.
+ */
+void nfct_filter_dump_destroy(struct nfct_filter_dump *filter)
+{
+	assert(filter != NULL);
+	free(filter);
+	filter = NULL;
+}
+
+/**
+ * nfct_filter_dump_attr_set - set filter attribute
+ * \param filter dump filter object that we want to modify
+ * \param type filter attribute type
+ * \param value pointer to the value of the filter attribute
+ */
+void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump,
+			       const enum nfct_filter_dump_attr type,
+			       const void *value)
+{
+	assert(filter_dump != NULL);
+	assert(value != NULL);
+
+	if (unlikely(type >= NFCT_FILTER_DUMP_MAX))
+		return;
+
+	if (set_filter_dump_attr_array[type]) {
+		set_filter_dump_attr_array[type](filter_dump, value);
+		filter_dump->set |= (1 << type);
+	}
+}
+
+/**
+ * nfct_filter_dump_attr_set_u8 - set u8 dump filter attribute
+ * \param filter dump filter object that we want to modify
+ * \param type filter attribute type
+ * \param value value of the filter attribute using unsigned int (32 bits).
+ */
+void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump,
+				  const enum nfct_filter_dump_attr type,
+				  u_int8_t value)
+{
+	nfct_filter_dump_set_attr(filter_dump, type, &value);
+}
+
+/**
+ * @}
+ */
diff --git a/src/conntrack/filter_dump.c b/src/conntrack/filter_dump.c
new file mode 100644
index 0000000..9e2e169
--- /dev/null
+++ b/src/conntrack/filter_dump.c
@@ -0,0 +1,49 @@
+/*
+ * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "internal/internal.h"
+
+static void
+set_filter_dump_attr_mark(struct nfct_filter_dump *filter_dump,
+			  const void *value)
+{
+	const struct nfct_filter_dump_mark *this = value;
+
+	filter_dump->mark.val = this->val;
+	filter_dump->mark.mask = this->mask;
+	filter_dump->set |= (1 << NFCT_FILTER_DUMP_MARK);
+}
+
+static void
+set_filter_dump_attr_family(struct nfct_filter_dump *filter_dump,
+			    const void *value)
+{
+	filter_dump->l3num = *((u_int8_t *)value);
+	filter_dump->set |= (1 << NFCT_FILTER_DUMP_L3NUM);
+}
+
+const set_filter_dump_attr set_filter_dump_attr_array[NFCT_FILTER_DUMP_MAX] = {
+	[NFCT_FILTER_DUMP_MARK]		= set_filter_dump_attr_mark,
+	[NFCT_FILTER_DUMP_L3NUM]	= set_filter_dump_attr_family,
+};
+
+void __build_filter_dump(struct nfnlhdr *req, size_t size,
+			 const struct nfct_filter_dump *filter_dump)
+{
+	if (filter_dump->set & (1 << NFCT_FILTER_DUMP_MARK)) {
+		nfnl_addattr32(&req->nlh, size, CTA_MARK,
+				htonl(filter_dump->mark.val));
+		nfnl_addattr32(&req->nlh, size, CTA_MARK_MASK,
+				htonl(filter_dump->mark.mask));
+	}
+	if (filter_dump->set & (1 << NFCT_FILTER_DUMP_L3NUM)) {
+		struct nfgenmsg *nfg = NLMSG_DATA(&req->nlh);
+		nfg->nfgen_family = filter_dump->l3num;
+	}
+}