From 62ed08f2d25ef0f332fe65fd40a97ff4dc4eda93 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 9 Feb 2012 18:56:59 +0100 Subject: conntrack: add support for CTA_MARK_MASK and filtered dumping This patch adds the infrastructure to allow filtered dumping. See utils/conntrack_dump_filter.c for instance. Signed-off-by: Pablo Neira Ayuso --- src/conntrack/Makefile.am | 2 +- src/conntrack/api.c | 80 ++++++++++++++++++++++++++++++++++++++++++++- src/conntrack/filter_dump.c | 49 +++++++++++++++++++++++++++ 3 files changed, 129 insertions(+), 2 deletions(-) create mode 100644 src/conntrack/filter_dump.c (limited to 'src') diff --git a/src/conntrack/Makefile.am b/src/conntrack/Makefile.am index fb6b048..3f7fb64 100644 --- a/src/conntrack/Makefile.am +++ b/src/conntrack/Makefile.am @@ -10,6 +10,6 @@ libnfconntrack_la_SOURCES = api.c \ objopt.c \ compare.c \ copy.c \ - filter.c bsf.c \ + filter.c bsf.c filter_dump.c \ grp.c grp_getter.c grp_setter.c \ stack.c diff --git a/src/conntrack/api.c b/src/conntrack/api.c index d3d9bdb..683b2ce 100644 --- a/src/conntrack/api.c +++ b/src/conntrack/api.c @@ -766,7 +766,14 @@ __build_query_ct(struct nfnl_subsys_handle *ssh, case NFCT_Q_CREATE_UPDATE: __build_conntrack(ssh, req, size, IPCTNL_MSG_CT_NEW, NLM_F_REQUEST|NLM_F_CREATE|NLM_F_ACK, data); break; - + case NFCT_Q_DUMP_FILTER: + nfnl_fill_hdr(ssh, &req->nlh, 0, AF_UNSPEC, 0, IPCTNL_MSG_CT_GET, NLM_F_REQUEST|NLM_F_DUMP); + __build_filter_dump(req, size, data); + break; + case NFCT_Q_DUMP_FILTER_RESET: + nfnl_fill_hdr(ssh, &req->nlh, 0, AF_UNSPEC, 0, IPCTNL_MSG_CT_GET_CTRZERO, NLM_F_REQUEST|NLM_F_DUMP); + __build_filter_dump(req, size, data); + break; default: errno = ENOTSUP; return -1; @@ -802,6 +809,8 @@ __build_query_ct(struct nfnl_subsys_handle *ssh, * - NFCT_Q_FLUSH: flush the conntrack table * - NFCT_Q_DUMP: dump the conntrack table * - NFCT_Q_DUMP_RESET: dump the conntrack table and reset counters + * - NFCT_Q_DUMP_FILTER: dump the conntrack table + * - NFCT_Q_DUMP_FILTER_RESET: dump the conntrack table and reset counters * * Pass a valid pointer to the protocol family (u_int32_t) * @@ -1356,3 +1365,72 @@ int nfct_filter_detach(int fd) /** * @} */ + +/** + * \defgroup dumpfilter Kernel-space filtering for dumping + * + * @{ + */ + +/** + * nfct_filter_dump_create - create a dump filter + * + * This function returns a valid pointer on success, otherwise NULL is + * returned and errno is appropriately set. + */ +struct nfct_filter_dump *nfct_filter_dump_create(void) +{ + return calloc(sizeof(struct nfct_filter_dump), 1); +} + +/** + * nfct_filter_dump_destroy - destroy a dump filter + * \param filter filter that we want to destroy + * + * This function releases the memory that is used by the filter object. + */ +void nfct_filter_dump_destroy(struct nfct_filter_dump *filter) +{ + assert(filter != NULL); + free(filter); + filter = NULL; +} + +/** + * nfct_filter_dump_attr_set - set filter attribute + * \param filter dump filter object that we want to modify + * \param type filter attribute type + * \param value pointer to the value of the filter attribute + */ +void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, + const enum nfct_filter_dump_attr type, + const void *value) +{ + assert(filter_dump != NULL); + assert(value != NULL); + + if (unlikely(type >= NFCT_FILTER_DUMP_MAX)) + return; + + if (set_filter_dump_attr_array[type]) { + set_filter_dump_attr_array[type](filter_dump, value); + filter_dump->set |= (1 << type); + } +} + +/** + * nfct_filter_dump_attr_set_u8 - set u8 dump filter attribute + * \param filter dump filter object that we want to modify + * \param type filter attribute type + * \param value value of the filter attribute using unsigned int (32 bits). + */ +void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, + const enum nfct_filter_dump_attr type, + u_int8_t value) +{ + nfct_filter_dump_set_attr(filter_dump, type, &value); +} + +/** + * @} + */ diff --git a/src/conntrack/filter_dump.c b/src/conntrack/filter_dump.c new file mode 100644 index 0000000..9e2e169 --- /dev/null +++ b/src/conntrack/filter_dump.c @@ -0,0 +1,49 @@ +/* + * (C) 2005-2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + */ + +#include "internal/internal.h" + +static void +set_filter_dump_attr_mark(struct nfct_filter_dump *filter_dump, + const void *value) +{ + const struct nfct_filter_dump_mark *this = value; + + filter_dump->mark.val = this->val; + filter_dump->mark.mask = this->mask; + filter_dump->set |= (1 << NFCT_FILTER_DUMP_MARK); +} + +static void +set_filter_dump_attr_family(struct nfct_filter_dump *filter_dump, + const void *value) +{ + filter_dump->l3num = *((u_int8_t *)value); + filter_dump->set |= (1 << NFCT_FILTER_DUMP_L3NUM); +} + +const set_filter_dump_attr set_filter_dump_attr_array[NFCT_FILTER_DUMP_MAX] = { + [NFCT_FILTER_DUMP_MARK] = set_filter_dump_attr_mark, + [NFCT_FILTER_DUMP_L3NUM] = set_filter_dump_attr_family, +}; + +void __build_filter_dump(struct nfnlhdr *req, size_t size, + const struct nfct_filter_dump *filter_dump) +{ + if (filter_dump->set & (1 << NFCT_FILTER_DUMP_MARK)) { + nfnl_addattr32(&req->nlh, size, CTA_MARK, + htonl(filter_dump->mark.val)); + nfnl_addattr32(&req->nlh, size, CTA_MARK_MASK, + htonl(filter_dump->mark.mask)); + } + if (filter_dump->set & (1 << NFCT_FILTER_DUMP_L3NUM)) { + struct nfgenmsg *nfg = NLMSG_DATA(&req->nlh); + nfg->nfgen_family = filter_dump->l3num; + } +} -- cgit v1.2.3