Skip to contentSkip to conversation

Making NFCT plugin IPv6 compliant

PATCH Applied Eric Leblond 2 participants 12 messages Mar 26, 2008 – Apr 5, 2008 netfilter

lore
Share & tools
lore

Eric Leblond

author
#0 lore raw

cover Making NFCT plugin IPv6 compliant

Hi,

This patchset contains several modifications which were necessary to make the NFCT plugin IPv6 compliant.

Some code factorization has been made to avoid duplicating code:
- Make arp related key optionnal.
- Use IP2STR keys in PRINTFLOW module.
Last patch suppress IP to string translation in the PRINTFLOW module but let IP2STR to do the work.

Some fixes have been made on existing code:
- Fix display of IPv6 address.
- Fix typo in error message.
- Fix display of DESTROY event.

And finally, NFCT plugin has been ported to the new API.
- Port of NFCT plugin to new libnetfilter_conntrack API.

I will soon send a other patchset with SQL schema modification and an upgrade of the example configuration file.

BR,
--
Eric Leblond
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

author
#1 lore raw

PATCH 1/6 Make arp related key optionnal.

Arp related key have to be optionnal to be able to use the IP2STR module for flow display.

Signed-off-by Eric Leblond <[email protected]>

---
:100644 100644 54e7d94... 9f36d60... M filter/ulogd_filter_IP2STR.c

 filter/ulogd_filter_IP2STR.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
filter/ulogd_filter_IP2STR.c +2 -2
index 54e7d94..9f36d60 100644
@@ -89,12 +89,12 @@ static struct ulogd_key ip2str_inp[] = {
 	},
 	[KEY_ARP_SPA] = {
 		.type = ULOGD_RET_IPADDR,
-		.flags = ULOGD_RETF_NONE,
+		.flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL,
 		.name = "arp.saddr",
 	},
 	[KEY_ARP_TPA] = {
 		.type = ULOGD_RET_IPADDR,
-		.flags = ULOGD_RETF_NONE,
+		.flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL,
 		.name = "arp.daddr",
 	},
 };
Signature · 1 line
1.5.2.5
maintainer Applied
#2 lore raw

Re: [ULOGD PATCH 1/6] Make arp related key optionnal.

Quoted 2 lines · Eric Leblond

Arp related key have to be optionnal to be able to use the IP2STR module for flow display.

Applied. Thanks.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
author
#3 lore raw

PATCH 2/6 Fix display of IPv6 address.

In reply to Eric Leblond

An error in the type of an argument in the call to inet_ntop was causing IPv6 address to be transformed in a string not really related to the real Ipv6 address.

Signed-off-by Eric Leblond <[email protected]>

---
:100644 100644 9f36d60... e4ec06d... M filter/ulogd_filter_IP2STR.c

 filter/ulogd_filter_IP2STR.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
filter/ulogd_filter_IP2STR.c +1 -1
index 9f36d60..e4ec06d 100644
@@ -174,7 +174,7 @@ static char *ip2str(struct ulogd_key *inp, int index)
 	switch (convfamily) {
 	case AF_INET6:
 		inet_ntop(AF_INET6,
-			  &GET_VALUE(inp, index).ptr,
+			  GET_VALUE(inp, index).ptr,
 			  tmp, sizeof(tmp));
 		break;
 	case AF_INET:
Signature · 1 line
1.5.2.5
maintainer Applied
#4 lore raw

Re: [ULOGD PATCH 2/6] Fix display of IPv6 address.

Quoted 3 lines · Eric Leblond

An error in the type of an argument in the call to inet_ntop was causing IPv6 address to be transformed in a string not really related to the real Ipv6 address.

Applied.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
author
#5 lore raw

PATCH 3/6 Fix typo in error message.

In reply to Eric Leblond

This patch fixes a typo in an error message.

Signed-off-by Eric Leblond <[email protected]>

---
:100644 100644 ef1c191... 249bde3... M src/ulogd.c

 src/ulogd.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
src/ulogd.c +1 -1
index ef1c191..249bde3 100644
@@ -163,7 +163,7 @@ int ulogd_key_size(struct ulogd_key *key)
 		ret = key->len;
 		break;
 	default:
-		ulogd_log(ULOGD_ERROR, "don't know sizeo f unknown key "
+		ulogd_log(ULOGD_ERROR, "don't know sizeof unknown key "
 			  "`%s' type 0x%x\n", key->name, key->type);
 		ret = -1;
 		break;
Signature · 1 line
1.5.2.5
maintainer Applied
#6 lore raw

Re: [ULOGD PATCH 3/6] Fix typo in error message.

Quoted 1 line · Eric Leblond

This patch fixes a typo in an error message.

Applied.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
author
#7 lore raw

PATCH 4/6 Use IP2STR keys in PRINTFLOW module.

In reply to Eric Leblond

The PRINTFLOW module had its own code for string conversion of IPv6 address. This patch change the input key of the module to use conversion made by the IP2STR module.

Signed-off-by Eric Leblond <[email protected]>

---
:100644 100644 6c2ffd5... 272ee4f... M util/printflow.c

 util/printflow.c |   20 ++++++++------------
 1 files changed, 8 insertions(+), 12 deletions(-)
util/printflow.c +8 -12
index 6c2ffd5..272ee4f 100644
@@ -52,12 +52,12 @@ struct ulogd_key printflow_keys[FLOW_IDS] = {
 	{
 		.type = ULOGD_RET_IPADDR,
 		.flags = ULOGD_RETF_NONE,
-		.name = "orig.ip.saddr",
+		.name = "orig.ip.saddr.str",
 	},
 	{
 		.type = ULOGD_RET_IPADDR,
 		.flags = ULOGD_RETF_NONE,
-		.name = "orig.ip.daddr",
+		.name = "orig.ip.daddr.str",
 	},
 	{
 		.type = ULOGD_RET_UINT8,

@@ -87,12 +87,12 @@ struct ulogd_key printflow_keys[FLOW_IDS] = {
 	{
 		.type = ULOGD_RET_IPADDR,
 		.flags = ULOGD_RETF_NONE,
-		.name = "reply.ip.saddr",
+		.name = "reply.ip.saddr.str",
 	},
 	{
 		.type = ULOGD_RET_IPADDR,
 		.flags = ULOGD_RETF_NONE,
-		.name = "reply.ip.daddr",
+		.name = "reply.ip.daddr.str",
 	},
 	{
 		.type = ULOGD_RET_UINT8,

@@ -162,12 +162,10 @@ int printflow_print(struct ulogd_key *res, char *buf)
 	buf_cur += sprintf(buf_cur, "ORIG: ");
 
 	if (pp_is_valid(res, PRINTFLOW_ORIG_IP_SADDR))
-		buf_cur += sprintf(buf_cur, "SRC=%s ", inet_ntoa(
-				(struct in_addr) {htonl(GET_VALUE(res, PRINTFLOW_ORIG_IP_SADDR).ui32)}));
+		buf_cur += sprintf(buf_cur, "SRC=%s ", GET_VALUE(res, PRINTFLOW_ORIG_IP_SADDR).ptr);
 
 	if (pp_is_valid(res, PRINTFLOW_ORIG_IP_DADDR))
-		buf_cur += sprintf(buf_cur, "DST=%s ", inet_ntoa(
-				(struct in_addr) {htonl(GET_VALUE(res, PRINTFLOW_ORIG_IP_DADDR).ui32)}));
+		buf_cur += sprintf(buf_cur, "DST=%s ", GET_VALUE(res, PRINTFLOW_ORIG_IP_DADDR).ptr);
 
 	if (!pp_is_valid(res, PRINTFLOW_ORIG_IP_PROTOCOL))
 		goto orig_out;

@@ -211,12 +209,10 @@ orig_out:
 	buf_cur += sprintf(buf_cur, ", REPLY: ");
 
 	if (pp_is_valid(res, PRINTFLOW_REPLY_IP_SADDR))
-		buf_cur += sprintf(buf_cur, "SRC=%s ", inet_ntoa(
-				(struct in_addr) {htonl(GET_VALUE(res, PRINTFLOW_REPLY_IP_SADDR).ui32)}));
+		buf_cur += sprintf(buf_cur, "SRC=%s ", GET_VALUE(res, PRINTFLOW_REPLY_IP_SADDR).ptr);
 
 	if (pp_is_valid(res, PRINTFLOW_REPLY_IP_DADDR))
-		buf_cur += sprintf(buf_cur, "DST=%s ", inet_ntoa(
-				(struct in_addr) {htonl(GET_VALUE(res, PRINTFLOW_REPLY_IP_DADDR).ui32)}));
+		buf_cur += sprintf(buf_cur, "DST=%s ", GET_VALUE(res, PRINTFLOW_REPLY_IP_DADDR).ptr);
 
 	if (!pp_is_valid(res, PRINTFLOW_REPLY_IP_PROTOCOL))
 		goto reply_out;
Signature · 1 line
1.5.2.5
maintainer Applied
#8 lore raw

Re: [ULOGD PATCH 4/6] Use IP2STR keys in PRINTFLOW module.

Quoted 3 lines · Eric Leblond

The PRINTFLOW module had its own code for string conversion of IPv6 address. This patch change the input key of the module to use conversion made by the IP2STR module.

Applied. Thanks.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
author
#9 lore raw

PATCH 5/6 Port of NFCT plugin to new libnetfilter_conntrack API.

In reply to Eric Leblond

This patch is a port to the new libnetfilter_conntrack API of the NFCT plugin. To be able to send IP addresses to the IP2STR and IP2BIN module oob.family and oob.protocol keys have been added.

There is only a single function which is marked as deprecated. This is nfct_dump_conntrack_table_reset_counters. This function is used to dump periodically counters. By default, this feature is not used. IMHO we could suppress this code and use conntrackd for similar tasks.

Signed-off-by Eric Leblond <[email protected]>

---
:100644 100644 19df32f... 5e5af87... M input/flow/ulogd_inpflow_NFCT.c

 input/flow/ulogd_inpflow_NFCT.c |  146 ++++++++++++++++++++++-----------------
 1 files changed, 82 insertions(+), 64 deletions(-)
input/flow/ulogd_inpflow_NFCT.c +82 -64
index 19df32f..5e5af87 100644
@@ -141,6 +141,8 @@ enum nfct_keys {
 	NFCT_FLOW_START_USEC,
 	NFCT_FLOW_END_SEC,
 	NFCT_FLOW_END_USEC,
+	NFCT_OOB_FAMILY,
+	NFCT_OOB_PROTOCOL,
 };
 
 static struct ulogd_key nfct_okeys[] = {

@@ -352,6 +354,16 @@ static struct ulogd_key nfct_okeys[] = {
 			.field_id	= IPFIX_flowEndSeconds,
 		},
 	},
+	{
+		.type	= ULOGD_RET_UINT8,
+		.flags	= ULOGD_RETF_NONE,
+		.name	= "oob.family",
+	},
+	{
+		.type	= ULOGD_RET_UINT8,
+		.flags	= ULOGD_RETF_NONE,
+		.name	= "oob.protocol",
+	},
 };
 
 static struct ct_htable *htable_alloc(int htable_size, int prealloc)

@@ -468,94 +480,100 @@ static struct ct_timestamp *ct_hash_get(struct ct_htable *htable, uint32_t id)
 }
 
 static int propagate_ct(struct ulogd_pluginstance *upi,
-			struct nfct_conntrack *ct,
-			unsigned int flags,
+			struct nf_conntrack *ct,
 			int type,
 			struct ct_timestamp *ts)
 {
 	struct ulogd_key *ret = upi->output.keys;
-	int dir;
-
+	
 	ret[NFCT_CT_EVENT].u.value.ui32 = type;
 	ret[NFCT_CT_EVENT].flags |= ULOGD_RETF_VALID;
 
-	dir = NFCT_DIR_ORIGINAL;
-	ret[NFCT_ORIG_IP_SADDR].u.value.ui32 = htonl(ct->tuple[dir].src.v4);
-	ret[NFCT_ORIG_IP_SADDR].flags |= ULOGD_RETF_VALID;
+	ret[NFCT_OOB_FAMILY].u.value.ui8 = nfct_get_attr_u8(ct, ATTR_L3PROTO);
+	ret[NFCT_OOB_FAMILY].flags |= ULOGD_RETF_VALID;
+	/* FIXME */
+	ret[NFCT_OOB_PROTOCOL].u.value.ui8 = 0;
+	ret[NFCT_OOB_PROTOCOL].flags |= ULOGD_RETF_VALID;
 
-	ret[NFCT_ORIG_IP_DADDR].u.value.ui32 = htonl(ct->tuple[dir].dst.v4);
-	ret[NFCT_ORIG_IP_DADDR].flags |= ULOGD_RETF_VALID;
+	switch (nfct_get_attr_u8(ct, ATTR_L3PROTO)) {
+		case AF_INET:
+			ret[NFCT_ORIG_IP_SADDR].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_ORIG_IPV4_SRC);
+			ret[NFCT_ORIG_IP_SADDR].flags |= ULOGD_RETF_VALID;
+			ret[NFCT_ORIG_IP_DADDR].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_ORIG_IPV4_DST);
+			ret[NFCT_ORIG_IP_DADDR].flags |= ULOGD_RETF_VALID;
 
-	ret[NFCT_ORIG_IP_PROTOCOL].u.value.ui8 = ct->tuple[dir].protonum;
+			ret[NFCT_REPLY_IP_SADDR].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_REPL_IPV4_SRC);
+			ret[NFCT_REPLY_IP_SADDR].flags |= ULOGD_RETF_VALID;
+			ret[NFCT_REPLY_IP_DADDR].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_REPL_IPV4_DST);
+			ret[NFCT_REPLY_IP_DADDR].flags |= ULOGD_RETF_VALID;
+
+			break;
+		case AF_INET6:
+			ret[NFCT_ORIG_IP_SADDR].u.value.ptr = (struct in6_addr *)nfct_get_attr(ct, ATTR_ORIG_IPV6_SRC);
+			ret[NFCT_ORIG_IP_SADDR].flags |= ULOGD_RETF_VALID;
+			ret[NFCT_ORIG_IP_DADDR].u.value.ptr = (struct in6_addr *)nfct_get_attr(ct, ATTR_ORIG_IPV6_DST);
+			ret[NFCT_ORIG_IP_DADDR].flags |= ULOGD_RETF_VALID;
+
+			ret[NFCT_REPLY_IP_SADDR].u.value.ptr = (struct in6_addr *)nfct_get_attr(ct, ATTR_REPL_IPV6_SRC);
+			ret[NFCT_REPLY_IP_SADDR].flags |= ULOGD_RETF_VALID;
+			ret[NFCT_REPLY_IP_DADDR].u.value.ptr = (struct in6_addr *)nfct_get_attr(ct, ATTR_REPL_IPV6_DST);
+			ret[NFCT_REPLY_IP_DADDR].flags |= ULOGD_RETF_VALID;
+
+			break;
+		default:
+			ulogd_log(ULOGD_NOTICE, "Unknown protocol family (%d)\n",
+				  nfct_get_attr_u8(ct, ATTR_L3PROTO));
+	}
+	ret[NFCT_ORIG_IP_PROTOCOL].u.value.ui8 = nfct_get_attr_u8(ct, ATTR_ORIG_L4PROTO);
 	ret[NFCT_ORIG_IP_PROTOCOL].flags |= ULOGD_RETF_VALID;
+	ret[NFCT_REPLY_IP_PROTOCOL].u.value.ui8 = nfct_get_attr_u8(ct, ATTR_REPL_L4PROTO);
+	ret[NFCT_REPLY_IP_PROTOCOL].flags |= ULOGD_RETF_VALID;
 
-	switch (ct->tuple[dir].protonum) {
+	switch (nfct_get_attr_u8(ct, ATTR_ORIG_L4PROTO)) {
 	case IPPROTO_TCP:
 	case IPPROTO_UDP:
 	case IPPROTO_SCTP:
 		/* FIXME: DCCP */
-		ret[NFCT_ORIG_L4_SPORT].u.value.ui16 = htons(ct->tuple[dir].l4src.tcp.port);
+		ret[NFCT_ORIG_L4_SPORT].u.value.ui16 = htons(nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC));
 		ret[NFCT_ORIG_L4_SPORT].flags |= ULOGD_RETF_VALID;
-		ret[NFCT_ORIG_L4_DPORT].u.value.ui16 = htons(ct->tuple[dir].l4dst.tcp.port);
+		ret[NFCT_ORIG_L4_DPORT].u.value.ui16 = htons(nfct_get_attr_u16(ct, ATTR_ORIG_PORT_DST));
 		ret[NFCT_ORIG_L4_DPORT].flags |= ULOGD_RETF_VALID;
 		break;
 	case IPPROTO_ICMP:
-		ret[NFCT_ICMP_CODE].u.value.ui8 = ct->tuple[dir].l4src.icmp.code;
+		ret[NFCT_ICMP_CODE].u.value.ui8 = nfct_get_attr_u8(ct, ATTR_ICMP_CODE);
 		ret[NFCT_ICMP_CODE].flags |= ULOGD_RETF_VALID;
-		ret[NFCT_ICMP_TYPE].u.value.ui8 = ct->tuple[dir].l4src.icmp.type;
+		ret[NFCT_ICMP_TYPE].u.value.ui8 = nfct_get_attr_u8(ct, ATTR_ICMP_TYPE);
 		ret[NFCT_ICMP_TYPE].flags |= ULOGD_RETF_VALID;
 		break;
 	}
 
-	ret[NFCT_ORIG_RAW_PKTLEN].u.value.ui64 = ct->counters[dir].bytes;
+	switch (nfct_get_attr_u8(ct, ATTR_REPL_L4PROTO)) {
+		case IPPROTO_TCP:
+		case IPPROTO_UDP:
+		case IPPROTO_SCTP:
+			ret[NFCT_REPLY_L4_SPORT].u.value.ui16 = htons(nfct_get_attr_u16(ct, ATTR_REPL_PORT_SRC));
+			ret[NFCT_REPLY_L4_SPORT].flags |= ULOGD_RETF_VALID;
+			ret[NFCT_REPLY_L4_DPORT].u.value.ui16 = htons(nfct_get_attr_u16(ct, ATTR_REPL_PORT_DST));
+			ret[NFCT_REPLY_L4_DPORT].flags |= ULOGD_RETF_VALID;
+	}
+
+	ret[NFCT_ORIG_RAW_PKTLEN].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_ORIG_COUNTER_BYTES);
 	ret[NFCT_ORIG_RAW_PKTLEN].flags |= ULOGD_RETF_VALID;
 
-	ret[NFCT_ORIG_RAW_PKTCOUNT].u.value.ui64 = ct->counters[dir].packets;
+	ret[NFCT_ORIG_RAW_PKTCOUNT].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_ORIG_COUNTER_PACKETS);
 	ret[NFCT_ORIG_RAW_PKTCOUNT].flags |= ULOGD_RETF_VALID;
 
-	dir = NFCT_DIR_REPLY;
-	ret[NFCT_REPLY_IP_SADDR].u.value.ui32 = htonl(ct->tuple[dir].src.v4);
-	ret[NFCT_REPLY_IP_SADDR].flags |= ULOGD_RETF_VALID;
-
-	ret[NFCT_REPLY_IP_DADDR].u.value.ui32 = htonl(ct->tuple[dir].dst.v4);
-	ret[NFCT_REPLY_IP_DADDR].flags |= ULOGD_RETF_VALID;
-
-	ret[NFCT_REPLY_IP_PROTOCOL].u.value.ui8 = ct->tuple[dir].protonum;
-	ret[NFCT_REPLY_IP_PROTOCOL].flags |= ULOGD_RETF_VALID;
-
-	switch (ct->tuple[dir].protonum) {
-	case IPPROTO_TCP:
-	case IPPROTO_UDP:
-	case IPPROTO_SCTP:
-		/* FIXME: DCCP */
-		ret[NFCT_REPLY_L4_SPORT].u.value.ui16 = htons(ct->tuple[dir].l4src.tcp.port);
-		ret[NFCT_REPLY_L4_SPORT].flags |= ULOGD_RETF_VALID;
-		ret[NFCT_REPLY_L4_DPORT].u.value.ui16 = htons(ct->tuple[dir].l4dst.tcp.port);
-		ret[NFCT_REPLY_L4_DPORT].flags |= ULOGD_RETF_VALID;
-		break;
-	case IPPROTO_ICMP:
-		ret[NFCT_ICMP_CODE].u.value.ui8 = ct->tuple[dir].l4src.icmp.code;
-		ret[NFCT_ICMP_CODE].flags |= ULOGD_RETF_VALID;
-		ret[NFCT_ICMP_TYPE].u.value.ui8 = ct->tuple[dir].l4src.icmp.type;
-		ret[NFCT_ICMP_TYPE].flags |= ULOGD_RETF_VALID;
-		break;
-	}
-
-	ret[NFCT_REPLY_RAW_PKTLEN].u.value.ui64 = ct->counters[dir].bytes;
+	ret[NFCT_REPLY_RAW_PKTLEN].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_REPL_COUNTER_BYTES);;
 	ret[NFCT_REPLY_RAW_PKTLEN].flags |= ULOGD_RETF_VALID;
 
-	ret[NFCT_REPLY_RAW_PKTCOUNT].u.value.ui64 = ct->counters[dir].packets;
+	ret[NFCT_REPLY_RAW_PKTCOUNT].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_REPL_COUNTER_PACKETS);
 	ret[NFCT_REPLY_RAW_PKTCOUNT].flags |= ULOGD_RETF_VALID;
 
-	if (flags & NFCT_MARK) {
-		ret[NFCT_CT_MARK].u.value.ui32 = ct->mark;
-		ret[NFCT_CT_MARK].flags |= ULOGD_RETF_VALID;
-	}
+	ret[NFCT_CT_MARK].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_MARK);
+	ret[NFCT_CT_MARK].flags |= ULOGD_RETF_VALID;
 
-	if (flags & NFCT_ID) {
-		ret[NFCT_CT_ID].u.value.ui32 = ct->id;
-		ret[NFCT_CT_ID].flags |= ULOGD_RETF_VALID;
-	}
+	ret[NFCT_CT_ID].u.value.ui32 = nfct_get_attr_u32(ct, ATTR_ID);
+	ret[NFCT_CT_ID].flags |= ULOGD_RETF_VALID;
 
 	if (ts) {
 		ret[NFCT_FLOW_START_SEC].u.value.ui32 = ts->time[START].tv_sec;

@@ -574,36 +592,36 @@ static int propagate_ct(struct ulogd_pluginstance *upi,
 }
 
 /* XXX: pollinterval needs a different handler */
-static int event_handler(void *arg, unsigned int flags, int type,
+static int event_handler(enum nf_conntrack_msg_type type,
+			 struct nf_conntrack *ct,
 			 void *data)
 {
-	struct nfct_conntrack *ct = arg;
 	struct ulogd_pluginstance *upi = data;
-	struct ulogd_pluginstance *npi = NULL;
 	struct nfct_pluginstance *cpi = 
 				(struct nfct_pluginstance *) upi->private;
 	struct ct_timestamp *ts = NULL;
+	struct ulogd_pluginstance *npi = NULL;
 	int ret = 0;
 
 	if (type == NFCT_MSG_NEW) {
 		if (usehash_ce(upi->config_kset).u.value != 0) {
-			ct_hash_add(cpi->ct_active, ct->id);
+			ct_hash_add(cpi->ct_active, nfct_get_attr_u32(ct, ATTR_ID));
 			return 0;
 		}
 	} else if (type == NFCT_MSG_DESTROY) {
 		if (usehash_ce(upi->config_kset).u.value != 0)
-			ts = ct_hash_get(cpi->ct_active, ct->id);
+			ts = ct_hash_get(cpi->ct_active, nfct_get_attr_u32(ct, ATTR_ID));
 	}
 
 	/* since we support the re-use of one instance in
 	 * several different stacks, we duplicate the message
 	 * to let them know */
 	llist_for_each_entry(npi, &upi->plist, plist) {
-		ret = propagate_ct(npi, ct, flags, type, ts);
+		ret = propagate_ct(npi, ct, type, ts);
 		if (ret != 0)
 			return ret;
 	}
-	return propagate_ct(upi, ct, flags, type, ts);
+	return propagate_ct(upi, ct, type, ts);
 }
 
 static int read_cb_nfct(int fd, unsigned int what, void *param)

@@ -614,7 +632,7 @@ static int read_cb_nfct(int fd, unsigned int what, void *param)
 		return 0;
 
 	/* FIXME: implement this */
-	nfct_event_conntrack(cpi->cth);
+	nfct_catch(cpi->cth);
 	return 0;
 }
 

@@ -668,7 +686,7 @@ static int constructor_nfct(struct ulogd_pluginstance *upi)
 		return -1;
 	}
 
-	nfct_register_callback(cpi->cth, &event_handler, upi);
+	nfct_callback_register(cpi->cth, NFCT_T_ALL, &event_handler, upi);
 
 	cpi->nfct_fd.fd = nfct_fd(cpi->cth);
 	cpi->nfct_fd.cb = &read_cb_nfct;
Signature · 1 line
1.5.2.5
maintainer
#10 lore raw

Re: [ULOGD PATCH 5/6] Port of NFCT plugin to new libnetfilter_conntrack API.

Quoted 3 lines · Eric Leblond

This patch is a port to the new libnetfilter_conntrack API of the NFCT plugin. To be able to send IP addresses to the IP2STR and IP2BIN module oob.family and oob.protocol keys have been added.

Applied, thanks. A patch on top of it to break lines at 80 columns would be great.

Quoted 4 lines

There is only a single function which is marked as deprecated. This is nfct_dump_conntrack_table_reset_counters. This function is used to dump periodically counters. By default, this feature is not used. IMHO we could suppress this code and use conntrackd for similar tasks.

As the counters are 32 bits, we can store 64 bits counters in userspace and periodically dump-and-reset the counters. Thus, we ensure that the probability of an overflow is low while using little memory in kernel space. We think that we should fix this in ulogd.

The problem that I see, not directly related with this, is that if ulogd does this counter-and-reset, it may break other existing application polling to obtain the counters. Probably we need a netlink event to notify to all processes that the counters have been reset.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
author
#11 lore raw

PATCH 6/6 Fix display of DESTROY event.

In reply to Eric Leblond

DESTROY event were not correctly displayed due to a problem in event type detection.

Signed-off-by Eric Leblond <[email protected]>

---
:100644 100644 272ee4f... d2ce952... M util/printflow.c

 util/printflow.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
util/printflow.c +1 -1
index 272ee4f..d2ce952 100644
@@ -153,7 +153,7 @@ int printflow_print(struct ulogd_key *res, char *buf)
 			case 2:
 				buf_cur += sprintf(buf_cur, "[UPDATE] ");
 				break;
-			case 3:
+			case 4:
 				buf_cur += sprintf(buf_cur, "[DESTROY] ");
 				break;
 		}
Signature · 1 line
1.5.2.5