Skip to contentSkip to conversation

add event filters

PATCH New Ken-ichirou MATSUZAWA 1 participant 3 messages Jun 9, 2014 netfilter

lore
Share & tools
lore

Ken-ichirou MATSUZAWA

author
#0 lore raw

v2 cover add event filters

Hello,

I tried to chang zero CTA_MARK and CTA_ZONE value handling, regard its value as 0 if the values are not set in a message.

Thanks,

author
#1 lore raw

PATCH v2 1/2 conntrack: add mark event filter

This patch adds mark filter for event listener, using same struct nfct_filter_dump_mark.

Signed-off-by Ken-ichirou MATSUZAWA <[email protected]>
---
 include/internal/object.h                          |  7 +++
 .../libnetfilter_conntrack.h                       |  1 +
 src/conntrack/bsf.c                                | 73 ++++++++++++++++++++++
 src/conntrack/filter.c                             | 13 ++++
 4 files changed, 94 insertions(+)
include/internal/object.h +7 -0
index 540ad0d..1259467 100644
@@ -263,6 +263,13 @@ struct nfct_filter {
 		u_int32_t 	mask[4];
 	} l3proto_ipv6[2][__FILTER_IPV6_MAX];
 
+	u_int32_t 		mark_elems;
+	struct {
+#define __FILTER_MARK_MAX	127
+		u_int32_t 	val;
+		u_int32_t 	mask;
+	} mark[__FILTER_MARK_MAX];
+
 	u_int32_t 		set[1];
 };
include/libnetfilter_conntrack/libnetfilter_conntrack.h +1 -0
index a5e6a91..03bf3ca 100644
@@ -498,6 +498,7 @@ enum nfct_filter_attr {
 	NFCT_FILTER_DST_IPV4,		/* struct nfct_filter_ipv4 */
 	NFCT_FILTER_SRC_IPV6,		/* struct nfct_filter_ipv6 */
 	NFCT_FILTER_DST_IPV6,		/* struct nfct_filter_ipv6 */
+	NFCT_FILTER_MARK,		/* struct nfct_filter_dump_mark */
 	NFCT_FILTER_MAX
 };
src/conntrack/bsf.c +73 -0

97 lines not on this page · raw message

src/conntrack/filter.c +13 -0
index 026545a..78fbbc5 100644
@@ -79,6 +79,18 @@ static void filter_attr_dst_ipv6(struct nfct_filter *filter, const void *value)
 	filter->l3proto_elems_ipv6[1]++;
 }
 
+static void filter_attr_mark(struct nfct_filter *filter, const void *value)
+{
+	const struct nfct_filter_dump_mark *this = value;
+
+	if (filter->mark_elems >= __FILTER_MARK_MAX)
+		return;
+
+	filter->mark[filter->mark_elems].val = this->val;
+	filter->mark[filter->mark_elems].mask = this->mask;
+	filter->mark_elems++;
+}
+
 const filter_attr filter_attr_array[NFCT_FILTER_MAX] = {
 	[NFCT_FILTER_L4PROTO]		= filter_attr_l4proto,
 	[NFCT_FILTER_L4PROTO_STATE]	= filter_attr_l4proto_state,

@@ -86,4 +98,5 @@ const filter_attr filter_attr_array[NFCT_FILTER_MAX] = {
 	[NFCT_FILTER_DST_IPV4]		= filter_attr_dst_ipv4,
 	[NFCT_FILTER_SRC_IPV6]		= filter_attr_src_ipv6,
 	[NFCT_FILTER_DST_IPV6]		= filter_attr_dst_ipv6,
+	[NFCT_FILTER_MARK]		= filter_attr_mark,
 };
Signature · 1 line
1.9.1
author
#2 lore raw

PATCH v2 2/2 conntrack: add zone event filter

In reply to Ken-ichirou MATSUZAWA

This patch adds zone filter for event listener.

Signed-off-by Ken-ichirou MATSUZAWA <[email protected]>
---
 include/internal/object.h                          |  4 ++
 .../libnetfilter_conntrack.h                       |  1 +
 src/conntrack/bsf.c                                | 71 +++++++++++++++++++---
 src/conntrack/filter.c                             | 10 +++
 4 files changed, 77 insertions(+), 9 deletions(-)
include/internal/object.h +4 -0
index 1259467..83d9010 100644
@@ -270,6 +270,10 @@ struct nfct_filter {
 		u_int32_t 	mask;
 	} mark[__FILTER_MARK_MAX];
 
+	u_int32_t 		zone_elems;
+#define __FILTER_ZONE_MAX	511
+	u_int16_t		zone[__FILTER_ZONE_MAX];
+
 	u_int32_t 		set[1];
 };
include/libnetfilter_conntrack/libnetfilter_conntrack.h +1 -0
index 03bf3ca..52fee85 100644
@@ -499,6 +499,7 @@ enum nfct_filter_attr {
 	NFCT_FILTER_SRC_IPV6,		/* struct nfct_filter_ipv6 */
 	NFCT_FILTER_DST_IPV6,		/* struct nfct_filter_ipv6 */
 	NFCT_FILTER_MARK,		/* struct nfct_filter_dump_mark */
+	NFCT_FILTER_ZONE,		/* u_int16_t */
 	NFCT_FILTER_MAX
 };
src/conntrack/bsf.c +62 -9

101 lines not on this page · raw message

src/conntrack/filter.c +10 -0
index 78fbbc5..34be99b 100644
@@ -91,6 +91,15 @@ static void filter_attr_mark(struct nfct_filter *filter, const void *value)
 	filter->mark_elems++;
 }
 
+static void filter_attr_zone(struct nfct_filter *filter, const void *value)
+{
+	if (filter->zone_elems >= __FILTER_ZONE_MAX)
+		return;
+
+	filter->zone[filter->zone_elems] = *(u_int16_t *)value;
+	filter->zone_elems++;
+}
+
 const filter_attr filter_attr_array[NFCT_FILTER_MAX] = {
 	[NFCT_FILTER_L4PROTO]		= filter_attr_l4proto,
 	[NFCT_FILTER_L4PROTO_STATE]	= filter_attr_l4proto_state,

@@ -99,4 +108,5 @@ const filter_attr filter_attr_array[NFCT_FILTER_MAX] = {
 	[NFCT_FILTER_SRC_IPV6]		= filter_attr_src_ipv6,
 	[NFCT_FILTER_DST_IPV6]		= filter_attr_dst_ipv6,
 	[NFCT_FILTER_MARK]		= filter_attr_mark,
+	[NFCT_FILTER_ZONE]		= filter_attr_zone,
 };
Signature · 1 line
1.9.1