Skip to contentSkip to conversation

add mark event filter

PATCH In review Ken-ichirou MATSUZAWA 3 participants 5 messages Mar 12, 2015 – Mar 13, 2015 netfilter

lore
Share & tools
lore

Ken-ichirou MATSUZAWA

author
#0 lore raw

cover add mark event filter

Hi,

This patchset adds mark filter for event listener and its test. Would you review?

author
#1 lore raw

PATCH 1/2 conntrack: add mark event filter

This patch adds mark filter for event listener, using same struct nfct_filter_dump_mark at dump.

Signed-off-by Ken-ichirou MATSUZAWA <[email protected]>
---
 include/internal/object.h                          |  7 +++
 .../libnetfilter_conntrack.h                       |  1 +
 src/conntrack/bsf.c                                | 73 ++++++++++++++++++++++
 src/conntrack/filter.c                             | 13 ++++
 4 files changed, 94 insertions(+)
include/internal/object.h +7 -0
index 540ad0d..1259467 100644
@@ -263,6 +263,13 @@ struct nfct_filter {
 		u_int32_t 	mask[4];
 	} l3proto_ipv6[2][__FILTER_IPV6_MAX];
 
+	u_int32_t 		mark_elems;
+	struct {
+#define __FILTER_MARK_MAX	127
+		u_int32_t 	val;
+		u_int32_t 	mask;
+	} mark[__FILTER_MARK_MAX];
+
 	u_int32_t 		set[1];
 };
include/libnetfilter_conntrack/libnetfilter_conntrack.h +1 -0
index d04a0c6..cea9a78 100644
@@ -499,6 +499,7 @@ enum nfct_filter_attr {
 	NFCT_FILTER_DST_IPV4,		/* struct nfct_filter_ipv4 */
 	NFCT_FILTER_SRC_IPV6,		/* struct nfct_filter_ipv6 */
 	NFCT_FILTER_DST_IPV6,		/* struct nfct_filter_ipv6 */
+	NFCT_FILTER_MARK,		/* struct nfct_filter_dump_mark */
 	NFCT_FILTER_MAX
 };
src/conntrack/bsf.c +73 -0

97 lines not on this page · raw message

src/conntrack/filter.c +13 -0
index 026545a..78fbbc5 100644
@@ -79,6 +79,18 @@ static void filter_attr_dst_ipv6(struct nfct_filter *filter, const void *value)
 	filter->l3proto_elems_ipv6[1]++;
 }
 
+static void filter_attr_mark(struct nfct_filter *filter, const void *value)
+{
+	const struct nfct_filter_dump_mark *this = value;
+
+	if (filter->mark_elems >= __FILTER_MARK_MAX)
+		return;
+
+	filter->mark[filter->mark_elems].val = this->val;
+	filter->mark[filter->mark_elems].mask = this->mask;
+	filter->mark_elems++;
+}
+
 const filter_attr filter_attr_array[NFCT_FILTER_MAX] = {
 	[NFCT_FILTER_L4PROTO]		= filter_attr_l4proto,
 	[NFCT_FILTER_L4PROTO_STATE]	= filter_attr_l4proto_state,

@@ -86,4 +98,5 @@ const filter_attr filter_attr_array[NFCT_FILTER_MAX] = {
 	[NFCT_FILTER_DST_IPV4]		= filter_attr_dst_ipv4,
 	[NFCT_FILTER_SRC_IPV6]		= filter_attr_src_ipv6,
 	[NFCT_FILTER_DST_IPV6]		= filter_attr_dst_ipv6,
+	[NFCT_FILTER_MARK]		= filter_attr_mark,
 };
Signature · 1 line
2.1.4
author
#2 lore raw

PATCH 2/2 qa: add test for mark event filter

In reply to Ken-ichirou MATSUZAWA

testing mark filter in root by

    # ./qa/ct_mark_filter.sh
Signed-off-by Ken-ichirou MATSUZAWA <[email protected]>
---
 qa/Makefile.am       |   6 ++-
 qa/ct_mark_filter.c  | 149 +++++++++++++++++++++++++++++++++++++++++++++++++++
 qa/ct_mark_filter.sh |  36 +++++++++++++
 qa/nssocket_env.sh   |   2 +-
 4 files changed, 191 insertions(+), 2 deletions(-)
 create mode 100644 qa/ct_mark_filter.c
 create mode 100755 qa/ct_mark_filter.sh
qa/Makefile.am +5 -1
index b16ab01..3c8a1cb 100644
@@ -1,7 +1,7 @@
 include $(top_srcdir)/Make_global.am
 
 check_PROGRAMS = test_api test_filter test_connlabel ct_stress \
-	ct_events_reliable ct_echo_event
+	ct_events_reliable ct_echo_event ct_mark_filter
 
 test_api_SOURCES = test_api.c
 test_api_LDADD = ../src/libnetfilter_conntrack.la

@@ -22,3 +22,7 @@ AM_CFLAGS += -D_GNU_SOURCE
 ct_echo_event_SOURCES = ct_echo_event.c nssocket.c
 ct_echo_event_DEPENDENCIES = ct_echo_event.sh
 ct_echo_event_LDADD = ../src/libnetfilter_conntrack.la -lmnl
+
+ct_mark_filter_SOURCES = ct_mark_filter.c nssocket.c
+ct_mark_filter_DEPENDENCIES = ct_mark_filter.sh
+ct_mark_filter_LDADD = ../src/libnetfilter_conntrack.la -lmnl
qa/ct_mark_filter.c new file +149 -0

149 lines not on this page · raw message

qa/ct_mark_filter.sh new file +36 -0
new file mode 100755
index 0000000..a2c7fed
@@ -0,0 +1,36 @@
+#!/bin/sh
+
+. `dirname $0`/nssocket_env.sh
+
+echo "---- TCP echo with ctmark 0/0 [filter_mark_zero]"
+pre_sync
+echo | nc -q 0 $VETH_CHILD_ADDR $DSTPORT
+post_sync
+
+echo "---- iptables CONNMARK settings - ctmark tcp 2/2, tcp fin 1/1"
+ip netns exec $NETNS sh <<EOF
+    iptables -t mangle -I PREROUTING -p tcp -m tcp -j CONNMARK --set-mark 2/2
+    iptables -t mangle -I PREROUTING -p tcp -m tcp --tcp-flags FIN FIN -j CONNMARK --set-mark 1/1
+EOF
+
+echo "---- TCP echo with mark filter 1/1 [filter_mark_1_1]"
+pre_sync
+echo | nc -q 0 $VETH_CHILD_ADDR $DSTPORT
+post_sync
+
+echo "---- TCP echo with mark filter ! 1/1 [filter_mark_neg_1_1]"
+pre_sync
+echo | nc -q 0 $VETH_CHILD_ADDR $DSTPORT
+post_sync
+
+echo "---- TCP echo with mark filter !0/fffffffd [filter_mark_neg_0_fffffffd]"
+pre_sync
+echo | nc -q 0 $VETH_CHILD_ADDR $DSTPORT
+post_sync
+
+echo "---- max mark filter entry [filter_mark_max]"
+pre_sync
+echo | nc -q 0 $VETH_CHILD_ADDR $DSTPORT
+post_sync
+
+fin
qa/nssocket_env.sh +1 -1
index 2bcd74d..1732eb1 100644
@@ -11,7 +11,7 @@ DSTPORT="7"
 ICMP_TYPE="8"
 ICMP_CODE="0"
 NF_TIMEOUT=2
-INIT_TIMEOUT=4
+INIT_TIMEOUT=8
 
 dname=`dirname $0`
 bname=`basename $0`
Signature · 1 line
2.1.4
maintainer
#3 lore raw
In reply to Ken-ichirou MATSUZAWA
Quoted 4 lines · Ken-ichirou MATSUZAWA

Hi,

This patchset adds mark filter for event listener and its test. Would you review?

Looks fine.

It would be good if someone can send follow up patches to:

1) Replace hardcoded '127' values by constants.

2) Assert on too many address/mark/etc instead of silently ignoring. The existing behaviour doesn't look good to me as the user will not know that it has reach the limit. Unfortunately this function was not designed at that time to return an error instead, so we cannot change that :-(