Skip to contentSkip to conversation

Add ctnetlink_change_protoinfo

PATCH In review Pablo Neira 2 participants 3 messages Aug 1, 2005 – Aug 2, 2005

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 4/7 Add ctnetlink_change_protoinfo

Implement a function to change the private protocol information stored in a conntrack.

net/ipv4/netfilter/ip_conntrack_netlink.c +42 -0
Index: netfilter-2.6.14/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================
@@ -948,6 +948,36 @@
 	return 0;
 }
 
+static inline int
+ctnetlink_change_protoinfo(struct ip_conntrack *ct, struct nfattr *cda[])
+{
+	struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
+	struct ip_conntrack_protocol *proto;
+	u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
+	int err;
+
+	if (nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr) < 0)
+		goto nfattr_failure;
+
+	proto = ip_conntrack_proto_find_get(npt);
+	if (!proto)
+		return -EINVAL;
+
+	if (proto->from_nfattr) {
+		err = proto->from_nfattr(tb, ct);
+		if (err < 0) {
+			ip_conntrack_proto_put(proto);
+			return -EINVAL;
+		}
+	}
+	ip_conntrack_proto_put(proto);
+
+	return 0;
+
+nfattr_failure:
+	return -1;
+}
+
 static int
 ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
 {
@@ -973,6 +1003,12 @@
 			return err;
 	}
 
+	if (cda[CTA_PROTOINFO-1]) {
+		err = ctnetlink_change_protoinfo(ct, cda);
+		if (err < 0)
+			return err;
+	}
+
 	DEBUGP("all done\n");
 	return 0;
 }
@@ -1002,6 +1038,12 @@
 	if (err < 0)
 		goto err;
 
+	if (cda[CTA_PROTOINFO-1]) {
+		err = ctnetlink_change_protoinfo(ct, cda);
+		if (err < 0)
+			return err;
+	}
+
 	ct->helper = ip_conntrack_helper_find_get(rtuple);
 
 	add_timer(&ct->timeout);
#1 lore raw
Quoted 2 lines · Pablo Neira

Implement a function to change the private protocol information stored in a conntrack.

I removed this from the patch intentionally for now. I really don't like the idea of userspace messing with the protocol specific state.

For now (this can change in the future) my policy is: Userspace can only change 'safe' things in the conntrack table.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie
#2 lore raw

Hi Harald,

Ok, I'll try to be more verbose, these surely will help to understand what I'm trying to do with the patches.

Quoted 9 lines · Harald Welte
Quoted 1 line · Pablo Neira

Implement a function to change the private protocol information stored in a conntrack.

I removed this from the patch intentionally for now. I really don't like the idea of userspace messing with the protocol specific state.

For now (this can change in the future) my policy is: Userspace can only change 'safe' things in the conntrack table.

Why? Currently if I create a TCP conntrack, the user won't be able to set the state, so the state will be set to NONE.

Besides, I think that libnfnetlink_conntrack must provide as many features to manipulate the connection tracking as possible. For example, think that someone whats to use libctnetlink to implement some kind of conntrack replication. If the user mess with it, it's his fault.

--
Pablo