send conntrack events on ctnetlink actions

Index: net-2.6/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================
@@ -986,7 +986,9 @@ ctnetlink_change_protoinfo(struct ip_con
 }
 
 static int
-ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
+ctnetlink_change_conntrack(struct ip_conntrack *ct,
+			   struct nfattr *cda[],
+			   unsigned int *changeset)
 {
 	int err;
 

@@ -996,29 +998,35 @@ ctnetlink_change_conntrack(struct ip_con
 		err = ctnetlink_change_helper(ct, cda);
 		if (err < 0)
 			return err;
+		*changeset |= IPCT_HELPER;
 	}
 
 	if (cda[CTA_TIMEOUT-1]) {
 		err = ctnetlink_change_timeout(ct, cda);
 		if (err < 0)
 			return err;
+		*changeset |= IPCT_REFRESH;
 	}
 
 	if (cda[CTA_STATUS-1]) {
 		err = ctnetlink_change_status(ct, cda);
 		if (err < 0)
 			return err;
+		*changeset |= IPCT_STATUS;
 	}
 
 	if (cda[CTA_PROTOINFO-1]) {
 		err = ctnetlink_change_protoinfo(ct, cda);
 		if (err < 0)
 			return err;
+		*changeset |= IPCT_PROTOINFO;
 	}
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
-	if (cda[CTA_MARK-1])
+	if (cda[CTA_MARK-1]) {
 		ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
+		*changeset |= IPCT_MARK;
+	}
 #endif
 
 	DEBUGP("all done\n");

@@ -1032,6 +1040,7 @@ ctnetlink_create_conntrack(struct nfattr
 {
 	struct ip_conntrack *ct;
 	int err = -EINVAL;
+	unsigned int changeset = IPCT_NEW|IPCT_REFRESH|IPCT_STATUS;
 
 	DEBUGP("entered %s\n", __FUNCTION__);
 

@@ -1054,12 +1063,17 @@ ctnetlink_create_conntrack(struct nfattr
 		err = ctnetlink_change_protoinfo(ct, cda);
 		if (err < 0)
 			return err;
+		changeset |= IPCT_PROTOINFO;
 	}
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
-	if (cda[CTA_MARK-1])
+	if (cda[CTA_MARK-1]) {
 		ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
+		changeset |= IPCT_MARK;
+	}
 #endif
+	/* increase refcount to 2 for event notification */
+	atomic_inc(&ct->ct_general.use);
 
 	/* we do no want any races on hash insertion */
 	write_lock_bh(&ip_conntrack_lock);

@@ -1068,6 +1082,10 @@ ctnetlink_create_conntrack(struct nfattr
 	add_timer(&ct->timeout);
 	write_unlock_bh(&ip_conntrack_lock);
 
+	/* now, notify the creation of this conntrack */
+	ip_conntrack_event(changeset, ct);
+	ip_conntrack_put(ct);
+
 	DEBUGP("conntrack with id %u inserted\n", ct->id);
 	return 0;
 

@@ -1083,6 +1101,7 @@ ctnetlink_new_conntrack(struct sock *ctn
 	struct ip_conntrack_tuple otuple, rtuple;
 	struct ip_conntrack_tuple_hash *h = NULL;
 	int err = 0;
+	unsigned int changeset = 0;
 
 	DEBUGP("entered %s\n", __FUNCTION__);
 

@@ -1108,30 +1127,36 @@ ctnetlink_new_conntrack(struct sock *ctn
 		h = __ip_conntrack_find(&rtuple, NULL);
 
 	if (h == NULL) {
+		/* create new conntrack */
 		write_unlock_bh(&ip_conntrack_lock);
 		DEBUGP("no such conntrack, create new\n");
 		err = -ENOENT;
 		if (nlh->nlmsg_flags & NLM_F_CREATE)
 			err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
-		return err;
-	}
-	/* implicit 'else' */
+	} else {
+		/* update existing conntrack */
+		struct ip_conntrack *ct = tuplehash_to_ctrack(h);
 
-	/* we only allow nat config for new conntracks */
-	if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
-		err = -EINVAL;
-		goto out_unlock;
-	}
+		/* we only allow nat config for new conntracks */
+		if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
+			write_unlock_bh(&ip_conntrack_lock);
+			return -EINVAL;
+		}
 
-	/* We manipulate the conntrack inside the global conntrack table lock,
-	 * so there's no need to increase the refcount */
-	DEBUGP("conntrack found\n");
-	err = -EEXIST;
-	if (!(nlh->nlmsg_flags & NLM_F_EXCL))
-		err = ctnetlink_change_conntrack(tuplehash_to_ctrack(h), cda);
+		DEBUGP("conntrack found\n");
+		err = -EEXIST;
+		if (!(nlh->nlmsg_flags & NLM_F_EXCL))
+			err = ctnetlink_change_conntrack(ct, cda, &changeset);
 
-out_unlock:
-	write_unlock_bh(&ip_conntrack_lock);
+		atomic_inc(&ct->ct_general.use);
+		write_unlock_bh(&ip_conntrack_lock);
+
+		/* report update event if no error happened */
+		if (err >= 0)
+			ip_conntrack_event(changeset, ct);
+
+		ip_conntrack_put(ct);
+	}
 	return err;
 }
 

@@ -1523,6 +1548,7 @@ ctnetlink_create_expect(struct nfattr *c
 	memcpy(&exp->mask, &mask, sizeof(struct ip_conntrack_tuple));
 
 	err = ip_conntrack_expect_related(exp);
+	ip_conntrack_expect_event(IPEXP_NEW, exp);
 	ip_conntrack_expect_put(exp);
 
 out:	

Index: net-2.6/net/ipv4/netfilter/ip_conntrack_core.c
===================================================================
@@ -1324,6 +1324,7 @@ static struct nf_sockopt_ops so_getorigd
 
 static int kill_all(struct ip_conntrack *i, void *data)
 {
+	ip_conntrack_event(IPCT_DESTROY, i);
 	return 1;
 }
 

149 lines not on this page · raw message

Index: net-2.6/net/netfilter/nf_conntrack_core.c
===================================================================
@@ -1525,6 +1525,7 @@ nf_ct_iterate_cleanup(int (*iter)(struct
 
 static int kill_all(struct nf_conn *i, void *data)
 {
+	nf_conntrack_event(IPCT_DESTROY, i);
 	return 1;
 }