netfilter: xtables: userspace notification target

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute for userspace to match it against a previously set rule. The rules also take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the target is in place. This target uses the nefilter netlink framework.

Quoted 8 lines · Samuel Ortiz

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute for userspace to match it against a previously set rule. The rules also take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the target is in place. This target uses the nefilter netlink framework.

Would it not make sense to modify that module?
Sounds an awful lot like NFQUEUE without passing the payload :)

Quoted 7 lines

+++ b/net/netfilter/xt_NFNOTIF.c

net/netfilter/xt_NFNOTIF.c new file +6 -0

+struct nfnotif_tg {
+	struct list_head entry;
+	struct work_struct work;
+
+	char *label;
+	__u8 all_packets;

net/netfilter/xt_NFNOTIF.c line 44

Quoted 6 lines

net/netfilter/xt_NFNOTIF.c new file +6 -0

+	struct net *net;
+
+	__u8 send_notif;
+
+	unsigned int refcnt;
+};

Has unnecessary padding holes.

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute for userspace to match it against a previously set rule. The rules also take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the target is in place. This target uses the nefilter netlink framework.

This target combined with various matches (quota, rateest, etc..) allows userspace to make decisions on interfaces handling. One could for example decide to switch between power saving modes depending on estimated rate thresholds.

 include/linux/netfilter/Kbuild             |    1 + include/linux/netfilter/nfnetlink.h        |    5 +- include/linux/netfilter/nfnetlink_compat.h |    1 + include/linux/netfilter/xt_NFNOTIF.h       |   55 +++++ net/netfilter/Kconfig                      |   17 ++ net/netfilter/Makefile                     |    1 + net/netfilter/xt_NFNOTIF.c                 |  300 ++++++++++++++++++++++++++++

 7 files changed, 379 insertions(+), 1 deletions(-)

 create mode 100644 include/linux/netfilter/xt_NFNOTIF.h create mode 100644 net/netfilter/xt_NFNOTIF.c

include/linux/netfilter/Kbuild +0 -0

index bb103f4..1b80b27 100644
@@ -12,6 +12,7 @@ header-y += xt_IDLETIMER.h

 header-y += xt_LED.h
 header-y += xt_MARK.h
 header-y += xt_NFLOG.h
+header-y += xt_NFNOTIF.h
 header-y += xt_NFQUEUE.h
 header-y += xt_RATEEST.h
 header-y += xt_SECMARK.h

include/linux/netfilter/nfnetlink.h +4 -1

index 361d6b5..e336f03 100644
@@ -18,6 +18,8 @@ enum nfnetlink_groups {
  #define NFNLGRP_CONNTRACK_EXP_UPDATE   NFNLGRP_CONNTRACK_EXP_UPDATE
        NFNLGRP_CONNTRACK_EXP_DESTROY,
  #define NFNLGRP_CONNTRACK_EXP_DESTROY  NFNLGRP_CONNTRACK_EXP_DESTROY
+       NFNLGRP_NFNOTIF,
+#define NFNLGRP_NFNOTIF                        NFNLGRP_NFNOTIF
        __NFNLGRP_MAX,
  };
  #define NFNLGRP_MAX    (__NFNLGRP_MAX - 1)

@@ -47,7 +49,8 @@ struct nfgenmsg {
  #define NFNL_SUBSYS_QUEUE              3
  #define NFNL_SUBSYS_ULOG               4
  #define NFNL_SUBSYS_OSF                        5
-#define NFNL_SUBSYS_COUNT              6
+#define NFNL_SUBSYS_NFNOTIF            6
+#define NFNL_SUBSYS_COUNT              7
 
  #ifdef __KERNEL__
 

include/linux/netfilter/nfnetlink_compat.h +1 -0

index ffb9503..dca8ab2 100644
@@ -13,6 +13,7 @@
  #define NF_NETLINK_CONNTRACK_EXP_NEW           0x00000008
  #define NF_NETLINK_CONNTRACK_EXP_UPDATE                0x00000010
  #define NF_NETLINK_CONNTRACK_EXP_DESTROY       0x00000020
+#define NF_NETLINK_NFNOTIF                     0x00000040
 
  /* Generic structure for encapsulation optional netfilter information.
  * It is reminiscent of sockaddr, but with sa_family replaced

include/linux/netfilter/xt_NFNOTIF.h new file +55 -0

new file mode 100644
index 0000000..8fae827
@@ -0,0 +1,55 @@
+/*
+ * linux/include/linux/netfilter/xt_NFNOTIF.h
+ *
+ * Header file for Xtables notification target module.
+ *
+ * Copyright (C) 2010 Intel Corporation
+ * Samuel Ortiz <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#ifndef _XT_NFNOTIF_H
+#define _XT_NFNOTIF_H
+
+#include <linux/types.h>
+
+enum nfnotif_msg_type {
+       NFNOTIF_TG_MSG_PACKETS,
+
+       NFNOTIF_TG_MSG_MAX
+};
+
+enum nfnotif_attr_type {
+       NFNOTIF_TG_ATTR_UNSPEC,
+       NFNOTIF_TG_ATTR_LABEL,
+       NFNOTIF_TG_ATTR_SEND_NOTIF,
+
+       __NFNOTIF_TG_ATTR_AFTER_LAST
+};
+#define NFNOTIF_TG_ATTR_MAX (__NFNOTIF_TG_ATTR_AFTER_LAST - 1)
+
+#define MAX_NFNOTIF_LABEL_SIZE 31
+
+struct nfnotif_tg_info {
+       __u8 all_packets;
+
+       char label[MAX_NFNOTIF_LABEL_SIZE];
+
+       /* for kernel module internal use only */
+       struct nfnotif_tg *notif __attribute((aligned(8)));
+};
+
+#endif

net/netfilter/Kconfig +0 -0

index aa2f106..0e2de36 100644
@@ -469,6 +469,23 @@ config NETFILTER_XT_TARGET_NFQUEUE
 

         To compile it as a module, choose M here.  If unsure, say N.

net/netfilter/Kconfig +17 -0

+config NETFILTER_XT_TARGET_NFNOTIF
+       tristate '"NFNOTIF" target Support'
+       depends on NETFILTER_ADVANCED
+       select NETFILTER_NETLINK
+       help
+
+         This option adds the `NFNOTIF' target, which allows to send
+         netfilter netlink messages when packets hit the target.
+
+         This target comes with an option to specify if one wants all
+         packets hitting the target to trigger the netlink message
+         transmission, or only the first one.
+         It also listen on its netfilter netlink subsystem for messages
+         allowing to reset the above option.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config NETFILTER_XT_TARGET_NOTRACK
       tristate  '"NOTRACK" target support'
       depends on IP_NF_RAW || IP6_NF_RAW

net/netfilter/Makefile +0 -0

index e28420a..5d9c9e9 100644
@@ -62,6 +62,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP) += xt_TCPOPTSTRIP.o

 obj-$(CONFIG_NETFILTER_XT_TARGET_TEE) += xt_TEE.o obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o obj-$(CONFIG_NETFILTER_XT_TARGET_IDLETIMER) += xt_IDLETIMER.o +obj-$(CONFIG_NETFILTER_XT_TARGET_NFNOTIF) += xt_NFNOTIF.o

 # matches
 obj-$(CONFIG_NETFILTER_XT_MATCH_CLUSTER) += xt_cluster.o

net/netfilter/xt_NFNOTIF.c new file +145 -0

new file mode 100644
index 0000000..e6e906b
@@ -0,0 +1,300 @@
+/*
+ * linux/net/netfilter/xt_NFNOTIF.c
+ *
+ * Copyright (C) 2010 Intel Corporation
+ * Samuel Ortiz <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/xt_NFNOTIF.h>
+
+struct nfnotif_tg {
+       struct list_head entry;
+       struct work_struct work;
+
+       char *label;
+       __u8 all_packets;
+       struct net *net;
+
+       __u8 send_notif;
+
+       unsigned int refcnt;
+};
+
+static LIST_HEAD(nfnotif_tg_list);
+static DEFINE_MUTEX(list_mutex);
+
+static int __nfnotif_tg_netlink_send(struct nfnotif_tg *nfnotif)
+{
+       struct nlmsghdr *nlh;
+       struct nfgenmsg *nfmsg;
+       struct sk_buff *skb;
+       struct net *net = nfnotif->net;
+       unsigned int type;
+       int flags;
+
+       type = NFNL_SUBSYS_NFNOTIF << 8;
+       flags = NLM_F_CREATE;
+
+       skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+       if (skb == NULL)
+               goto error_out;
+
+       nlh = nlmsg_put(skb, 0, 0, type, sizeof(*nfmsg), flags);
+       if (nlh == NULL)
+               goto nlmsg_put_failure;
+
+       nfmsg = nlmsg_data(nlh);
+       nfmsg->version      = NFNETLINK_V0;
+       nfmsg->res_id       = 0;
+
+       NLA_PUT_STRING(skb, NFNOTIF_TG_ATTR_LABEL, nfnotif->label);
+
+       nlmsg_end(skb, nlh);
+
+       return nfnetlink_send(skb, net, 0, NFNLGRP_NFNOTIF, 0, GFP_KERNEL);
+
+nla_put_failure:
+       nlmsg_cancel(skb, nlh);
+
+nlmsg_put_failure:
+       kfree_skb(skb);
+
+error_out:
+       return nfnetlink_set_err(net, 0, 0, -ENOBUFS);
+}
+
+static void nfnotif_tg_work(struct work_struct *work)
+{
+       struct nfnotif_tg *notif = container_of(work, struct nfnotif_tg, work);
+
+
+       if (__nfnotif_tg_netlink_send(notif) < 0)
+               pr_debug("Could not send notification");
+
+       if (!notif->all_packets)
+               notif->send_notif = 0;
+}
+
+static struct nfnotif_tg *__nfnotif_tg_find_by_label(const char *label)
+{
+       struct nfnotif_tg *entry;
+
+       BUG_ON(!label);
+
+       list_for_each_entry(entry, &nfnotif_tg_list, entry) {
+               if (!strcmp(label, entry->label))
+                       return entry;
+       }
+
+       return NULL;
+}
+
+static int nfnotif_tg_create(struct nfnotif_tg_info *info)
+{
+       info->notif = kmalloc(sizeof(*info->notif), GFP_KERNEL);
+       if (!info->notif) {
+               pr_debug("Couldn't allocate notification\n");
+               return -ENOMEM;
+       }
+
+       info->notif->label = kstrdup(info->label, GFP_KERNEL);
+       if (!info->notif->label) {
+               pr_debug("Couldn't allocate label\n");
+               kfree(info->notif);
+               return -ENOMEM;
+       }
+
+       info->notif->all_packets = info->all_packets;
+       info->notif->send_notif = 1;
+
+       list_add(&info->notif->entry, &nfnotif_tg_list);
+
+       info->notif->refcnt = 1;
+
+       INIT_WORK(&info->notif->work, nfnotif_tg_work);
+
+       return 0;
+}
+
+static unsigned int nfnotif_tg_target(struct sk_buff *skb,
+                                     const struct xt_action_param *par)
+{
+       const struct nfnotif_tg_info *info = par->targinfo;

net/netfilter/xt_NFNOTIF.c new file +145 -1

+       return XT_CONTINUE;
+}
+
+static int nfnotif_tg_checkentry(const struct xt_tgchk_param *par)
+{
+       struct nfnotif_tg_info *info = par->targinfo;
+       int ret;
+
+       pr_debug("Checkentry targinfo %s\n", info->label);
+
+       if (info->label[0] == '\0' ||
+           strnlen(info->label,
+                   MAX_NFNOTIF_LABEL_SIZE) == MAX_NFNOTIF_LABEL_SIZE) {
+               pr_debug("Label is empty or not nul-terminated\n");
+               return -EINVAL;
+       }
+
+       mutex_lock(&list_mutex);
+
+       info->notif = __nfnotif_tg_find_by_label(info->label);
+       if (info->notif) {
+               info->notif->refcnt++;
+
+               pr_debug("Increased refcnt for %s to %u\n",
+                        info->label, info->notif->refcnt);
+       } else {
+               ret = nfnotif_tg_create(info);
+               if (ret < 0) {
+                       pr_debug("Failed to create notification\n");
+                       mutex_unlock(&list_mutex);
+                       return ret;
+               }
+       }
+
+       info->notif->net = par->net;
+
+       mutex_unlock(&list_mutex);
+       return 0;
+}
+
+static void nfnotif_tg_destroy(const struct xt_tgdtor_param *par)
+{
+       const struct nfnotif_tg_info *info = par->targinfo;
+
+       pr_debug("Destroy targinfo %s\n", info->label);
+
+       mutex_lock(&list_mutex);
+
+       if (--info->notif->refcnt == 0) {
+               pr_debug("Deleting notification %s\n", info->label);
+
+               list_del(&info->notif->entry);
+               kfree(info->notif->label);
+               kfree(info->notif);
+       }
+
+       mutex_unlock(&list_mutex);
+}
+
+static struct xt_target nfnotif_tg __read_mostly = {
+       .name           = "NFNOTIF",
+       .family         = NFPROTO_UNSPEC,
+       .target         = nfnotif_tg_target,
+       .targetsize     = sizeof(struct nfnotif_tg_info),
+       .checkentry     = nfnotif_tg_checkentry,
+       .destroy        = nfnotif_tg_destroy,
+       .me             = THIS_MODULE,
+};
+
+static int nfnotif_msg_send_notif(struct sock *nfnl, struct sk_buff *skb,
+                                 const struct nlmsghdr *nlh,
+                                 const struct nlattr * const attrs[])
+{
+       struct nfnotif_tg *notif;
+       char *label;
+       u8 send_notif;
+
+       if (attrs[NFNOTIF_TG_ATTR_LABEL] == NULL ||
+           attrs[NFNOTIF_TG_ATTR_SEND_NOTIF] == NULL)
+               return -EINVAL;
+
+       label = nla_data(attrs[NFNOTIF_TG_ATTR_LABEL]);
+       send_notif = nla_get_u8(attrs[NFNOTIF_TG_ATTR_SEND_NOTIF]);
+
+       pr_debug("Label %s send %d\n", label, send_notif);
+
+       notif = __nfnotif_tg_find_by_label(label);
+       if (notif == NULL)
+               return -EINVAL;
+
+       notif->send_notif = send_notif;
+
+       return 0;
+}
+
+
+static const struct nla_policy nfnotif_nla_policy[NFNOTIF_TG_ATTR_MAX + 1] = {
+       [NFNOTIF_TG_ATTR_LABEL]            = { .type = NLA_NUL_STRING },
+       [NFNOTIF_TG_ATTR_SEND_NOTIF]       = { .type = NLA_U8 },
+};
+
+static const struct nfnl_callback nfnotif_cb[NFNOTIF_TG_MSG_MAX] = {
+       [NFNOTIF_TG_MSG_PACKETS]   = { .call = nfnotif_msg_send_notif,
+                                      .attr_count = NFNOTIF_TG_ATTR_MAX,
+                                      .policy = nfnotif_nla_policy },
+};
+
+static const struct nfnetlink_subsystem nfnotif_subsys = {
+       .name                           = "nfnotif",
+       .subsys_id                      = NFNL_SUBSYS_NFNOTIF,
+       .cb_count                       = NFNOTIF_TG_MSG_MAX,
+       .cb                             = nfnotif_cb,
+};
+
+static int __init nfnotif_tg_init(void)
+{
+       int ret;
+
+       ret = nfnetlink_subsys_register(&nfnotif_subsys);
+       if (ret < 0) {
+               pr_err("%s: Cannot register with nfnetlink\n", __func__);
+               return ret;
+       }
+
+       ret = xt_register_target(&nfnotif_tg);
+       if (ret < 0) {
+               pr_err("%s: Cannot register target\n", __func__);
+               nfnetlink_subsys_unregister(&nfnotif_subsys);
+       }
+
+       return ret;
+}
+
+static void __exit nfnotif_tg_exit(void)
+{
+       nfnetlink_subsys_unregister(&nfnotif_subsys);
+       xt_unregister_target(&nfnotif_tg);
+}
+
+module_init(nfnotif_tg_init);
+module_exit(nfnotif_tg_exit);
+
+MODULE_AUTHOR("Samuel Ortiz <[email protected]>");
+MODULE_DESCRIPTION("Xtables: userspace notification");
+MODULE_LICENSE("GPL v2");
--

1.7.1

--
Intel Open Source Technology Centre
http://oss.intel.com/
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Quoted 9 lines · Samuel Ortiz

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute for userspace to match it against a previously set rule. The rules also take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the target is in place. This target uses the nefilter netlink framework.

Quoted 5 lines

This target combined with various matches (quota, rateest, etc..) allows userspace to make decisions on interfaces handling. One could for example decide to switch between power saving modes depending on estimated rate thresholds.

It much like the following iptables rules.

iptables -N log_and_drop
iptables -A log_and_drop -j NFLOG --nflog-group 1 --nflog-prefix "log_and_drop" iptables -A log_and_drop -j DROP

...
iptables ... -m quota --quota-bytes 20000 -j log_and_drop
...

Quoted 22 lines · Changli Gao

Quoted 9 lines · Samuel Ortiz

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute for userspace to match it against a previously set rule. The rules also take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the target is in place. This target uses the nefilter netlink framework.

Quoted 5 lines

This target combined with various matches (quota, rateest, etc..) allows userspace to make decisions on interfaces handling. One could for example decide to switch between power saving modes depending on estimated rate thresholds.

It much like the following iptables rules.

iptables -N log_and_drop
iptables -A log_and_drop -j NFLOG --nflog-group 1 --nflog-prefix "log_and_drop" iptables -A log_and_drop -j DROP

Quoted 3 lines

...
iptables ... -m quota --quota-bytes 20000 -j log_and_drop
...

Indeed, this looks to me like something that you can do with NFLOG and some combination of matches.

Quoted 3 lines

Indeed, this looks to me like something that you can do with NFLOG and some combination of matches.

Is it possible to have the NFLOG send only one notification to the userspace? In the example above, once the quota exceeds, the userspace will be notified of every packet arriving, won't it? That would cause unnecessary processing in the userspace.

The userspace could remove the rule when it gets the first notification and only add it again when it needs to get the information again (as a "toggle" functionality), but I think that would take too long and there would be several packets going through before the rule could be removed.

Quoted 9 lines · Luciano Coelho

Quoted 3 lines

Indeed, this looks to me like something that you can do with NFLOG and some combination of matches.

Is it possible to have the NFLOG send only one notification to the userspace? In the example above, once the quota exceeds, the userspace will be notified of every packet arriving, won't it? That would cause unnecessary processing in the userspace.

Quoted 4 lines

The userspace could remove the rule when it gets the first notification and only add it again when it needs to get the information again (as a "toggle" functionality), but I think that would take too long and there would be several packets going through before the rule could be removed.

With xt_condition that should not be a problem
(-A INPUT -m condition --name ruleXYZ -j NFLOG..)
This is settable through procfs.

Quoted 27 lines · ext Pablo Neira Ayuso

Quoted 25 lines · Changli Gao

Quoted 9 lines · Samuel Ortiz

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute for userspace to match it against a previously set rule. The rules also take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the target is in place. This target uses the nefilter netlink framework.

Quoted 5 lines

This target combined with various matches (quota, rateest, etc..) allows userspace to make decisions on interfaces handling. One could for example decide to switch between power saving modes depending on estimated rate thresholds.

It much like the following iptables rules.

iptables -N log_and_drop
iptables -A log_and_drop -j NFLOG --nflog-group 1 --nflog-prefix "log_and_drop" iptables -A log_and_drop -j DROP

...
iptables ... -m quota --quota-bytes 20000 -j log_and_drop
...

Quoted 2 lines

Indeed, this looks to me like something that you can do with NFLOG and some combination of matches.

Is it possible to have the NFLOG send only one notification to the userspace?

In the example above, once the quota exceeds, the userspace will be notified of every packet arriving, won't it? That would cause unnecessary processing in the userspace.

The userspace could remove the rule when it gets the first notification and only add it again when it needs to get the information again (as a "toggle" functionality), but I think that would take too long and there would be several packets going through before the rule could be removed.

Quoted 39 lines · Luciano Coelho

Quoted 37 lines · ext Pablo Neira Ayuso

Quoted 25 lines · Changli Gao

Quoted 12 lines · Samuel Ortiz

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute
for userspace to match it against a previously set rule. The rules also
take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the
target is in place. This target uses the nefilter netlink framework.

Quoted 8 lines

This target combined with various matches (quota, rateest, etc..) allows
userspace to make decisions on interfaces handling. One could for example
decide to switch between power saving modes depending on estimated rate
thresholds.

It much like the following iptables rules.

Quoted 8 lines

iptables -N log_and_drop
iptables -A log_and_drop -j NFLOG --nflog-group 1 --nflog-prefix "log_and_drop"
iptables -A log_and_drop -j DROP

...
iptables ... -m quota --quota-bytes 20000 -j log_and_drop
...

Indeed, this looks to me like something that you can do with NFLOG and some combination of matches.

Quoted 2 lines

Is it possible to have the NFLOG send only one notification to the userspace?

Not possible, but you could easily extend NFLOG to implement this feature if it's not possible to do what you need with the existing matches/targets. This NOTIF infrastructure is redundant and it looks like a subset of NFLOG.

Quoted 40 lines · Pablo Neira Ayuso

Quoted 39 lines · Luciano Coelho

Quoted 37 lines · ext Pablo Neira Ayuso

Quoted 25 lines · Changli Gao

Quoted 12 lines · Samuel Ortiz

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute
for userspace to match it against a previously set rule. The rules also
take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the
target is in place. This target uses the nefilter netlink framework.

Quoted 8 lines

This target combined with various matches (quota, rateest, etc..) allows
userspace to make decisions on interfaces handling. One could for example
decide to switch between power saving modes depending on estimated rate
thresholds.

It much like the following iptables rules.

Quoted 8 lines

iptables -N log_and_drop
iptables -A log_and_drop -j NFLOG --nflog-group 1 --nflog-prefix "log_and_drop"
iptables -A log_and_drop -j DROP

...
iptables ... -m quota --quota-bytes 20000 -j log_and_drop
...

Indeed, this looks to me like something that you can do with NFLOG and some combination of matches.

Quoted 7 lines

Quoted 2 lines

Is it possible to have the NFLOG send only one notification to the userspace?

Not possible, but you could easily extend NFLOG to implement this feature if it's not possible to do what you need with the existing matches/targets. This NOTIF infrastructure is redundant and it looks like a subset of NFLOG.

If you're using connection tracking, you can use conntrack marks to avoid sending more than a single message:

iptables ... -m connmark --mark 0x1/0x1 -j RETURN
iptables ... -j NFLOG ...
iptables ... -j CONNMARK --set-mark 0x1/0x1

Quoted 6 lines · ext Patrick McHardy

If you're using connection tracking, you can use conntrack marks to avoid sending more than a single message:

iptables ... -m connmark --mark 0x1/0x1 -j RETURN
iptables ... -j NFLOG ...
iptables ... -j CONNMARK --set-mark 0x1/0x1

Cool, thanks.

It seems that there are lots of possibilities to get this to work, but this is starting to get quite complex. I would still prefer having the NFNOTIF module included, since we would be able to do what we want in a very simple way. It's also probably much more efficient that using several rules, which would increase the CPU usage considerably (in our device we are already reaching the limit of a reasonable CPU resource usage with high throughput WLAN connections).

While I agree that it is possible to achieve the NFNOTIF functionality with existing modules, I still think there is a "niche" for such module, because it is very simple, has a very clear purpose and would make the ruleset simpler and more efficient.

Does this make any sense?

Hi Luciano,

Quoted 17 lines · Luciano Coelho

Quoted 6 lines · ext Patrick McHardy

If you're using connection tracking, you can use conntrack marks to avoid sending more than a single message:

iptables ... -m connmark --mark 0x1/0x1 -j RETURN
iptables ... -j NFLOG ...
iptables ... -j CONNMARK --set-mark 0x1/0x1

Cool, thanks.

It seems that there are lots of possibilities to get this to work, but this is starting to get quite complex. I would still prefer having the NFNOTIF module included, since we would be able to do what we want in a very simple way. It's also probably much more efficient that using several rules, which would increase the CPU usage considerably (in our device we are already reaching the limit of a reasonable CPU resource usage with high throughput WLAN connections).

Quoted 6 lines

While I agree that it is possible to achieve the NFNOTIF functionality with existing modules, I still think there is a "niche" for such module, because it is very simple, has a very clear purpose and would make the ruleset simpler and more efficient.

Does this make any sense?

I don't think that the NFNOTIF infrastructure fulfill the policy for inclusion. It seems to me like something quite specific for your needs. It is simple, yes, but we already have this feature into the kernel. I don't think that this will reduce CPU usage considerably with regards to the NFLOG way.

I would still prefer adding the once-per-matching notification feature to NFLOG than these extra lines in the kernel, Patrick?

Am 14.07.2010 18:34, schrieb Pablo Neira Ayuso:

Quoted 7 lines

Quoted 7 lines

It seems that there are lots of possibilities to get this to work, but this is starting to get quite complex. I would still prefer having the NFNOTIF module included, since we would be able to do what we want in a very simple way. It's also probably much more efficient that using several rules, which would increase the CPU usage considerably (in our device we are already reaching the limit of a reasonable CPU resource usage with high throughput WLAN connections).

Its hard to believe that a connmark match filtering out notifications would require more CPU time than doing the same in a new target module.

Quoted 13 lines

Quoted 6 lines

While I agree that it is possible to achieve the NFNOTIF functionality with existing modules, I still think there is a "niche" for such module, because it is very simple, has a very clear purpose and would make the ruleset simpler and more efficient.

Does this make any sense?

I don't think that the NFNOTIF infrastructure fulfill the policy for inclusion. It seems to me like something quite specific for your needs. It is simple, yes, but we already have this feature into the kernel. I don't think that this will reduce CPU usage considerably with regards to the NFLOG way.

Quoted 2 lines

I would still prefer adding the once-per-matching notification feature to NFLOG than these extra lines in the kernel, Patrick?

I agree with Pablo.

Quoted 9 lines · Samuel Ortiz

The userspace notification Xtables target sends a netlink notification whenever a packet hits the target. Notifications have a label attribute for userspace to match it against a previously set rule. The rules also take a --all option to switch between sending a notification for all packets or for the first one only.
Userspace can also send a netlink message to toggle this switch while the target is in place. This target uses the nefilter netlink framework.

Quoted 5 lines

This target combined with various matches (quota, rateest, etc..) allows userspace to make decisions on interfaces handling. One could for example decide to switch between power saving modes depending on estimated rate thresholds.

It much like the following iptables rules.

iptables -N log_and_drop
iptables -A log_and_drop -j NFLOG --nflog-group 1 --nflog-prefix "log_and_drop" iptables -A log_and_drop -j DROP

...
iptables ... -m quota --quota-bytes 20000 -j log_and_drop
...

Quoted 9 lines

net/netfilter/xt_NFNOTIF.c new file +9 -0

+static unsigned int nfnotif_tg_target(struct sk_buff *skb,
+                                     const struct xt_action_param *par)
+{
+       const struct nfnotif_tg_info *info = par->targinfo;
+
+       BUG_ON(!info->notif);
+
+       if (!info->notif->send_notif)
+               return XT_CONTINUE;

net/netfilter/xt_NFNOTIF.c line 155

Quoted 5 lines

net/netfilter/xt_NFNOTIF.c new file +5 -0

+
+       pr_debug("Sending notification for %s\n", info->label);
+
+       schedule_work(&info->notif->work);
+

Why do you use another kernel activity: kernel thread? netlink messages can be sent in atomic context.