conntrackd: support replication of connlabels

index 79745f3..cc312cb 100644
@@ -228,9 +228,13 @@ enum nta_attr {
 	NTA_TCP_WSCALE_ORIG,	/* uint8_t */
 	NTA_TCP_WSCALE_REPL,	/* uint8_t */
 	NTA_HELPER_NAME,	/* string (variable length) */
+	NTA_LABELS,		/* array of uint32_t (variable length) */
 	NTA_MAX
 };
 
+/* allow to serialize/replicate up to 4k labels per flow */
+#define NTA_LABELS_MAX_SIZE	(4096/sizeof(uint32_t))
+
 struct nta_attr_natseqadj {
 	uint32_t orig_seq_correction_pos;
 	uint32_t orig_seq_offset_before;

index e15eb4f..5799b51 100644
@@ -158,6 +158,42 @@ static void build_l4proto_udp(const struct nf_conntrack *ct, struct nethdr *n)
 		      sizeof(struct nfct_attr_grp_port));
 }
 
+static void ct_build_clabel(const struct nf_conntrack *ct, struct nethdr *n)
+{
+	const struct nfct_bitmask *b;
+	uint32_t *words;
+	unsigned int wordcount, i, maxbit;
+
+	if (!nfct_attr_is_set(ct, ATTR_CONNLABELS))
+		return;
+
+	b = nfct_get_attr(ct, ATTR_CONNLABELS);
+
+	maxbit = nfct_bitmask_maxbit(b);
+	for (i=0; i <= maxbit; i++) {
+		if (nfct_bitmask_test_bit(b, i))
+			break;
+	}
+
+	if (i > maxbit)
+		return;
+
+	wordcount = (nfct_bitmask_maxbit(b) / 32) + 1;
+	words = put_header(n, NTA_LABELS, wordcount * sizeof(*words));
+
+	for (i=0; i < wordcount; i++) {
+		int bit = 31;
+		uint32_t tmp = 0;
+
+		do {
+			if (nfct_bitmask_test_bit(b, (32 * i) + bit))
+				tmp |= (1 << bit);
+		} while (--bit >= 0);
+
+		words[i] = htonl(tmp);
+	}
+}
+
 #ifndef IPPROTO_DCCP
 #define IPPROTO_DCCP 33
 #endif

@@ -233,6 +269,9 @@ void ct2msg(const struct nf_conntrack *ct, struct nethdr *n)
 
 	if (nfct_attr_is_set(ct, ATTR_HELPER_NAME))
 		ct_build_str(ct, ATTR_HELPER_NAME, n, NTA_HELPER_NAME);
+
+	if (nfct_attr_is_set(ct, ATTR_CONNLABELS))
+		ct_build_clabel(ct, n);
 }
 
 static void

127 lines not on this page · raw message

index d4e79de..74561ba 100644
@@ -488,6 +488,7 @@ static unsigned int addr_valid_flags[ADDR_VALID_FLAGS_MAX] = {
 static LIST_HEAD(proto_list);
 
 static unsigned int options;
+static struct nfct_labelmap *label_map;
 
 void register_proto(struct ctproto_handler *h)
 {

@@ -731,6 +732,7 @@ enum {
 	_O_TMS	= (1 << 2),
 	_O_ID	= (1 << 3),
 	_O_KTMS	= (1 << 4),
+	_O_LAB	= (1 << 5),
 };
 
 enum {

@@ -749,8 +751,8 @@ static struct parse_parameter {
 	  { IPS_ASSURED, IPS_SEEN_REPLY, 0, IPS_FIXED_TIMEOUT, IPS_EXPECTED} },
 	{ {"ALL", "NEW", "UPDATES", "DESTROY"}, 4,
 	  { CT_EVENT_F_ALL, CT_EVENT_F_NEW, CT_EVENT_F_UPD, CT_EVENT_F_DEL } },
-	{ {"xml", "extended", "timestamp", "id", "ktimestamp"}, 5, 
-	  { _O_XML, _O_EXT, _O_TMS, _O_ID, _O_KTMS },
+	{ {"xml", "extended", "timestamp", "id", "ktimestamp", "labels", }, 6, 
+	  { _O_XML, _O_EXT, _O_TMS, _O_ID, _O_KTMS, _O_LAB },
 	},
 };
 

@@ -1108,6 +1110,15 @@ exp_event_sighandler(int s)
 	exit(0);
 }
 
+static void print_labels(const struct nfct_bitmask *b)
+{
+	char buf[1024];
+	if (!b)
+		return;
+	nfct_snprintf_labels(buf, sizeof(buf), label_map, b, NFCT_O_DEFAULT);
+	printf(" labels=%s", buf);
+}
+
 static int event_cb(enum nf_conntrack_msg_type type,
 		    struct nf_conntrack *ct,
 		    void *data)

@@ -1152,7 +1163,11 @@ static int event_cb(enum nf_conntrack_msg_type type,
 
 	nfct_snprintf(buf, sizeof(buf), ct, type, op_type, op_flags);
 
-	printf("%s\n", buf);
+	printf("%s", buf);
+
+	if (output_mask & _O_LAB)
+		print_labels(nfct_get_attr(ct, ATTR_CONNLABELS));
+	printf("\n");
 	fflush(stdout);
 
 	counter++;

@@ -1195,8 +1210,11 @@ static int dump_cb(enum nf_conntrack_msg_type type,
 		op_flags |= NFCT_OF_ID;
 
 	nfct_snprintf(buf, sizeof(buf), ct, NFCT_T_UNKNOWN, op_type, op_flags);
-	printf("%s\n", buf);
+	printf("%s", buf);
 
+	if (output_mask & _O_LAB)
+		print_labels(nfct_get_attr(ct, ATTR_CONNLABELS));
+	printf("\n");
 	counter++;
 
 	return NFCT_CB_CONTINUE;

@@ -1879,6 +1897,17 @@ int main(int argc, char *argv[])
 		case 'o':
 			options |= CT_OPT_OUTPUT;
 			parse_parameter(optarg, &output_mask, PARSE_OUTPUT);
+			if (output_mask & _O_LAB) {
+				if (output_mask & _O_XML) {
+					output_mask &= ~_O_LAB;
+					break;
+				}
+				label_map = nfct_labelmap_new(NULL);
+				if (!label_map) {
+					perror("nfct_labelmap_new");
+					output_mask &= ~_O_LAB;
+				}
+			}
 			break;
 		case 'z':
 			options |= CT_OPT_ZERO;

@@ -2372,6 +2401,8 @@ try_proc:
 
 	free_tmpl_objects();
 	free_options();
+	if (label_map)
+		nfct_labelmap_destroy(label_map);
 
 	if (command && exit_msg[cmd][0]) {
 		fprintf(stderr, "%s v%s (conntrack-tools): ",PROGNAME,VERSION);