ctnetlink port to nf_conntrack take #1

RFC PATCH In review Pablo Neira 3 participants 5 messages Nov 14, 2005 – Nov 15, 2005 1 message not in the archive

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Pablo Neira

author

2005-11-14 01:30 UTC #0 lore raw

RFC PATCH 1/1 ctnetlink port to nf_conntrack take #1

Hi,

This is a RFC. Attached two patches, the first contains the required modifications for nf_conntrack in order to get nf_conntrack_netlink working.

The second patch is an incremental diff against ip_conntrack_netlink.c, my intention with this patch is making easy your review. It clearly shows the slighty modifications introduced to carry out the porting.

On the other hand, the whole C file (nf_netlink_conntrack.c) is available at http://people.netfilter.org/pablo/nf_conntrack_netlink.c

Signature · 1 line

Pablo

include/net/netfilter/nf_conntrack.h +31 -0

index cc48256..64b82b7 100644
@@ -94,6 +94,9 @@ struct nf_conn
 	/* Current number of expected connections */
 	unsigned int expecting;
 
+	/* Unique ID that identifies this conntrack*/
+	unsigned int id;
+
 	/* Helper. if any */
 	struct nf_conntrack_helper *helper;

@@ -140,6 +143,9 @@ struct nf_conntrack_expect
 	/* Usage count. */
 	atomic_t use;
 
+	/* Unique ID */
+	unsigned int id;
+
 	/* Flags */
 	unsigned int flags;

@@ -190,6 +196,31 @@ static inline void nf_ct_put(struct nf_c
 	nf_conntrack_put(&ct->ct_general);
 }
 
+extern struct nf_conntrack_tuple_hash *
+__nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
+		    const struct nf_conn *ignored_conntrack);
+
+extern void nf_conntrack_hash_insert(struct nf_conn *ct);
+
+extern struct nf_conntrack_expect *
+__nf_conntrack_expect_find(const struct nf_conntrack_tuple *tuple);
+
+extern struct nf_conntrack_expect *
+nf_conntrack_expect_find(const struct nf_conntrack_tuple *tuple);
+
+extern void nf_ct_unlink_expect(struct nf_conntrack_expect *exp);
+
+extern void nf_ct_remove_expectations(struct nf_conn *ct);
+
+extern void nf_conntrack_flush(void);
+
+extern struct nf_conntrack_helper *
+nf_ct_helper_find_get( const struct nf_conntrack_tuple *tuple);
+extern void nf_ct_helper_put(struct nf_conntrack_helper *helper);
+
+extern struct nf_conntrack_helper *
+__nf_conntrack_helper_find_byname(const char *name);
+
 /* call to create an explicit dependency on nf_conntrack. */
 extern void need_nf_conntrack(void);

include/net/netfilter/nf_conntrack_core.h +0 -0

include/net/netfilter/nf_conntrack_helper.h +2 -0

index 5a66b2a..86ec817 100644
@@ -33,6 +33,8 @@ struct nf_conntrack_helper
 		    unsigned int protoff,
 		    struct nf_conn *ct,
 		    enum ip_conntrack_info conntrackinfo);
+
+	int (*to_nfattr)(struct sk_buff *skb, const struct nf_conn *ct);
 };
 
 extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);

include/net/netfilter/nf_conntrack_protocol.h +24 -0

index b3afda3..41e357d 100644
@@ -12,6 +12,7 @@
 #include <net/netfilter/nf_conntrack.h>
 
 struct seq_file;
+struct nfattr;
 
 struct nf_conntrack_protocol
 {

@@ -66,6 +67,18 @@ struct nf_conntrack_protocol
 		     enum ip_conntrack_info *ctinfo,
 		     int pf, unsigned int hooknum);
 
+	/* convert protoinfo to nfnetink attributes */
+	int (*to_nfattr)(struct sk_buff *skb, struct nfattr *nfa,
+			 const struct nf_conn *ct);
+
+	/* convert nfnetlink attributes to protoinfo */
+	int (*from_nfattr)(struct nfattr *tb[], struct nf_conn *ct);
+
+	int (*tuple_to_nfattr)(struct sk_buff *skb,
+			       const struct nf_conntrack_tuple *t);
+	int (*nfattr_to_tuple)(struct nfattr *tb[],
+			       struct nf_conntrack_tuple *t);
+
 	/* Module (if any) which this is connected to. */
 	struct module *me;
 };

@@ -82,10 +95,21 @@ extern struct nf_conntrack_protocol **nf
 extern struct nf_conntrack_protocol *
 nf_ct_find_proto(u_int16_t l3proto, u_int8_t protocol);
 
+extern struct nf_conntrack_protocol *
+nf_ct_proto_find_get(u_int16_t l3proto, u_int8_t protocol);
+
+extern void nf_ct_proto_put(struct nf_conntrack_protocol *p);
+
 /* Protocol registration. */
 extern int nf_conntrack_protocol_register(struct nf_conntrack_protocol *proto);
 extern void nf_conntrack_protocol_unregister(struct nf_conntrack_protocol *proto);
 
+/* Generic netlink helpers */
+extern int nf_ct_port_tuple_to_nfattr(struct sk_buff *skb,
+				      const struct nf_conntrack_tuple *tuple);
+extern int nf_ct_port_nfattr_to_tuple(struct nfattr *tb[],
+				      struct nf_conntrack_tuple *t);
+
 /* Log invalid packets */
 extern unsigned int nf_ct_log_invalid;

include/net/netfilter/nf_conntrack_tuple.h +0 -0

net/ipv4/netfilter/ip_conntrack_core.c +0 -0

net/ipv4/netfilter/ip_conntrack_netlink.c +0 -0

net/ipv4/netfilter/nf_conntrack_proto_icmp.c +57 -7

86 lines not on this page · raw message

net/netfilter/Kconfig +7 -0

index a84f922..eaab979 100644
@@ -95,4 +95,11 @@ config NF_CONNTRACK_FTP
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
+config NF_CT_NETLINK
+	tristate 'Connection tracking netlink interface'
+	depends on NF_CONNTRACK && NETFILTER_NETLINK
+	depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
+	help
+	  This option enables support for a netlink-based userspace interface
+
 endmenu

net/netfilter/Makefile +3 -0

index 55f019a..cb21831 100644
@@ -13,3 +13,6 @@ obj-$(CONFIG_NF_CONNTRACK_FTP) += nf_con
 
 # SCTP protocol connection tracking
 obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
+
+# netlink interface for nf_conntrack
+obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o

net/netfilter/nf_conntrack_core.c +173 ~~-14~~

284 lines not on this page · raw message

net/netfilter/nf_conntrack_proto_tcp.c +70 -0

88 lines not on this page · raw message

net/netfilter/nf_conntrack_proto_udp.c +10 -0

index 3cae7ce..1a592a5 100644
@@ -196,6 +196,11 @@ struct nf_conntrack_protocol nf_conntrac
 	.packet			= udp_packet,
 	.new			= udp_new,
 	.error			= udp_error4,
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+	.tuple_to_nfattr	= nf_ct_port_tuple_to_nfattr,
+	.nfattr_to_tuple	= nf_ct_port_nfattr_to_tuple,
+#endif
 };
 
 struct nf_conntrack_protocol nf_conntrack_protocol_udp6 =

@@ -210,6 +215,11 @@ struct nf_conntrack_protocol nf_conntrac
 	.packet			= udp_packet,
 	.new			= udp_new,
 	.error			= udp_error6,
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+	.tuple_to_nfattr	= nf_ct_port_tuple_to_nfattr,
+	.nfattr_to_tuple	= nf_ct_port_nfattr_to_tuple,
+#endif
 };
 
 EXPORT_SYMBOL(nf_conntrack_protocol_udp4);

net/netfilter/nf_conntrack_standalone.c +17 -0

index 45224db..6c1ff41 100644
@@ -848,6 +848,8 @@ EXPORT_SYMBOL(nf_ct_iterate_cleanup);
 EXPORT_SYMBOL(__nf_ct_refresh_acct);
 EXPORT_SYMBOL(nf_ct_protos);
 EXPORT_SYMBOL(nf_ct_find_proto);
+EXPORT_SYMBOL(nf_ct_proto_find_get);
+EXPORT_SYMBOL(nf_ct_proto_put);
 EXPORT_SYMBOL(nf_ct_l3protos);
 EXPORT_SYMBOL(nf_conntrack_expect_alloc);
 EXPORT_SYMBOL(nf_conntrack_expect_put);

@@ -867,3 +869,18 @@ EXPORT_SYMBOL(nf_ct_get_tuple);
 EXPORT_SYMBOL(nf_ct_invert_tuple);
 EXPORT_SYMBOL(nf_conntrack_in);
 EXPORT_SYMBOL(__nf_conntrack_attach);
+EXPORT_SYMBOL(nf_conntrack_alloc);
+EXPORT_SYMBOL(nf_conntrack_free);
+EXPORT_SYMBOL(nf_conntrack_flush);
+EXPORT_SYMBOL(nf_ct_remove_expectations);
+EXPORT_SYMBOL(nf_ct_helper_find_get);
+EXPORT_SYMBOL(nf_ct_helper_put);
+EXPORT_SYMBOL(__nf_conntrack_helper_find_byname);
+EXPORT_SYMBOL(__nf_conntrack_find);
+EXPORT_SYMBOL(nf_ct_unlink_expect);
+EXPORT_SYMBOL(nf_conntrack_hash_insert);
+EXPORT_SYMBOL(__nf_conntrack_expect_find);
+EXPORT_SYMBOL(nf_conntrack_expect_find);
+EXPORT_SYMBOL(nf_conntrack_expect_list);
+EXPORT_SYMBOL(nf_ct_port_tuple_to_nfattr);
+EXPORT_SYMBOL(nf_ct_port_nfattr_to_tuple);

net/netfilter/nf_conntrack_netlink.c renamed from net/ipv4/netfilter/ip_conntrack_netlink.c +201 ~~-186~~

1,058 lines not on this page · raw message

Yasuyuki KOZAKAI

2005-11-14 16:22 UTC #1 lore raw

Hi, Pablo, that's great news.

From: Pablo Neira <[email protected]>
Date: Mon, 14 Nov 2005 02:30:02 +0100

Quoted 2 lines

This is a RFC. Attached two patches, the first contains the required modifications for nf_conntrack in order to get nf_conntrack_netlink working.

I'll read this deeply on this weekend.

Quoted 6 lines

The second patch is an incremental diff against ip_conntrack_netlink.c, my intention with this patch is making easy your review. It clearly shows the slighty modifications introduced to carry out the porting.
On the other hand, the whole C file (nf_netlink_conntrack.c) is available at http://people.netfilter.org/pablo/nf_conntrack_netlink.c

I think we can generalize layer 3 protocol handling more, by introducing nfattr_to_tuple/tuple_to_nfattr to l3proto modules like proto.

And it would be great if {ip,nf}_conntrack_netlink.c can be unified. But currently I don't have good idea to do that in clear way, and without extensibility limitation of nf_conntrack_netlink. I'll think about this more. How do you think ?

Regards,

-- Yasuyuki Kozakai

Harald Welte

2005-11-14 17:10 UTC #3 lore raw

In reply to a message not in the archive

Quoted 2 lines · Yasuyuki KOZAKAI

I think we can generalize layer 3 protocol handling more, by introducing nfattr_to_tuple/tuple_to_nfattr to l3proto modules like proto.

I agree.

Quoted 4 lines

And it would be great if {ip,nf}_conntrack_netlink.c can be unified. But currently I don't have good idea to do that in clear way, and without extensibility limitation of nf_conntrack_netlink. I'll think about this more. How do you think ?

I don't think it's really worth the effort. we already have two instances of connection tracking code.

ip_conntrack will go sooner or later, so we should rather spend time on important features such as userspace conntrack helpers and NAT for nf_conntrack

Signature · 5 lines

- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

Pablo Neira

author

2005-11-14 19:15 UTC #4 lore raw

Quoted 7 lines · Harald Welte

Quoted 2 lines · Yasuyuki KOZAKAI
I think we can generalize layer 3 protocol handling more, by introducing nfattr_to_tuple/tuple_to_nfattr to l3proto modules like proto.
I agree.

Fine with it. I expect to send a new patch before the weekend.

Quoted 11 lines

Quoted 4 lines
And it would be great if {ip,nf}_conntrack_netlink.c can be unified. But currently I don't have good idea to do that in clear way, and without extensibility limitation of nf_conntrack_netlink. I'll think about this more. How do you think ?
I don't think it's really worth the effort. we already have two instances of connection tracking code.
ip_conntrack will go sooner or later, so we should rather spend time on important features such as userspace conntrack helpers and NAT for nf_conntrack

Same feeling.

Signature · 1 line

Pablo

Yasuyuki KOZAKAI

2005-11-15 09:21 UTC #5 lore raw

From: Pablo Neira <[email protected]>
Date: Mon, 14 Nov 2005 20:15:24 +0100

Quoted 16 lines

Quoted 7 lines · Harald Welte
Quoted 2 lines · Yasuyuki KOZAKAI
I think we can generalize layer 3 protocol handling more, by introducing nfattr_to_tuple/tuple_to_nfattr to l3proto modules like proto.
I agree.
Fine with it. I expect to send a new patch before the weekend.
Quoted 5 lines
Quoted 4 lines
And it would be great if {ip,nf}_conntrack_netlink.c can be unified. But currently I don't have good idea to do that in clear way, and without extensibility limitation of nf_conntrack_netlink. I'll think about this more. How do you think ?

Quoted 8 lines

Quoted 6 lines
I don't think it's really worth the effort. we already have two instances of connection tracking code.
ip_conntrack will go sooner or later, so we should rather spend time on important features such as userspace conntrack helpers and NAT for nf_conntrack
Same feeling.

OK, let's go ahead.

-- Yasuyuki Kozakai