On Sun, Jun 23, 2013 at 11:14:39PM +0200, Florian Westphal wrote:
> By default, nfct_snprintf will not print connlabels, as they're
> system specific and can easily generate lots of output.
>
> This adds a fmt attribute to print connlabel names.
>
> output looks like this:
> ... mark=0 use=1 labels=eth0-in,eth1-in
> or
> <labels>
> <label>eth0-in</label>
> <label>eth1-in</label>
> </labels>
>
> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> ---
> Pablo, I _think_ this is pretty much what you had in
> mind, if I misunderstood anything please let me know.
>
> Change since V1:
> - avoid changing current nfct_snprint default output
> - print only name of a label, needs NFCT_OF_CONNLABELS output format
>
> include/internal/prototypes.h | 1 +
> .../libnetfilter_conntrack.h | 3 ++
> src/conntrack/snprintf_default.c | 60 ++++++++++++++++++++++
> src/conntrack/snprintf_xml.c | 37 +++++++++++++
> 4 files changed, 101 insertions(+)
>
> diff --git a/include/internal/prototypes.h b/include/internal/prototypes.h
> index 484deea..414d7f8 100644
> --- a/include/internal/prototypes.h
> +++ b/include/internal/prototypes.h
> @@ -15,6 +15,7 @@ int __snprintf_protocol(char *buf, unsigned int len, const struct nf_conntrack *
> int __snprintf_proto(char *buf, unsigned int len, const struct __nfct_tuple *tuple);
> int __snprintf_conntrack_default(char *buf, unsigned int len, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int flags);
> int __snprintf_conntrack_xml(char *buf, unsigned int len, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int flags);
> +int __snprintf_connlabels(char *buf, unsigned int len, struct nfct_labelmap *map, const struct nfct_bitmask *b, const char *fmt);
>
> enum __nfct_addr {
> __ADDR_SRC = 0,
> diff --git a/include/libnetfilter_conntrack/libnetfilter_conntrack.h b/include/libnetfilter_conntrack/libnetfilter_conntrack.h
> index 39dc24c..eedf85e 100644
> --- a/include/libnetfilter_conntrack/libnetfilter_conntrack.h
> +++ b/include/libnetfilter_conntrack/libnetfilter_conntrack.h
> @@ -389,6 +389,9 @@ enum {
>
> NFCT_OF_TIMESTAMP_BIT = 3,
> NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT),
> +
> + NFCT_OF_CONNLABELS_BIT = 4,
> + NFCT_OF_CONNLABELS = (1 << NFCT_OF_CONNLABELS_BIT),
> };
>
> extern int nfct_snprintf(char *buf,
> diff --git a/src/conntrack/snprintf_default.c b/src/conntrack/snprintf_default.c
> index 911faea..2ede0bc 100644
> --- a/src/conntrack/snprintf_default.c
> +++ b/src/conntrack/snprintf_default.c
> @@ -288,6 +288,61 @@ __snprintf_helper_name(char *buf, unsigned int len, const struct nf_conntrack *c
> return (snprintf(buf, len, "helper=%s ", ct->helper_name));
> }
>
> +int
> +__snprintf_connlabels(char *buf, unsigned int len,
> + struct nfct_labelmap *map,
> + const struct nfct_bitmask *b, const char *fmt)
> +{
> + unsigned int i, max;
> + int ret, size = 0, offset = 0;
> +
> + max = nfct_bitmask_maxbit(b);
> + for (i = 0; i <= max && len; i++) {
> + const char *name;
> + if (!nfct_bitmask_test_bit(b, i))
> + continue;
> + name = nfct_labelmap_get_name(map, i);
> + if (!name || strcmp(name, "") == 0)
> + continue;
> +
> + ret = snprintf(buf + offset, len, fmt, name);
> + BUFFER_SIZE(ret, size, len, offset);
> + }
> + return size;
> +}
> +
> +static int
> +__snprintf_clabels(char *buf, unsigned int len,
> + const struct nf_conntrack *ct)
> +{
> + const struct nfct_bitmask *b = nfct_get_attr(ct, ATTR_CONNLABELS);
> + struct nfct_labelmap *map;
> + int ret, size = 0, offset = 0;
> +
> + if (!b)
> + return 0;
> +
> + map = nfct_labelmap_new(NULL);
> + if (!map)
> + return 0;
This opens and parses the map file for each conntrack, it would be
expensive. I think it's better provide more control to the client
regarding the load of the mapping, it's more flexible.
Consider adding:
int nfct_snprintf_connlabel(char *buf, unsigned int len,
const struct nf_conntrack *ct,
const struct nfct_labelmap *labelmap);
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
