On Sat, Mar 31, 2018 at 01:52:32PM +0530, Harsha Sharma wrote:
> This patch allows to add, list and delete connection tracking timeout
> policy via nft objref infrastructure.
>
> Signed-off-by: Harsha Sharma <harshasharmaiitr@xxxxxxxxx>
> ---
> include/net/netfilter/nf_conntrack_timeout.h | 1 +
> include/uapi/linux/netfilter/nf_tables.h | 15 ++-
> net/netfilter/nft_ct.c | 167 ++++++++++++++++++++++++++-
> 3 files changed, 180 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h
> index 9468ab4ad12d..ae0f59cc1ffa 100644
> --- a/include/net/netfilter/nf_conntrack_timeout.h
> +++ b/include/net/netfilter/nf_conntrack_timeout.h
> @@ -8,6 +8,7 @@
> #include <linux/refcount.h>
> #include <net/netfilter/nf_conntrack.h>
> #include <net/netfilter/nf_conntrack_extend.h>
> +#include <net/netfilter/nf_conntrack_l4proto.h>
>
> #define CTNL_TIMEOUT_NAME_MAX 32
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 66dceee0ae30..5762388e89dd 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -920,6 +920,7 @@ enum nft_rt_attributes {
> * @NFT_CT_AVGPKT: conntrack average bytes per packet
> * @NFT_CT_ZONE: conntrack zone
> * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
> + * @NFT_CT_TIMEOUT: connection tracking timeout policy assigned to conntrack
> */
> enum nft_ct_keys {
> NFT_CT_STATE,
> @@ -941,6 +942,7 @@ enum nft_ct_keys {
> NFT_CT_AVGPKT,
> NFT_CT_ZONE,
> NFT_CT_EVENTMASK,
> + NFT_CT_TIMEOUT,
> };
>
> /**
> @@ -1302,12 +1304,23 @@ enum nft_ct_helper_attributes {
> };
> #define NFTA_CT_HELPER_MAX (__NFTA_CT_HELPER_MAX - 1)
>
> +enum nft_ct_timeout_timeout_attributes {
> + NFTA_CT_TIMEOUT_UNSPEC,
> + NFTA_CT_TIMEOUT_L3PROTO,
> + NFTA_CT_TIMEOUT_L4PROTO,
> + NFTA_CT_TIMEOUT_DATA,
> + NFTA_CT_TIMEOUT_USE,
> + __NFTA_CT_TIMEOUT_MAX,
> +};
> +#define NFTA_CT_TIMEOUT_MAX (__NFTA_CT_TIMEOUT_MAX - 1)
> +
> #define NFT_OBJECT_UNSPEC 0
> #define NFT_OBJECT_COUNTER 1
> #define NFT_OBJECT_QUOTA 2
> #define NFT_OBJECT_CT_HELPER 3
> #define NFT_OBJECT_LIMIT 4
> -#define __NFT_OBJECT_MAX 5
> +#define NFT_OBJECT_CT_TIMEOUT 5
> +#define __NFT_OBJECT_MAX 6
> #define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1)
>
> /**
> diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
> index 6ab274b14484..e7af9781e4c1 100644
> --- a/net/netfilter/nft_ct.c
> +++ b/net/netfilter/nft_ct.c
> @@ -22,6 +22,9 @@
> #include <net/netfilter/nf_conntrack_helper.h>
> #include <net/netfilter/nf_conntrack_ecache.h>
> #include <net/netfilter/nf_conntrack_labels.h>
> +#include <linux/netfilter/nfnetlink_cttimeout.h>
> +#include <net/netfilter/nf_conntrack_timeout.h>
> +#include <net/netfilter/nf_conntrack_l4proto.h>
>
> struct nft_ct {
> enum nft_ct_keys key:8;
> @@ -32,12 +35,16 @@ struct nft_ct {
> };
> };
>
> -struct nft_ct_helper_obj {
> +struct nft_ct_helper_obj {
> struct nf_conntrack_helper *helper4;
> struct nf_conntrack_helper *helper6;
> u8 l4proto;
> };
>
> +struct nft_ct_timeout_obj {
> + struct ctnl_timeout *timeout;
> +};
> +
> #ifdef CONFIG_NF_CONNTRACK_ZONES
> static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
> static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
> @@ -392,7 +399,6 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
> return -EINVAL;
> len = NF_CT_HELPER_NAME_LEN;
> break;
> -
> case NFT_CT_L3PROTOCOL:
> case NFT_CT_PROTOCOL:
> /* For compatibility, do not report error if NFTA_CT_DIRECTION
> @@ -727,6 +733,134 @@ static struct nft_expr_type nft_notrack_type __read_mostly = {
> .owner = THIS_MODULE,
> };
>
> +static int
> +ctnl_timeout_parse_policy(void *timeouts,
> + const struct nf_conntrack_l4proto *l4proto,
> + struct net *net, const struct nlattr *attr)
> +{
> + int ret = 0;
> +
> + if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
Remove all likely() and unlikely() in this code, I know you took it
from nfnetlink_cttimeout.c but we don't need it.
> + struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max + 1];
Use no VLA here, it seems some people don't like it, instead you can
do like what we do in more recent code:
https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git/tree/net/netfilter/nfnetlink_cttimeout.c#n57
Would you add _eval() code too? It will be very similar to
nft_ct_helper_obj_eval().
After that change, you will need to extend userspace to allow to set
timeouts, have a look at:
commit 8675f943e7eff24f29aaa492cb58267f9291de31
commit 1ed84c4626973cee92e4a238ad55f7ba1f5af249
commit aabb9c46ac4cfdff3aad136dd2ed7cb2bb0f9293
commit ec38e5ed61a088a1fbd2922742c9125aa1c63a7c
commit 5ca4eb30d62e0ab2768d64de5c70931292213338
It should be similar to that.
I remember you told me that you were hitting problems with parser when
adding the ct timeout states, skip that, we'll fix it at the end.
Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
