[NETFILTER]: ctnetlink: rework conntrack fields dumping logic on events

               |   NEW   | UPDATE  | DESTROY |
     ----------------------------------------|
     tuples    |    Y    |    Y    |    Y    |
     status    |    Y    |    Y    |    N    |
     timeout   |    Y    |    Y    |    N    |
     protoinfo |    S    |    S    |    N    |
     helper    |    S    |    S    |    N    |
     mark      |    S    |    S    |    N    |
     counters  |    F    |    F    |    Y    |

 Leyend:
         Y: yes
         N: no
         S: iif the field is set
	 F: iif overflow

This patch also replace IPCT_HELPINFO by IPCT_HELPER since we want to
track the helper assignation process, not the changes in the private
information held by the helper.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index d5d2efddba574350caa7e30da079e85991aa7472..5fcf91d617cd44e66a59559b31636c144307a6ac 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -320,8 +320,6 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
        } else if (events & (IPCT_NEW | IPCT_RELATED)) {
                type = IPCTNL_MSG_CT_NEW;
                flags = NLM_F_CREATE|NLM_F_EXCL;
-               /* dump everything */
-               events = ~0UL;
                group = NFNLGRP_CONNTRACK_NEW;
        } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
                type = IPCTNL_MSG_CT_NEW;
@@ -356,28 +354,35 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
        if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
                goto nfattr_failure;
        NFA_NEST_END(skb, nest_parms);
-       
-       /* NAT stuff is now a status flag */
-       if ((events & IPCT_STATUS || events & IPCT_NATINFO)
-           && ctnetlink_dump_status(skb, ct) < 0)
-               goto nfattr_failure;
-       if (events & IPCT_REFRESH
-           && ctnetlink_dump_timeout(skb, ct) < 0)
-               goto nfattr_failure;
-       if (events & IPCT_PROTOINFO
-           && ctnetlink_dump_protoinfo(skb, ct) < 0)
-               goto nfattr_failure;
-       if (events & IPCT_HELPINFO
-           && ctnetlink_dump_helpinfo(skb, ct) < 0)
-               goto nfattr_failure;
 
-       if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
-           ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
-               goto nfattr_failure;
+       if (events & IPCT_DESTROY) {
+               if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
+                   ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
+                       goto nfattr_failure;
+       } else {
+               if (ctnetlink_dump_status(skb, ct) < 0)
+                       goto nfattr_failure;
 
-       if (events & IPCT_MARK
-           && ctnetlink_dump_mark(skb, ct) < 0)
-               goto nfattr_failure;
+               if (ctnetlink_dump_timeout(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if (events & IPCT_PROTOINFO
+                   && ctnetlink_dump_protoinfo(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if ((events & IPCT_HELPER || ct->helper)
+                   && ctnetlink_dump_helpinfo(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if ((events & IPCT_MARK || ct->mark)
+                   && ctnetlink_dump_mark(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if (events & IPCT_COUNTER_FILLING &&
+                   (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
+                    ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
+                       goto nfattr_failure;
+       }
 
        nlh->nlmsg_len = skb->tail - b;
        nfnetlink_send(skb, 0, group, 0);

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index ba77183be2f3ae3be7acc610065c614c15434dab..e3a7204721231dc47d76141b1a6daf0fec1ce2d1 100644 (file)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -331,8 +331,6 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
        } else  if (events & (IPCT_NEW | IPCT_RELATED)) {
                type = IPCTNL_MSG_CT_NEW;
                flags = NLM_F_CREATE|NLM_F_EXCL;
-               /* dump everything */
-               events = ~0UL;
                group = NFNLGRP_CONNTRACK_NEW;
        } else  if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
                type = IPCTNL_MSG_CT_NEW;
@@ -367,28 +365,35 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
        if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
                goto nfattr_failure;
        NFA_NEST_END(skb, nest_parms);
-       
-       /* NAT stuff is now a status flag */
-       if ((events & IPCT_STATUS || events & IPCT_NATINFO)
-           && ctnetlink_dump_status(skb, ct) < 0)
-               goto nfattr_failure;
-       if (events & IPCT_REFRESH
-           && ctnetlink_dump_timeout(skb, ct) < 0)
-               goto nfattr_failure;
-       if (events & IPCT_PROTOINFO
-           && ctnetlink_dump_protoinfo(skb, ct) < 0)
-               goto nfattr_failure;
-       if (events & IPCT_HELPINFO
-           && ctnetlink_dump_helpinfo(skb, ct) < 0)
-               goto nfattr_failure;
 
-       if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
-           ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
-               goto nfattr_failure;
+       if (events & IPCT_DESTROY) {
+               if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
+                   ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
+                       goto nfattr_failure;
+       } else {
+               if (ctnetlink_dump_status(skb, ct) < 0)
+                       goto nfattr_failure;
 
-       if (events & IPCT_MARK
-           && ctnetlink_dump_mark(skb, ct) < 0)
-               goto nfattr_failure;
+               if (ctnetlink_dump_timeout(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if (events & IPCT_PROTOINFO
+                   && ctnetlink_dump_protoinfo(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if ((events & IPCT_HELPER || nfct_help(ct))
+                   && ctnetlink_dump_helpinfo(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if ((events & IPCT_MARK || ct->mark)
+                   && ctnetlink_dump_mark(skb, ct) < 0)
+                       goto nfattr_failure;
+
+               if (events & IPCT_COUNTER_FILLING &&
+                   (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
+                    ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
+                       goto nfattr_failure;
+       }
 
        nlh->nlmsg_len = skb->tail - b;
        nfnetlink_send(skb, 0, group, 0);