Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3087c3f7 authored by Brett Mastbergen's avatar Brett Mastbergen Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_ct: Add ct id support 



The 'id' key returns the unique id of the conntrack entry as returned
by nf_ct_get_id().

Signed-off-by: default avatarBrett Mastbergen <bmastbergen@untangle.com>
Acked-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent fec9c271

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -967,6 +967,7 @@ enum nft_socket_keys { 
 * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address)

 * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address)

 * @NFT_CT_TIMEOUT: connection tracking timeout policy assigned to conntrack

 * @NFT_CT_ID: conntrack id

 */

enum nft_ct_keys {

	NFT_CT_STATE,
@@ -993,6 +994,7 @@ enum nft_ct_keys { 
	NFT_CT_SRC_IP6,

	NFT_CT_DST_IP6,

	NFT_CT_TIMEOUT,

	NFT_CT_ID,

	__NFT_CT_MAX

};

#define NFT_CT_MAX		(__NFT_CT_MAX - 1)

net/netfilter/nft_ct.c

+8 −0
Original line number Diff line number Diff line
@@ -178,6 +178,11 @@ static void nft_ct_get_eval(const struct nft_expr *expr, 
		return;

	}

#endif

	case NFT_CT_ID:

		if (!nf_ct_is_confirmed(ct))

			goto err;

		*dest = nf_ct_get_id(ct);

		return;

	default:

		break;

	}
@@ -479,6 +484,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx, 
		len = sizeof(u16);

		break;

#endif

	case NFT_CT_ID:

		len = sizeof(u32);

		break;

	default:

		return -EOPNOTSUPP;

	}