[PATCH net] netlink: specs: fix the conntrack filter type

[PATCH net] netlink: specs: fix the conntrack filter type

[Ilya Maximets]

The CTA_FILTER doesn't contain nested tuple attributes, instead it
contains bit masks that specify which tuple attributes to filter on.
The values for filtering are taken from the top-level CTA_TUPLE_ORIG
and CTA_TUPLE_REPLY.

The bits themselves somehow are not in the public headers, so not
defining them in the spec either for now.  Once they are public in
uAPI, they can be added here with enum-as-flags.

Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
---
 Documentation/netlink/specs/conntrack.yaml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index db7cddcda50a..46f1ba880745 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -360,6 +360,17 @@ attribute-sets:
         name: tsoff
         type: u32
         byte-order: big-endian
+  -
+    name: filter-attrs
+    attributes:
+      -
+        name: orig-flags
+        type: u32
+        doc: bitmask of tuple fields to filter on, original direction
+      -
+        name: reply-flags
+        type: u32
+        doc: bitmask of tuple fields to filter on, reply direction
   -
     name: conntrack-attrs
     attributes:
@@ -466,7 +477,7 @@ attribute-sets:
       -
         name: filter
         type: nest
-        nested-attributes: tuple-attrs
+        nested-attributes: filter-attrs
       -
         name: status-mask
         type: u32
-- 
2.55.0

Re: [PATCH net] netlink: specs: fix the conntrack filter type

[Asbjørn Sloth Tønnesen]

On 8/25/26 3:58 PM, Ilya Maximets wrote:
> The CTA_FILTER doesn't contain nested tuple attributes, instead it
> contains bit masks that specify which tuple attributes to filter on.
> The values for filtering are taken from the top-level CTA_TUPLE_ORIG
> and CTA_TUPLE_REPLY.

As identified by Sashiko-NIPA[1], then CTA_TUPLE_ORIG and CTA_TUPLE_REPLY
are both absent from the GET DUMP request attribute list.

However this doesn't prevent ynl CLI from sending the attributes:

$ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
   '{"nfgen-family": 2, "filter": {"orig-flags": 1}}'
Netlink error: Invalid argument

$ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
'{"nfgen-family": 2, "filter": {"orig-flags": 1}, "tuple-orig": {"tuple-ip": {"ip-v4-src": "192.255.0.255", "ip-v4-dst": 
"192.255.255.0"}}}'
[]

Otherwise, LGTM.

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260825155832.3685714-1-i.maximets%40ovn.org

Re: [PATCH net] netlink: specs: fix the conntrack filter type

[Ilya Maximets]

On 8/26/26 7:20 PM, Asbjørn Sloth Tønnesen wrote:
> On 8/25/26 3:58 PM, Ilya Maximets wrote:
>> The CTA_FILTER doesn't contain nested tuple attributes, instead it
>> contains bit masks that specify which tuple attributes to filter on.
>> The values for filtering are taken from the top-level CTA_TUPLE_ORIG
>> and CTA_TUPLE_REPLY.
> 
> As identified by Sashiko-NIPA[1], then CTA_TUPLE_ORIG and CTA_TUPLE_REPLY
> are both absent from the GET DUMP request attribute list.
> 
> However this doesn't prevent ynl CLI from sending the attributes:
> 
> $ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
>    '{"nfgen-family": 2, "filter": {"orig-flags": 1}}'
> Netlink error: Invalid argument
> 
> $ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
> '{"nfgen-family": 2, "filter": {"orig-flags": 1}, "tuple-orig": {"tuple-ip": {"ip-v4-src": "192.255.0.255", "ip-v4-dst": 
> "192.255.255.0"}}}'
> []
> 
> Otherwise, LGTM.
> 
> [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260825155832.3685714-1-i.maximets%40ovn.org

The reported issue is preexisting and a little orthogonal to the goal of
this patch.  I.e. missing dump attributes vs wrong type of attributes that
are specified.

I can add all the missing attributes: tuple-orig, tuple-reply, mark-mask
and status-mask.  Either as a separate patch, or fold the change into this
one, but rename it into something like:
  "netlink: specs: fix conntrack filtering attributes and types"

WDYT?

Best regrads, Ilya Maximets.

Re: [PATCH net] netlink: specs: fix the conntrack filter type

[Asbjørn Sloth Tønnesen]

On 8/26/26 6:38 PM, Ilya Maximets wrote:
> On 8/26/26 7:20 PM, Asbjørn Sloth Tønnesen wrote:
>> On 8/25/26 3:58 PM, Ilya Maximets wrote:
>>> The CTA_FILTER doesn't contain nested tuple attributes, instead it
>>> contains bit masks that specify which tuple attributes to filter on.
>>> The values for filtering are taken from the top-level CTA_TUPLE_ORIG
>>> and CTA_TUPLE_REPLY.
>>
>> As identified by Sashiko-NIPA[1], then CTA_TUPLE_ORIG and CTA_TUPLE_REPLY
>> are both absent from the GET DUMP request attribute list.
>>
>> However this doesn't prevent ynl CLI from sending the attributes:
>>
>> $ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
>>     '{"nfgen-family": 2, "filter": {"orig-flags": 1}}'
>> Netlink error: Invalid argument
>>
>> $ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
>> '{"nfgen-family": 2, "filter": {"orig-flags": 1}, "tuple-orig": {"tuple-ip": {"ip-v4-src": "192.255.0.255", "ip-v4-dst":
>> "192.255.255.0"}}}'
>> []
>>
>> Otherwise, LGTM.
>>
>> [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260825155832.3685714-1-i.maximets%40ovn.org
> 
> The reported issue is preexisting and a little orthogonal to the goal of
> this patch.  I.e. missing dump attributes vs wrong type of attributes that
> are specified.
> 
> I can add all the missing attributes: tuple-orig, tuple-reply, mark-mask
> and status-mask.  Either as a separate patch, or fold the change into this
> one, but rename it into something like:
>    "netlink: specs: fix conntrack filtering attributes and types"
> 
> WDYT?

I agree that it is a little orthogonal, but OTOH the patch doesn't really fix
anything meaningful when the YNL spec doesn't allow actually making the request.
The commit message directly refers to attributes not allowed in the YNL spec,
without declaring it as intentionally deferred (like the filter bitmasks).

I see mark-mask and status-mask as a fully orthogonal issue, as they don't
clash with the commit message.

I would just fold tuple-orig and tuple-reply into this patch, and leave
mark-mask and status-mask for another patch.  Alternatively make it a series.

Re: [PATCH net] netlink: specs: fix the conntrack filter type

[Ilya Maximets]

On 8/26/26 9:40 PM, Asbjørn Sloth Tønnesen wrote:
> On 8/26/26 6:38 PM, Ilya Maximets wrote:
>> On 8/26/26 7:20 PM, Asbjørn Sloth Tønnesen wrote:
>>> On 8/25/26 3:58 PM, Ilya Maximets wrote:
>>>> The CTA_FILTER doesn't contain nested tuple attributes, instead it
>>>> contains bit masks that specify which tuple attributes to filter on.
>>>> The values for filtering are taken from the top-level CTA_TUPLE_ORIG
>>>> and CTA_TUPLE_REPLY.
>>>
>>> As identified by Sashiko-NIPA[1], then CTA_TUPLE_ORIG and CTA_TUPLE_REPLY
>>> are both absent from the GET DUMP request attribute list.
>>>
>>> However this doesn't prevent ynl CLI from sending the attributes:
>>>
>>> $ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
>>>     '{"nfgen-family": 2, "filter": {"orig-flags": 1}}'
>>> Netlink error: Invalid argument
>>>
>>> $ sudo ./tools/net/ynl/pyynl/cli.py --family conntrack --dump get --json \
>>> '{"nfgen-family": 2, "filter": {"orig-flags": 1}, "tuple-orig": {"tuple-ip": {"ip-v4-src": "192.255.0.255", "ip-v4-dst":
>>> "192.255.255.0"}}}'
>>> []
>>>
>>> Otherwise, LGTM.
>>>
>>> [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260825155832.3685714-1-i.maximets%40ovn.org
>>
>> The reported issue is preexisting and a little orthogonal to the goal of
>> this patch.  I.e. missing dump attributes vs wrong type of attributes that
>> are specified.
>>
>> I can add all the missing attributes: tuple-orig, tuple-reply, mark-mask
>> and status-mask.  Either as a separate patch, or fold the change into this
>> one, but rename it into something like:
>>    "netlink: specs: fix conntrack filtering attributes and types"
>>
>> WDYT?
> 
> I agree that it is a little orthogonal, but OTOH the patch doesn't really fix
> anything meaningful when the YNL spec doesn't allow actually making the request.
> The commit message directly refers to attributes not allowed in the YNL spec,
> without declaring it as intentionally deferred (like the filter bitmasks).
> 
> I see mark-mask and status-mask as a fully orthogonal issue, as they don't
> clash with the commit message.
> 
> I would just fold tuple-orig and tuple-reply into this patch, and leave
> mark-mask and status-mask for another patch.  Alternatively make it a series.

Makes sense.  I'll make it a set:  First patch will be this one with the
tuple-orig and tuple-reply folded in.  The second will add missing
mark-mask and status-mask.

Best regards, Ilya Maximets.