[PATCH net v2 0/2] netlink: specs: fixes for conntrack dump filtering

[PATCH net v2 0/2] netlink: specs: fixes for conntrack dump filtering

[Ilya Maximets]

Version 2:
 - Also added missing tuple attributes for the dump request.
 - Converted into a set by adding the patch 2.

Version 1:
 - https://lore.kernel.org/r/20260825155832.3685714-1-i.maximets@ovn.org

Ilya Maximets (2):
  netlink: specs: fix the conntrack filter type
  netlink: specs: add missing mask attributes for conntrack dump

 Documentation/netlink/specs/conntrack.yaml | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

-- 
2.55.0

[PATCH net v2 1/2] netlink: specs: fix the conntrack filter type

[Ilya Maximets]

The CTA_FILTER doesn't contain nested tuple attributes, instead it
contains bit masks that specify which tuple attributes to filter on.
The values for filtering are taken from the top-level CTA_TUPLE_ORIG
and CTA_TUPLE_REPLY, which are also missing in the attribute list
for the dump request.

The bits themselves somehow are not in the public headers, so not
defining them in the spec either for now.  Once they are public in
uAPI, they can be added here with enum-as-flags.

Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
---
 Documentation/netlink/specs/conntrack.yaml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index db7cddcda50a..6ba28cb1c2ab 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -360,6 +360,17 @@ attribute-sets:
         name: tsoff
         type: u32
         byte-order: big-endian
+  -
+    name: filter-attrs
+    attributes:
+      -
+        name: orig-flags
+        type: u32
+        doc: bitmask of tuple fields to filter on, original direction
+      -
+        name: reply-flags
+        type: u32
+        doc: bitmask of tuple fields to filter on, reply direction
   -
     name: conntrack-attrs
     attributes:
@@ -466,7 +477,7 @@ attribute-sets:
       -
         name: filter
         type: nest
-        nested-attributes: tuple-attrs
+        nested-attributes: filter-attrs
       -
         name: status-mask
         type: u32
@@ -591,6 +602,8 @@ operations:
         request:
           value: 0x101
           attributes:
+            - tuple-orig
+            - tuple-reply
             - mark
             - filter
             - status
-- 
2.55.0

Re: [PATCH net v2 1/2] netlink: specs: fix the conntrack filter type

[Asbjørn Sloth Tønnesen]

On 8/26/26 10:01 PM, Ilya Maximets wrote:
> The CTA_FILTER doesn't contain nested tuple attributes, instead it
> contains bit masks that specify which tuple attributes to filter on.
> The values for filtering are taken from the top-level CTA_TUPLE_ORIG
> and CTA_TUPLE_REPLY, which are also missing in the attribute list
> for the dump request.
> 
> The bits themselves somehow are not in the public headers, so not
> defining them in the spec either for now.  Once they are public in
> uAPI, they can be added here with enum-as-flags.
> 
> Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

LGTM, thanks.

Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>

[PATCH net v2 2/2] netlink: specs: add missing mask attributes for conntrack dump

[Ilya Maximets]

'mark-mask' and 'status-mask' are defined and supported by the
conntrack dump, but missing from the list of arguments.

While at it, the order of the arguments should follow the order of
their definition in the enum ctattr_type.  That appears to be a common
convention for other spec files.

Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
---
 Documentation/netlink/specs/conntrack.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index 6ba28cb1c2ab..b1eb102ab843 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -604,10 +604,12 @@ operations:
           attributes:
             - tuple-orig
             - tuple-reply
-            - mark
-            - filter
             - status
+            - mark
             - zone
+            - mark-mask
+            - filter
+            - status-mask
         reply:
           value: 0x100
           attributes:
-- 
2.55.0

Re: [PATCH net v2 2/2] netlink: specs: add missing mask attributes for conntrack dump

[Asbjørn Sloth Tønnesen]

On 8/26/26 10:01 PM, Ilya Maximets wrote:
> 'mark-mask' and 'status-mask' are defined and supported by the
> conntrack dump, but missing from the list of arguments.
> 
> While at it, the order of the arguments should follow the order of
> their definition in the enum ctattr_type.  That appears to be a common
> convention for other spec files.
> 
> Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

LGTM, thanks.

Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>

Re: [PATCH net v2 0/2] netlink: specs: fixes for conntrack dump filtering

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 27 Aug 2026 00:01:10 +0200 you wrote:
> Version 2:
>  - Also added missing tuple attributes for the dump request.
>  - Converted into a set by adding the patch 2.
> 
> Version 1:
>  - https://lore.kernel.org/r/20260825155832.3685714-1-i.maximets@ovn.org
> 
> [...]

Here is the summary with links:
  - [net,v2,1/2] netlink: specs: fix the conntrack filter type
    https://git.kernel.org/netdev/net/c/2a004bfb62bd
  - [net,v2,2/2] netlink: specs: add missing mask attributes for conntrack dump
    https://git.kernel.org/netdev/net/c/8b348496cbec

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html