* [PATCH] netfilter: ctnetlink: support CTA_FILTER for flush
@ 2024-06-20 11:35 Changliang Wu
2024-07-11 5:40 ` Changliang Wu
0 siblings, 1 reply; 4+ messages in thread
From: Changliang Wu @ 2024-06-20 11:35 UTC (permalink / raw)
To: pablo, kadlec, davem, edumazet, kuba, pabeni
Cc: netfilter-devel, coreteam, netdev, linux-kernel, Changliang Wu
From cb8aa9a, we can use kernel side filtering for dump, but
this capability is not available for flush.
This Patch allows advanced filter with CTA_FILTER for flush
Performace
1048576 ct flows in total, delete 50,000 flows by origin src ip
3.06s -> dump all, compare and delete
584ms -> directly flush with filter
Signed-off-by: Changliang Wu <changliang.wu@smartx.com>
---
net/netfilter/nf_conntrack_netlink.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 3b846cbdc..93afe57d9 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1579,9 +1579,6 @@ static int ctnetlink_flush_conntrack(struct net *net,
};
if (ctnetlink_needs_filter(family, cda)) {
- if (cda[CTA_FILTER])
- return -EOPNOTSUPP;
-
filter = ctnetlink_alloc_filter(cda, family);
if (IS_ERR(filter))
return PTR_ERR(filter);
@@ -1610,14 +1607,14 @@ static int ctnetlink_del_conntrack(struct sk_buff *skb,
if (err < 0)
return err;
- if (cda[CTA_TUPLE_ORIG])
+ if (cda[CTA_TUPLE_ORIG] && !cda[CTA_FILTER])
err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
family, &zone);
- else if (cda[CTA_TUPLE_REPLY])
+ else if (cda[CTA_TUPLE_REPLY] && !cda[CTA_FILTER])
err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
family, &zone);
else {
- u_int8_t u3 = info->nfmsg->version ? family : AF_UNSPEC;
+ u8 u3 = info->nfmsg->version || cda[CTA_FILTER] ? family : AF_UNSPEC;
return ctnetlink_flush_conntrack(info->net, cda,
NETLINK_CB(skb).portid,
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] netfilter: ctnetlink: support CTA_FILTER for flush
2024-06-20 11:35 [PATCH] netfilter: ctnetlink: support CTA_FILTER for flush Changliang Wu
@ 2024-07-11 5:40 ` Changliang Wu
2024-08-19 18:47 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Changliang Wu @ 2024-07-11 5:40 UTC (permalink / raw)
To: pablo, kadlec, davem, edumazet, kuba, pabeni
Cc: netfilter-devel, coreteam, netdev, linux-kernel
PING
Changliang Wu <changliang.wu@smartx.com> 于2024年6月20日周四 19:35写道：
>
> From cb8aa9a, we can use kernel side filtering for dump, but
> this capability is not available for flush.
>
> This Patch allows advanced filter with CTA_FILTER for flush
>
> Performace
> 1048576 ct flows in total, delete 50,000 flows by origin src ip
> 3.06s -> dump all, compare and delete
> 584ms -> directly flush with filter
>
> Signed-off-by: Changliang Wu <changliang.wu@smartx.com>
> ---
> net/netfilter/nf_conntrack_netlink.c | 9 +++------
> 1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> index 3b846cbdc..93afe57d9 100644
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -1579,9 +1579,6 @@ static int ctnetlink_flush_conntrack(struct net *net,
> };
>
> if (ctnetlink_needs_filter(family, cda)) {
> - if (cda[CTA_FILTER])
> - return -EOPNOTSUPP;
> -
> filter = ctnetlink_alloc_filter(cda, family);
> if (IS_ERR(filter))
> return PTR_ERR(filter);
> @@ -1610,14 +1607,14 @@ static int ctnetlink_del_conntrack(struct sk_buff *skb,
> if (err < 0)
> return err;
>
> - if (cda[CTA_TUPLE_ORIG])
> + if (cda[CTA_TUPLE_ORIG] && !cda[CTA_FILTER])
> err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
> family, &zone);
> - else if (cda[CTA_TUPLE_REPLY])
> + else if (cda[CTA_TUPLE_REPLY] && !cda[CTA_FILTER])
> err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
> family, &zone);
> else {
> - u_int8_t u3 = info->nfmsg->version ? family : AF_UNSPEC;
> + u8 u3 = info->nfmsg->version || cda[CTA_FILTER] ? family : AF_UNSPEC;
>
> return ctnetlink_flush_conntrack(info->net, cda,
> NETLINK_CB(skb).portid,
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netfilter: ctnetlink: support CTA_FILTER for flush
2024-07-11 5:40 ` Changliang Wu
@ 2024-08-19 18:47 ` Pablo Neira Ayuso
2024-08-22 7:58 ` Changliang Wu
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2024-08-19 18:47 UTC (permalink / raw)
To: Changliang Wu
Cc: kadlec, davem, edumazet, kuba, pabeni, netfilter-devel, coreteam,
netdev, linux-kernel
Please, provide an example program for libnetfilter_conntrack.
See:
commit 27f09380ebb0fc21c4cd20070b828a27430b5de1
Author: Felix Huettner <felix.huettner@mail.schwarz>
Date: Tue Dec 5 09:35:16 2023 +0000
conntrack: support flush filtering
for instance.
thanks
On Thu, Jul 11, 2024 at 01:40:02PM +0800, Changliang Wu wrote:
> PING
>
>
> Changliang Wu <changliang.wu@smartx.com> 于2024年6月20日周四 19:35写道：
> >
> > From cb8aa9a, we can use kernel side filtering for dump, but
> > this capability is not available for flush.
> >
> > This Patch allows advanced filter with CTA_FILTER for flush
> >
> > Performace
> > 1048576 ct flows in total, delete 50,000 flows by origin src ip
> > 3.06s -> dump all, compare and delete
> > 584ms -> directly flush with filter
> >
> > Signed-off-by: Changliang Wu <changliang.wu@smartx.com>
> > ---
> > net/netfilter/nf_conntrack_netlink.c | 9 +++------
> > 1 file changed, 3 insertions(+), 6 deletions(-)
> >
> > diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> > index 3b846cbdc..93afe57d9 100644
> > --- a/net/netfilter/nf_conntrack_netlink.c
> > +++ b/net/netfilter/nf_conntrack_netlink.c
> > @@ -1579,9 +1579,6 @@ static int ctnetlink_flush_conntrack(struct net *net,
> > };
> >
> > if (ctnetlink_needs_filter(family, cda)) {
> > - if (cda[CTA_FILTER])
> > - return -EOPNOTSUPP;
> > -
> > filter = ctnetlink_alloc_filter(cda, family);
> > if (IS_ERR(filter))
> > return PTR_ERR(filter);
> > @@ -1610,14 +1607,14 @@ static int ctnetlink_del_conntrack(struct sk_buff *skb,
> > if (err < 0)
> > return err;
> >
> > - if (cda[CTA_TUPLE_ORIG])
> > + if (cda[CTA_TUPLE_ORIG] && !cda[CTA_FILTER])
> > err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
> > family, &zone);
> > - else if (cda[CTA_TUPLE_REPLY])
> > + else if (cda[CTA_TUPLE_REPLY] && !cda[CTA_FILTER])
> > err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
> > family, &zone);
> > else {
> > - u_int8_t u3 = info->nfmsg->version ? family : AF_UNSPEC;
> > + u8 u3 = info->nfmsg->version || cda[CTA_FILTER] ? family : AF_UNSPEC;
> >
> > return ctnetlink_flush_conntrack(info->net, cda,
> > NETLINK_CB(skb).portid,
> > --
> > 2.43.0
> >
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netfilter: ctnetlink: support CTA_FILTER for flush
2024-08-19 18:47 ` Pablo Neira Ayuso
@ 2024-08-22 7:58 ` Changliang Wu
0 siblings, 0 replies; 4+ messages in thread
From: Changliang Wu @ 2024-08-22 7:58 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: kadlec, davem, edumazet, kuba, pabeni, netfilter-devel, coreteam,
netdev, linux-kernel
diff --git a/src/conntrack/filter_dump.c b/src/conntrack/filter_dump.c
index fd2d002..18d941b 100644
--- a/src/conntrack/filter_dump.c
+++ b/src/conntrack/filter_dump.c
@@ -68,9 +68,5 @@ int __build_filter_dump(struct nfnlhdr *req, size_t size,
int __build_filter_flush(struct nfnlhdr *req, size_t size,
const struct nfct_filter_dump *filter_dump)
{
- if (filter_dump->set & (1 << NFCT_FILTER_DUMP_TUPLE)) {
- errno = ENOTSUP;
- return -1;
- }
return nfct_nlmsg_build_filter(&req->nlh, filter_dump);
}
diff --git a/utils/Makefile.am b/utils/Makefile.am
index 7e7aef4..50a1c7c 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -11,6 +11,7 @@ check_PROGRAMS = expect_dump expect_create
expect_get expect_delete \
conntrack_dump_filter \
conntrack_dump_filter_tuple \
conntrack_flush_filter \
+ conntrack_flush_filter_tuple \
ctexp_events
conntrack_grp_create_SOURCES = conntrack_grp_create.c
@@ -46,6 +47,9 @@ conntrack_flush_LDADD = ../src/libnetfilter_conntrack.la
conntrack_flush_filter_SOURCES = conntrack_flush_filter.c
conntrack_flush_filter_LDADD = ../src/libnetfilter_conntrack.la
+conntrack_flush_filter_tuple_SOURCES = conntrack_flush_filter_tuple.c
+conntrack_flush_filter_tuple_LDADD = ../src/libnetfilter_conntrack.la
+
conntrack_events_SOURCES = conntrack_events.c
conntrack_events_LDADD = ../src/libnetfilter_conntrack.la
diff --git a/utils/conntrack_flush_filter_tuple.c
b/utils/conntrack_flush_filter_tuple.c
new file mode 100644
index 0000000..f2bf558
--- /dev/null
+++ b/utils/conntrack_flush_filter_tuple.c
@@ -0,0 +1,61 @@
+#include <arpa/inet.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+
+static int cb(enum nf_conntrack_msg_type type, struct nf_conntrack *ct,
+ void *data) {
+ char buf[1024];
+
+ nfct_snprintf(buf, sizeof(buf), ct, NFCT_T_UNKNOWN, NFCT_O_DEFAULT,
+ NFCT_OF_SHOW_LAYER3 | NFCT_OF_TIMESTAMP);
+ printf("%s\n", buf);
+
+ return NFCT_CB_CONTINUE;
+}
+
+int main(void) {
+ int ret;
+ struct nfct_handle *h;
+
+ h = nfct_open(CONNTRACK, 0);
+ if (!h) {
+ perror("nfct_open");
+ return -1;
+ }
+ struct nfct_filter_dump *filter_dump = nfct_filter_dump_create();
+ if (filter_dump == NULL) {
+ perror("nfct_filter_dump_alloc");
+ return -1;
+ }
+
+ struct nf_conntrack *ct;
+ ct = nfct_new();
+ if (!ct) {
+ perror("nfct_new");
+ return 0;
+ }
+
+ nfct_set_attr_u8(ct, ATTR_ORIG_L3PROTO, AF_INET);
+ nfct_set_attr_u8(ct, ATTR_L4PROTO, IPPROTO_ICMP);
+ nfct_set_attr_u32(ct, ATTR_ORIG_IPV4_DST, inet_addr("192.168.1.1"));
+ nfct_filter_dump_set_attr(filter_dump, NFCT_FILTER_DUMP_TUPLE, ct);
+
+ nfct_callback_register(h, NFCT_T_ALL, cb, NULL);
+ ret = nfct_query(h, NFCT_Q_FLUSH_FILTER, filter_dump);
+
+ nfct_filter_dump_destroy(filter_dump);
+
+ printf("TEST: get conntrack ");
+ if (ret == -1)
+ printf("(%d)(%s)\n", ret, strerror(errno));
+ else
+ printf("(OK)\n");
+
+ nfct_close(h);
+
+ ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS);
+}
Thank you for your reply.
Here is an example patch for conntrack_flush_filter_tuple above.
Pablo Neira Ayuso <pablo@netfilter.org> 于2024年8月20日周二 02:47写道：
>
> Please, provide an example program for libnetfilter_conntrack.
>
> See:
>
> commit 27f09380ebb0fc21c4cd20070b828a27430b5de1
> Author: Felix Huettner <felix.huettner@mail.schwarz>
> Date: Tue Dec 5 09:35:16 2023 +0000
>
> conntrack: support flush filtering
>
> for instance.
>
> thanks
>
> On Thu, Jul 11, 2024 at 01:40:02PM +0800, Changliang Wu wrote:
> > PING
> >
> >
> > Changliang Wu <changliang.wu@smartx.com> 于2024年6月20日周四 19:35写道：
> > >
> > > From cb8aa9a, we can use kernel side filtering for dump, but
> > > this capability is not available for flush.
> > >
> > > This Patch allows advanced filter with CTA_FILTER for flush
> > >
> > > Performace
> > > 1048576 ct flows in total, delete 50,000 flows by origin src ip
> > > 3.06s -> dump all, compare and delete
> > > 584ms -> directly flush with filter
> > >
> > > Signed-off-by: Changliang Wu <changliang.wu@smartx.com>
> > > ---
> > > net/netfilter/nf_conntrack_netlink.c | 9 +++------
> > > 1 file changed, 3 insertions(+), 6 deletions(-)
> > >
> > > diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> > > index 3b846cbdc..93afe57d9 100644
> > > --- a/net/netfilter/nf_conntrack_netlink.c
> > > +++ b/net/netfilter/nf_conntrack_netlink.c
> > > @@ -1579,9 +1579,6 @@ static int ctnetlink_flush_conntrack(struct net *net,
> > > };
> > >
> > > if (ctnetlink_needs_filter(family, cda)) {
> > > - if (cda[CTA_FILTER])
> > > - return -EOPNOTSUPP;
> > > -
> > > filter = ctnetlink_alloc_filter(cda, family);
> > > if (IS_ERR(filter))
> > > return PTR_ERR(filter);
> > > @@ -1610,14 +1607,14 @@ static int ctnetlink_del_conntrack(struct sk_buff *skb,
> > > if (err < 0)
> > > return err;
> > >
> > > - if (cda[CTA_TUPLE_ORIG])
> > > + if (cda[CTA_TUPLE_ORIG] && !cda[CTA_FILTER])
> > > err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
> > > family, &zone);
> > > - else if (cda[CTA_TUPLE_REPLY])
> > > + else if (cda[CTA_TUPLE_REPLY] && !cda[CTA_FILTER])
> > > err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
> > > family, &zone);
> > > else {
> > > - u_int8_t u3 = info->nfmsg->version ? family : AF_UNSPEC;
> > > + u8 u3 = info->nfmsg->version || cda[CTA_FILTER] ? family : AF_UNSPEC;
> > >
> > > return ctnetlink_flush_conntrack(info->net, cda,
> > > NETLINK_CB(skb).portid,
> > > --
> > > 2.43.0
> > >
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-08-22 7:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-20 11:35 [PATCH] netfilter: ctnetlink: support CTA_FILTER for flush Changliang Wu
2024-07-11 5:40 ` Changliang Wu
2024-08-19 18:47 ` Pablo Neira Ayuso
2024-08-22 7:58 ` Changliang Wu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).