[PATCH nf] net: netfilter: report NLM_F_DUMP_FILTERED when all is filtered out

[PATCH nf] net: netfilter: report NLM_F_DUMP_FILTERED when all is filtered out

[Ilya Maximets]

NLM_F_DUMP_FILTERED is only set on data elements in the conntrack dump.
But when everything is filtered out it is confusing for the user space,
since the flag is not reported anymore and it looks like the table was
empty, which may or may not be the case.

'answer_flags' were introduced precisely for this use case, and the
conntrack dump should set the flag in there in case the filtering was
applied.

This is important, for example, to be able to tell if the filters are
supported or not by the kernel without modifying the kernel state.

With the proper reporting of NLM_F_DUMP_FILTERED on NLMSG_DONE, an
application in user space can just try and dump with an arbitrary
filter without worrying that there could be no matching entry.  The
reported flag will signal that the filtering was applied and therefore
supported.

Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
---
 net/netfilter/nf_conntrack_netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9b4e29557ec3..579ada063b1b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1077,6 +1077,8 @@ static int ctnetlink_start(struct netlink_callback *cb)
 	}
 
 	cb->data = filter;
+	if (filter)
+		cb->answer_flags = NLM_F_DUMP_FILTERED;
 	return 0;
 }
 
-- 
2.55.0

Re: [PATCH nf] net: netfilter: report NLM_F_DUMP_FILTERED when all is filtered out

[Florian Westphal]

Ilya Maximets <i.maximets@ovn.org> wrote:
> NLM_F_DUMP_FILTERED is only set on data elements in the conntrack dump.
> But when everything is filtered out it is confusing for the user space,
> since the flag is not reported anymore and it looks like the table was
> empty, which may or may not be the case.
> 
> 'answer_flags' were introduced precisely for this use case, and the
> conntrack dump should set the flag in there in case the filtering was
> applied.
> 
> This is important, for example, to be able to tell if the filters are
> supported or not by the kernel without modifying the kernel state.
> 
> With the proper reporting of NLM_F_DUMP_FILTERED on NLMSG_DONE, an
> application in user space can just try and dump with an arbitrary
> filter without worrying that there could be no matching entry.  The
> reported flag will signal that the filtering was applied and therefore
> supported.
> 
> Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Reviewed-by: Florian Westphal <fw@strlen.de>

FWIW this also passes libnetfilter_conntrack and conntrack userspace tests.