Re: [PATCH nf-next] netfilter: ctnetlink: make more information available in DESTROY events

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jan 18, 2017 at 04:07:45PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Jan 18, 2017 at 03:54:32PM +0100, Florian Westphal wrote:
> > > destroy events currently don't contain the tcp state info and no
> > > secmark and conntrack labels.
> > > 
> > > Quoting Victor:
> > >  "I was hoping to get the last TCP state in a conntrack destroy event,
> > >   however it seems to be unavailable."
> > > 
> > > Quoting Jarno:
> > >  "I have a use case where we want to log terminating connections, but
> > >  only if a specific label bit is set."
> > > 
> > > While at it, also include SECMARK in destroy events if one is available.
> > 
> > I'm fine with this.
> > 
> > But to remember the original problem is that netlink bandwidth is
> > limited, so the more we load the netlink message, the more chances we
> > have to hit ENOBUFS.
> > 
> > connlabel is optional, so you only get it if needed.
> 
> Yes, and only if there was a label change or at least one label bit is
> set.
> 
> > But the protoinfo thing, I would prefer we just dump the state given
> > this the usecase we have now.
> > 
> > Probably extend ->to_nlattr() to have a bool that indicates if this is
> > a dump?
> 
> Could do that by it only avoids 4 attributes (so we only save 32bytes
> per message).

IIRC, the destroy message is rather small. Moreover, think of
thousands of messages in that queue, that makes a difference. And I
cannot think of anything useful people can do with window scale and
flags at that stage, right?