Re: Seeking help for implementing CT HELPER in nftables

[Christophe Leroy <christophe.leroy@c-s.fr>]

Patrick, can you help ?

Le 09/03/2016 00:25, Christophe Leroy a écrit :
>
> Le 07/03/2016 14:20, Patrick McHardy a écrit :
>> On 05.03, christophe leroy wrote:
>>> Hello,
>>>
>>> I'm trying to implement support for CT HELPERs in linux kernel for
>>> nftables and need some help/guidance.
>>>
>>> The rule beeing 'udp dport tftp ct helper set "tftp"', I get
>>> nft_ct_set_init() called when I add the rule in the table output filter
>>> table.
>>>
>>> I believe I have to call nf_ct_helper_ext_add() from nft_ct_set_init(),
>>> but for that I need the name of the helper that is to be set, ie 
>>> 'tftp'.
>>> How do I get the name of the requested helper in that function ? I
>>> suppose once I get it I can do the same as  xt_ct_set_helper() does.
>> This depends on how we want to implement this. We could pass a static 
>> helper
>> name in a new CT attribute, look the helper up in the init path and 
>> assign it
>> to the conntrack in the eval function. This means we'd require a 
>> single rule
>> for every helper assignment.
> How do we add a new CT attribute for that ? Is there any exemple in 
> other parts of the kernel for doing that ?
> Is it just to add a NFTA_CT_HELPER then add it in the nft_ct_policy 
> structure as an NLA_STRING type and then retrieve it with 
> nla_strl_cpy() ?
> But how does it gets populated with the helper string passed in by nft ?
>
> Christophe
>
>

Christophe
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html