Support ctnetlink messages #9

terassyi · 2025-01-31T04:47:27Z

This PR supports CtNetlink messages and add some example code to use it.

This is based on #8.

And as a reference implementation, I'm developing conntrack command in Rust with rust-netlink.
https://github.com/terassyi/rconntrack

Signed-off-by: terassyi <iscale821@gmail.com>

cathay4t

Just some cosmetic review comments.

Please give me more time(up to 2 weeks) to test and review the real functionality.

cathay4t · 2025-02-12T03:08:15Z

src/ctnetlink/mod.rs

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: MIT
+
+pub mod message;


Let's not expose internal module path to public.

I prefer expose all types as netlink-packet-netfilter::conn_track::{ContrackAttr, etc}.

cathay4t · 2025-02-12T03:10:12Z

src/ctnetlink/nlas/ct_attr.rs

+};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CtAttr {


How about ConnTrackAttribute?

cathay4t · 2025-02-12T03:11:52Z

src/ctnetlink/message.rs

+    GetUnconfirmed(Option<Vec<FlowNla>>),
+    Other {
+        message_type: u8,
+        nlas: Vec<DefaultNla>,


Unless kernel code confirmed future data will always a array of Nla, we should use Other((u8, DefaultNla)).

It seems NetfilterBuffer doesn't provide the method to parse it to a single DefaultNla, should I create a new method?

cathay4t · 2025-02-12T03:14:22Z

src/constants.rs

+
+// netflter/nfnetlink_conntrack.h
+// There is no definitions in rust-lang/libc
+pub const IPCTNL_MSG_CT_NEW: u8 = 0;


The netlink-packet-route has stopped exposing constants out.

I do not have time to polish here yet, but please do not add more lines to src/contants.rs.
Please:

Remoev pub.

Move constant to its user, this make our review easier.

cathay4t · 2025-02-12T03:21:21Z

src/ctnetlink/nlas/ct_attr.rs

+    ];
+
+    #[test]
+    fn test_ct_attr_parse() {


I am expecting test case looks like:

https://github.com/rust-netlink/netlink-packet-route/blob/main/src/link/tests/vrf.rs#L68

(You do not need to document every bits)

You may use nlmon to capture real netlink message:
https://github.com/rust-netlink/netlink-packet-route?tab=readme-ov-file#development

cathay4t · 2025-02-12T03:29:38Z

src/ctnetlink/nlas/flow/protocol_info.rs

+pub struct ProtocolInfoTcp {
+    pub state: u8,
+    pub wscale_original: u8,
+    pub wscale_reply: u8,
+    pub flgas_original: u16,
+    pub flags_reply: u16,
+}


Please consider to use NlaBuffer, example: https://github.com/rust-netlink/netlink-packet-route/blob/main/src/route/via.rs#L31

I tried to use buffer macro like the following.

buffer!(ProtocolInfoTcpBuffer { state: (u8, 0), wscale_original: (u8, 1), wscale_reply: (u8, 2), flags_original: (u16, 3..5), flags_reply: (u16, 5..7), });

But ProtocolInfoTcp cannot be parsed simply like the example you gave, because it consists of nested ConntrackAttribute.

I'm not familiar with using buffer macro, so if you have any better idea about this, could you give me any hints?

cathay4t · 2025-02-12T03:30:54Z

src/ctnetlink/nlas/flow/status.rs

+use crate::constants::CTA_STATUS;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum ConnectionStatusFlag {


Please use bitflags! here. Example: https://github.com/rust-netlink/netlink-packet-route/blob/main/src/route/next_hops.rs#L22

cathay4t · 2025-02-12T03:31:10Z

src/ctnetlink/nlas/mod.rs

+// SPDX-License-Identifier: MIT
+
+pub mod ct_attr;
+pub mod flow;


do not expose module path out.

cathay4t · 2025-02-12T03:31:31Z

src/ctnetlink/nlas/stat/nla.rs

+    Invalid(u32),
+    Ignore(u32),     // no longer used
+    Delete(u32),     // no longer used
+    DeleteList(u32), // no longer used


If no longer used, please remove it.

cathay4t · 2025-02-12T03:32:01Z

src/lib.rs

@@ -4,4 +4,5 @@ pub(crate) mod buffer;
 pub mod constants;
 mod message;
 pub use message::{NetfilterHeader, NetfilterMessage, NetfilterMessageInner};
+pub mod ctnetlink;


The crate name already contains netlink, how about conn_track?

It is fine for me to change.
How about conntrack?
Upstream netfilter.org seems to use conntrack rather than conn_track.

- rename from CtAttr to ConntrackAttribute - rename from FlowNla and StatNla to FlowAttribute and StatCpuAttribute - use buffier!() for ProtocolInfoTcp - use bitflags!() for ConnectionStatusFlag - remove constant values and enum variants that is no longer used - move values from src/constatnts.rs to its users - stop exposing internal modules - introduce StatGlobalAttribute that represents ctattr_stats_global in the kernel Signed-off-by: terassyi <iscale821@gmail.com>

tik-stbuehler · 2025-02-26T10:58:14Z

src/ctnetlink/nlas/flow/protocol_info.rs

+    pub state: u8,
+    pub wscale_original: u8,
+    pub wscale_reply: u8,
+    pub flgas_original: u16,


typo: flgas_original -> flags_original

tik-stbuehler · 2025-02-26T13:41:02Z

src/ctnetlink/nlas/flow/ip_tuple.rs

+pub struct ProtocolTuple {
+    pub src_port: u16,
+    pub dst_port: u16,
+    pub protocol: u8,
+}


The protocol tuple doesn't always include ports, and might include other information (attributes). ICMP flows have id, type and code, and IGMP has no additional fields (only CTA_PROTO_NUM should always be present):

enum ctattr_l4proto { CTA_PROTO_UNSPEC, CTA_PROTO_NUM, CTA_PROTO_SRC_PORT, CTA_PROTO_DST_PORT, CTA_PROTO_ICMP_ID, CTA_PROTO_ICMP_TYPE, CTA_PROTO_ICMP_CODE, CTA_PROTO_ICMPV6_ID, CTA_PROTO_ICMPV6_TYPE, CTA_PROTO_ICMPV6_CODE, __CTA_PROTO_MAX };

terassyi added 12 commits December 20, 2024 23:21

Support IPCTNL_MSG_CT_NEW and IPCTNL_MSG_CT_GET

77de466

Signed-off-by: terassyi <iscale821@gmail.com>

Support IPCTNL_MSG_CT_DELETE

c46bd62

Signed-off-by: terassyi <iscale821@gmail.com>

Fix to parse get message

050bd98

Signed-off-by: terassyi <iscale821@gmail.com>

Support IPCTNL_MSG_CT_GET_STATS

af15691

Signed-off-by: terassyi <iscale821@gmail.com>

Support IPCTNL_MSG_CT_GET_STATS_CPU

3d01568

Signed-off-by: terassyi <iscale821@gmail.com>

Support IPCTNL_MSG_CT_GET_CTRZERO

ff62583

Signed-off-by: terassyi <iscale821@gmail.com>

Support IPCTNL_MSG_CT_GET_DYING and IPCTNL_MSG_CT_GET_UNCONFIRMED

8c3e16b

Signed-off-by: terassyi <iscale821@gmail.com>

Export ProtocolInfoTcp's fields

a3a8b4b

Signed-off-by: terassyi <iscale821@gmail.com>

Add Hash trait for ConnectionStatusFlag

0675579

Signed-off-by: terassyi <iscale821@gmail.com>

Fix ConnectionStatusFlag's value

147656a

Signed-off-by: terassyi <iscale821@gmail.com>

Export CtAttr

386a809

Signed-off-by: terassyi <iscale821@gmail.com>

fix StatNla variants

2cb429b

Signed-off-by: terassyi <iscale821@gmail.com>

terassyi force-pushed the support-ctnetlink-subsys branch from 98ea7f8 to 2cb429b Compare February 3, 2025 10:34

cathay4t requested changes Feb 12, 2025

View reviewed changes

cathay4t added the Wait_Submitter label Feb 12, 2025

reyzell mentioned this pull request Feb 17, 2025

Add support for CTNETLINK messages #8

Open

terassyi requested a review from cathay4t February 23, 2025 14:20

terassyi force-pushed the support-ctnetlink-subsys branch from 75efe13 to 83942c6 Compare February 23, 2025 14:26

terassyi force-pushed the support-ctnetlink-subsys branch from 83942c6 to 17bb58f Compare February 23, 2025 15:20

tik-stbuehler reviewed Feb 26, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support ctnetlink messages #9

Support ctnetlink messages #9

terassyi commented Jan 31, 2025

cathay4t left a comment

cathay4t Feb 12, 2025

cathay4t Feb 12, 2025

cathay4t Feb 12, 2025

terassyi Feb 16, 2025

cathay4t Feb 12, 2025

cathay4t Feb 12, 2025

cathay4t Feb 12, 2025

terassyi Feb 16, 2025

cathay4t Feb 12, 2025

cathay4t Feb 12, 2025

cathay4t Feb 12, 2025

cathay4t Feb 12, 2025

terassyi Feb 16, 2025

tik-stbuehler Feb 26, 2025

tik-stbuehler Feb 26, 2025

		@@ -0,0 +1,4 @@
		// SPDX-License-Identifier: MIT

		pub mod message;

Support ctnetlink messages #9

Are you sure you want to change the base?

Support ctnetlink messages #9

Conversation

terassyi commented Jan 31, 2025

cathay4t left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment