netdev - Re: [PATCH v2 net-next] netlink: specs: add conntrack dump and stats dump support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <m2cyfoohwu.fsf@gmail.com>
Date: Tue, 11 Feb 2025 11:11:13 +0000
From: Donald Hunter <donald.hunter@...il.com>
To: Florian Westphal <fw@...len.de>
Cc: <netdev@...r.kernel.org>,  <netfilter-devel@...r.kernel.org>
Subject: Re: [PATCH v2 net-next] netlink: specs: add conntrack dump and
 stats dump support

Florian Westphal <fw@...len.de> writes:

> This adds support to dump the connection tracking table
> ("conntrack -L") and the conntrack statistics, ("conntrack -S").
>
> Example conntrack dump:
> tools/net/ynl/pyynl/cli.py --spec Documentation/netlink/specs/conntrack.yaml --dump get

Hi Florian,

Updates all look good, with one minor new point below.

Reviewed-by: Donald Hunter <donald.hunter@...il.com>

> +operations:
> +  enum-model: directional
> +  list:
> +    -
> +      name: get
> +      doc: get / dump entries
> +      attribute-set: conntrack-attrs
> +      fixed-header: nfgenmsg
> +      do:
> +        request:
> +          value: 0x101
> +          attributes:
> +            - tuple-orig
> +            - tuple-reply
> +            - zone
> +        reply:
> +          value: 0x100
> +          attributes:

To avoid duplicating the attribute list in the dump reply, you can
reference this definition:

@@ -565,7 +565,7 @@ operations:
             - zone
         reply:
           value: 0x100
-          attributes:
+          attributes: &entries-attrs
             - tuple-orig
             - tuple-reply
             - status
@@ -598,28 +598,7 @@ operations:
             - zone
         reply:
           value: 0x100
-          attributes:
-            - tuple-orig
-            - tuple-reply
-            - status
-            - protoinfo
-            - help
-            - nat-src
-            - nat-dst
-            - timeout
-            - mark
-            - counter-orig
-            - counter-reply
-            - use
-            - id
-            - nat-dst
-            - tuple-master
-            - seq-adj-orig
-            - seq-adj-reply
-            - zone
-            - secctx
-            - labels
-            - synproxy
+          attributes: *entries-attrs
     -
       name: get-stats
       doc: dump pcpu conntrack stats