netfilter: ctnetlink: Support L3 protocol-filter on flush

Browse source

The same connection mark can be set on flows belonging to different
address families. This commit adds support for filtering on the L3
protocol when flushing connection track entries. If no protocol is
specified, then all L3 protocols match.

In order to avoid code duplication and a redundant check, the protocol
comparison in ctnetlink_dump_table() has been removed. Instead, a filter
is created if the GET-message triggering the dump contains an address
family. ctnetlink_filter_match() is then used to compare the L3
protocols.

Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Kristian Evensen 2018-09-03 18:28:20 +02:00 • committed by Pablo Neira Ayuso

parent 6c47260250

commit 59c08c69c2

1 changed files with 28 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

50

net/netfilter/nf_conntrack_netlink.c

View file