Commit e2cf17d3 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: add new hook nfnl subsystem 



This nfnl subsystem allows to dump the list of all active netfiler hooks,
e.g. defrag, conntrack, nf/ip/arp/ip6tables and so on.

This helps to see what kind of features are currently enabled in
the network stack.

Sample output from nft tool using this infra:

 $ nft list hook ip input
 family ip hook input {
   +0000000010 nft_do_chain_inet [nf_tables] # nft table firewalld INPUT
   +0000000100 nf_nat_ipv4_local_in [nf_nat]
   +2147483647 ipv4_confirm [nf_conntrack]
 }

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7b4b2fa3

include/uapi/linux/netfilter/nfnetlink.h

+2 −1
Original line number Diff line number Diff line
@@ -60,7 +60,8 @@ struct nfgenmsg { 
#define NFNL_SUBSYS_CTHELPER		9

#define NFNL_SUBSYS_NFTABLES		10

#define NFNL_SUBSYS_NFT_COMPAT		11

#define NFNL_SUBSYS_COUNT		12

#define NFNL_SUBSYS_HOOK		12

#define NFNL_SUBSYS_COUNT		13



/* Reserved control nfnetlink messages */

#define NFNL_MSG_BATCH_BEGIN		NLMSG_MIN_TYPE

include/uapi/linux/netfilter/nfnetlink_hook.h

0 → 100644
+55 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */

#ifndef _NFNL_HOOK_H_

#define _NFNL_HOOK_H_



enum nfnl_hook_msg_types {

	NFNL_MSG_HOOK_GET,

	NFNL_MSG_HOOK_MAX,

};



/**

 * enum nfnl_hook_attributes - netfilter hook netlink attributes

 *

 * @NFNLA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)

 * @NFNLA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)

 * @NFNLA_HOOK_DEV: netdevice name (NLA_STRING)

 * @NFNLA_HOOK_FUNCTION_NAME: hook function name (NLA_STRING)

 * @NFNLA_HOOK_MODULE_NAME: kernel module that registered this hook (NLA_STRING)

 * @NFNLA_HOOK_CHAIN_INFO: basechain hook metadata (NLA_NESTED)

 */

enum nfnl_hook_attributes {

	NFNLA_HOOK_UNSPEC,

	NFNLA_HOOK_HOOKNUM,

	NFNLA_HOOK_PRIORITY,

	NFNLA_HOOK_DEV,

	NFNLA_HOOK_FUNCTION_NAME,

	NFNLA_HOOK_MODULE_NAME,

	NFNLA_HOOK_CHAIN_INFO,

	__NFNLA_HOOK_MAX

};

#define NFNLA_HOOK_MAX		(__NFNLA_HOOK_MAX - 1)



/**

 * enum nfnl_hook_chain_info_attributes - chain description

 *

 * NFNLA_HOOK_INFO_DESC: nft chain and table name (enum nft_table_attributes) (NLA_NESTED)

 * NFNLA_HOOK_INFO_TYPE: chain type (enum nfnl_hook_chaintype) (NLA_U32)

 */

enum nfnl_hook_chain_info_attributes {

	NFNLA_HOOK_INFO_UNSPEC,

	NFNLA_HOOK_INFO_DESC,

	NFNLA_HOOK_INFO_TYPE,

	__NFNLA_HOOK_INFO_MAX,

};

#define NFNLA_HOOK_INFO_MAX (__NFNLA_HOOK_INFO_MAX - 1)



/**

 * enum nfnl_hook_chaintype - chain type

 *

 * @NFNL_HOOK_TYPE_NFTABLES nf_tables base chain

 */

enum nfnl_hook_chaintype {

	NFNL_HOOK_TYPE_NFTABLES = 0x1,

};



#endif /* _NFNL_HOOK_H */

net/netfilter/Kconfig

+9 −0
Original line number Diff line number Diff line
@@ -19,6 +19,15 @@ config NETFILTER_FAMILY_BRIDGE 
config NETFILTER_FAMILY_ARP

	bool



config NETFILTER_NETLINK_HOOK

	tristate "Netfilter base hook dump support"

	depends on NETFILTER_ADVANCED

	select NETFILTER_NETLINK

	help

	  If this option is enabled, the kernel will include support

	  to list the base netfilter hooks via NFNETLINK.

	  This is helpful for debugging.



config NETFILTER_NETLINK_ACCT

	tristate "Netfilter NFACCT over NFNETLINK interface"

	depends on NETFILTER_ADVANCED

net/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ obj-$(CONFIG_NETFILTER_NETLINK_ACCT) += nfnetlink_acct.o 
obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o

obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o

obj-$(CONFIG_NETFILTER_NETLINK_OSF) += nfnetlink_osf.o

obj-$(CONFIG_NETFILTER_NETLINK_HOOK) += nfnetlink_hook.o



# connection tracking

obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o

net/netfilter/nfnetlink.c

+1 −0
Original line number Diff line number Diff line
@@ -68,6 +68,7 @@ static const char *const nfnl_lockdep_names[NFNL_SUBSYS_COUNT] = { 
	[NFNL_SUBSYS_CTHELPER] = "nfnl_subsys_cthelper",

	[NFNL_SUBSYS_NFTABLES] = "nfnl_subsys_nftables",

	[NFNL_SUBSYS_NFT_COMPAT] = "nfnl_subsys_nftcompat",

	[NFNL_SUBSYS_HOOK] = "nfnl_subsys_hook",

};



static const int nfnl_group2type[NFNLGRP_MAX+1] = {