• Florian Westphal's avatar
    netfilter: nf_tables: extend tracing infrastructure · 33d5a7b1
    Florian Westphal authored
    nft monitor mode can then decode and display this trace data.
    
    Parts of LL/Network/Transport headers are provided as separate
    attributes.
    
    Otherwise, printing IP address data becomes virtually impossible
    for userspace since in the case of the netdev family we really don't
    want userspace to have to know all the possible link layer types
    and/or sizes just to display/print an ip address.
    
    We also don't want userspace to have to follow ipv6 header chains
    to get the s/dport info, the kernel already did this work for us.
    
    To avoid bloating nft_do_chain all data required for tracing is
    encapsulated in nft_traceinfo.
    
    The structure is initialized unconditionally(!) for each nft_do_chain
    invocation.
    
    This unconditionall call will be moved under a static key in a
    followup patch.
    
    With lots of help from Patrick McHardy and Pablo Neira.
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Acked-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    33d5a7b1
Makefile 7.76 KB