netfilter: conntrack: tag conntracks picked up in local out hook

This allows to identify flows that originate from local machine
in a followup patch.

It would be possible to make this a ->status bit instead.
For now I did not do that yet because I don't have a use-case for
exposing this info to userspace.

If one comes up the toggle can be replaced with a status bit.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index d24b0a34c8f0cd3571893e0c16b10fa391c0511d..871489df63c6470ff899da113806a695d826a129 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -95,6 +95,7 @@ struct nf_conn {
        unsigned long status;
 
        u16             cpu;
+       u16             local_origin:1;
        possible_net_t ct_net;
 
 #if IS_ENABLED(CONFIG_NF_NAT)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index d7e31354806674e49b6c9d074cca78217a38df3b..bed0017cadb027b0f717bfded0618dbbddb5dc0c 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1747,6 +1747,9 @@ resolve_normal_ct(struct nf_conn *tmpl,
                        return 0;
                if (IS_ERR(h))
                        return PTR_ERR(h);
+
+               ct = nf_ct_tuplehash_to_ctrack(h);
+               ct->local_origin = state->hook == NF_INET_LOCAL_OUT;
        }
        ct = nf_ct_tuplehash_to_ctrack(h);