add ct labels support

Signed-off-by: Antonio Ojea <[email protected]>

Author: aojea

nfqueue.go

@@ -62,6 +62,25 @@ func (nfqueue *Nfqueue) SetVerdictWithConnMark(id uint32, verdict, mark int) err
 	return nfqueue.setVerdict(id, verdict, false, attributes)
 }
 
+// SetVerdictWithLabel signals the kernel the next action and the label for a specified package id
+func (nfqueue *Nfqueue) SetVerdictWithLabel(id uint32, verdict int, label []byte) error {
+	ctAttrs, err := netlink.MarshalAttributes([]netlink.Attribute{{
+		Type: ctaLabels,
+		Data: label,
+	}})
+	if err != nil {
+		return err
+	}
+	attributes, err := netlink.MarshalAttributes([]netlink.Attribute{{
+		Type: netlink.Nested | nfQaCt,
+		Data: ctAttrs,
+	}})
+	if err != nil {
+		return err
+	}
+	return nfqueue.setVerdict(id, verdict, false, attributes)
+}
+
 // SetVerdictModPacket signals the kernel the next action for an altered packet
 func (nfqueue *Nfqueue) SetVerdictModPacket(id uint32, verdict int, packet []byte) error {
 	data, err := netlink.MarshalAttributes([]netlink.Attribute{{
@@ -121,6 +140,31 @@ func (nfqueue *Nfqueue) SetVerdictModPacketWithConnMark(id uint32, verdict, mark
 	return nfqueue.setVerdict(id, verdict, false, data)
 }
 
+// SetVerdictModPacketWithLabel signals the kernel the next action and label for an altered packet
+func (nfqueue *Nfqueue) SetVerdictModPacketWithLabel(id uint32, verdict int, label []byte, packet []byte) error {
+	ctAttrs, err := netlink.MarshalAttributes([]netlink.Attribute{{
+		Type: ctaLabels,
+		Data: label,
+	}})
+	if err != nil {
+		return err
+	}
+	data, err := netlink.MarshalAttributes([]netlink.Attribute{
+		{
+			Type: nfQaPayload,
+			Data: packet,
+		},
+		{
+			Type: netlink.Nested | nfQaCt,
+			Data: ctAttrs,
+		},
+	})
+	if err != nil {
+		return err
+	}
+	return nfqueue.setVerdict(id, verdict, false, data)
+}
+
 // SetVerdict signals the kernel the next action for a specified package id
 func (nfqueue *Nfqueue) SetVerdict(id uint32, verdict int) error {
 	return nfqueue.setVerdict(id, verdict, false, []byte{})

types.go

@@ -164,6 +164,8 @@ const (
 )
 
 // conntrack attributes
+// include/uapi/linux/netfilter/nfnetlink_conntrack.h
 const (
-	ctaMark = 8
+	ctaMark   = 8
+	ctaLabels = 22 // CTA_LABELS
 )