openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: nft_ct: add average bytes per packet support 

Similar to xt_connbytes, user can match how many average bytes per packet
a connection has transferred so far.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Liping Zhang 2016-12-25 19:58:59 +08:00 committed by Pablo Neira Ayuso
parent 237bab6611
commit 949a358418
2 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/uapi/linux/netfilter/nf_tables.h
View File

@ -863,6 +863,7 @@ enum nft_rt_attributes {
* @NFT_CT_LABELS: conntrack labels * @NFT_CT_LABELS: conntrack labels
* @NFT_CT_PKTS: conntrack packets * @NFT_CT_PKTS: conntrack packets
* @NFT_CT_BYTES: conntrack bytes * @NFT_CT_BYTES: conntrack bytes
* @NFT_CT_AVGPKT: conntrack average bytes per packet
*/ */
enum nft_ct_keys { enum nft_ct_keys {
NFT_CT_STATE, NFT_CT_STATE,
@ -881,6 +882,7 @@ enum nft_ct_keys {
NFT_CT_LABELS, NFT_CT_LABELS,
NFT_CT_PKTS, NFT_CT_PKTS,
NFT_CT_BYTES, NFT_CT_BYTES,
NFT_CT_AVGPKT,
}; };
/** /**

22
net/netfilter/nft_ct.c
View File

@ -129,6 +129,22 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
memcpy(dest, &count, sizeof(count)); memcpy(dest, &count, sizeof(count));
return; return;
} }
case NFT_CT_AVGPKT: {
const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
u64 avgcnt = 0, bcnt = 0, pcnt = 0;
if (acct) {
pcnt = nft_ct_get_eval_counter(acct->counter,
NFT_CT_PKTS, priv->dir);
bcnt = nft_ct_get_eval_counter(acct->counter,
NFT_CT_BYTES, priv->dir);
if (pcnt != 0)
avgcnt = div64_u64(bcnt, pcnt);
}
memcpy(dest, &avgcnt, sizeof(avgcnt));
return;
}
case NFT_CT_L3PROTOCOL: case NFT_CT_L3PROTOCOL:
*dest = nf_ct_l3num(ct); *dest = nf_ct_l3num(ct);
return; return;
@ -316,6 +332,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
break; break;
case NFT_CT_BYTES: case NFT_CT_BYTES:
case NFT_CT_PKTS: case NFT_CT_PKTS:
case NFT_CT_AVGPKT:
/* no direction? return sum of original + reply */ /* no direction? return sum of original + reply */
if (tb[NFTA_CT_DIRECTION] == NULL) if (tb[NFTA_CT_DIRECTION] == NULL)
priv->dir = IP_CT_DIR_MAX; priv->dir = IP_CT_DIR_MAX;
@ -346,7 +363,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
if (err < 0) if (err < 0)
return err; return err;
if (priv->key == NFT_CT_BYTES || priv->key == NFT_CT_PKTS) if (priv->key == NFT_CT_BYTES ||
priv->key == NFT_CT_PKTS ||
priv->key == NFT_CT_AVGPKT)
nf_ct_set_acct(ctx->net, true); nf_ct_set_acct(ctx->net, true);
return 0; return 0;
@ -445,6 +464,7 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
break; break;
case NFT_CT_BYTES: case NFT_CT_BYTES:
case NFT_CT_PKTS: case NFT_CT_PKTS:
case NFT_CT_AVGPKT:
if (priv->dir < IP_CT_DIR_MAX && if (priv->dir < IP_CT_DIR_MAX &&
nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir)) nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
goto nla_put_failure; goto nla_put_failure;