p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

netfilter: flowtable: add counter support 

Add a new flag to turn on flowtable counters which are stored in the
conntrack entry.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2020-03-24 12:50:02 +01:00
parent cfbd1125fc
commit 53c2b2899a
3 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/netfilter/nf_flow_table.h
View File

@ -63,6 +63,7 @@ struct nf_flowtable_type {
enum nf_flowtable_flags {
NF_FLOWTABLE_HW_OFFLOAD = 0x1, /* NFT_FLOWTABLE_HW_OFFLOAD */
NF_FLOWTABLE_COUNTER = 0x2, /* NFT_FLOWTABLE_COUNTER */
};
struct nf_flowtable {

5
include/uapi/linux/netfilter/nf_tables.h
View File

@ -1557,10 +1557,13 @@ enum nft_object_attributes {
* enum nft_flowtable_flags - nf_tables flowtable flags
*
* @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
* @NFT_FLOWTABLE_COUNTER: enable flow counters
*/
enum nft_flowtable_flags {
NFT_FLOWTABLE_HW_OFFLOAD = 0x1,
NFT_FLOWTABLE_MASK = NFT_FLOWTABLE_HW_OFFLOAD
NFT_FLOWTABLE_COUNTER = 0x2,
NFT_FLOWTABLE_MASK = (NFT_FLOWTABLE_HW_OFFLOAD |
NFT_FLOWTABLE_COUNTER)
};
/**

7
net/netfilter/nf_flow_table_ip.c
View File

@ -12,6 +12,7 @@
#include <net/ip6_route.h>
#include <net/neighbour.h>
#include <net/netfilter/nf_flow_table.h>
#include <net/netfilter/nf_conntrack_acct.h>
/* For layer 4 checksum field offset. */
#include <linux/tcp.h>
#include <linux/udp.h>
@ -286,6 +287,9 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
ip_decrease_ttl(iph);
skb->tstamp = 0;
if (flow_table->flags & NF_FLOWTABLE_COUNTER)
nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
if (unlikely(dst_xfrm(&rt->dst))) {
memset(skb->cb, 0, sizeof(struct inet_skb_parm));
IPCB(skb)->iif = skb->dev->ifindex;
@ -516,6 +520,9 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
ip6h->hop_limit--;
skb->tstamp = 0;
if (flow_table->flags & NF_FLOWTABLE_COUNTER)
nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
if (unlikely(dst_xfrm(&rt->dst))) {
memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
IP6CB(skb)->iif = skb->dev->ifindex;