Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 718d4ad9 authored by Fabian Hugelshofer's avatar Fabian Hugelshofer Committed by David S. Miller
Browse files

netfilter: nf_conntrack: properly account terminating packets 



Currently the last packet of a connection isn't accounted when its causing
abnormal termination.

Introduces nf_ct_kill_acct() which increments the accounting counters on
conntrack kill. The new function was necessary, because there are calls
to nf_ct_kill() which don't need accounting:

nf_conntrack_proto_tcp.c line ~847:
Kills ct and returns NF_REPEAT. We don't want to count twice.

nf_conntrack_proto_tcp.c line ~880:
Kills ct and returns NF_DROP. I think we don't want to count dropped
packets.

nf_conntrack_netlink.c line ~824:
As far as I can see ctnetlink_del_conntrack() is used to destroy a
conntrack on behalf of the user. There is an sk_buff, but I don't think
this is an actual packet. Incrementing counters here is therefore not
desired.

Signed-off-by: default avatarFabian Hugelshofer <hugelshofer2006@gmx.ch>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 51091764

include/net/netfilter/nf_conntrack.h

+18 −1
Original line number Diff line number Diff line
@@ -223,7 +223,24 @@ static inline void nf_ct_refresh(struct nf_conn *ct, 
	__nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);

}



extern void nf_ct_kill(struct nf_conn *ct);

extern void __nf_ct_kill_acct(struct nf_conn *ct,

				enum ip_conntrack_info ctinfo,

				const struct sk_buff *skb,

				int do_acct);



/* kill conntrack and do accounting */

static inline void nf_ct_kill_acct(struct nf_conn *ct,

				enum ip_conntrack_info ctinfo,

				const struct sk_buff *skb)

{

	__nf_ct_kill_acct(ct, ctinfo, skb, 1);

}



/* kill conntrack without accounting */

static inline void nf_ct_kill(struct nf_conn *ct)

{

	__nf_ct_kill_acct(ct, 0, NULL, 0);

}



/* These are for NAT.  Icky. */

/* Update TCP window tracking data when NAT mangles the packet */

net/ipv4/netfilter/nf_conntrack_proto_icmp.c

+1 −1
Original line number Diff line number Diff line
@@ -88,7 +88,7 @@ static int icmp_packet(struct nf_conn *ct, 
	   (theoretically possible with SMP) */

	if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {

		if (atomic_dec_and_test(&ct->proto.icmp.count))

			nf_ct_kill(ct);

			nf_ct_kill_acct(ct, ctinfo, skb);

	} else {

		atomic_inc(&ct->proto.icmp.count);

		nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);

net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c

+1 −1
Original line number Diff line number Diff line
@@ -90,7 +90,7 @@ static int icmpv6_packet(struct nf_conn *ct, 
	   (theoretically possible with SMP) */

	if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {

		if (atomic_dec_and_test(&ct->proto.icmp.count))

			nf_ct_kill(ct);

			nf_ct_kill_acct(ct, ctinfo, skb);

	} else {

		atomic_inc(&ct->proto.icmp.count);

		nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);

net/netfilter/nf_conntrack_core.c

+14 −2
Original line number Diff line number Diff line
@@ -848,12 +848,24 @@ void __nf_ct_refresh_acct(struct nf_conn *ct, 
}

EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);



void nf_ct_kill(struct nf_conn *ct)

void __nf_ct_kill_acct(struct nf_conn *ct,

		enum ip_conntrack_info ctinfo,

		const struct sk_buff *skb,

		int do_acct)

{

#ifdef CONFIG_NF_CT_ACCT

	if (do_acct) {

		spin_lock_bh(&nf_conntrack_lock);

		ct->counters[CTINFO2DIR(ctinfo)].packets++;

		ct->counters[CTINFO2DIR(ctinfo)].bytes +=

			skb->len - skb_network_offset(skb);

		spin_unlock_bh(&nf_conntrack_lock);

	}

#endif

	if (del_timer(&ct->timeout))

		ct->timeout.function((unsigned long)ct);

}

EXPORT_SYMBOL_GPL(nf_ct_kill);

EXPORT_SYMBOL_GPL(__nf_ct_kill_acct);



#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)

net/netfilter/nf_conntrack_proto_dccp.c

+1 −1
Original line number Diff line number Diff line
@@ -475,7 +475,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, 
	if (type == DCCP_PKT_RESET &&

	    !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {

		/* Tear down connection immediately if only reply is a RESET */

		nf_ct_kill(ct);

		nf_ct_kill_acct(ct, ctinfo, skb);

		return NF_ACCEPT;

	}