Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 949a3584 authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_ct: add average bytes per packet support 



Similar to xt_connbytes, user can match how many average bytes per packet
a connection has transferred so far.

Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 237bab66

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -863,6 +863,7 @@ enum nft_rt_attributes { 
 * @NFT_CT_LABELS: conntrack labels

 * @NFT_CT_PKTS: conntrack packets

 * @NFT_CT_BYTES: conntrack bytes

 * @NFT_CT_AVGPKT: conntrack average bytes per packet

 */

enum nft_ct_keys {

	NFT_CT_STATE,
@@ -881,6 +882,7 @@ enum nft_ct_keys { 
	NFT_CT_LABELS,

	NFT_CT_PKTS,

	NFT_CT_BYTES,

	NFT_CT_AVGPKT,

};



/**

net/netfilter/nft_ct.c

+21 −1
Original line number Diff line number Diff line
@@ -129,6 +129,22 @@ static void nft_ct_get_eval(const struct nft_expr *expr, 
		memcpy(dest, &count, sizeof(count));

		return;

	}

	case NFT_CT_AVGPKT: {

		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);

		u64 avgcnt = 0, bcnt = 0, pcnt = 0;



		if (acct) {

			pcnt = nft_ct_get_eval_counter(acct->counter,

						       NFT_CT_PKTS, priv->dir);

			bcnt = nft_ct_get_eval_counter(acct->counter,

						       NFT_CT_BYTES, priv->dir);

			if (pcnt != 0)

				avgcnt = div64_u64(bcnt, pcnt);

		}



		memcpy(dest, &avgcnt, sizeof(avgcnt));

		return;

	}

	case NFT_CT_L3PROTOCOL:

		*dest = nf_ct_l3num(ct);

		return;
@@ -316,6 +332,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx, 
		break;

	case NFT_CT_BYTES:

	case NFT_CT_PKTS:

	case NFT_CT_AVGPKT:

		/* no direction? return sum of original + reply */

		if (tb[NFTA_CT_DIRECTION] == NULL)

			priv->dir = IP_CT_DIR_MAX;
@@ -346,7 +363,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx, 
	if (err < 0)

		return err;



	if (priv->key == NFT_CT_BYTES || priv->key == NFT_CT_PKTS)

	if (priv->key == NFT_CT_BYTES ||

	    priv->key == NFT_CT_PKTS  ||

	    priv->key == NFT_CT_AVGPKT)

		nf_ct_set_acct(ctx->net, true);



	return 0;
@@ -445,6 +464,7 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr) 
		break;

	case NFT_CT_BYTES:

	case NFT_CT_PKTS:

	case NFT_CT_AVGPKT:

		if (priv->dir < IP_CT_DIR_MAX &&

		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))

			goto nla_put_failure;