Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58401572 authored by Krzysztof Piotr Oledzki's avatar Krzysztof Piotr Oledzki Committed by David S. Miller
Browse files

netfilter: accounting rework: ct_extend + 64bit counters (v4) 



Initially netfilter has had 64bit counters for conntrack-based accounting, but
it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
still required, for example for "connbytes" extension. However, 64bit counters
waste a lot of memory and it was not possible to enable/disable it runtime.

This patch:
 - reimplements accounting with respect to the extension infrastructure,
 - makes one global version of seq_print_acct() instead of two seq_print_counters(),
 - makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
 - makes it possible to enable/disable it at runtime by sysctl or sysfs,
 - extends counters from 32bit to 64bit,
 - renames ip_conntrack_counter -> nf_conn_counter,
 - enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
 - set initial accounting enable state based on CONFIG_NF_CT_ACCT
 - removes buggy IPCT_COUNTER_FILLING event handling.

If accounting is enabled newly created connections get additional acct extend.
Old connections are not changed as it is not possible to add a ct_extend area
to confirmed conntrack. Accounting is performed for all connections with
acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".

Signed-off-by: default avatarKrzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 07a7c107

Documentation/feature-removal-schedule.txt

+10 −0
Original line number Diff line number Diff line
@@ -336,3 +336,13 @@ When: After the only user (hal) has seen a release with the patches 
Why:	Over 1K .text/.data size reduction, data is available in other

	ways (ioctls)

Who:	Johannes Berg <johannes@sipsolutions.net>



---------------------------



What: CONFIG_NF_CT_ACCT

When: 2.6.29

Why:  Accounting can now be enabled/disabled without kernel recompilation.

      Currently used only to set a default value for a feature that is also

      controlled by a kernel/module/sysfs/sysctl parameter.

Who:  Krzysztof Piotr Oledzki <ole@ans.pl>

Documentation/kernel-parameters.txt

+7 −0
Original line number Diff line number Diff line
@@ -1279,6 +1279,13 @@ and is between 256 and 4096 characters. It is defined in the file 
			This usage is only documented in each driver source

			file if at all.



	nf_conntrack.acct=

			[NETFILTER] Enable connection tracking flow accounting

			0 to disable accounting

			1 to enable accounting

			Default value depends on CONFIG_NF_CT_ACCT that is

			going to be removed in 2.6.29.



	nfsaddrs=	[NFS]

			See Documentation/filesystems/nfsroot.txt.

include/linux/netfilter/nf_conntrack_common.h

+1 −7
Original line number Diff line number Diff line
@@ -122,7 +122,7 @@ enum ip_conntrack_events 
	IPCT_NATINFO_BIT = 10,

	IPCT_NATINFO = (1 << IPCT_NATINFO_BIT),



	/* Counter highest bit has been set */

	/* Counter highest bit has been set, unused */

	IPCT_COUNTER_FILLING_BIT = 11,

	IPCT_COUNTER_FILLING = (1 << IPCT_COUNTER_FILLING_BIT),
@@ -145,12 +145,6 @@ enum ip_conntrack_expect_events { 
};



#ifdef __KERNEL__

struct ip_conntrack_counter

{

	u_int32_t packets;

	u_int32_t bytes;

};



struct ip_conntrack_stat

{

	unsigned int searched;

include/linux/netfilter/nfnetlink_conntrack.h

+4 −4
Original line number Diff line number Diff line
@@ -115,10 +115,10 @@ enum ctattr_protoinfo_sctp { 


enum ctattr_counters {

	CTA_COUNTERS_UNSPEC,

	CTA_COUNTERS_PACKETS,		/* old 64bit counters */

	CTA_COUNTERS_BYTES,		/* old 64bit counters */

	CTA_COUNTERS32_PACKETS,

	CTA_COUNTERS32_BYTES,

	CTA_COUNTERS_PACKETS,		/* 64bit counters */

	CTA_COUNTERS_BYTES,		/* 64bit counters */

	CTA_COUNTERS32_PACKETS,		/* old 32bit counters, unused */

	CTA_COUNTERS32_BYTES,		/* old 32bit counters, unused */

	__CTA_COUNTERS_MAX

};

#define CTA_COUNTERS_MAX (__CTA_COUNTERS_MAX - 1)

include/net/netfilter/nf_conntrack.h

+0 −6
Original line number Diff line number Diff line
@@ -88,7 +88,6 @@ struct nf_conn_help { 
	u8 expecting[NF_CT_MAX_EXPECT_CLASSES];

};





#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>

#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
@@ -111,11 +110,6 @@ struct nf_conn 
	/* Timer function; drops refcnt when it goes off. */

	struct timer_list timeout;



#ifdef CONFIG_NF_CT_ACCT

	/* Accounting Information (same cache line as other written members) */

	struct ip_conntrack_counter counters[IP_CT_DIR_MAX];

#endif



#if defined(CONFIG_NF_CONNTRACK_MARK)

	u_int32_t mark;

#endif