Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8756201 authored by Tim Gardner's avatar Tim Gardner Committed by Patrick McHardy
Browse files

netfilter: xt_connbytes: Force CT accounting to be enabled 



Check at rule install time that CT accounting is enabled. Force it
to be enabled if not while also emitting a warning since this is not
the default state.

This is in preparation for deprecating CONFIG_NF_CT_ACCT upon which
CONFIG_NETFILTER_XT_MATCH_CONNBYTES depended being set.

Added 2 CT accounting support functions:

nf_ct_acct_enabled() - Get CT accounting state.
nf_ct_set_acct() - Enable/disable CT accountuing.

Signed-off-by: default avatarTim Gardner <tim.gardner@canonical.com>
Acked-by: default avatarJan Engelhardt <jengelh@medozas.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent fe6fb552

include/net/netfilter/nf_conntrack_acct.h

+12 −0
Original line number Diff line number Diff line
@@ -45,6 +45,18 @@ struct nf_conn_counter *nf_ct_acct_ext_add(struct nf_conn *ct, gfp_t gfp) 
extern unsigned int

seq_print_acct(struct seq_file *s, const struct nf_conn *ct, int dir);



/* Check if connection tracking accounting is enabled */

static inline bool nf_ct_acct_enabled(struct net *net)

{

	return net->ct.sysctl_acct != 0;

}



/* Enable/disable connection tracking accounting */

static inline void nf_ct_set_acct(struct net *net, bool enable)

{

	net->ct.sysctl_acct = enable;

}



extern int nf_conntrack_acct_init(struct net *net);

extern void nf_conntrack_acct_fini(struct net *net);

net/netfilter/xt_connbytes.c

+10 −0
Original line number Diff line number Diff line
@@ -112,6 +112,16 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par) 
	if (ret < 0)

		pr_info("cannot load conntrack support for proto=%u\n",

			par->family);



	/*

	 * This filter cannot function correctly unless connection tracking

	 * accounting is enabled, so complain in the hope that someone notices.

	 */

	if (!nf_ct_acct_enabled(par->net)) {

		pr_warning("Forcing CT accounting to be enabled\n");

		nf_ct_set_acct(par->net, true);

	}



	return ret;

}