netfilter: flowtable: add counter support

Add a new flag to turn on flowtable counters which are stored in the
conntrack entry.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 4beb7f13bc50846a26687e5b97999ce9af7ed820..4a2ec6fd9ad23a1d3aa3d0f56f09347a63114caf 100644 (file)
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -63,6 +63,7 @@ struct nf_flowtable_type {
 
 enum nf_flowtable_flags {
        NF_FLOWTABLE_HW_OFFLOAD         = 0x1,  /* NFT_FLOWTABLE_HW_OFFLOAD */
+       NF_FLOWTABLE_COUNTER            = 0x2,  /* NFT_FLOWTABLE_COUNTER */
 };
 
 struct nf_flowtable {

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 717ee3aa05d7ee0961c7b8c1489c5df027634c84..30f2a87270dc5622cf616084d542cdc765193a44 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1557,10 +1557,13 @@ enum nft_object_attributes {
  * enum nft_flowtable_flags - nf_tables flowtable flags
  *
  * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
+ * @NFT_FLOWTABLE_COUNTER: enable flow counters
  */
 enum nft_flowtable_flags {
        NFT_FLOWTABLE_HW_OFFLOAD        = 0x1,
-       NFT_FLOWTABLE_MASK              = NFT_FLOWTABLE_HW_OFFLOAD
+       NFT_FLOWTABLE_COUNTER           = 0x2,
+       NFT_FLOWTABLE_MASK              = (NFT_FLOWTABLE_HW_OFFLOAD |
+                                          NFT_FLOWTABLE_COUNTER)
 };
 
 /**

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 5272721080f8c5abe2ad64b3c1f01591390af772..553cc0d5695af80d9fc73223b2231d4435729433 100644 (file)
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -12,6 +12,7 @@
 #include <net/ip6_route.h>
 #include <net/neighbour.h>
 #include <net/netfilter/nf_flow_table.h>
+#include <net/netfilter/nf_conntrack_acct.h>
 /* For layer 4 checksum field offset. */
 #include <linux/tcp.h>
 #include <linux/udp.h>
@@ -286,6 +287,9 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
        ip_decrease_ttl(iph);
        skb->tstamp = 0;
 
+       if (flow_table->flags & NF_FLOWTABLE_COUNTER)
+               nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
+
        if (unlikely(dst_xfrm(&rt->dst))) {
                memset(skb->cb, 0, sizeof(struct inet_skb_parm));
                IPCB(skb)->iif = skb->dev->ifindex;
@@ -516,6 +520,9 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
        ip6h->hop_limit--;
        skb->tstamp = 0;
 
+       if (flow_table->flags & NF_FLOWTABLE_COUNTER)
+               nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
+
        if (unlikely(dst_xfrm(&rt->dst))) {
                memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
                IP6CB(skb)->iif = skb->dev->ifindex;