* [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update()
@ 2020-03-24 17:50 Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-24 17:50 UTC (permalink / raw)
To: netfilter-devel
This function allows you to update the conntrack counters.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_acct.h | 2 ++
net/netfilter/nf_conntrack_core.c | 15 +++++++--------
2 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_acct.h b/include/net/netfilter/nf_conntrack_acct.h
index f7a060c6eb28..df198c51244a 100644
--- a/include/net/netfilter/nf_conntrack_acct.h
+++ b/include/net/netfilter/nf_conntrack_acct.h
@@ -65,6 +65,8 @@ static inline void nf_ct_set_acct(struct net *net, bool enable)
#endif
}
+void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes);
+
void nf_conntrack_acct_pernet_init(struct net *net);
int nf_conntrack_acct_init(void);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a18f8fe728e3..a55c1d6f8191 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -863,9 +863,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
}
EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
-static inline void nf_ct_acct_update(struct nf_conn *ct,
- enum ip_conntrack_info ctinfo,
- unsigned int len)
+void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes)
{
struct nf_conn_acct *acct;
@@ -873,10 +871,11 @@ static inline void nf_ct_acct_update(struct nf_conn *ct,
if (acct) {
struct nf_conn_counter *counter = acct->counter;
- atomic64_inc(&counter[CTINFO2DIR(ctinfo)].packets);
- atomic64_add(len, &counter[CTINFO2DIR(ctinfo)].bytes);
+ atomic64_inc(&counter[dir].packets);
+ atomic64_add(bytes, &counter[dir].bytes);
}
}
+EXPORT_SYMBOL_GPL(nf_ct_acct_update);
static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
const struct nf_conn *loser_ct)
@@ -890,7 +889,7 @@ static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
/* u32 should be fine since we must have seen one packet. */
bytes = atomic64_read(&counter[CTINFO2DIR(ctinfo)].bytes);
- nf_ct_acct_update(ct, ctinfo, bytes);
+ nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), bytes);
}
}
@@ -1931,7 +1930,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
WRITE_ONCE(ct->timeout, extra_jiffies);
acct:
if (do_acct)
- nf_ct_acct_update(ct, ctinfo, skb->len);
+ nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
}
EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
@@ -1939,7 +1938,7 @@ bool nf_ct_kill_acct(struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
const struct sk_buff *skb)
{
- nf_ct_acct_update(ct, ctinfo, skb->len);
+ nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
return nf_ct_delete(ct, 0, 0);
}
--
2.11.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi
2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
@ 2020-03-24 17:50 ` Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 3/3] netfilter: flowtable: add counter support Pablo Neira Ayuso
2020-03-25 2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
2 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-24 17:50 UTC (permalink / raw)
To: netfilter-devel
Expose the NFT_FLOWTABLE_HW_OFFLOAD flag through uapi.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_flow_table.h | 2 +-
include/uapi/linux/netfilter/nf_tables.h | 10 ++++++++++
net/netfilter/nf_tables_api.c | 2 +-
3 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index f523ea87b6ae..4beb7f13bc50 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -62,7 +62,7 @@ struct nf_flowtable_type {
};
enum nf_flowtable_flags {
- NF_FLOWTABLE_HW_OFFLOAD = 0x1,
+ NF_FLOWTABLE_HW_OFFLOAD = 0x1, /* NFT_FLOWTABLE_HW_OFFLOAD */
};
struct nf_flowtable {
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 4e3a5971d4ee..717ee3aa05d7 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1554,6 +1554,16 @@ enum nft_object_attributes {
#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
/**
+ * enum nft_flowtable_flags - nf_tables flowtable flags
+ *
+ * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
+ */
+enum nft_flowtable_flags {
+ NFT_FLOWTABLE_HW_OFFLOAD = 0x1,
+ NFT_FLOWTABLE_MASK = NFT_FLOWTABLE_HW_OFFLOAD
+};
+
+/**
* enum nft_flowtable_attributes - nf_tables flow table netlink attributes
*
* @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c5332a313283..ace325218edb 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6375,7 +6375,7 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
if (nla[NFTA_FLOWTABLE_FLAGS]) {
flowtable->data.flags =
ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
- if (flowtable->data.flags & ~NF_FLOWTABLE_HW_OFFLOAD)
+ if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK)
goto err3;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH nf-next 3/3] netfilter: flowtable: add counter support
2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
@ 2020-03-24 17:50 ` Pablo Neira Ayuso
2020-03-25 2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
2 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-24 17:50 UTC (permalink / raw)
To: netfilter-devel
Add a new flag to turn on flowtable counters which are stored in the
conntrack entry.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_flow_table.h | 1 +
include/uapi/linux/netfilter/nf_tables.h | 5 ++++-
net/netfilter/nf_flow_table_ip.c | 7 +++++++
3 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 4beb7f13bc50..4a2ec6fd9ad2 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -63,6 +63,7 @@ struct nf_flowtable_type {
enum nf_flowtable_flags {
NF_FLOWTABLE_HW_OFFLOAD = 0x1, /* NFT_FLOWTABLE_HW_OFFLOAD */
+ NF_FLOWTABLE_COUNTER = 0x2, /* NFT_FLOWTABLE_COUNTER */
};
struct nf_flowtable {
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 717ee3aa05d7..30f2a87270dc 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1557,10 +1557,13 @@ enum nft_object_attributes {
* enum nft_flowtable_flags - nf_tables flowtable flags
*
* @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
+ * @NFT_FLOWTABLE_COUNTER: enable flow counters
*/
enum nft_flowtable_flags {
NFT_FLOWTABLE_HW_OFFLOAD = 0x1,
- NFT_FLOWTABLE_MASK = NFT_FLOWTABLE_HW_OFFLOAD
+ NFT_FLOWTABLE_COUNTER = 0x2,
+ NFT_FLOWTABLE_MASK = (NFT_FLOWTABLE_HW_OFFLOAD |
+ NFT_FLOWTABLE_COUNTER)
};
/**
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 5272721080f8..553cc0d5695a 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -12,6 +12,7 @@
#include <net/ip6_route.h>
#include <net/neighbour.h>
#include <net/netfilter/nf_flow_table.h>
+#include <net/netfilter/nf_conntrack_acct.h>
/* For layer 4 checksum field offset. */
#include <linux/tcp.h>
#include <linux/udp.h>
@@ -286,6 +287,9 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
ip_decrease_ttl(iph);
skb->tstamp = 0;
+ if (flow_table->flags & NF_FLOWTABLE_COUNTER)
+ nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
+
if (unlikely(dst_xfrm(&rt->dst))) {
memset(skb->cb, 0, sizeof(struct inet_skb_parm));
IPCB(skb)->iif = skb->dev->ifindex;
@@ -516,6 +520,9 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
ip6h->hop_limit--;
skb->tstamp = 0;
+ if (flow_table->flags & NF_FLOWTABLE_COUNTER)
+ nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
+
if (unlikely(dst_xfrm(&rt->dst))) {
memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
IP6CB(skb)->iif = skb->dev->ifindex;
--
2.11.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update()
2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 3/3] netfilter: flowtable: add counter support Pablo Neira Ayuso
@ 2020-03-25 2:59 ` wenxu
2020-03-26 11:49 ` Pablo Neira Ayuso
2 siblings, 1 reply; 5+ messages in thread
From: wenxu @ 2020-03-25 2:59 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel
On 3/25/2020 1:50 AM, Pablo Neira Ayuso wrote:
> This function allows you to update the conntrack counters.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> include/net/netfilter/nf_conntrack_acct.h | 2 ++
> net/netfilter/nf_conntrack_core.c | 15 +++++++--------
> 2 files changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/include/net/netfilter/nf_conntrack_acct.h b/include/net/netfilter/nf_conntrack_acct.h
> index f7a060c6eb28..df198c51244a 100644
> --- a/include/net/netfilter/nf_conntrack_acct.h
> +++ b/include/net/netfilter/nf_conntrack_acct.h
> @@ -65,6 +65,8 @@ static inline void nf_ct_set_acct(struct net *net, bool enable)
> #endif
> }
>
> +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes);
> +
> void nf_conntrack_acct_pernet_init(struct net *net);
>
> int nf_conntrack_acct_init(void);
> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> index a18f8fe728e3..a55c1d6f8191 100644
> --- a/net/netfilter/nf_conntrack_core.c
> +++ b/net/netfilter/nf_conntrack_core.c
> @@ -863,9 +863,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
> }
> EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
>
> -static inline void nf_ct_acct_update(struct nf_conn *ct,
> - enum ip_conntrack_info ctinfo,
> - unsigned int len)
> +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes)
> {
> struct nf_conn_acct *acct;
>
> @@ -873,10 +871,11 @@ static inline void nf_ct_acct_update(struct nf_conn *ct,
> if (acct) {
> struct nf_conn_counter *counter = acct->counter;
>
> - atomic64_inc(&counter[CTINFO2DIR(ctinfo)].packets);
> - atomic64_add(len, &counter[CTINFO2DIR(ctinfo)].bytes);
> + atomic64_inc(&counter[dir].packets);
> + atomic64_add(bytes, &counter[dir].bytes);
> }
> }
> +EXPORT_SYMBOL_GPL(nf_ct_acct_update);
This function only add one packet once. Maybe is not so suit for all the scenario
such as the HW flowtable offload get the counter from HW periodicly.
>
> static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
> const struct nf_conn *loser_ct)
> @@ -890,7 +889,7 @@ static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
>
> /* u32 should be fine since we must have seen one packet. */
> bytes = atomic64_read(&counter[CTINFO2DIR(ctinfo)].bytes);
> - nf_ct_acct_update(ct, ctinfo, bytes);
> + nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), bytes);
> }
> }
>
> @@ -1931,7 +1930,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
> WRITE_ONCE(ct->timeout, extra_jiffies);
> acct:
> if (do_acct)
> - nf_ct_acct_update(ct, ctinfo, skb->len);
> + nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
> }
> EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
>
> @@ -1939,7 +1938,7 @@ bool nf_ct_kill_acct(struct nf_conn *ct,
> enum ip_conntrack_info ctinfo,
> const struct sk_buff *skb)
> {
> - nf_ct_acct_update(ct, ctinfo, skb->len);
> + nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
>
> return nf_ct_delete(ct, 0, 0);
> }
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update()
2020-03-25 2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
@ 2020-03-26 11:49 ` Pablo Neira Ayuso
0 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-26 11:49 UTC (permalink / raw)
To: wenxu; +Cc: netfilter-devel
On Wed, Mar 25, 2020 at 10:59:14AM +0800, wenxu wrote:
>
> On 3/25/2020 1:50 AM, Pablo Neira Ayuso wrote:
> > This function allows you to update the conntrack counters.
> >
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > include/net/netfilter/nf_conntrack_acct.h | 2 ++
> > net/netfilter/nf_conntrack_core.c | 15 +++++++--------
> > 2 files changed, 9 insertions(+), 8 deletions(-)
> >
> > diff --git a/include/net/netfilter/nf_conntrack_acct.h b/include/net/netfilter/nf_conntrack_acct.h
> > index f7a060c6eb28..df198c51244a 100644
> > --- a/include/net/netfilter/nf_conntrack_acct.h
> > +++ b/include/net/netfilter/nf_conntrack_acct.h
> > @@ -65,6 +65,8 @@ static inline void nf_ct_set_acct(struct net *net, bool enable)
> > #endif
> > }
> >
> > +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes);
> > +
> > void nf_conntrack_acct_pernet_init(struct net *net);
> >
> > int nf_conntrack_acct_init(void);
> > diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> > index a18f8fe728e3..a55c1d6f8191 100644
> > --- a/net/netfilter/nf_conntrack_core.c
> > +++ b/net/netfilter/nf_conntrack_core.c
> > @@ -863,9 +863,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
> > }
> > EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
> >
> > -static inline void nf_ct_acct_update(struct nf_conn *ct,
> > - enum ip_conntrack_info ctinfo,
> > - unsigned int len)
> > +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes)
> > {
> > struct nf_conn_acct *acct;
> >
> > @@ -873,10 +871,11 @@ static inline void nf_ct_acct_update(struct nf_conn *ct,
> > if (acct) {
> > struct nf_conn_counter *counter = acct->counter;
> >
> > - atomic64_inc(&counter[CTINFO2DIR(ctinfo)].packets);
> > - atomic64_add(len, &counter[CTINFO2DIR(ctinfo)].bytes);
> > + atomic64_inc(&counter[dir].packets);
> > + atomic64_add(bytes, &counter[dir].bytes);
> > }
> > }
> > +EXPORT_SYMBOL_GPL(nf_ct_acct_update);
>
> This function only add one packet once. Maybe is not so suit for all the scenario
>
> such as the HW flowtable offload get the counter from HW periodicly.
This patchset is not addressing the flowtable HW offload.
That will need something like nf_ct_acct_add() to accumulate packets
and bytes. Probably nf_ct_acct_update() should be a static inline that
calls nf_ct_acct_add().
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-03-26 11:49 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 3/3] netfilter: flowtable: add counter support Pablo Neira Ayuso
2020-03-25 2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
2020-03-26 11:49 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).