Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update()
@ 2020-03-24 17:50 Pablo Neira Ayuso
  2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-24 17:50 UTC (permalink / raw)
  To: netfilter-devel

This function allows you to update the conntrack counters.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/net/netfilter/nf_conntrack_acct.h |  2 ++
 net/netfilter/nf_conntrack_core.c         | 15 +++++++--------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_acct.h b/include/net/netfilter/nf_conntrack_acct.h
index f7a060c6eb28..df198c51244a 100644
--- a/include/net/netfilter/nf_conntrack_acct.h
+++ b/include/net/netfilter/nf_conntrack_acct.h
@@ -65,6 +65,8 @@ static inline void nf_ct_set_acct(struct net *net, bool enable)
 #endif
 }
 
+void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes);
+
 void nf_conntrack_acct_pernet_init(struct net *net);
 
 int nf_conntrack_acct_init(void);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a18f8fe728e3..a55c1d6f8191 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -863,9 +863,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
-static inline void nf_ct_acct_update(struct nf_conn *ct,
-				     enum ip_conntrack_info ctinfo,
-				     unsigned int len)
+void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes)
 {
 	struct nf_conn_acct *acct;
 
@@ -873,10 +871,11 @@ static inline void nf_ct_acct_update(struct nf_conn *ct,
 	if (acct) {
 		struct nf_conn_counter *counter = acct->counter;
 
-		atomic64_inc(&counter[CTINFO2DIR(ctinfo)].packets);
-		atomic64_add(len, &counter[CTINFO2DIR(ctinfo)].bytes);
+		atomic64_inc(&counter[dir].packets);
+		atomic64_add(bytes, &counter[dir].bytes);
 	}
 }
+EXPORT_SYMBOL_GPL(nf_ct_acct_update);
 
 static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 			     const struct nf_conn *loser_ct)
@@ -890,7 +889,7 @@ static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 
 		/* u32 should be fine since we must have seen one packet. */
 		bytes = atomic64_read(&counter[CTINFO2DIR(ctinfo)].bytes);
-		nf_ct_acct_update(ct, ctinfo, bytes);
+		nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), bytes);
 	}
 }
 
@@ -1931,7 +1930,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
 		WRITE_ONCE(ct->timeout, extra_jiffies);
 acct:
 	if (do_acct)
-		nf_ct_acct_update(ct, ctinfo, skb->len);
+		nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
 }
 EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
 
@@ -1939,7 +1938,7 @@ bool nf_ct_kill_acct(struct nf_conn *ct,
 		     enum ip_conntrack_info ctinfo,
 		     const struct sk_buff *skb)
 {
-	nf_ct_acct_update(ct, ctinfo, skb->len);
+	nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
 
 	return nf_ct_delete(ct, 0, 0);
 }
-- 
2.11.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi
  2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
@ 2020-03-24 17:50 ` Pablo Neira Ayuso
  2020-03-24 17:50 ` [PATCH nf-next 3/3] netfilter: flowtable: add counter support Pablo Neira Ayuso
  2020-03-25  2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
  2 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-24 17:50 UTC (permalink / raw)
  To: netfilter-devel

Expose the NFT_FLOWTABLE_HW_OFFLOAD flag through uapi.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/net/netfilter/nf_flow_table.h    |  2 +-
 include/uapi/linux/netfilter/nf_tables.h | 10 ++++++++++
 net/netfilter/nf_tables_api.c            |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index f523ea87b6ae..4beb7f13bc50 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -62,7 +62,7 @@ struct nf_flowtable_type {
 };
 
 enum nf_flowtable_flags {
-	NF_FLOWTABLE_HW_OFFLOAD		= 0x1,
+	NF_FLOWTABLE_HW_OFFLOAD		= 0x1,	/* NFT_FLOWTABLE_HW_OFFLOAD */
 };
 
 struct nf_flowtable {
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 4e3a5971d4ee..717ee3aa05d7 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1554,6 +1554,16 @@ enum nft_object_attributes {
 #define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
 
 /**
+ * enum nft_flowtable_flags - nf_tables flowtable flags
+ *
+ * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
+ */
+enum nft_flowtable_flags {
+	NFT_FLOWTABLE_HW_OFFLOAD	= 0x1,
+	NFT_FLOWTABLE_MASK		= NFT_FLOWTABLE_HW_OFFLOAD
+};
+
+/**
  * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
  *
  * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c5332a313283..ace325218edb 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6375,7 +6375,7 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
 	if (nla[NFTA_FLOWTABLE_FLAGS]) {
 		flowtable->data.flags =
 			ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
-		if (flowtable->data.flags & ~NF_FLOWTABLE_HW_OFFLOAD)
+		if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK)
 			goto err3;
 	}
 
-- 
2.11.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH nf-next 3/3] netfilter: flowtable: add counter support
  2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
  2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
@ 2020-03-24 17:50 ` Pablo Neira Ayuso
  2020-03-25  2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
  2 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-24 17:50 UTC (permalink / raw)
  To: netfilter-devel

Add a new flag to turn on flowtable counters which are stored in the
conntrack entry.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/net/netfilter/nf_flow_table.h    | 1 +
 include/uapi/linux/netfilter/nf_tables.h | 5 ++++-
 net/netfilter/nf_flow_table_ip.c         | 7 +++++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 4beb7f13bc50..4a2ec6fd9ad2 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -63,6 +63,7 @@ struct nf_flowtable_type {
 
 enum nf_flowtable_flags {
 	NF_FLOWTABLE_HW_OFFLOAD		= 0x1,	/* NFT_FLOWTABLE_HW_OFFLOAD */
+	NF_FLOWTABLE_COUNTER		= 0x2,	/* NFT_FLOWTABLE_COUNTER */
 };
 
 struct nf_flowtable {
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 717ee3aa05d7..30f2a87270dc 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1557,10 +1557,13 @@ enum nft_object_attributes {
  * enum nft_flowtable_flags - nf_tables flowtable flags
  *
  * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
+ * @NFT_FLOWTABLE_COUNTER: enable flow counters
  */
 enum nft_flowtable_flags {
 	NFT_FLOWTABLE_HW_OFFLOAD	= 0x1,
-	NFT_FLOWTABLE_MASK		= NFT_FLOWTABLE_HW_OFFLOAD
+	NFT_FLOWTABLE_COUNTER		= 0x2,
+	NFT_FLOWTABLE_MASK		= (NFT_FLOWTABLE_HW_OFFLOAD |
+					   NFT_FLOWTABLE_COUNTER)
 };
 
 /**
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 5272721080f8..553cc0d5695a 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -12,6 +12,7 @@
 #include <net/ip6_route.h>
 #include <net/neighbour.h>
 #include <net/netfilter/nf_flow_table.h>
+#include <net/netfilter/nf_conntrack_acct.h>
 /* For layer 4 checksum field offset. */
 #include <linux/tcp.h>
 #include <linux/udp.h>
@@ -286,6 +287,9 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
 	ip_decrease_ttl(iph);
 	skb->tstamp = 0;
 
+	if (flow_table->flags & NF_FLOWTABLE_COUNTER)
+		nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
+
 	if (unlikely(dst_xfrm(&rt->dst))) {
 		memset(skb->cb, 0, sizeof(struct inet_skb_parm));
 		IPCB(skb)->iif = skb->dev->ifindex;
@@ -516,6 +520,9 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 	ip6h->hop_limit--;
 	skb->tstamp = 0;
 
+	if (flow_table->flags & NF_FLOWTABLE_COUNTER)
+		nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
+
 	if (unlikely(dst_xfrm(&rt->dst))) {
 		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 		IP6CB(skb)->iif = skb->dev->ifindex;
-- 
2.11.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update()
  2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
  2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
  2020-03-24 17:50 ` [PATCH nf-next 3/3] netfilter: flowtable: add counter support Pablo Neira Ayuso
@ 2020-03-25  2:59 ` wenxu
  2020-03-26 11:49   ` Pablo Neira Ayuso
  2 siblings, 1 reply; 5+ messages in thread
From: wenxu @ 2020-03-25  2:59 UTC (permalink / raw)
  To: Pablo Neira Ayuso, netfilter-devel


On 3/25/2020 1:50 AM, Pablo Neira Ayuso wrote:
> This function allows you to update the conntrack counters.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  include/net/netfilter/nf_conntrack_acct.h |  2 ++
>  net/netfilter/nf_conntrack_core.c         | 15 +++++++--------
>  2 files changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/include/net/netfilter/nf_conntrack_acct.h b/include/net/netfilter/nf_conntrack_acct.h
> index f7a060c6eb28..df198c51244a 100644
> --- a/include/net/netfilter/nf_conntrack_acct.h
> +++ b/include/net/netfilter/nf_conntrack_acct.h
> @@ -65,6 +65,8 @@ static inline void nf_ct_set_acct(struct net *net, bool enable)
>  #endif
>  }
>  
> +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes);
> +
>  void nf_conntrack_acct_pernet_init(struct net *net);
>  
>  int nf_conntrack_acct_init(void);
> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> index a18f8fe728e3..a55c1d6f8191 100644
> --- a/net/netfilter/nf_conntrack_core.c
> +++ b/net/netfilter/nf_conntrack_core.c
> @@ -863,9 +863,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
>  }
>  EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
>  
> -static inline void nf_ct_acct_update(struct nf_conn *ct,
> -				     enum ip_conntrack_info ctinfo,
> -				     unsigned int len)
> +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes)
>  {
>  	struct nf_conn_acct *acct;
>  
> @@ -873,10 +871,11 @@ static inline void nf_ct_acct_update(struct nf_conn *ct,
>  	if (acct) {
>  		struct nf_conn_counter *counter = acct->counter;
>  
> -		atomic64_inc(&counter[CTINFO2DIR(ctinfo)].packets);
> -		atomic64_add(len, &counter[CTINFO2DIR(ctinfo)].bytes);
> +		atomic64_inc(&counter[dir].packets);
> +		atomic64_add(bytes, &counter[dir].bytes);
>  	}
>  }
> +EXPORT_SYMBOL_GPL(nf_ct_acct_update);

This function only add one packet once. Maybe is not so suit for all the scenario

such as the HW flowtable offload get the counter from HW periodicly.

>  
>  static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
>  			     const struct nf_conn *loser_ct)
> @@ -890,7 +889,7 @@ static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
>  
>  		/* u32 should be fine since we must have seen one packet. */
>  		bytes = atomic64_read(&counter[CTINFO2DIR(ctinfo)].bytes);
> -		nf_ct_acct_update(ct, ctinfo, bytes);
> +		nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), bytes);
>  	}
>  }
>  
> @@ -1931,7 +1930,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
>  		WRITE_ONCE(ct->timeout, extra_jiffies);
>  acct:
>  	if (do_acct)
> -		nf_ct_acct_update(ct, ctinfo, skb->len);
> +		nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
>  }
>  EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
>  
> @@ -1939,7 +1938,7 @@ bool nf_ct_kill_acct(struct nf_conn *ct,
>  		     enum ip_conntrack_info ctinfo,
>  		     const struct sk_buff *skb)
>  {
> -	nf_ct_acct_update(ct, ctinfo, skb->len);
> +	nf_ct_acct_update(ct, CTINFO2DIR(ctinfo), skb->len);
>  
>  	return nf_ct_delete(ct, 0, 0);
>  }

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update()
  2020-03-25  2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
@ 2020-03-26 11:49   ` Pablo Neira Ayuso
  0 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-26 11:49 UTC (permalink / raw)
  To: wenxu; +Cc: netfilter-devel

On Wed, Mar 25, 2020 at 10:59:14AM +0800, wenxu wrote:
> 
> On 3/25/2020 1:50 AM, Pablo Neira Ayuso wrote:
> > This function allows you to update the conntrack counters.
> >
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> >  include/net/netfilter/nf_conntrack_acct.h |  2 ++
> >  net/netfilter/nf_conntrack_core.c         | 15 +++++++--------
> >  2 files changed, 9 insertions(+), 8 deletions(-)
> >
> > diff --git a/include/net/netfilter/nf_conntrack_acct.h b/include/net/netfilter/nf_conntrack_acct.h
> > index f7a060c6eb28..df198c51244a 100644
> > --- a/include/net/netfilter/nf_conntrack_acct.h
> > +++ b/include/net/netfilter/nf_conntrack_acct.h
> > @@ -65,6 +65,8 @@ static inline void nf_ct_set_acct(struct net *net, bool enable)
> >  #endif
> >  }
> >  
> > +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes);
> > +
> >  void nf_conntrack_acct_pernet_init(struct net *net);
> >  
> >  int nf_conntrack_acct_init(void);
> > diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> > index a18f8fe728e3..a55c1d6f8191 100644
> > --- a/net/netfilter/nf_conntrack_core.c
> > +++ b/net/netfilter/nf_conntrack_core.c
> > @@ -863,9 +863,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
> >  }
> >  EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
> >  
> > -static inline void nf_ct_acct_update(struct nf_conn *ct,
> > -				     enum ip_conntrack_info ctinfo,
> > -				     unsigned int len)
> > +void nf_ct_acct_update(struct nf_conn *ct, u32 dir, unsigned int bytes)
> >  {
> >  	struct nf_conn_acct *acct;
> >  
> > @@ -873,10 +871,11 @@ static inline void nf_ct_acct_update(struct nf_conn *ct,
> >  	if (acct) {
> >  		struct nf_conn_counter *counter = acct->counter;
> >  
> > -		atomic64_inc(&counter[CTINFO2DIR(ctinfo)].packets);
> > -		atomic64_add(len, &counter[CTINFO2DIR(ctinfo)].bytes);
> > +		atomic64_inc(&counter[dir].packets);
> > +		atomic64_add(bytes, &counter[dir].bytes);
> >  	}
> >  }
> > +EXPORT_SYMBOL_GPL(nf_ct_acct_update);
> 
> This function only add one packet once. Maybe is not so suit for all the scenario
> 
> such as the HW flowtable offload get the counter from HW periodicly.

This patchset is not addressing the flowtable HW offload.

That will need something like nf_ct_acct_add() to accumulate packets
and bytes. Probably nf_ct_acct_update() should be a static inline that
calls nf_ct_acct_add().

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, back to index

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-24 17:50 [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 2/3] netfilter: nf_tables: add enum nft_flowtable_flags to uapi Pablo Neira Ayuso
2020-03-24 17:50 ` [PATCH nf-next 3/3] netfilter: flowtable: add counter support Pablo Neira Ayuso
2020-03-25  2:59 ` [PATCH nf-next 1/3] netfilter: conntrack: export nf_ct_acct_update() wenxu
2020-03-26 11:49   ` Pablo Neira Ayuso

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git