mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-24 18:19:29 +07:00
netfilter: netns nf_conntrack: per-netns conntrack accounting
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
c2a2c7e0cc
commit
d716a4dfbb
@ -8,6 +8,7 @@
|
|||||||
|
|
||||||
#ifndef _NF_CONNTRACK_ACCT_H
|
#ifndef _NF_CONNTRACK_ACCT_H
|
||||||
#define _NF_CONNTRACK_ACCT_H
|
#define _NF_CONNTRACK_ACCT_H
|
||||||
|
#include <net/net_namespace.h>
|
||||||
#include <linux/netfilter/nf_conntrack_common.h>
|
#include <linux/netfilter/nf_conntrack_common.h>
|
||||||
#include <linux/netfilter/nf_conntrack_tuple_common.h>
|
#include <linux/netfilter/nf_conntrack_tuple_common.h>
|
||||||
#include <net/netfilter/nf_conntrack.h>
|
#include <net/netfilter/nf_conntrack.h>
|
||||||
@ -18,8 +19,6 @@ struct nf_conn_counter {
|
|||||||
u_int64_t bytes;
|
u_int64_t bytes;
|
||||||
};
|
};
|
||||||
|
|
||||||
extern int nf_ct_acct;
|
|
||||||
|
|
||||||
static inline
|
static inline
|
||||||
struct nf_conn_counter *nf_conn_acct_find(const struct nf_conn *ct)
|
struct nf_conn_counter *nf_conn_acct_find(const struct nf_conn *ct)
|
||||||
{
|
{
|
||||||
@ -29,9 +28,10 @@ struct nf_conn_counter *nf_conn_acct_find(const struct nf_conn *ct)
|
|||||||
static inline
|
static inline
|
||||||
struct nf_conn_counter *nf_ct_acct_ext_add(struct nf_conn *ct, gfp_t gfp)
|
struct nf_conn_counter *nf_ct_acct_ext_add(struct nf_conn *ct, gfp_t gfp)
|
||||||
{
|
{
|
||||||
|
struct net *net = nf_ct_net(ct);
|
||||||
struct nf_conn_counter *acct;
|
struct nf_conn_counter *acct;
|
||||||
|
|
||||||
if (!nf_ct_acct)
|
if (!net->ct.sysctl_acct)
|
||||||
return NULL;
|
return NULL;
|
||||||
|
|
||||||
acct = nf_ct_ext_add(ct, NF_CT_EXT_ACCT, gfp);
|
acct = nf_ct_ext_add(ct, NF_CT_EXT_ACCT, gfp);
|
||||||
@ -45,7 +45,7 @@ struct nf_conn_counter *nf_ct_acct_ext_add(struct nf_conn *ct, gfp_t gfp)
|
|||||||
extern unsigned int
|
extern unsigned int
|
||||||
seq_print_acct(struct seq_file *s, const struct nf_conn *ct, int dir);
|
seq_print_acct(struct seq_file *s, const struct nf_conn *ct, int dir);
|
||||||
|
|
||||||
extern int nf_conntrack_acct_init(void);
|
extern int nf_conntrack_acct_init(struct net *net);
|
||||||
extern void nf_conntrack_acct_fini(void);
|
extern void nf_conntrack_acct_fini(struct net *net);
|
||||||
|
|
||||||
#endif /* _NF_CONNTRACK_ACCT_H */
|
#endif /* _NF_CONNTRACK_ACCT_H */
|
||||||
|
@ -17,10 +17,12 @@ struct netns_ct {
|
|||||||
#ifdef CONFIG_NF_CONNTRACK_EVENTS
|
#ifdef CONFIG_NF_CONNTRACK_EVENTS
|
||||||
struct nf_conntrack_ecache *ecache;
|
struct nf_conntrack_ecache *ecache;
|
||||||
#endif
|
#endif
|
||||||
|
int sysctl_acct;
|
||||||
int sysctl_checksum;
|
int sysctl_checksum;
|
||||||
unsigned int sysctl_log_invalid; /* Log invalid packets */
|
unsigned int sysctl_log_invalid; /* Log invalid packets */
|
||||||
#ifdef CONFIG_SYSCTL
|
#ifdef CONFIG_SYSCTL
|
||||||
struct ctl_table_header *sysctl_header;
|
struct ctl_table_header *sysctl_header;
|
||||||
|
struct ctl_table_header *acct_sysctl_header;
|
||||||
#endif
|
#endif
|
||||||
int hash_vmalloc;
|
int hash_vmalloc;
|
||||||
int expect_vmalloc;
|
int expect_vmalloc;
|
||||||
|
@ -22,19 +22,17 @@
|
|||||||
#define NF_CT_ACCT_DEFAULT 0
|
#define NF_CT_ACCT_DEFAULT 0
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
int nf_ct_acct __read_mostly = NF_CT_ACCT_DEFAULT;
|
static int nf_ct_acct __read_mostly = NF_CT_ACCT_DEFAULT;
|
||||||
EXPORT_SYMBOL_GPL(nf_ct_acct);
|
|
||||||
|
|
||||||
module_param_named(acct, nf_ct_acct, bool, 0644);
|
module_param_named(acct, nf_ct_acct, bool, 0644);
|
||||||
MODULE_PARM_DESC(acct, "Enable connection tracking flow accounting.");
|
MODULE_PARM_DESC(acct, "Enable connection tracking flow accounting.");
|
||||||
|
|
||||||
#ifdef CONFIG_SYSCTL
|
#ifdef CONFIG_SYSCTL
|
||||||
static struct ctl_table_header *acct_sysctl_header;
|
|
||||||
static struct ctl_table acct_sysctl_table[] = {
|
static struct ctl_table acct_sysctl_table[] = {
|
||||||
{
|
{
|
||||||
.ctl_name = CTL_UNNUMBERED,
|
.ctl_name = CTL_UNNUMBERED,
|
||||||
.procname = "nf_conntrack_acct",
|
.procname = "nf_conntrack_acct",
|
||||||
.data = &nf_ct_acct,
|
.data = &init_net.ct.sysctl_acct,
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = &proc_dointvec,
|
.proc_handler = &proc_dointvec,
|
||||||
@ -64,41 +62,87 @@ static struct nf_ct_ext_type acct_extend __read_mostly = {
|
|||||||
.id = NF_CT_EXT_ACCT,
|
.id = NF_CT_EXT_ACCT,
|
||||||
};
|
};
|
||||||
|
|
||||||
int nf_conntrack_acct_init(void)
|
|
||||||
{
|
|
||||||
int ret;
|
|
||||||
|
|
||||||
#ifdef CONFIG_NF_CT_ACCT
|
|
||||||
printk(KERN_WARNING "CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use\n");
|
|
||||||
printk(KERN_WARNING "nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or\n");
|
|
||||||
printk(KERN_WARNING "sysctl net.netfilter.nf_conntrack_acct=1 to enable it.\n");
|
|
||||||
#endif
|
|
||||||
|
|
||||||
ret = nf_ct_extend_register(&acct_extend);
|
|
||||||
if (ret < 0) {
|
|
||||||
printk(KERN_ERR "nf_conntrack_acct: Unable to register extension\n");
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef CONFIG_SYSCTL
|
#ifdef CONFIG_SYSCTL
|
||||||
acct_sysctl_header = register_sysctl_paths(nf_net_netfilter_sysctl_path,
|
static int nf_conntrack_acct_init_sysctl(struct net *net)
|
||||||
acct_sysctl_table);
|
{
|
||||||
|
struct ctl_table *table;
|
||||||
|
|
||||||
if (!acct_sysctl_header) {
|
table = kmemdup(acct_sysctl_table, sizeof(acct_sysctl_table),
|
||||||
nf_ct_extend_unregister(&acct_extend);
|
GFP_KERNEL);
|
||||||
|
if (!table)
|
||||||
|
goto out;
|
||||||
|
|
||||||
|
table[0].data = &net->ct.sysctl_acct;
|
||||||
|
|
||||||
|
net->ct.acct_sysctl_header = register_net_sysctl_table(net,
|
||||||
|
nf_net_netfilter_sysctl_path, table);
|
||||||
|
if (!net->ct.acct_sysctl_header) {
|
||||||
printk(KERN_ERR "nf_conntrack_acct: can't register to sysctl.\n");
|
printk(KERN_ERR "nf_conntrack_acct: can't register to sysctl.\n");
|
||||||
return -ENOMEM;
|
goto out_register;
|
||||||
}
|
}
|
||||||
#endif
|
return 0;
|
||||||
|
|
||||||
|
out_register:
|
||||||
|
kfree(table);
|
||||||
|
out:
|
||||||
|
return -ENOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
static void nf_conntrack_acct_fini_sysctl(struct net *net)
|
||||||
|
{
|
||||||
|
struct ctl_table *table;
|
||||||
|
|
||||||
|
table = net->ct.acct_sysctl_header->ctl_table_arg;
|
||||||
|
unregister_net_sysctl_table(net->ct.acct_sysctl_header);
|
||||||
|
kfree(table);
|
||||||
|
}
|
||||||
|
#else
|
||||||
|
static int nf_conntrack_acct_init_sysctl(struct net *net)
|
||||||
|
{
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
void nf_conntrack_acct_fini(void)
|
static void nf_conntrack_acct_fini_sysctl(struct net *net)
|
||||||
{
|
{
|
||||||
#ifdef CONFIG_SYSCTL
|
}
|
||||||
unregister_sysctl_table(acct_sysctl_header);
|
#endif
|
||||||
#endif
|
|
||||||
nf_ct_extend_unregister(&acct_extend);
|
int nf_conntrack_acct_init(struct net *net)
|
||||||
|
{
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
net->ct.sysctl_acct = nf_ct_acct;
|
||||||
|
|
||||||
|
if (net_eq(net, &init_net)) {
|
||||||
|
#ifdef CONFIG_NF_CT_ACCT
|
||||||
|
printk(KERN_WARNING "CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use\n");
|
||||||
|
printk(KERN_WARNING "nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or\n");
|
||||||
|
printk(KERN_WARNING "sysctl net.netfilter.nf_conntrack_acct=1 to enable it.\n");
|
||||||
|
#endif
|
||||||
|
|
||||||
|
ret = nf_ct_extend_register(&acct_extend);
|
||||||
|
if (ret < 0) {
|
||||||
|
printk(KERN_ERR "nf_conntrack_acct: Unable to register extension\n");
|
||||||
|
goto out_extend_register;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = nf_conntrack_acct_init_sysctl(net);
|
||||||
|
if (ret < 0)
|
||||||
|
goto out_sysctl;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
out_sysctl:
|
||||||
|
if (net_eq(net, &init_net))
|
||||||
|
nf_ct_extend_unregister(&acct_extend);
|
||||||
|
out_extend_register:
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
void nf_conntrack_acct_fini(struct net *net)
|
||||||
|
{
|
||||||
|
nf_conntrack_acct_fini_sysctl(net);
|
||||||
|
if (net_eq(net, &init_net))
|
||||||
|
nf_ct_extend_unregister(&acct_extend);
|
||||||
}
|
}
|
||||||
|
@ -1039,7 +1039,7 @@ void nf_conntrack_cleanup(struct net *net)
|
|||||||
nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
|
nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
|
||||||
nf_conntrack_htable_size);
|
nf_conntrack_htable_size);
|
||||||
|
|
||||||
nf_conntrack_acct_fini();
|
nf_conntrack_acct_fini(net);
|
||||||
nf_conntrack_expect_fini(net);
|
nf_conntrack_expect_fini(net);
|
||||||
free_percpu(net->ct.stat);
|
free_percpu(net->ct.stat);
|
||||||
nf_conntrack_helper_fini();
|
nf_conntrack_helper_fini();
|
||||||
@ -1191,7 +1191,7 @@ int nf_conntrack_init(struct net *net)
|
|||||||
if (ret < 0)
|
if (ret < 0)
|
||||||
goto out_fini_expect;
|
goto out_fini_expect;
|
||||||
|
|
||||||
ret = nf_conntrack_acct_init();
|
ret = nf_conntrack_acct_init(net);
|
||||||
if (ret < 0)
|
if (ret < 0)
|
||||||
goto out_fini_helper;
|
goto out_fini_helper;
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user