From patchwork Sat Mar 23 12:17:09 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Zintakis X-Patchwork-Id: 230329 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4BD432C0092 for ; Sat, 23 Mar 2013 23:17:34 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750735Ab3CWMRc (ORCPT ); Sat, 23 Mar 2013 08:17:32 -0400 Received: from mail-la0-f42.google.com ([209.85.215.42]:39175 "EHLO mail-la0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750708Ab3CWMRc (ORCPT ); Sat, 23 Mar 2013 08:17:32 -0400 Received: by mail-la0-f42.google.com with SMTP id fe20so8891592lab.1 for ; Sat, 23 Mar 2013 05:17:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=x-received:message-id:disposition-notification-to:date:from :user-agent:mime-version:to:cc:subject:content-type :content-transfer-encoding; bh=OutZ5atJmTNLfNCVNsIa54ig49AM1dQgWjLODBfePH8=; b=DFGIqtYumOUOqhaxRrDH+yd5GKHVpRKxRdCC3pdbXDQkL3OkDAL0oLybWXlmqZt7ou /eRDTj4xBRGRvOHmVz/7D8CMzG1ynZx67MvFBK8sBd6OCeC44qHT2siN5Kc82nR3rr34 euNBrsyeG5YALhpQvhuyJus5uwPjyQ0l7NN49HHhGwkbfVY0lHtEoXfWnrFSh+QkAgik PNdlYbr81IG1Ml9TOD2/6vSjY90q+fw3U6IWoAgWz+Cy9bisvsaVSV8bkPzjWUF/qb/j 6KS3zGqnqBnHesjwTd1EQSWqfbUQAuNV4Q0JG4KQpjqXQM6vBetSkpqA/EsT94MVg8f4 9r3w== X-Received: by 10.152.47.97 with SMTP id c1mr2719811lan.6.1364041050544; Sat, 23 Mar 2013 05:17:30 -0700 (PDT) Received: from xp1.wyse.network (assk.torservers.net. [78.108.63.46]) by mx.google.com with ESMTPS id oy10sm2173689lab.8.2013.03.23.05.17.28 (version=TLSv1 cipher=RC4-SHA bits=128/128); Sat, 23 Mar 2013 05:17:29 -0700 (PDT) Message-ID: <514D9D45.6090804@googlemail.com> Date: Sat, 23 Mar 2013 12:17:09 +0000 From: Michael Zintakis User-Agent: Thunderbird 17.0.3-1.fc18 (X11/20130107) MIME-Version: 1.0 To: netfilter-devel@vger.kernel.org CC: pablo@netfilter.org Subject: [PATCH 1/3 nfnetlink_acct] numerous changes and improvements to the kernel code Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org The following is a first patch of a series of 3 patches dealing with the following kernel changes to nfnetlink_acct: * fmt and bthr (format and bytes threshold) properties have been added to the nfacct object. * ability to change all nfacct object properties (with the exception of name) has been added. * as a result of the above, a full save/restore is now possible, even if the accounting object is in use by iptables. Signed-off-by: Michael Zintakis --- include/uapi/linux/netfilter/nfnetlink_acct.h | 2 + net/netfilter/nfnetlink_acct.c | 63 ++++++++++++++++++++++++- 2 files changed, 64 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/uapi/linux/netfilter/nfnetlink_acct.h b/include/uapi/linux/netfilter/nfnetlink_acct.h index c7b6269..f07e825 100644 --- a/include/uapi/linux/netfilter/nfnetlink_acct.h +++ b/include/uapi/linux/netfilter/nfnetlink_acct.h @@ -18,6 +18,8 @@ enum nfnl_acct_type { NFACCT_NAME, NFACCT_PKTS, NFACCT_BYTES, + NFACCT_BTHR, + NFACCT_FMT, NFACCT_USE, __NFACCT_MAX }; diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c index 589d686..bcd4ae8 100644 --- a/net/netfilter/nfnetlink_acct.c +++ b/net/netfilter/nfnetlink_acct.c @@ -32,6 +32,8 @@ static LIST_HEAD(nfnl_acct_list); struct nf_acct { atomic64_t pkts; atomic64_t bytes; + atomic64_t bthr; + atomic_t fmt; struct list_head head; atomic_t refcnt; char name[NFACCT_NAME_MAX]; @@ -63,9 +65,55 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb, if (matching) { if (nlh->nlmsg_flags & NLM_F_REPLACE) { - /* reset counters if you request a replacement. */ + /* reset counters if you request a replacement */ + if (!tb[NFACCT_PKTS]) { + /* + * Prevent resetting the packets counter if + * either fmt or bthr are specified. + * + * This is done for backward compatibility, + * otherwise resetting these counters should + * only be allowed when tb[NFACCT_PKTS] is + * explicitly specified and == 0. + * + */ + if (!tb[NFACCT_FMT] && + !tb[NFACCT_BTHR]) { atomic64_set(&matching->pkts, 0); + } + } else { + atomic64_set(&matching->pkts, + be64_to_cpu(nla_get_be64(tb[NFACCT_PKTS]))); + } + if (!tb[NFACCT_BYTES]) { + /* + * Prevent resetting the packets counter if + * either fmt or bthr are specified. + * + * This is done for backward compatibility, + * otherwise resetting these counters should + * only be allowed when tb[NFACCT_BYTES] is + * explicitly specified and == 0. + * + */ + if (!tb[NFACCT_FMT] && + !tb[NFACCT_BTHR]) { atomic64_set(&matching->bytes, 0); + } + } else { + atomic64_set(&matching->bytes, + be64_to_cpu(nla_get_be64(tb[NFACCT_BYTES]))); + } + /* ...and change the format... */ + if (tb[NFACCT_FMT]) { + atomic_set(&matching->fmt, + be32_to_cpu(nla_get_be32(tb[NFACCT_FMT]))); + } + /* ... as well as the bytes threshold */ + if (tb[NFACCT_BTHR]) { + atomic64_set(&matching->bthr, + be64_to_cpu(nla_get_be64(tb[NFACCT_BTHR]))); + } return 0; } return -EBUSY; @@ -85,6 +133,14 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb, atomic64_set(&nfacct->pkts, be64_to_cpu(nla_get_be64(tb[NFACCT_PKTS]))); } + if (tb[NFACCT_FMT]) { + atomic_set(&nfacct->fmt, + be32_to_cpu(nla_get_be32(tb[NFACCT_FMT]))); + } + if (tb[NFACCT_BTHR]) { + atomic64_set(&nfacct->bthr, + be64_to_cpu(nla_get_be64(tb[NFACCT_BTHR]))); + } atomic_set(&nfacct->refcnt, 1); list_add_tail_rcu(&nfacct->head, &nfnl_acct_list); return 0; @@ -121,6 +177,9 @@ nfnl_acct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, } if (nla_put_be64(skb, NFACCT_PKTS, cpu_to_be64(pkts)) || nla_put_be64(skb, NFACCT_BYTES, cpu_to_be64(bytes)) || + nla_put_be64(skb, NFACCT_BTHR, + cpu_to_be64(atomic64_read(&acct->bthr))) || + nla_put_be32(skb, NFACCT_FMT, htonl(atomic_read(&acct->fmt))) || nla_put_be32(skb, NFACCT_USE, htonl(atomic_read(&acct->refcnt)))) goto nla_put_failure; @@ -265,6 +324,8 @@ static const struct nla_policy nfnl_acct_policy[NFACCT_MAX+1] = { [NFACCT_NAME] = { .type = NLA_NUL_STRING, .len = NFACCT_NAME_MAX-1 }, [NFACCT_BYTES] = { .type = NLA_U64 }, [NFACCT_PKTS] = { .type = NLA_U64 }, + [NFACCT_BTHR] = { .type = NLA_U64 }, + [NFACCT_FMT] = { .type = NLA_U32 }, }; static const struct nfnl_callback nfnl_acct_cb[NFNL_MSG_ACCT_MAX] = {