提交 718d4ad9 编写于 作者: F Fabian Hugelshofer 提交者: David S. Miller

netfilter: nf_conntrack: properly account terminating packets

Currently the last packet of a connection isn't accounted when its causing
abnormal termination.

Introduces nf_ct_kill_acct() which increments the accounting counters on
conntrack kill. The new function was necessary, because there are calls
to nf_ct_kill() which don't need accounting:

nf_conntrack_proto_tcp.c line ~847:
Kills ct and returns NF_REPEAT. We don't want to count twice.

nf_conntrack_proto_tcp.c line ~880:
Kills ct and returns NF_DROP. I think we don't want to count dropped
packets.

nf_conntrack_netlink.c line ~824:
As far as I can see ctnetlink_del_conntrack() is used to destroy a
conntrack on behalf of the user. There is an sk_buff, but I don't think
this is an actual packet. Incrementing counters here is therefore not
desired.
Signed-off-by: NFabian Hugelshofer <hugelshofer2006@gmx.ch>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 51091764
......@@ -223,7 +223,24 @@ static inline void nf_ct_refresh(struct nf_conn *ct,
__nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
}
extern void nf_ct_kill(struct nf_conn *ct);
extern void __nf_ct_kill_acct(struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
const struct sk_buff *skb,
int do_acct);
/* kill conntrack and do accounting */
static inline void nf_ct_kill_acct(struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
const struct sk_buff *skb)
{
__nf_ct_kill_acct(ct, ctinfo, skb, 1);
}
/* kill conntrack without accounting */
static inline void nf_ct_kill(struct nf_conn *ct)
{
__nf_ct_kill_acct(ct, 0, NULL, 0);
}
/* These are for NAT. Icky. */
/* Update TCP window tracking data when NAT mangles the packet */
......
......@@ -88,7 +88,7 @@ static int icmp_packet(struct nf_conn *ct,
(theoretically possible with SMP) */
if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
if (atomic_dec_and_test(&ct->proto.icmp.count))
nf_ct_kill(ct);
nf_ct_kill_acct(ct, ctinfo, skb);
} else {
atomic_inc(&ct->proto.icmp.count);
nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
......
......@@ -90,7 +90,7 @@ static int icmpv6_packet(struct nf_conn *ct,
(theoretically possible with SMP) */
if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
if (atomic_dec_and_test(&ct->proto.icmp.count))
nf_ct_kill(ct);
nf_ct_kill_acct(ct, ctinfo, skb);
} else {
atomic_inc(&ct->proto.icmp.count);
nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
......
......@@ -848,12 +848,24 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
}
EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
void nf_ct_kill(struct nf_conn *ct)
void __nf_ct_kill_acct(struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
const struct sk_buff *skb,
int do_acct)
{
#ifdef CONFIG_NF_CT_ACCT
if (do_acct) {
spin_lock_bh(&nf_conntrack_lock);
ct->counters[CTINFO2DIR(ctinfo)].packets++;
ct->counters[CTINFO2DIR(ctinfo)].bytes +=
skb->len - skb_network_offset(skb);
spin_unlock_bh(&nf_conntrack_lock);
}
#endif
if (del_timer(&ct->timeout))
ct->timeout.function((unsigned long)ct);
}
EXPORT_SYMBOL_GPL(nf_ct_kill);
EXPORT_SYMBOL_GPL(__nf_ct_kill_acct);
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
......
......@@ -475,7 +475,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
if (type == DCCP_PKT_RESET &&
!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
/* Tear down connection immediately if only reply is a RESET */
nf_ct_kill(ct);
nf_ct_kill_acct(ct, ctinfo, skb);
return NF_ACCEPT;
}
......
......@@ -959,7 +959,7 @@ static int tcp_packet(struct nf_conn *ct,
problem case, so we can delete the conntrack
immediately. --RR */
if (th->rst) {
nf_ct_kill(ct);
nf_ct_kill_acct(ct, ctinfo, skb);
return NF_ACCEPT;
}
} else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册