add support for zeroing counters at getting

Add support to zero counters conntrack at getting. Currently we can zero all the conntracks via zero and dump, but it could be useful more fine grain zeroing.

The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

Add support to zero counters conntrack at getting. Currently we can zero all the conntracks via zero and dump, but it could be useful more fine grain zeroing.

Signed-by-off: Pablo Neira Ayuso <[email protected]>

Index: net-2.6.git/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================
@@ -788,6 +788,12 @@ ctnetlink_get_conntrack(struct sock *ctn
 
 	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 
 				  IPCTNL_MSG_CT_NEW, 1, ct);
+
+#ifdef CONFIG_IP_NF_CT_ACCT
+	if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO) 
+		memset(&ct->counters, 0, sizeof(ct->counters));
+#endif
+	
 	ip_conntrack_put(ct);
 	if (err <= 0)
 		goto free;

This misses proper write locking, so we can get corruption with packets trying to increment the counter meanwhile.

Please try adding write locking, test it, and re-submit.

- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie