Skip to contentSkip to conversation

implement get and zero counters

PATCH Applied Pablo Neira 2 participants 3 messages Nov 10, 2005 – Nov 12, 2005

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Pablo Neira

author maintainer
#0 lore raw

PATCH 1/4 implement get and zero counters

Add support to zero counters conntrack at getting. Currently we can zero all the conntracks via "zero and dump", but it could be useful more fine grain zeroing.

Signed-off-by Pablo Neira Ayuso <[email protected]>
Signature · 2 lines
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

Add support to zero counters conntrack at getting.

Signed-off-by Pablo Neira Ayuso <[email protected]>
net/ipv4/netfilter/ip_conntrack_netlink.c +10 -4
Index: netfilter-2.6.14.git/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================
@@ -770,25 +770,31 @@ ctnetlink_get_conntrack(struct sock *ctn
 	if (err < 0)
 		return err;
 
-	h = ip_conntrack_find_get(&tuple, NULL);
+	write_lock_bh(&ip_conntrack_lock);
+	h = __ip_conntrack_find(&tuple, NULL);
 	if (!h) {
 		DEBUGP("tuple not found in conntrack hash");
+		write_unlock_bh(&ip_conntrack_lock);
 		return -ENOENT;
 	}
 	DEBUGP("tuple found\n");
 	ct = tuplehash_to_ctrack(h);
 
 	err = -ENOMEM;
-	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
+	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
 	if (!skb2) {
-		ip_conntrack_put(ct);
+		write_unlock_bh(&ip_conntrack_lock);
 		return -ENOMEM;
 	}
 	NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
 
 	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 
 				  IPCTNL_MSG_CT_NEW, 1, ct);
-	ip_conntrack_put(ct);
+#ifdef CONFIG_IP_NF_CT_ACCT
+	if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO) 
+		memset(&ct->counters, 0, sizeof(ct->counters));
+#endif
+	write_unlock_bh(&ip_conntrack_lock);
 	if (err <= 0)
 		goto free;
#1 lore raw
Quoted 3 lines · Pablo Neira

Add support to zero counters conntrack at getting. Currently we can zero all the conntracks via "zero and dump", but it could be useful more fine grain zeroing.

but do we really want to add this feature at the expense of _always_ grabbing a write lock on ip_conntrack_lock? I don't think so.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie
author maintainer
#2 lore raw
Quoted 8 lines · Harald Welte
Quoted 3 lines · Pablo Neira

Add support to zero counters conntrack at getting. Currently we can zero all the conntracks via "zero and dump", but it could be useful more fine grain zeroing.

but do we really want to add this feature at the expense of _always_ grabbing a write lock on ip_conntrack_lock? I don't think so.

OK, in that case I'll rework patch and send it to you soon.

Signature · 2 lines
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris