01 Jan, 2012

1 commit

• 3ab0b245a   netfilter: nfnetlink_acct: fix nfnl_acct_get operation ... Browse Code »

  The get operation was not sending the message that was built to
  user-space. This patch also includes the appropriate handling for
  the return value of netlink_unicast().

  Moreover, fix error codes on error (for example, for non-existing
  entry was uncorrect).

  Signed-off-by: Pablo Neira Ayuso

  Pablo Neira Ayuso

  2012-01-01 23:36:08 +0800  

25 Dec, 2011

1 commit

• 941390279   netfilter: add extended accounting infrastructure over nfnetlink ... Browse Code »

  We currently have two ways to account traffic in netfilter:

  - iptables chain and rule counters:

  # iptables -L -n -v
  Chain INPUT (policy DROP 3 packets, 867 bytes)
  pkts bytes target prot opt in out source destination
  8 1104 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0

  - use flow-based accounting provided by ctnetlink:

  # conntrack -L
  tcp 6 431999 ESTABLISHED src=192.168.1.130 dst=212.106.219.168 sport=58152 dport=80 packets=47 bytes=7654 src=212.106.219.168 dst=192.168.1.130 sport=80 dport=58152 packets=49 bytes=66340 [ASSURED] mark=0 use=1

  While trying to display real-time accounting statistics, we require
  to pool the kernel periodically to obtain this information. This is
  OK if the number of flows is relatively low. However, in case that
  the number of flows is huge, we can spend a considerable amount of
  cycles to iterate over the list of flows that have been obtained.

  Moreover, if we want to obtain the sum of the flow accounting results
  that match some criteria, we have to iterate over the whole list of
  existing flows, look for matchings and update the counters.

  This patch adds the extended accounting infrastructure for
  nfnetlink which aims to allow displaying real-time traffic accounting
  without the need of complicated and resource-consuming implementation
  in user-space. Basically, this new infrastructure allows you to create
  accounting objects. One accounting object is composed of packet and
  byte counters.

  In order to manipulate create accounting objects, you require the
  new libnetfilter_acct library. It contains several examples of use:

  libnetfilter_acct/examples# ./nfacct-add http-traffic
  libnetfilter_acct/examples# ./nfacct-get
  http-traffic = { pkts = 000000000000, bytes = 000000000000 };

  Then, you can use one of this accounting objects in several iptables
  rules using the new nfacct match (which comes in a follow-up patch):

  # iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic
  # iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic

  The idea is simple: if one packet matches the rule, the nfacct match
  updates the counters.

  Thanks to Patrick McHardy, Eric Dumazet, Changli Gao for reviewing and
  providing feedback for this contribution.

  Signed-off-by: Pablo Neira Ayuso

  Pablo Neira Ayuso

  2011-12-25 09:43:03 +0800