netfilter: flowtable: add counter support (53c2b289) · Commits · 戴 / test

include/net/netfilter/nf_flow_table.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -63,6 +63,7 @@ struct nf_flowtable_type {

		enum nf_flowtable_flags {
		NF_FLOWTABLE_HW_OFFLOAD = 0x1, /* NFT_FLOWTABLE_HW_OFFLOAD */
		NF_FLOWTABLE_COUNTER = 0x2, /* NFT_FLOWTABLE_COUNTER */
		};

		struct nf_flowtable {

+4 −1

Original line number	Diff line number	Diff line
		@@ -1557,10 +1557,13 @@ enum nft_object_attributes {
		* enum nft_flowtable_flags - nf_tables flowtable flags
		*
		* @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
		* @NFT_FLOWTABLE_COUNTER: enable flow counters
		*/
		enum nft_flowtable_flags {
		NFT_FLOWTABLE_HW_OFFLOAD = 0x1,
		NFT_FLOWTABLE_MASK = NFT_FLOWTABLE_HW_OFFLOAD
		NFT_FLOWTABLE_COUNTER = 0x2,
		NFT_FLOWTABLE_MASK = (NFT_FLOWTABLE_HW_OFFLOAD \|
		NFT_FLOWTABLE_COUNTER)
		};

		/**

+7 −0

Original line number	Diff line number	Diff line
		@@ -12,6 +12,7 @@
		#include <net/ip6_route.h>
		#include <net/neighbour.h>
		#include <net/netfilter/nf_flow_table.h>
		#include <net/netfilter/nf_conntrack_acct.h>
		/* For layer 4 checksum field offset. */
		#include <linux/tcp.h>
		#include <linux/udp.h>
		@@ -286,6 +287,9 @@ nf_flow_offload_ip_hook(void priv, struct sk_buff skb,
		ip_decrease_ttl(iph);
		skb->tstamp = 0;

		if (flow_table->flags & NF_FLOWTABLE_COUNTER)
		nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);

		if (unlikely(dst_xfrm(&rt->dst))) {
		memset(skb->cb, 0, sizeof(struct inet_skb_parm));
		IPCB(skb)->iif = skb->dev->ifindex;
		@@ -516,6 +520,9 @@ nf_flow_offload_ipv6_hook(void priv, struct sk_buff skb,
		ip6h->hop_limit--;
		skb->tstamp = 0;

		if (flow_table->flags & NF_FLOWTABLE_COUNTER)
		nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);

		if (unlikely(dst_xfrm(&rt->dst))) {
		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
		IP6CB(skb)->iif = skb->dev->ifindex;