Re: [PATCH 1/2] netfilter: add extended accounting infrastructure over nfnetlink

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Dec 14, 2011 at 12:16:48PM +0100, Eric Dumazet wrote:
> Le mercredi 14 décembre 2011 à 12:00 +0100, pablo@netfilter.org a
> écrit :
> > From: Pablo Neira Ayuso <pablo@netfilter.org>
> > 
> > We currently have two ways to account traffic in netfilter:
> > 
> > - iptables chain and rule counters:
> > 
> >  # iptables -L -n -v
> > Chain INPUT (policy DROP 3 packets, 867 bytes)
> >  pkts bytes target     prot opt in     out     source               destination
> >     8  1104 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
> > 
> > - use flow-based accounting provided by ctnetlink:
> > 
> >  # conntrack -L
> > tcp      6 431999 ESTABLISHED src=192.168.1.130 dst=212.106.219.168 sport=58152 dport=80 packets=47 bytes=7654 src=212.106.219.168 dst=192.168.1.130 sport=80 dport=58152 packets=49 bytes=66340 [ASSURED] mark=0 use=1
> > 
> > While trying to display real-time accounting statistics, we require
> > to pool the kernel periodically to obtain this information. This is
> > OK if the number of flows is relatively low. However, in case that
> > the number of flows is huge, we can spend a considerable amount of
> > cycles to iterate over the list of flows that have been obtained.
> > 
> > Moreover, if we want to obtain the sum of the flow accounting results
> > that match some criteria, we have to iterate over the whole list of
> > existing flows, look for matchings and update the counters.
> > 
> > This patch adds the extended accounting infrastructure for
> > nfnetlink which aims to allow displaying real-time traffic accounting
> > without the need of complicated and resource-consuming implementation
> > in user-space. Basically, this new infrastructure allows you to create
> > accounting objects. One accounting object is composed of packet and
> > byte counters.
> > 
> > In order to manipulate create accounting objects, you require the
> > new libnetfilter_acct library. It contains several examples of use:
> > 
> > libnetfilter_acct/examples# ./nfacct-add http-traffic
> > libnetfilter_acct/examples# ./nfacct-get
> > http-traffic = { pkts = 000000000000,   bytes = 000000000000 };
> > 
> > Then, you can use one of this accounting objects in several iptables
> > rules using the new NFACCT target (which comes in a follow-up patch):
> > 
> >  # iptables -I INPUT -p tcp --sport 80 -j NFACCT --nfacct-name http-traffic
> >  # iptables -I OUTPUT -p tcp --dport 80 -j NFACCT --nfacct-name http-traffic
> > 
> > The idea is simple: if one packet matches the rule, the NFACCT target
> > updates the counters.
> > 
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> >  include/linux/netfilter/Kbuild           |    1 +
> >  include/linux/netfilter/nfnetlink.h      |    3 +-
> >  include/linux/netfilter/nfnetlink_acct.h |   34 +++
> >  net/netfilter/Kconfig                    |    8 +
> >  net/netfilter/Makefile                   |    1 +
> >  net/netfilter/nfnetlink_acct.c           |  352 ++++++++++++++++++++++++++++++
> >  6 files changed, 398 insertions(+), 1 deletions(-)
> >  create mode 100644 include/linux/netfilter/nfnetlink_acct.h
> >  create mode 100644 net/netfilter/nfnetlink_acct.c
> > 
> > diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
> > index a1b410c..8995867 100644
> > --- a/include/linux/netfilter/Kbuild
> > +++ b/include/linux/netfilter/Kbuild
> > @@ -6,6 +6,7 @@ header-y += nf_conntrack_sctp.h
> >  header-y += nf_conntrack_tcp.h
> >  header-y += nf_conntrack_tuple_common.h
> >  header-y += nfnetlink.h
> > +header-y += nfnetlink_acct.h
> >  header-y += nfnetlink_compat.h
> >  header-y += nfnetlink_conntrack.h
> >  header-y += nfnetlink_log.h
> > diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
> > index 74d3386..b64454c 100644
> > --- a/include/linux/netfilter/nfnetlink.h
> > +++ b/include/linux/netfilter/nfnetlink.h
> > @@ -48,7 +48,8 @@ struct nfgenmsg {
> >  #define NFNL_SUBSYS_ULOG		4
> >  #define NFNL_SUBSYS_OSF			5
> >  #define NFNL_SUBSYS_IPSET		6
> > -#define NFNL_SUBSYS_COUNT		7
> > +#define NFNL_SUBSYS_ACCT		7
> > +#define NFNL_SUBSYS_COUNT		8
> >  
> >  #ifdef __KERNEL__
> >  
> > diff --git a/include/linux/netfilter/nfnetlink_acct.h b/include/linux/netfilter/nfnetlink_acct.h
> > new file mode 100644
> > index 0000000..9a1a119
> > --- /dev/null
> > +++ b/include/linux/netfilter/nfnetlink_acct.h
> > @@ -0,0 +1,34 @@
> > +#ifndef _NFNL_ACCT_H_
> > +#define _NFNL_ACCT_H_
> > +#include <linux/netfilter/nfnetlink.h>
> > +
> > +#define NFACCT_NAME_MAX		64
> > +
> > +enum nfnl_acct_msg_types {
> > +	NFNL_MSG_ACCT_NEW,
> > +	NFNL_MSG_ACCT_GET,
> > +	NFNL_MSG_ACCT_GET_CTRZERO,
> > +	NFNL_MSG_ACCT_DEL,
> > +	NFNL_MSG_ACCT_MAX
> > +};
> > +
> > +enum nfnl_acct_type {
> > +	NFACCT_UNSPEC,
> > +	NFACCT_NAME,
> > +	NFACCT_PKTS,
> > +	NFACCT_BYTES,
> > +	__NFACCT_MAX
> > +};
> > +#define NFACCT_MAX (__NFACCT_MAX - 1)
> > +
> > +#ifdef __KERNEL__
> > +
> > +struct nf_acct;
> > +
> > +extern struct nf_acct *nfnl_acct_find_get(const char *filter_name);
> > +extern void nfnl_acct_put(struct nf_acct *acct);
> > +extern void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);
> > +
> > +#endif /* __KERNEL__ */
> > +
> > +#endif /* _NFNL_ACCT_H */
> > diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> > index d5597b7..77326ac 100644
> > --- a/net/netfilter/Kconfig
> > +++ b/net/netfilter/Kconfig
> > @@ -4,6 +4,14 @@ menu "Core Netfilter Configuration"
> >  config NETFILTER_NETLINK
> >  	tristate
> >  
> > +config NETFILTER_NETLINK_ACCT
> > +tristate "Netfilter NFACCT over NFNETLINK interface"
> > +	depends on NETFILTER_ADVANCED
> > +	select NETFILTER_NETLINK
> > +	help
> > +	  If this option is enabled, the kernel will include support
> > +	  for extended accounting via NFNETLINK.
> > +
> >  config NETFILTER_NETLINK_QUEUE
> >  	tristate "Netfilter NFQUEUE over NFNETLINK interface"
> >  	depends on NETFILTER_ADVANCED
> > diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
> > index 1a02853..4da1c87 100644
> > --- a/net/netfilter/Makefile
> > +++ b/net/netfilter/Makefile
> > @@ -7,6 +7,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
> >  obj-$(CONFIG_NETFILTER) = netfilter.o
> >  
> >  obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o
> > +obj-$(CONFIG_NETFILTER_NETLINK_ACCT) += nfnetlink_acct.o
> >  obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o
> >  obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
> >  
> > diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
> > new file mode 100644
> > index 0000000..3ec407f
> > --- /dev/null
> > +++ b/net/netfilter/nfnetlink_acct.c
> > @@ -0,0 +1,352 @@
> > +/*
> > + * (C) 2011 Pablo Neira Ayuso <pablo@netfilter.org>
> > + * (C) 2011 Intra2net AG <http://www.intra2net.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU General Public License version 2 as
> > + * published by the Free Software Foundation (or any later at your option).
> > + */
> > +#include <linux/init.h>
> > +#include <linux/module.h>
> > +#include <linux/kernel.h>
> > +#include <linux/skbuff.h>
> > +#include <linux/netlink.h>
> > +#include <linux/rculist.h>
> > +#include <linux/slab.h>
> > +#include <linux/types.h>
> > +#include <linux/errno.h>
> > +#include <net/netlink.h>
> > +#include <net/sock.h>
> > +#include <asm/atomic.h>
> > +
> > +#include <linux/netfilter.h>
> > +#include <linux/netfilter/nfnetlink.h>
> > +#include <linux/netfilter/nfnetlink_acct.h>
> > +
> > +MODULE_LICENSE("GPL");
> > +MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
> > +MODULE_DESCRIPTION("nfacct: Extended Netfilter accounting infrastructure");
> > +
> > +static LIST_HEAD(nfnl_acct_list);
> > +
> > +struct nf_acct {
> > +	struct rcu_head		rcu_head;
> > +	struct list_head	head;
> > +	spinlock_t		lock;	/* to update the counters. */
> > +	atomic_t		refcnt;
> > +
> > +	char			name[NFACCT_NAME_MAX];
> > +	__u64			pkts;
> > +	__u64			bytes;
> 
> atomic64_t ?
>
> This would remove use of spinlock in fast path

Good idea :-).

Not related to this, but we can also replace this in the connection
tracking system.

> Also, you put lock and pkts,bytes in different cache lines :(

Sorry, I added the locking in a later stage while in the rush, I
completely missed this.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html