Re: nfacct: setting quotas does not seem to work.

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Aug 11, 2016 at 04:00:37PM +0200, Josue Alvarez wrote:
> Hi,
> 
> I tried to play a little bit with the quota features of the extended
> accounting infrastructure.
> However, it seemed that the quotas were not registered when creating the
> accounting objects.
> 
> Example :
> # nfacct add testquota packet 5
> # iptables -I OUTPUT -p icmp -m nfacct --nfacct-name testquota
> # nfacct get testquota
> { pkts = 00000000000000000000, bytes = 00000000000000000000 } = testquota;
> 
> When I ping the machine, I see the counters go above 5 packets, however I
> get no output when running :
> # nfacct monitor

I get this here:

{ pkts = 00000000000000000005, bytes = 00000000000000000420, quota =
00000000000000000005, mode = packet, overquota = yes } = testquota;

> After a little bit of investigation in the code of nfacct, I checked that
> the NFACCT_ATTR_FLAGS and NFACCT_ATTR_QUOTA attributes were set. (i managed
> to call _nfacct_cmd_add with flags=NFACCT_F_QUOTA_PKTS).
> 
> However, the kernel code in netfilter/net/nfnetlink_acct.c somehow did not
> "get" the flags : the execution didn't enter in the  "if (tb[NFACCT_FLAGS])
> { ... }" in nfnl_acct_new(). (checked that using printk).
> 
> Any idea how this could happen ?

Probably using an old kernel version with no quota support?