[PATCH 1/4] implement get and zero counters

[PATCH 1/4] implement get and zero counters

[Pablo Neira]

[-- Attachment #1: Type: text/plain, Size: 363 bytes --]

Add support to zero counters conntrack at getting. Currently we can zero
all the conntracks via "zero and dump", but it could be useful more fine
grain zeroing.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

[-- Attachment #2: 03-zeroing.patch --]
[-- Type: text/plain, Size: 1481 bytes --]

Add support to zero counters conntrack at getting.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Index: netfilter-2.6.14.git/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================
--- netfilter-2.6.14.git.orig/net/ipv4/netfilter/ip_conntrack_netlink.c	2005-11-09 19:15:25.000000000 +0100
+++ netfilter-2.6.14.git/net/ipv4/netfilter/ip_conntrack_netlink.c	2005-11-09 19:28:00.000000000 +0100
@@ -770,25 +770,31 @@ ctnetlink_get_conntrack(struct sock *ctn
 	if (err < 0)
 		return err;
 
-	h = ip_conntrack_find_get(&tuple, NULL);
+	write_lock_bh(&ip_conntrack_lock);
+	h = __ip_conntrack_find(&tuple, NULL);
 	if (!h) {
 		DEBUGP("tuple not found in conntrack hash");
+		write_unlock_bh(&ip_conntrack_lock);
 		return -ENOENT;
 	}
 	DEBUGP("tuple found\n");
 	ct = tuplehash_to_ctrack(h);
 
 	err = -ENOMEM;
-	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
+	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
 	if (!skb2) {
-		ip_conntrack_put(ct);
+		write_unlock_bh(&ip_conntrack_lock);
 		return -ENOMEM;
 	}
 	NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
 
 	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 
 				  IPCTNL_MSG_CT_NEW, 1, ct);
-	ip_conntrack_put(ct);
+#ifdef CONFIG_IP_NF_CT_ACCT
+	if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO) 
+		memset(&ct->counters, 0, sizeof(ct->counters));
+#endif
+	write_unlock_bh(&ip_conntrack_lock);
 	if (err <= 0)
 		goto free;
 

Re: [PATCH 1/4] implement get and zero counters

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 741 bytes --]

On Thu, Nov 10, 2005 at 02:04:04AM +0100, Pablo Neira wrote:
> Add support to zero counters conntrack at getting. Currently we can zero
> all the conntracks via "zero and dump", but it could be useful more fine
> grain zeroing.

but do we really want to add this feature at the expense of _always_
grabbing a write lock on ip_conntrack_lock?  I don't think so.

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [PATCH 1/4] implement get and zero counters

[Pablo Neira]

Harald Welte wrote:
> On Thu, Nov 10, 2005 at 02:04:04AM +0100, Pablo Neira wrote:
> 
>>Add support to zero counters conntrack at getting. Currently we can zero
>>all the conntracks via "zero and dump", but it could be useful more fine
>>grain zeroing.
> 
> but do we really want to add this feature at the expense of _always_
> grabbing a write lock on ip_conntrack_lock?  I don't think so.

OK, in that case I'll rework patch and send it to you soon.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris