-
- Downloads
netfilter: accounting rework: ct_extend + 64bit counters (v4)
Initially netfilter has had 64bit counters for conntrack-based accounting, but it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are still required, for example for "connbytes" extension. However, 64bit counters waste a lot of memory and it was not possible to enable/disable it runtime. This patch: - reimplements accounting with respect to the extension infrastructure, - makes one global version of seq_print_acct() instead of two seq_print_counters(), - makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n), - makes it possible to enable/disable it at runtime by sysctl or sysfs, - extends counters from 32bit to 64bit, - renames ip_conntrack_counter -> nf_conn_counter, - enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT), - set initial accounting enable state based on CONFIG_NF_CT_ACCT - removes buggy IPCT_COUNTER_FILLING event handling. If accounting is enabled newly created connections get additional acct extend. Old connections are not changed as it is not possible to add a ct_extend area to confirmed conntrack. Accounting is performed for all connections with acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct". Signed-off-by:Krzysztof Piotr Oledzki <ole@ans.pl> Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
Showing
- Documentation/feature-removal-schedule.txt 10 additions, 0 deletionsDocumentation/feature-removal-schedule.txt
- Documentation/kernel-parameters.txt 7 additions, 0 deletionsDocumentation/kernel-parameters.txt
- include/linux/netfilter/nf_conntrack_common.h 1 addition, 7 deletionsinclude/linux/netfilter/nf_conntrack_common.h
- include/linux/netfilter/nfnetlink_conntrack.h 4 additions, 4 deletionsinclude/linux/netfilter/nfnetlink_conntrack.h
- include/net/netfilter/nf_conntrack.h 0 additions, 6 deletionsinclude/net/netfilter/nf_conntrack.h
- include/net/netfilter/nf_conntrack_acct.h 51 additions, 0 deletionsinclude/net/netfilter/nf_conntrack_acct.h
- include/net/netfilter/nf_conntrack_extend.h 2 additions, 0 deletionsinclude/net/netfilter/nf_conntrack_extend.h
- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c 3 additions, 15 deletionsnet/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
- net/netfilter/Kconfig 9 additions, 0 deletionsnet/netfilter/Kconfig
- net/netfilter/Makefile 1 addition, 1 deletionnet/netfilter/Makefile
- net/netfilter/nf_conntrack_acct.c 104 additions, 0 deletionsnet/netfilter/nf_conntrack_acct.c
- net/netfilter/nf_conntrack_core.c 26 additions, 13 deletionsnet/netfilter/nf_conntrack_core.c
- net/netfilter/nf_conntrack_netlink.c 21 additions, 23 deletionsnet/netfilter/nf_conntrack_netlink.c
- net/netfilter/nf_conntrack_standalone.c 3 additions, 15 deletionsnet/netfilter/nf_conntrack_standalone.c
- net/netfilter/xt_connbytes.c 6 additions, 2 deletionsnet/netfilter/xt_connbytes.c
Loading
Please register or sign in to comment