netfilter: nft_ct: add average bytes per packet support

Similar to xt_connbytes, user can match how many average bytes per packet
a connection has transferred so far.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 5726f90bfc2f7c876427e14cabbe3079ed5acee8..b00a05d1ee566f18ff07fc6a2cf73643081b87af 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -863,6 +863,7 @@ enum nft_rt_attributes {
  * @NFT_CT_LABELS: conntrack labels
  * @NFT_CT_PKTS: conntrack packets
  * @NFT_CT_BYTES: conntrack bytes
+ * @NFT_CT_AVGPKT: conntrack average bytes per packet
  */
 enum nft_ct_keys {
        NFT_CT_STATE,
@@ -881,6 +882,7 @@ enum nft_ct_keys {
        NFT_CT_LABELS,
        NFT_CT_PKTS,
        NFT_CT_BYTES,
+       NFT_CT_AVGPKT,
 };
 
 /**

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index e6baeaebe6537ea6337d001faa58631ebf6e41b2..d774d7823688378c89e577efc89773b25f8fa885 100644 (file)
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -129,6 +129,22 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                memcpy(dest, &count, sizeof(count));
                return;
        }
+       case NFT_CT_AVGPKT: {
+               const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
+               u64 avgcnt = 0, bcnt = 0, pcnt = 0;
+
+               if (acct) {
+                       pcnt = nft_ct_get_eval_counter(acct->counter,
+                                                      NFT_CT_PKTS, priv->dir);
+                       bcnt = nft_ct_get_eval_counter(acct->counter,
+                                                      NFT_CT_BYTES, priv->dir);
+                       if (pcnt != 0)
+                               avgcnt = div64_u64(bcnt, pcnt);
+               }
+
+               memcpy(dest, &avgcnt, sizeof(avgcnt));
+               return;
+       }
        case NFT_CT_L3PROTOCOL:
                *dest = nf_ct_l3num(ct);
                return;
@@ -316,6 +332,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
                break;
        case NFT_CT_BYTES:
        case NFT_CT_PKTS:
+       case NFT_CT_AVGPKT:
                /* no direction? return sum of original + reply */
                if (tb[NFTA_CT_DIRECTION] == NULL)
                        priv->dir = IP_CT_DIR_MAX;
@@ -346,7 +363,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
        if (err < 0)
                return err;
 
-       if (priv->key == NFT_CT_BYTES || priv->key == NFT_CT_PKTS)
+       if (priv->key == NFT_CT_BYTES ||
+           priv->key == NFT_CT_PKTS  ||
+           priv->key == NFT_CT_AVGPKT)
                nf_ct_set_acct(ctx->net, true);
 
        return 0;
@@ -445,6 +464,7 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
                break;
        case NFT_CT_BYTES:
        case NFT_CT_PKTS:
+       case NFT_CT_AVGPKT:
                if (priv->dir < IP_CT_DIR_MAX &&
                    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
                        goto nla_put_failure;