• Fabian Hugelshofer's avatar
    netfilter: nf_conntrack: properly account terminating packets · 718d4ad9
    Fabian Hugelshofer authored
    Currently the last packet of a connection isn't accounted when its causing
    abnormal termination.
    
    Introduces nf_ct_kill_acct() which increments the accounting counters on
    conntrack kill. The new function was necessary, because there are calls
    to nf_ct_kill() which don't need accounting:
    
    nf_conntrack_proto_tcp.c line ~847:
    Kills ct and returns NF_REPEAT. We don't want to count twice.
    
    nf_conntrack_proto_tcp.c line ~880:
    Kills ct and returns NF_DROP. I think we don't want to count dropped
    packets.
    
    nf_conntrack_netlink.c line ~824:
    As far as I can see ctnetlink_del_conntrack() is used to destroy a
    conntrack on behalf of the user. There is an sk_buff, but I don't think
    this is an actual packet. Incrementing counters here is therefore not
    desired.
    Signed-off-by: default avatarFabian Hugelshofer <hugelshofer2006@gmx.ch>
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    718d4ad9
nf_conntrack_proto_icmpv6.c 8.03 KB