--- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -158,6 +158,8 @@ struct nf_flow_table_hw { int nf_flow_table_hw_register(const struct nf_flow_table_hw *offload); void nf_flow_table_hw_unregister(const struct nf_flow_table_hw *offload); +void nf_flow_table_acct(struct flow_offload *flow, struct sk_buff *skb, int dir); + extern struct work_struct nf_flow_offload_hw_work; #define MODULE_ALIAS_NF_FLOWTABLE(family) \ --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -13,6 +13,7 @@ #include #include #include +#include struct flow_offload_entry { struct flow_offload flow; @@ -164,6 +165,22 @@ void flow_offload_free(struct flow_offlo } EXPORT_SYMBOL_GPL(flow_offload_free); +void nf_flow_table_acct(struct flow_offload *flow, struct sk_buff *skb, int dir) +{ + struct flow_offload_entry *entry; + struct nf_conn_acct *acct; + + entry = container_of(flow, struct flow_offload_entry, flow); + acct = nf_conn_acct_find(entry->ct); + if (acct) { + struct nf_conn_counter *counter = acct->counter; + + atomic64_inc(&counter[dir].packets); + atomic64_add(skb->len, &counter[dir].bytes); + } +} +EXPORT_SYMBOL_GPL(nf_flow_table_acct); + static u32 flow_offload_hash(const void *data, u32 len, u32 seed) { const struct flow_offload_tuple *tuple = data; --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -12,6 +12,7 @@ #include #include #include + /* For layer 4 checksum field offset. */ #include #include @@ -296,6 +297,7 @@ nf_flow_offload_ip_hook(void *priv, stru skb->dev = outdev; nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr); skb_dst_set_noref(skb, &rt->dst); + nf_flow_table_acct(flow, skb, dir); neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb); return NF_STOLEN; @@ -526,6 +528,7 @@ nf_flow_offload_ipv6_hook(void *priv, st skb->dev = outdev; nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); skb_dst_set_noref(skb, &rt->dst); + nf_flow_table_acct(flow, skb, dir); neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb); return NF_STOLEN;