netfilter: conntrack: remove ignore stats

This counter increments when nf_conntrack_in sees a packet that already
has a conntrack attached or when the packet is marked as UNTRACKED.
Neither is an error.

The former is normal for loopback traffic.  The second happens for
certain ICMPv6 packets or when nftables/ip(6)tables rules are in place.

In case someone needs to count UNTRACKED packets, or packets
that are marked as untracked before conntrack_in this can be done with
both nftables and ip(6)tables rules.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index 1db83c931d9c07470723e59e42f44e7ceb160b2d..96b90d7e361f339743c31d710e5ddca93be82a91 100644 (file)
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -8,7 +8,6 @@
 struct ip_conntrack_stat {
        unsigned int found;
        unsigned int invalid;
-       unsigned int ignore;
        unsigned int insert;
        unsigned int insert_failed;
        unsigned int drop;

diff --git a/include/uapi/linux/netfilter/nfnetlink_conntrack.h b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
index 262881792671baec5a8b0cd14dd271067225b3db..3e471558da82e4a4ec121dbf8677bed042ed0afe 100644 (file)
--- a/include/uapi/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
@@ -247,7 +247,7 @@ enum ctattr_stats_cpu {
        CTA_STATS_FOUND,
        CTA_STATS_NEW,          /* no longer used */
        CTA_STATS_INVALID,
-       CTA_STATS_IGNORE,
+       CTA_STATS_IGNORE,       /* no longer used */
        CTA_STATS_DELETE,       /* no longer used */
        CTA_STATS_DELETE_LIST,  /* no longer used */
        CTA_STATS_INSERT,

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3cfbafdff941a2d644440cd45362031b7a5a2388..a111bcf1b93c7f3ade21f8a809c42043d3e0ea04 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1800,10 +1800,8 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state)
        if (tmpl || ctinfo == IP_CT_UNTRACKED) {
                /* Previously seen (loopback or untracked)?  Ignore. */
                if ((tmpl && !nf_ct_is_template(tmpl)) ||
-                    ctinfo == IP_CT_UNTRACKED) {
-                       NF_CT_STAT_INC_ATOMIC(state->net, ignore);
+                    ctinfo == IP_CT_UNTRACKED)
                        return NF_ACCEPT;
-               }
                skb->_nfct = 0;
        }
 

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 832eabecfbddc4418e983e7d2c4846e3c2498c72..c64f23a8f373d030966020a974f2eae482c9b758 100644 (file)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2509,7 +2509,6 @@ ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
 
        if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
            nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||
-           nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||
            nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||
            nla_put_be32(skb, CTA_STATS_INSERT_FAILED,
                                htonl(st->insert_failed)) ||

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index a604f43e3e6bdbedfaee43bb1a70b02e2a1725e8..b673a03624d23c2d200295e04b747eb4949dc91e 100644 (file)
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -439,7 +439,7 @@ static int ct_cpu_seq_show(struct seq_file *seq, void *v)
                   st->found,
                   0,
                   st->invalid,
-                  st->ignore,
+                  0,
                   0,
                   0,
                   st->insert,