nfacct: add timestamp option

This patch adds a timestamp option to the nfacct plugin.
If activated, nfacct output a timestamp which is computed just
after sending the nfacct request.

Signed-off-by: Eric Leblond <eric@regit.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/input/sum/ulogd_inpflow_NFACCT.c b/input/sum/ulogd_inpflow_NFACCT.c
index 7852b2784022685932766455ae325e7e8f455bd5..b022e6373406424ac2cfac94a2c2864569758e9d 100644 (file)
--- a/input/sum/ulogd_inpflow_NFACCT.c
+++ b/input/sum/ulogd_inpflow_NFACCT.c
@@ -30,6 +30,7 @@ struct nfacct_pluginstance {
        uint32_t                seq;
        struct ulogd_fd         ufd;
        struct ulogd_timer      timer;
+       struct timeval tv;
 };
 
 static struct config_keyset nfacct_kset = {
@@ -45,18 +46,27 @@ static struct config_keyset nfacct_kset = {
                        .type    = CONFIG_TYPE_INT,
                        .options = CONFIG_OPT_NONE,
                        .u.value = 1,
+               },
+               {
+                       .key     = "timestamp",
+                       .type    = CONFIG_TYPE_INT,
+                       .options = CONFIG_OPT_NONE,
+                       .u.value = 0,
                }
        },
-       .num_ces = 2,
+       .num_ces = 3,
 };
 #define pollint_ce(x)  (x->ces[0])
 #define zerocounter_ce(x) (x->ces[1])
+#define timestamp_ce(x) (x->ces[2])
 
 enum ulogd_nfacct_keys {
        ULOGD_NFACCT_NAME,
        ULOGD_NFACCT_PKTS,
        ULOGD_NFACCT_BYTES,
        ULOGD_NFACCT_RAW,
+       ULOGD_NFACCT_TIME_SEC,
+       ULOGD_NFACCT_TIME_USEC,
 };
 
 static struct ulogd_key nfacct_okeys[] = {
@@ -80,12 +90,23 @@ static struct ulogd_key nfacct_okeys[] = {
                .flags  = ULOGD_RETF_NONE,
                .name   = "sum",
        },
+       [ULOGD_NFACCT_TIME_SEC] = {
+               .type = ULOGD_RET_UINT32,
+               .flags = ULOGD_RETF_NONE,
+               .name = "oob.time.sec",
+       },
+       [ULOGD_NFACCT_TIME_USEC] = {
+               .type = ULOGD_RET_UINT32,
+               .flags = ULOGD_RETF_NONE,
+               .name = "oob.time.usec",
+       },
 };
 
 static void
 propagate_nfacct(struct ulogd_pluginstance *upi, struct nfacct *nfacct)
 {
        struct ulogd_key *ret = upi->output.keys;
+       struct nfacct_pluginstance *cpi = (struct nfacct_pluginstance *) upi->private;
 
        okey_set_ptr(&ret[ULOGD_NFACCT_NAME],
                        (void *)nfacct_attr_get_str(nfacct, NFACCT_ATTR_NAME));
@@ -95,6 +116,11 @@ propagate_nfacct(struct ulogd_pluginstance *upi, struct nfacct *nfacct)
                        nfacct_attr_get_u64(nfacct, NFACCT_ATTR_BYTES));
        okey_set_ptr(&ret[ULOGD_NFACCT_RAW], nfacct);
 
+       if (timestamp_ce(upi->config_kset).u.value != 0) {
+               okey_set_u32(&ret[ULOGD_NFACCT_TIME_SEC], cpi->tv.tv_sec);
+               okey_set_u32(&ret[ULOGD_NFACCT_TIME_USEC], cpi->tv.tv_usec);
+       }
+
        ulogd_propagate_results(upi);
 }
 
@@ -172,6 +198,10 @@ static int nfacct_send_request(struct ulogd_pluginstance *upi)
                ulogd_log(ULOGD_ERROR, "Cannot send netlink message\n");
                return -1;
        }
+       if (timestamp_ce(upi->config_kset).u.value != 0) {
+               /* Compute time of query */
+               gettimeofday(&cpi->tv, NULL);
+       }
        return 0;
 }
 

diff --git a/ulogd.conf.in b/ulogd.conf.in
index 0e4571496c30ebf0a5f352ceeca91bcccd179504..4c2e73fe0aeec2d13e202cced51011fc92f0686b 100644 (file)
--- a/ulogd.conf.in
+++ b/ulogd.conf.in
@@ -273,3 +273,6 @@ mark = 1
 pollinterval = 2
 # Set to zero to avoid zeroing counters after read
 #zerocounter = 0
+# Set timestamp (default is 0, which means not set). This timestamp can be
+# interpreted by the output plugin.
+#timestamp = 1