netfilter: nf_conntrack: prepare namespace support for l3 protocol trackers
This patch prepares the namespace support for layer 3 protocol trackers. Basically, this modifies the following interfaces: * nf_ct_l3proto_[un]register_sysctl. * nf_conntrack_l3proto_[un]register. We add a new nf_ct_l3proto_net is used to get the pernet data of l3proto. This adds rhe new struct nf_ip_net that is used to store the sysctl header and l3proto_ipv4,l4proto_tcp(6),l4proto_udp(6),l4proto_icmp(v6) because the protos such tcp and tcp6 use the same data,so making nf_ip_net as a field of netns_ct is the easiest way to manager it. This patch also adds init_net to struct nf_conntrack_l3proto to initial the layer 3 protocol pernet data. Acked-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
2c352f444c
commit
524a53e5ad
|
@ -69,6 +69,9 @@ struct nf_conntrack_l3proto {
|
||||||
struct ctl_table *ctl_table;
|
struct ctl_table *ctl_table;
|
||||||
#endif /* CONFIG_SYSCTL */
|
#endif /* CONFIG_SYSCTL */
|
||||||
|
|
||||||
|
/* Init l3proto pernet data */
|
||||||
|
int (*init_net)(struct net *net);
|
||||||
|
|
||||||
/* Module (if any) which this is connected to. */
|
/* Module (if any) which this is connected to. */
|
||||||
struct module *me;
|
struct module *me;
|
||||||
};
|
};
|
||||||
|
@ -76,8 +79,10 @@ struct nf_conntrack_l3proto {
|
||||||
extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];
|
extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];
|
||||||
|
|
||||||
/* Protocol registration. */
|
/* Protocol registration. */
|
||||||
extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
|
extern int nf_conntrack_l3proto_register(struct net *net,
|
||||||
extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);
|
struct nf_conntrack_l3proto *proto);
|
||||||
|
extern void nf_conntrack_l3proto_unregister(struct net *net,
|
||||||
|
struct nf_conntrack_l3proto *proto);
|
||||||
extern struct nf_conntrack_l3proto *nf_ct_l3proto_find_get(u_int16_t l3proto);
|
extern struct nf_conntrack_l3proto *nf_ct_l3proto_find_get(u_int16_t l3proto);
|
||||||
extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p);
|
extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p);
|
||||||
|
|
||||||
|
|
|
@ -20,6 +20,13 @@ struct nf_proto_net {
|
||||||
unsigned int users;
|
unsigned int users;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
struct nf_ip_net {
|
||||||
|
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
|
||||||
|
struct ctl_table_header *ctl_table_header;
|
||||||
|
struct ctl_table *ctl_table;
|
||||||
|
#endif
|
||||||
|
};
|
||||||
|
|
||||||
struct netns_ct {
|
struct netns_ct {
|
||||||
atomic_t count;
|
atomic_t count;
|
||||||
unsigned int expect_count;
|
unsigned int expect_count;
|
||||||
|
@ -40,6 +47,7 @@ struct netns_ct {
|
||||||
unsigned int sysctl_log_invalid; /* Log invalid packets */
|
unsigned int sysctl_log_invalid; /* Log invalid packets */
|
||||||
int sysctl_auto_assign_helper;
|
int sysctl_auto_assign_helper;
|
||||||
bool auto_assign_helper_warned;
|
bool auto_assign_helper_warned;
|
||||||
|
struct nf_ip_net nf_ct_proto;
|
||||||
#ifdef CONFIG_SYSCTL
|
#ifdef CONFIG_SYSCTL
|
||||||
struct ctl_table_header *sysctl_header;
|
struct ctl_table_header *sysctl_header;
|
||||||
struct ctl_table_header *acct_sysctl_header;
|
struct ctl_table_header *acct_sysctl_header;
|
||||||
|
|
|
@ -409,7 +409,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
|
||||||
goto cleanup_udp;
|
goto cleanup_udp;
|
||||||
}
|
}
|
||||||
|
|
||||||
ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv4);
|
ret = nf_conntrack_l3proto_register(&init_net, &nf_conntrack_l3proto_ipv4);
|
||||||
if (ret < 0) {
|
if (ret < 0) {
|
||||||
pr_err("nf_conntrack_ipv4: can't register ipv4\n");
|
pr_err("nf_conntrack_ipv4: can't register ipv4\n");
|
||||||
goto cleanup_icmp;
|
goto cleanup_icmp;
|
||||||
|
@ -432,7 +432,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
|
||||||
nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
|
nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
|
||||||
#endif
|
#endif
|
||||||
cleanup_ipv4:
|
cleanup_ipv4:
|
||||||
nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
|
nf_conntrack_l3proto_unregister(&init_net, &nf_conntrack_l3proto_ipv4);
|
||||||
cleanup_icmp:
|
cleanup_icmp:
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmp);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmp);
|
||||||
cleanup_udp:
|
cleanup_udp:
|
||||||
|
@ -451,7 +451,7 @@ static void __exit nf_conntrack_l3proto_ipv4_fini(void)
|
||||||
nf_conntrack_ipv4_compat_fini();
|
nf_conntrack_ipv4_compat_fini();
|
||||||
#endif
|
#endif
|
||||||
nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
|
nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
|
||||||
nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
|
nf_conntrack_l3proto_unregister(&init_net, &nf_conntrack_l3proto_ipv4);
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmp);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmp);
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_udp4);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_udp4);
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_tcp4);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_tcp4);
|
||||||
|
|
|
@ -358,7 +358,7 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
|
||||||
goto cleanup_udp;
|
goto cleanup_udp;
|
||||||
}
|
}
|
||||||
|
|
||||||
ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv6);
|
ret = nf_conntrack_l3proto_register(&init_net, &nf_conntrack_l3proto_ipv6);
|
||||||
if (ret < 0) {
|
if (ret < 0) {
|
||||||
pr_err("nf_conntrack_ipv6: can't register ipv6\n");
|
pr_err("nf_conntrack_ipv6: can't register ipv6\n");
|
||||||
goto cleanup_icmpv6;
|
goto cleanup_icmpv6;
|
||||||
|
@ -374,7 +374,7 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
cleanup_ipv6:
|
cleanup_ipv6:
|
||||||
nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
|
nf_conntrack_l3proto_unregister(&init_net, &nf_conntrack_l3proto_ipv6);
|
||||||
cleanup_icmpv6:
|
cleanup_icmpv6:
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmpv6);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmpv6);
|
||||||
cleanup_udp:
|
cleanup_udp:
|
||||||
|
@ -388,7 +388,7 @@ static void __exit nf_conntrack_l3proto_ipv6_fini(void)
|
||||||
{
|
{
|
||||||
synchronize_net();
|
synchronize_net();
|
||||||
nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
|
nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
|
||||||
nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
|
nf_conntrack_l3proto_unregister(&init_net, &nf_conntrack_l3proto_ipv6);
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmpv6);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_icmpv6);
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_udp6);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_udp6);
|
||||||
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_tcp6);
|
nf_conntrack_l4proto_unregister(&init_net, &nf_conntrack_l4proto_tcp6);
|
||||||
|
|
|
@ -168,31 +168,57 @@ static int kill_l4proto(struct nf_conn *i, void *data)
|
||||||
nf_ct_l3num(i) == l4proto->l3proto;
|
nf_ct_l3num(i) == l4proto->l3proto;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int nf_ct_l3proto_register_sysctl(struct nf_conntrack_l3proto *l3proto)
|
static struct nf_ip_net *nf_ct_l3proto_net(struct net *net,
|
||||||
|
struct nf_conntrack_l3proto *l3proto)
|
||||||
|
{
|
||||||
|
if (l3proto->l3proto == PF_INET)
|
||||||
|
return &net->ct.nf_ct_proto;
|
||||||
|
else
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int nf_ct_l3proto_register_sysctl(struct net *net,
|
||||||
|
struct nf_conntrack_l3proto *l3proto)
|
||||||
{
|
{
|
||||||
int err = 0;
|
int err = 0;
|
||||||
|
struct nf_ip_net *in = nf_ct_l3proto_net(net, l3proto);
|
||||||
|
/* nf_conntrack_l3proto_ipv6 doesn't support sysctl */
|
||||||
|
if (in == NULL)
|
||||||
|
return 0;
|
||||||
|
|
||||||
#ifdef CONFIG_SYSCTL
|
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
|
||||||
if (l3proto->ctl_table != NULL) {
|
if (in->ctl_table != NULL) {
|
||||||
err = nf_ct_register_sysctl(&init_net,
|
err = nf_ct_register_sysctl(net,
|
||||||
&l3proto->ctl_table_header,
|
&in->ctl_table_header,
|
||||||
l3proto->ctl_table_path,
|
l3proto->ctl_table_path,
|
||||||
l3proto->ctl_table, NULL);
|
in->ctl_table,
|
||||||
|
NULL);
|
||||||
|
if (err < 0) {
|
||||||
|
kfree(in->ctl_table);
|
||||||
|
in->ctl_table = NULL;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void nf_ct_l3proto_unregister_sysctl(struct nf_conntrack_l3proto *l3proto)
|
static void nf_ct_l3proto_unregister_sysctl(struct net *net,
|
||||||
|
struct nf_conntrack_l3proto *l3proto)
|
||||||
{
|
{
|
||||||
#ifdef CONFIG_SYSCTL
|
struct nf_ip_net *in = nf_ct_l3proto_net(net, l3proto);
|
||||||
if (l3proto->ctl_table_header != NULL)
|
|
||||||
nf_ct_unregister_sysctl(&l3proto->ctl_table_header,
|
if (in == NULL)
|
||||||
&l3proto->ctl_table, NULL);
|
return;
|
||||||
|
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
|
||||||
|
if (in->ctl_table_header != NULL)
|
||||||
|
nf_ct_unregister_sysctl(&in->ctl_table_header,
|
||||||
|
&in->ctl_table,
|
||||||
|
NULL);
|
||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
|
static int
|
||||||
|
nf_conntrack_l3proto_register_net(struct nf_conntrack_l3proto *proto)
|
||||||
{
|
{
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
struct nf_conntrack_l3proto *old;
|
struct nf_conntrack_l3proto *old;
|
||||||
|
@ -211,10 +237,6 @@ int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
|
||||||
goto out_unlock;
|
goto out_unlock;
|
||||||
}
|
}
|
||||||
|
|
||||||
ret = nf_ct_l3proto_register_sysctl(proto);
|
|
||||||
if (ret < 0)
|
|
||||||
goto out_unlock;
|
|
||||||
|
|
||||||
if (proto->nlattr_tuple_size)
|
if (proto->nlattr_tuple_size)
|
||||||
proto->nla_size = 3 * proto->nlattr_tuple_size();
|
proto->nla_size = 3 * proto->nlattr_tuple_size();
|
||||||
|
|
||||||
|
@ -223,13 +245,32 @@ int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
|
||||||
out_unlock:
|
out_unlock:
|
||||||
mutex_unlock(&nf_ct_proto_mutex);
|
mutex_unlock(&nf_ct_proto_mutex);
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
int nf_conntrack_l3proto_register(struct net *net,
|
||||||
|
struct nf_conntrack_l3proto *proto)
|
||||||
|
{
|
||||||
|
int ret = 0;
|
||||||
|
|
||||||
|
if (net == &init_net)
|
||||||
|
ret = nf_conntrack_l3proto_register_net(proto);
|
||||||
|
|
||||||
|
if (ret < 0)
|
||||||
|
return ret;
|
||||||
|
|
||||||
|
if (proto->init_net) {
|
||||||
|
ret = proto->init_net(net);
|
||||||
|
if (ret < 0)
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
return nf_ct_l3proto_register_sysctl(net, proto);
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_register);
|
EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_register);
|
||||||
|
|
||||||
void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
|
static void
|
||||||
|
nf_conntrack_l3proto_unregister_net(struct nf_conntrack_l3proto *proto)
|
||||||
{
|
{
|
||||||
struct net *net;
|
|
||||||
|
|
||||||
BUG_ON(proto->l3proto >= AF_MAX);
|
BUG_ON(proto->l3proto >= AF_MAX);
|
||||||
|
|
||||||
mutex_lock(&nf_ct_proto_mutex);
|
mutex_lock(&nf_ct_proto_mutex);
|
||||||
|
@ -238,15 +279,22 @@ void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
|
||||||
) != proto);
|
) != proto);
|
||||||
rcu_assign_pointer(nf_ct_l3protos[proto->l3proto],
|
rcu_assign_pointer(nf_ct_l3protos[proto->l3proto],
|
||||||
&nf_conntrack_l3proto_generic);
|
&nf_conntrack_l3proto_generic);
|
||||||
nf_ct_l3proto_unregister_sysctl(proto);
|
|
||||||
mutex_unlock(&nf_ct_proto_mutex);
|
mutex_unlock(&nf_ct_proto_mutex);
|
||||||
|
|
||||||
synchronize_rcu();
|
synchronize_rcu();
|
||||||
|
}
|
||||||
|
|
||||||
|
void nf_conntrack_l3proto_unregister(struct net *net,
|
||||||
|
struct nf_conntrack_l3proto *proto)
|
||||||
|
{
|
||||||
|
if (net == &init_net)
|
||||||
|
nf_conntrack_l3proto_unregister_net(proto);
|
||||||
|
|
||||||
|
nf_ct_l3proto_unregister_sysctl(net, proto);
|
||||||
|
|
||||||
/* Remove all contrack entries for this protocol */
|
/* Remove all contrack entries for this protocol */
|
||||||
rtnl_lock();
|
rtnl_lock();
|
||||||
for_each_net(net)
|
nf_ct_iterate_cleanup(net, kill_l3proto, proto);
|
||||||
nf_ct_iterate_cleanup(net, kill_l3proto, proto);
|
|
||||||
rtnl_unlock();
|
rtnl_unlock();
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
|
EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
|
||||||
|
|
Loading…
Reference in New Issue