Commit 80250707 authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by Patrick McHardy

netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_count sysctl

Note, sysctl table is always duplicated, this is simpler and less
special-cased.
Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 8e9df801
...@@ -4,6 +4,7 @@ ...@@ -4,6 +4,7 @@
#include <linux/list.h> #include <linux/list.h>
#include <asm/atomic.h> #include <asm/atomic.h>
struct ctl_table_header;
struct nf_conntrack_ecache; struct nf_conntrack_ecache;
struct netns_ct { struct netns_ct {
...@@ -15,6 +16,9 @@ struct netns_ct { ...@@ -15,6 +16,9 @@ struct netns_ct {
struct ip_conntrack_stat *stat; struct ip_conntrack_stat *stat;
#ifdef CONFIG_NF_CONNTRACK_EVENTS #ifdef CONFIG_NF_CONNTRACK_EVENTS
struct nf_conntrack_ecache *ecache; struct nf_conntrack_ecache *ecache;
#endif
#ifdef CONFIG_SYSCTL
struct ctl_table_header *sysctl_header;
#endif #endif
int hash_vmalloc; int hash_vmalloc;
int expect_vmalloc; int expect_vmalloc;
......
...@@ -330,7 +330,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_checksum); ...@@ -330,7 +330,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
static int log_invalid_proto_min = 0; static int log_invalid_proto_min = 0;
static int log_invalid_proto_max = 255; static int log_invalid_proto_max = 255;
static struct ctl_table_header *nf_ct_sysctl_header;
static struct ctl_table_header *nf_ct_netfilter_header; static struct ctl_table_header *nf_ct_netfilter_header;
static ctl_table nf_ct_sysctl_table[] = { static ctl_table nf_ct_sysctl_table[] = {
...@@ -409,40 +408,58 @@ static struct ctl_path nf_ct_path[] = { ...@@ -409,40 +408,58 @@ static struct ctl_path nf_ct_path[] = {
EXPORT_SYMBOL_GPL(nf_ct_log_invalid); EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
static int nf_conntrack_standalone_init_sysctl(void) static int nf_conntrack_standalone_init_sysctl(struct net *net)
{ {
nf_ct_netfilter_header = struct ctl_table *table;
register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
if (!nf_ct_netfilter_header) if (net_eq(net, &init_net)) {
goto out; nf_ct_netfilter_header =
register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
nf_ct_sysctl_header = if (!nf_ct_netfilter_header)
register_sysctl_paths(nf_net_netfilter_sysctl_path, goto out;
nf_ct_sysctl_table); }
if (!nf_ct_sysctl_header)
table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
GFP_KERNEL);
if (!table)
goto out_kmemdup;
table[1].data = &net->ct.count;
net->ct.sysctl_header = register_net_sysctl_table(net,
nf_net_netfilter_sysctl_path, table);
if (!net->ct.sysctl_header)
goto out_unregister_netfilter; goto out_unregister_netfilter;
return 0; return 0;
out_unregister_netfilter: out_unregister_netfilter:
unregister_sysctl_table(nf_ct_netfilter_header); kfree(table);
out_kmemdup:
if (net_eq(net, &init_net))
unregister_sysctl_table(nf_ct_netfilter_header);
out: out:
printk("nf_conntrack: can't register to sysctl.\n"); printk("nf_conntrack: can't register to sysctl.\n");
return -ENOMEM; return -ENOMEM;
} }
static void nf_conntrack_standalone_fini_sysctl(void) static void nf_conntrack_standalone_fini_sysctl(struct net *net)
{ {
unregister_sysctl_table(nf_ct_netfilter_header); struct ctl_table *table;
unregister_sysctl_table(nf_ct_sysctl_header);
if (net_eq(net, &init_net))
unregister_sysctl_table(nf_ct_netfilter_header);
table = net->ct.sysctl_header->ctl_table_arg;
unregister_net_sysctl_table(net->ct.sysctl_header);
kfree(table);
} }
#else #else
static int nf_conntrack_standalone_init_sysctl(void) static int nf_conntrack_standalone_init_sysctl(struct net *net)
{ {
return 0; return 0;
} }
static void nf_conntrack_standalone_fini_sysctl(void) static void nf_conntrack_standalone_fini_sysctl(struct net *net)
{ {
} }
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
...@@ -457,8 +474,13 @@ static int nf_conntrack_net_init(struct net *net) ...@@ -457,8 +474,13 @@ static int nf_conntrack_net_init(struct net *net)
ret = nf_conntrack_standalone_init_proc(net); ret = nf_conntrack_standalone_init_proc(net);
if (ret < 0) if (ret < 0)
goto out_proc; goto out_proc;
ret = nf_conntrack_standalone_init_sysctl(net);
if (ret < 0)
goto out_sysctl;
return 0; return 0;
out_sysctl:
nf_conntrack_standalone_fini_proc(net);
out_proc: out_proc:
nf_conntrack_cleanup(net); nf_conntrack_cleanup(net);
out_init: out_init:
...@@ -467,6 +489,7 @@ out_init: ...@@ -467,6 +489,7 @@ out_init:
static void nf_conntrack_net_exit(struct net *net) static void nf_conntrack_net_exit(struct net *net)
{ {
nf_conntrack_standalone_fini_sysctl(net);
nf_conntrack_standalone_fini_proc(net); nf_conntrack_standalone_fini_proc(net);
nf_conntrack_cleanup(net); nf_conntrack_cleanup(net);
} }
...@@ -478,25 +501,11 @@ static struct pernet_operations nf_conntrack_net_ops = { ...@@ -478,25 +501,11 @@ static struct pernet_operations nf_conntrack_net_ops = {
static int __init nf_conntrack_standalone_init(void) static int __init nf_conntrack_standalone_init(void)
{ {
int ret; return register_pernet_subsys(&nf_conntrack_net_ops);
ret = register_pernet_subsys(&nf_conntrack_net_ops);
if (ret < 0)
goto out;
ret = nf_conntrack_standalone_init_sysctl();
if (ret < 0)
goto out_sysctl;
return 0;
out_sysctl:
unregister_pernet_subsys(&nf_conntrack_net_ops);
out:
return ret;
} }
static void __exit nf_conntrack_standalone_fini(void) static void __exit nf_conntrack_standalone_fini(void)
{ {
nf_conntrack_standalone_fini_sysctl();
unregister_pernet_subsys(&nf_conntrack_net_ops); unregister_pernet_subsys(&nf_conntrack_net_ops);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment