netfilter: add and use nf_ct_netns_get/put

currently aliased to try_module_get/_put.
Will be changed in next patch when we add functions to make use of ->net
argument to store usercount per l3proto tracker.

This is needed to avoid registering the conntrack hooks in all netns and
later only enable connection tracking in those that need conntrack.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index d9d52c020a709993fbbb02898ffe2931271a5ff7..5916aa9ab3f0070411f6c3eb2842fadcdb605510 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -181,6 +181,10 @@ static inline void nf_ct_put(struct nf_conn *ct)
 int nf_ct_l3proto_try_module_get(unsigned short l3proto);
 void nf_ct_l3proto_module_put(unsigned short l3proto);
 
+/* load module; enable/disable conntrack in this namespace */
+int nf_ct_netns_get(struct net *net, u8 nfproto);
+void nf_ct_netns_put(struct net *net, u8 nfproto);
+
 /*
  * Allocate a hashtable of hlist_head (if nulls == 0),
  * or hlist_nulls_head (if nulls == 1)

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e6e206fa86c84a0668fdd0eaa015a6ccc3998b45..21db00d0362bb60d48aed2c900b857f86cef5793 100644 (file)
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -419,7 +419,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
        }
        cipinfo->config = config;
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -444,7 +444,7 @@ static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
 
        clusterip_config_put(cipinfo->config);
 
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_get(par->net, par->family);
 }
 
 #ifdef CONFIG_COMPAT

diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 36141168822122ebe4fe3d044c183195d0f2ef88..30c0de53e2541b45c494830bf0fc2fc36b0b9d43 100644 (file)
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -418,12 +418,12 @@ static int synproxy_tg4_check(const struct xt_tgchk_param *par)
            e->ip.invflags & XT_INV_PROTO)
                return -EINVAL;
 
-       return nf_ct_l3proto_try_module_get(par->family);
+       return nf_ct_netns_get(par->net, par->family);
 }
 
 static void synproxy_tg4_destroy(const struct xt_tgdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_target synproxy_tg4_reg __read_mostly = {

diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index 99a1216287c8a00fd198edb0693117727891edec..98c8dd38575a35c0c3d243378cd516f23ca8d62d 100644 (file)
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -440,12 +440,12 @@ static int synproxy_tg6_check(const struct xt_tgchk_param *par)
            e->ipv6.invflags & XT_INV_PROTO)
                return -EINVAL;
 
-       return nf_ct_l3proto_try_module_get(par->family);
+       return nf_ct_netns_get(par->net, par->family);
 }
 
 static void synproxy_tg6_destroy(const struct xt_tgdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_target synproxy_tg6_reg __read_mostly = {

diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index b218e70b2f747586aa70d643770603755cec2829..948f1e2fc80b705a7a2f3309c069357e6064b9da 100644 (file)
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -125,6 +125,18 @@ void nf_ct_l3proto_module_put(unsigned short l3proto)
 }
 EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
 
+int nf_ct_netns_get(struct net *net, u8 nfproto)
+{
+       return nf_ct_l3proto_try_module_get(nfproto);
+}
+EXPORT_SYMBOL_GPL(nf_ct_netns_get);
+
+void nf_ct_netns_put(struct net *net, u8 nfproto)
+{
+       nf_ct_l3proto_module_put(nfproto);
+}
+EXPORT_SYMBOL_GPL(nf_ct_netns_put);
+
 struct nf_conntrack_l4proto *
 nf_ct_l4proto_find_get(u_int16_t l3num, u_int8_t l4num)
 {

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 6837348c8993b4f131b189423d4610377f9c2109..e6baeaebe6537ea6337d001faa58631ebf6e41b2 100644 (file)
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -208,37 +208,37 @@ static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
        [NFTA_CT_SREG]          = { .type = NLA_U32 },
 };
 
-static int nft_ct_l3proto_try_module_get(uint8_t family)
+static int nft_ct_netns_get(struct net *net, uint8_t family)
 {
        int err;
 
        if (family == NFPROTO_INET) {
-               err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
+               err = nf_ct_netns_get(net, NFPROTO_IPV4);
                if (err < 0)
                        goto err1;
-               err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
+               err = nf_ct_netns_get(net, NFPROTO_IPV6);
                if (err < 0)
                        goto err2;
        } else {
-               err = nf_ct_l3proto_try_module_get(family);
+               err = nf_ct_netns_get(net, family);
                if (err < 0)
                        goto err1;
        }
        return 0;
 
 err2:
-       nf_ct_l3proto_module_put(NFPROTO_IPV4);
+       nf_ct_netns_put(net, NFPROTO_IPV4);
 err1:
        return err;
 }
 
-static void nft_ct_l3proto_module_put(uint8_t family)
+static void nft_ct_netns_put(struct net *net, uint8_t family)
 {
        if (family == NFPROTO_INET) {
-               nf_ct_l3proto_module_put(NFPROTO_IPV4);
-               nf_ct_l3proto_module_put(NFPROTO_IPV6);
+               nf_ct_netns_put(net, NFPROTO_IPV4);
+               nf_ct_netns_put(net, NFPROTO_IPV6);
        } else
-               nf_ct_l3proto_module_put(family);
+               nf_ct_netns_put(net, family);
 }
 
 static int nft_ct_get_init(const struct nft_ctx *ctx,
@@ -342,7 +342,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
        if (err < 0)
                return err;
 
-       err = nft_ct_l3proto_try_module_get(ctx->afi->family);
+       err = nft_ct_netns_get(ctx->net, ctx->afi->family);
        if (err < 0)
                return err;
 
@@ -390,7 +390,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
        if (err < 0)
                goto err1;
 
-       err = nft_ct_l3proto_try_module_get(ctx->afi->family);
+       err = nft_ct_netns_get(ctx->net, ctx->afi->family);
        if (err < 0)
                goto err1;
 
@@ -405,7 +405,7 @@ err1:
 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
                               const struct nft_expr *expr)
 {
-       nft_ct_l3proto_module_put(ctx->afi->family);
+       nf_ct_netns_put(ctx->net, ctx->afi->family);
 }
 
 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
@@ -423,7 +423,7 @@ static void nft_ct_set_destroy(const struct nft_ctx *ctx,
                break;
        }
 
-       nft_ct_l3proto_module_put(ctx->afi->family);
+       nft_ct_netns_put(ctx->net, ctx->afi->family);
 }
 
 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)

diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index e04dc282e3bba104d361cbc07e450ffdf3c2c3a0..da56c06a443c0bcf0dd1e767b4d4848179a7ce73 100644 (file)
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -106,7 +106,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
                return -EINVAL;
        }
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -115,7 +115,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
 
 static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_target connsecmark_tg_reg __read_mostly = {

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 6669e68d589ee07782c54e9ef36a4a386dc348b1..95c75035874758ce56c8656b859204bf8f10e6cf 100644 (file)
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -216,7 +216,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
                goto err1;
 #endif
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                goto err1;
 
@@ -260,7 +260,7 @@ out:
 err3:
        nf_ct_tmpl_free(ct);
 err2:
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 err1:
        return ret;
 }
@@ -341,7 +341,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
                if (help)
                        module_put(help->helper->me);
 
-               nf_ct_l3proto_module_put(par->family);
+               nf_ct_netns_put(par->net, par->family);
 
                xt_ct_destroy_timeout(ct);
                nf_ct_put(info->ct);

diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c
index d4bec261e74e636e5a51c8ea95480f15bc61a1ab..cad0b7b5eb35654d066072d1b7cf31510e98aa45 100644 (file)
--- a/net/netfilter/xt_connbytes.c
+++ b/net/netfilter/xt_connbytes.c
@@ -110,7 +110,7 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par)
            sinfo->direction != XT_CONNBYTES_DIR_BOTH)
                return -EINVAL;
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -129,7 +129,7 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par)
 
 static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_match connbytes_mt_reg __read_mostly = {

diff --git a/net/netfilter/xt_connlabel.c b/net/netfilter/xt_connlabel.c
index 03d66f1c5e69069077fa65b76339554d7c56ee6d..7827128d5a95f5faf699d49c5dac796d03744a51 100644 (file)
--- a/net/netfilter/xt_connlabel.c
+++ b/net/netfilter/xt_connlabel.c
@@ -61,7 +61,7 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par)
                return -EINVAL;
        }
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0) {
                pr_info("cannot load conntrack support for proto=%u\n",
                                                        par->family);
@@ -70,14 +70,14 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par)
 
        ret = nf_connlabels_get(par->net, info->bit);
        if (ret < 0)
-               nf_ct_l3proto_module_put(par->family);
+               nf_ct_netns_put(par->net, par->family);
        return ret;
 }
 
 static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
 {
        nf_connlabels_put(par->net);
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_match connlabels_mt_reg __read_mostly = {

diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index bb3845339efd83803e243de0ff13d595227bd8ff..2aff2b7c4689c897be7c0250d5c514e5ee8014d5 100644 (file)
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -368,7 +368,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
 
        net_get_random_once(&connlimit_rnd, sizeof(connlimit_rnd));
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0) {
                pr_info("cannot load conntrack support for "
                        "address family %u\n", par->family);
@@ -378,7 +378,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
        /* init private data */
        info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);
        if (info->data == NULL) {
-               nf_ct_l3proto_module_put(par->family);
+               nf_ct_netns_put(par->net, par->family);
                return -ENOMEM;
        }
 
@@ -414,7 +414,7 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
        const struct xt_connlimit_info *info = par->matchinfo;
        unsigned int i;
 
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 
        for (i = 0; i < ARRAY_SIZE(info->data->climit_root4); ++i)
                destroy_tree(&info->data->climit_root4[i]);

diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index b83e158e116afc35f3a9ab7b739409b523cebb86..9935d5029b0e52735b45bca017e52dd72f593c1e 100644 (file)
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -77,7 +77,7 @@ static int connmark_tg_check(const struct xt_tgchk_param *par)
 {
        int ret;
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -86,7 +86,7 @@ static int connmark_tg_check(const struct xt_tgchk_param *par)
 
 static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static bool
@@ -107,7 +107,7 @@ static int connmark_mt_check(const struct xt_mtchk_param *par)
 {
        int ret;
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -116,7 +116,7 @@ static int connmark_mt_check(const struct xt_mtchk_param *par)
 
 static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_target connmark_tg_reg __read_mostly = {

diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 2dea15ebc55bbbc57baaed42cb8cbbe819733e0a..c0fb217bc64969bd0da2c656d4418f8c80b29d14 100644 (file)
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -271,7 +271,7 @@ static int conntrack_mt_check(const struct xt_mtchk_param *par)
 {
        int ret;
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -280,7 +280,7 @@ static int conntrack_mt_check(const struct xt_mtchk_param *par)
 
 static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_match conntrack_mt_reg[] __read_mostly = {

diff --git a/net/netfilter/xt_helper.c b/net/netfilter/xt_helper.c
index f679dd4c272a55691bf74ee09e29d6329def06e2..38a78151c0e99124b3071374b99897a1eefffdd5 100644 (file)
--- a/net/netfilter/xt_helper.c
+++ b/net/netfilter/xt_helper.c
@@ -59,7 +59,7 @@ static int helper_mt_check(const struct xt_mtchk_param *par)
        struct xt_helper_info *info = par->matchinfo;
        int ret;
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0) {
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -71,7 +71,7 @@ static int helper_mt_check(const struct xt_mtchk_param *par)
 
 static void helper_mt_destroy(const struct xt_mtdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_match helper_mt_reg __read_mostly = {

diff --git a/net/netfilter/xt_state.c b/net/netfilter/xt_state.c
index a507922d80cdc2854a141acde78e5410bf918a48..5746a33789a50ced02746d57403970872f2cf29f 100644 (file)
--- a/net/netfilter/xt_state.c
+++ b/net/netfilter/xt_state.c
@@ -43,7 +43,7 @@ static int state_mt_check(const struct xt_mtchk_param *par)
 {
        int ret;
 
-       ret = nf_ct_l3proto_try_module_get(par->family);
+       ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
@@ -52,7 +52,7 @@ static int state_mt_check(const struct xt_mtchk_param *par)
 
 static void state_mt_destroy(const struct xt_mtdtor_param *par)
 {
-       nf_ct_l3proto_module_put(par->family);
+       nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_match state_mt_reg __read_mostly = {