netfilter: remove nf_ct_is_untracked

This function is now obsolete and always returns false.
This change has no effect on generated code.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 9a75d9933e6362cfb8f46ae853371f8524068713..632082300e77f0fc012a35fc7e880e5bacb49da8 100644 (file)
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1555,7 +1555,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb)
        enum ip_conntrack_info ctinfo;
        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 
-       if (!ct || !nf_ct_is_untracked(ct)) {
+       if (ct) {
                nf_conntrack_put(&ct->ct_general);
                nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
        }
@@ -1616,7 +1616,7 @@ static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp,
        if (!(cp->flags & IP_VS_CONN_F_NFCT))
                return false;
        ct = nf_ct_get(skb, &ctinfo);
-       if (ct && !nf_ct_is_untracked(ct))
+       if (ct)
                return true;
 #endif
        return false;

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 012b99f563e536ee60f536a89522a713cebcec38..4978a82b75fa068f53f17703293b8e68f25507ef 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -273,11 +273,6 @@ static inline int nf_ct_is_dying(const struct nf_conn *ct)
        return test_bit(IPS_DYING_BIT, &ct->status);
 }
 
-static inline int nf_ct_is_untracked(const struct nf_conn *ct)
-{
-       return false;
-}
-
 /* Packet is received from loopback */
 static inline bool nf_is_loopback_packet(const struct sk_buff *skb)
 {

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 84ec7ca5f195db411b7e07c6dce641a286b5ea0a..81d7f8a3094557c3cd518be809c524b4448bbe1b 100644 (file)
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -65,7 +65,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
        struct nf_conn *ct = (struct nf_conn *)skb_nfct(skb);
        int ret = NF_ACCEPT;
 
-       if (ct && !nf_ct_is_untracked(ct)) {
+       if (ct) {
                if (!nf_ct_is_confirmed(ct))
                        ret = __nf_conntrack_confirm(skb);
                if (likely(ret == NF_ACCEPT))

diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index 6f5e8d01b876933a68e5f6cf8b2a48f8c4e17262..e3bfa6a169f004c7e505641bb1b79fac56bf6675 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -264,10 +264,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
        if (!ct)
                return NF_ACCEPT;
 
-       /* Don't try to NAT if this packet is not conntracked */
-       if (nf_ct_is_untracked(ct))
-               return NF_ACCEPT;
-
        nat = nf_ct_nat_ext_add(ct);
        if (nat == NULL)
                return NF_ACCEPT;

diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c
index a83d558e1aaed62b6bce05d9cce36405b0c210ef..e9293bdebba04f5b329cd4fd4a6b5b676ade5988 100644 (file)
--- a/net/ipv4/netfilter/nf_socket_ipv4.c
+++ b/net/ipv4/netfilter/nf_socket_ipv4.c
@@ -139,7 +139,7 @@ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,
         * SNAT-ted connection.
         */
        ct = nf_ct_get(skb, &ctinfo);
-       if (ct && !nf_ct_is_untracked(ct) &&
+       if (ct &&
            ((iph->protocol != IPPROTO_ICMP &&
              ctinfo == IP_CT_ESTABLISHED_REPLY) ||
             (iph->protocol == IPPROTO_ICMP &&

diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index e0be97e636a48f54c1488ca70ae97a9a13e8be61..922b5aef273c3e05c2025b951df30508f2ca1992 100644 (file)
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -273,10 +273,6 @@ nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
        if (!ct)
                return NF_ACCEPT;
 
-       /* Don't try to NAT if this packet is not conntracked */
-       if (nf_ct_is_untracked(ct))
-               return NF_ACCEPT;
-
        nat = nf_ct_nat_ext_add(ct);
        if (nat == NULL)
                return NF_ACCEPT;

diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 1e589f8644ca85d733867f7373eafa9126b0bd72..af3a9bbdf2ae24e1ccdc47fe0b4cf3ff3e498fe6 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -260,9 +260,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                buf_len = strlen(buf);
 
                ct = nf_ct_get(skb, &ctinfo);
-               if (ct && !nf_ct_is_untracked(ct) && (ct->status & IPS_NAT_MASK)) {
+               if (ct && nfct_nat(ct)) {
                        bool mangled;
-
                        /* If mangling fails this function will return 0
                         * which will cause the packet to be dropped.
                         * Mangling can only fail under memory pressure,

diff --git a/net/netfilter/ipvs/ip_vs_nfct.c b/net/netfilter/ipvs/ip_vs_nfct.c
index fc230d99aa3b0143f198d7a9ec798344886058ad..6cf3fd81a5eca887ccefe628c2b9d627b40cf055 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_nfct.c
+++ b/net/netfilter/ipvs/ip_vs_nfct.c
@@ -85,7 +85,7 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin)
        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
        struct nf_conntrack_tuple new_tuple;
 
-       if (ct == NULL || nf_ct_is_confirmed(ct) || nf_ct_is_untracked(ct) ||
+       if (ct == NULL || nf_ct_is_confirmed(ct) ||
            nf_ct_is_dying(ct))
                return;
 
@@ -232,7 +232,7 @@ void ip_vs_nfct_expect_related(struct sk_buff *skb, struct nf_conn *ct,
 {
        struct nf_conntrack_expect *exp;
 
-       if (ct == NULL || nf_ct_is_untracked(ct))
+       if (ct == NULL)
                return;
 
        exp = nf_ct_expect_alloc(ct);

diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 4e1a98fcc8c3faa3fd037cc0516fd8a3108ab2a9..2eab1e0400f48a5816239cbb95a6b192169137bf 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -775,7 +775,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                enum ip_conntrack_info ctinfo;
                struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 
-               if (ct && !nf_ct_is_untracked(ct)) {
+               if (ct) {
                        IP_VS_DBG_RL_PKT(10, AF_INET, pp, skb, ipvsh->off,
                                         "ip_vs_nat_xmit(): "
                                         "stopping DNAT to local address");
@@ -866,7 +866,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
                enum ip_conntrack_info ctinfo;
                struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 
-               if (ct && !nf_ct_is_untracked(ct)) {
+               if (ct) {
                        IP_VS_DBG_RL_PKT(10, AF_INET6, pp, skb, ipvsh->off,
                                         "ip_vs_nat_xmit_v6(): "
                                         "stopping DNAT to local address");
@@ -1338,7 +1338,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                enum ip_conntrack_info ctinfo;
                struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 
-               if (ct && !nf_ct_is_untracked(ct)) {
+               if (ct) {
                        IP_VS_DBG(10, "%s(): "
                                  "stopping DNAT to local address %pI4\n",
                                  __func__, &cp->daddr.ip);
@@ -1429,7 +1429,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
                enum ip_conntrack_info ctinfo;
                struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 
-               if (ct && !nf_ct_is_untracked(ct)) {
+               if (ct) {
                        IP_VS_DBG(10, "%s(): "
                                  "stopping DNAT to local address %pI6\n",
                                  __func__, &cp->daddr.in6);

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 773d2187a5eaa23cee475c9f583f6c2aa92c9a96..83a1190504b40c1c35c57a9cdcda40b6dca03b73 100644 (file)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -627,10 +627,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
        unsigned int flags = 0, group;
        int err;
 
-       /* ignore our fake conntrack entry */
-       if (nf_ct_is_untracked(ct))
-               return 0;
-
        if (events & (1 << IPCT_DESTROY)) {
                type = IPCTNL_MSG_CT_DELETE;
                group = NFNLGRP_CONNTRACK_DESTROY;
@@ -2173,13 +2169,7 @@ ctnetlink_glue_build_size(const struct nf_conn *ct)
 static struct nf_conn *ctnetlink_glue_get_ct(const struct sk_buff *skb,
                                             enum ip_conntrack_info *ctinfo)
 {
-       struct nf_conn *ct;
-
-       ct = nf_ct_get(skb, ctinfo);
-       if (ct && nf_ct_is_untracked(ct))
-               ct = NULL;
-
-       return ct;
+       return nf_ct_get(skb, ctinfo);
 }
 
 static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)

diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
index 02afaf48a7290b15e6f2d56b2ca2c5cb07455b4d..60e6dbe124605569f249f0e15c7304b231fe1500 100644 (file)
--- a/net/netfilter/xt_HMARK.c
+++ b/net/netfilter/xt_HMARK.c
@@ -84,7 +84,7 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
        struct nf_conntrack_tuple *otuple;
        struct nf_conntrack_tuple *rtuple;
 
-       if (ct == NULL || nf_ct_is_untracked(ct))
+       if (ct == NULL)
                return -1;
 
        otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;

diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
index 9a9884a39c0e9cc806a3a6b0b16bbd387a26d220..57ef175dfbfaa86db8368c10fbbd51ba3b2a691c 100644 (file)
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -121,9 +121,6 @@ xt_cluster_mt(const struct sk_buff *skb, struct xt_action_param *par)
        if (ct == NULL)
                return false;
 
-       if (nf_ct_is_untracked(ct))
-               return false;
-
        if (ct->master)
                hash = xt_cluster_hash(ct->master, info);
        else

diff --git a/net/netfilter/xt_connlabel.c b/net/netfilter/xt_connlabel.c
index 7827128d5a95f5faf699d49c5dac796d03744a51..23372879e6e3004398454f6c96944422db8e1cc7 100644 (file)
--- a/net/netfilter/xt_connlabel.c
+++ b/net/netfilter/xt_connlabel.c
@@ -29,7 +29,7 @@ connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
        bool invert = info->options & XT_CONNLABEL_OP_INVERT;
 
        ct = nf_ct_get(skb, &ctinfo);
-       if (ct == NULL || nf_ct_is_untracked(ct))
+       if (ct == NULL)
                return invert;
 
        labels = nf_ct_labels_find(ct);

diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 9935d5029b0e52735b45bca017e52dd72f593c1e..ec377cc6a369c71025136fc4b8b3cf3fce177eea 100644 (file)
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -44,7 +44,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
        u_int32_t newmark;
 
        ct = nf_ct_get(skb, &ctinfo);
-       if (ct == NULL || nf_ct_is_untracked(ct))
+       if (ct == NULL)
                return XT_CONTINUE;
 
        switch (info->mode) {
@@ -97,7 +97,7 @@ connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
        const struct nf_conn *ct;
 
        ct = nf_ct_get(skb, &ctinfo);
-       if (ct == NULL || nf_ct_is_untracked(ct))
+       if (ct == NULL)
                return false;
 
        return ((ct->mark & info->mask) == info->mark) ^ info->invert;

diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c
index 0fdc89064488050bf4e667b1c09a26169a326872..42540d26c2b8ec34ab62422fe5894588df2306b6 100644 (file)
--- a/net/netfilter/xt_ipvs.c
+++ b/net/netfilter/xt_ipvs.c
@@ -116,7 +116,7 @@ ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par)
                enum ip_conntrack_info ctinfo;
                struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 
-               if (ct == NULL || nf_ct_is_untracked(ct)) {
+               if (ct == NULL) {
                        match = false;
                        goto out_put_cp;
                }

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 7b2c2fce408a02d4251f03a2e3f0b4d9e7fccb80..57c68664d09cdcafb9fe003c8e5151d1f7a9e955 100644 (file)
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -795,11 +795,6 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
        enum nf_nat_manip_type maniptype;
        int err;
 
-       if (nf_ct_is_untracked(ct)) {
-               /* A NAT action may only be performed on tracked packets. */
-               return NF_ACCEPT;
-       }
-
        /* Add NAT extension if not confirmed yet. */
        if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
                return NF_ACCEPT;   /* Can't NAT. */