Commit 481fa373 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: conntrack: add nf_conntrack_default_on sysctl

This switch (default on) can be used to disable automatic registration
of connection tracking functionality in newly created network
namespaces.

This means that when net namespace goes down (or the tracker protocol
module is unloaded) we *might* have to unregister the hooks.

We can either add another per-netns variable that tells if
the hooks got registered by default, or, alternatively, just call
the protocol _put() function and have the callee deal with a possible
'extra' put() operation that doesn't pair with a get() one.

This uses the latter approach, i.e. a put() without a get has no effect.

Conntrack is still enabled automatically regardless of the new sysctl
setting if the new net namespace requires connection tracking, e.g. when
NAT rules are created.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0c66dc1e
...@@ -96,6 +96,17 @@ nf_conntrack_max - INTEGER ...@@ -96,6 +96,17 @@ nf_conntrack_max - INTEGER
Size of connection tracking table. Default value is Size of connection tracking table. Default value is
nf_conntrack_buckets value * 4. nf_conntrack_buckets value * 4.
nf_conntrack_default_on - BOOLEAN
0 - don't register conntrack in new net namespaces
1 - register conntrack in new net namespaces (default)
This controls wheter newly created network namespaces have connection
tracking enabled by default. It will be enabled automatically
regardless of this setting if the new net namespace requires
connection tracking, e.g. when NAT rules are created.
This setting is only visible in initial user namespace, it has no
effect on existing namespaces.
nf_conntrack_tcp_be_liberal - BOOLEAN nf_conntrack_tcp_be_liberal - BOOLEAN
0 - disabled (default) 0 - disabled (default)
not 0 - enabled not 0 - enabled
......
...@@ -73,9 +73,18 @@ struct nf_conntrack_l3proto { ...@@ -73,9 +73,18 @@ struct nf_conntrack_l3proto {
extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX]; extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];
#ifdef CONFIG_SYSCTL
/* Protocol pernet registration. */ /* Protocol pernet registration. */
int nf_ct_l3proto_pernet_register(struct net *net, int nf_ct_l3proto_pernet_register(struct net *net,
struct nf_conntrack_l3proto *proto); struct nf_conntrack_l3proto *proto);
#else
static inline int nf_ct_l3proto_pernet_register(struct net *n,
struct nf_conntrack_l3proto *p)
{
return 0;
}
#endif
void nf_ct_l3proto_pernet_unregister(struct net *net, void nf_ct_l3proto_pernet_unregister(struct net *net,
struct nf_conntrack_l3proto *proto); struct nf_conntrack_l3proto *proto);
......
...@@ -238,12 +238,19 @@ int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto) ...@@ -238,12 +238,19 @@ int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto)
} }
EXPORT_SYMBOL_GPL(nf_ct_l3proto_register); EXPORT_SYMBOL_GPL(nf_ct_l3proto_register);
#ifdef CONFIG_SYSCTL
extern unsigned int nf_conntrack_default_on;
int nf_ct_l3proto_pernet_register(struct net *net, int nf_ct_l3proto_pernet_register(struct net *net,
struct nf_conntrack_l3proto *proto) struct nf_conntrack_l3proto *proto)
{ {
if (nf_conntrack_default_on == 0)
return 0; return 0;
return proto->net_ns_get ? proto->net_ns_get(net) : 0;
} }
EXPORT_SYMBOL_GPL(nf_ct_l3proto_pernet_register); EXPORT_SYMBOL_GPL(nf_ct_l3proto_pernet_register);
#endif
void nf_ct_l3proto_unregister(struct nf_conntrack_l3proto *proto) void nf_ct_l3proto_unregister(struct nf_conntrack_l3proto *proto)
{ {
...@@ -264,6 +271,16 @@ EXPORT_SYMBOL_GPL(nf_ct_l3proto_unregister); ...@@ -264,6 +271,16 @@ EXPORT_SYMBOL_GPL(nf_ct_l3proto_unregister);
void nf_ct_l3proto_pernet_unregister(struct net *net, void nf_ct_l3proto_pernet_unregister(struct net *net,
struct nf_conntrack_l3proto *proto) struct nf_conntrack_l3proto *proto)
{ {
/*
* nf_conntrack_default_on *might* have registered hooks.
* ->net_ns_put must cope with more puts() than get(), i.e.
* if nf_conntrack_default_on was 0 at time of
* nf_ct_l3proto_pernet_register invocation this net_ns_put()
* should be a noop.
*/
if (proto->net_ns_put)
proto->net_ns_put(net);
/* Remove all contrack entries for this protocol */ /* Remove all contrack entries for this protocol */
nf_ct_iterate_cleanup(net, kill_l3proto, proto, 0, 0); nf_ct_iterate_cleanup(net, kill_l3proto, proto, 0, 0);
} }
......
...@@ -452,6 +452,9 @@ static int log_invalid_proto_max __read_mostly = 255; ...@@ -452,6 +452,9 @@ static int log_invalid_proto_max __read_mostly = 255;
/* size the user *wants to set */ /* size the user *wants to set */
static unsigned int nf_conntrack_htable_size_user __read_mostly; static unsigned int nf_conntrack_htable_size_user __read_mostly;
extern unsigned int nf_conntrack_default_on;
unsigned int nf_conntrack_default_on __read_mostly = 1;
static int static int
nf_conntrack_hash_sysctl(struct ctl_table *table, int write, nf_conntrack_hash_sysctl(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos) void __user *buffer, size_t *lenp, loff_t *ppos)
...@@ -517,6 +520,13 @@ static struct ctl_table nf_ct_sysctl_table[] = { ...@@ -517,6 +520,13 @@ static struct ctl_table nf_ct_sysctl_table[] = {
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec, .proc_handler = proc_dointvec,
}, },
{
.procname = "nf_conntrack_default_on",
.data = &nf_conntrack_default_on,
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{ } { }
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment