Commit adf05168 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: remove ip_conntrack* sysctl compat code

This backward compatibility has been around for more than ten years,
since Yasuyuki Kozakai introduced IPv6 in conntrack. These days, we have
alternate /proc/net/nf_conntrack* entries, the ctnetlink interface and
the conntrack utility got adopted by many people in the user community
according to what I observed on the netfilter user mailing list.

So let's get rid of this.

Note that nf_conntrack_htable_size and unsigned int nf_conntrack_max do
not need to be exported as symbol anymore.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cb1b69b0
...@@ -134,14 +134,6 @@ void nf_ct_l4proto_pernet_unregister(struct net *net, ...@@ -134,14 +134,6 @@ void nf_ct_l4proto_pernet_unregister(struct net *net,
int nf_ct_l4proto_register(struct nf_conntrack_l4proto *proto); int nf_ct_l4proto_register(struct nf_conntrack_l4proto *proto);
void nf_ct_l4proto_unregister(struct nf_conntrack_l4proto *proto); void nf_ct_l4proto_unregister(struct nf_conntrack_l4proto *proto);
static inline void nf_ct_kfree_compat_sysctl_table(struct nf_proto_net *pn)
{
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
kfree(pn->ctl_compat_table);
pn->ctl_compat_table = NULL;
#endif
}
/* Generic netlink helpers */ /* Generic netlink helpers */
int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb, int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
const struct nf_conntrack_tuple *tuple); const struct nf_conntrack_tuple *tuple);
......
...@@ -15,10 +15,6 @@ struct nf_proto_net { ...@@ -15,10 +15,6 @@ struct nf_proto_net {
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
struct ctl_table_header *ctl_table_header; struct ctl_table_header *ctl_table_header;
struct ctl_table *ctl_table; struct ctl_table *ctl_table;
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
struct ctl_table_header *ctl_compat_header;
struct ctl_table *ctl_compat_table;
#endif
#endif #endif
unsigned int users; unsigned int users;
}; };
...@@ -58,10 +54,6 @@ struct nf_ip_net { ...@@ -58,10 +54,6 @@ struct nf_ip_net {
struct nf_udp_net udp; struct nf_udp_net udp;
struct nf_icmp_net icmp; struct nf_icmp_net icmp;
struct nf_icmp_net icmpv6; struct nf_icmp_net icmpv6;
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
struct ctl_table_header *ctl_table_header;
struct ctl_table *ctl_table;
#endif
}; };
struct ct_pcpu { struct ct_pcpu {
......
...@@ -25,17 +25,6 @@ config NF_CONNTRACK_IPV4 ...@@ -25,17 +25,6 @@ config NF_CONNTRACK_IPV4
To compile it as a module, choose M here. If unsure, say N. To compile it as a module, choose M here. If unsure, say N.
config NF_CONNTRACK_PROC_COMPAT
bool "proc/sysctl compatibility with old connection tracking"
depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4
default y
help
This option enables /proc and sysctl compatibility with the old
layer 3 dependent connection tracking. This is needed to keep
old programs that have not been adapted to the new names working.
If unsure, say Y.
if NF_TABLES if NF_TABLES
config NF_TABLES_IPV4 config NF_TABLES_IPV4
......
...@@ -4,11 +4,6 @@ ...@@ -4,11 +4,6 @@
# objects for l3 independent conntrack # objects for l3 independent conntrack
nf_conntrack_ipv4-y := nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o nf_conntrack_ipv4-y := nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
ifeq ($(CONFIG_PROC_FS),y)
nf_conntrack_ipv4-objs += nf_conntrack_l3proto_ipv4_compat.o
endif
endif
# connection tracking # connection tracking
obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
......
...@@ -202,47 +202,6 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = { ...@@ -202,47 +202,6 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
}, },
}; };
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
static int log_invalid_proto_min = 0;
static int log_invalid_proto_max = 255;
static struct ctl_table ip_ct_sysctl_table[] = {
{
.procname = "ip_conntrack_max",
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{
.procname = "ip_conntrack_count",
.maxlen = sizeof(int),
.mode = 0444,
.proc_handler = proc_dointvec,
},
{
.procname = "ip_conntrack_buckets",
.maxlen = sizeof(unsigned int),
.mode = 0444,
.proc_handler = proc_dointvec,
},
{
.procname = "ip_conntrack_checksum",
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{
.procname = "ip_conntrack_log_invalid",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = &log_invalid_proto_min,
.extra2 = &log_invalid_proto_max,
},
{ }
};
#endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */
/* Fast function for those who don't want to parse /proc (and I don't /* Fast function for those who don't want to parse /proc (and I don't
blame them). */ blame them). */
/* Reversing the socket's dst/src point of view gives us the reply /* Reversing the socket's dst/src point of view gives us the reply
...@@ -350,20 +309,6 @@ static struct nf_sockopt_ops so_getorigdst = { ...@@ -350,20 +309,6 @@ static struct nf_sockopt_ops so_getorigdst = {
static int ipv4_init_net(struct net *net) static int ipv4_init_net(struct net *net)
{ {
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
struct nf_ip_net *in = &net->ct.nf_ct_proto;
in->ctl_table = kmemdup(ip_ct_sysctl_table,
sizeof(ip_ct_sysctl_table),
GFP_KERNEL);
if (!in->ctl_table)
return -ENOMEM;
in->ctl_table[0].data = &nf_conntrack_max;
in->ctl_table[1].data = &net->ct.count;
in->ctl_table[2].data = &nf_conntrack_htable_size;
in->ctl_table[3].data = &net->ct.sysctl_checksum;
in->ctl_table[4].data = &net->ct.sysctl_log_invalid;
#endif
return 0; return 0;
} }
...@@ -379,9 +324,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = { ...@@ -379,9 +324,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
.nlattr_tuple_size = ipv4_nlattr_tuple_size, .nlattr_tuple_size = ipv4_nlattr_tuple_size,
.nlattr_to_tuple = ipv4_nlattr_to_tuple, .nlattr_to_tuple = ipv4_nlattr_to_tuple,
.nla_policy = ipv4_nla_policy, .nla_policy = ipv4_nla_policy,
#endif
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
.ctl_table_path = "net/ipv4/netfilter",
#endif #endif
.init_net = ipv4_init_net, .init_net = ipv4_init_net,
.me = THIS_MODULE, .me = THIS_MODULE,
...@@ -492,16 +434,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void) ...@@ -492,16 +434,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
goto cleanup_icmpv4; goto cleanup_icmpv4;
} }
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
ret = nf_conntrack_ipv4_compat_init();
if (ret < 0)
goto cleanup_proto;
#endif
return ret; return ret;
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
cleanup_proto:
nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
#endif
cleanup_icmpv4: cleanup_icmpv4:
nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp); nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp);
cleanup_udp4: cleanup_udp4:
...@@ -520,9 +453,6 @@ static int __init nf_conntrack_l3proto_ipv4_init(void) ...@@ -520,9 +453,6 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
static void __exit nf_conntrack_l3proto_ipv4_fini(void) static void __exit nf_conntrack_l3proto_ipv4_fini(void)
{ {
synchronize_net(); synchronize_net();
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
nf_conntrack_ipv4_compat_fini();
#endif
nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4); nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp); nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp);
nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udp4); nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udp4);
......
This diff is collapsed.
...@@ -327,17 +327,6 @@ static struct ctl_table icmp_sysctl_table[] = { ...@@ -327,17 +327,6 @@ static struct ctl_table icmp_sysctl_table[] = {
}, },
{ } { }
}; };
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
static struct ctl_table icmp_compat_sysctl_table[] = {
{
.procname = "ip_conntrack_icmp_timeout",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{ }
};
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn, static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn,
...@@ -355,40 +344,14 @@ static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -355,40 +344,14 @@ static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn,
return 0; return 0;
} }
static int icmp_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
struct nf_icmp_net *in)
{
#ifdef CONFIG_SYSCTL
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
pn->ctl_compat_table = kmemdup(icmp_compat_sysctl_table,
sizeof(icmp_compat_sysctl_table),
GFP_KERNEL);
if (!pn->ctl_compat_table)
return -ENOMEM;
pn->ctl_compat_table[0].data = &in->timeout;
#endif
#endif
return 0;
}
static int icmp_init_net(struct net *net, u_int16_t proto) static int icmp_init_net(struct net *net, u_int16_t proto)
{ {
int ret;
struct nf_icmp_net *in = icmp_pernet(net); struct nf_icmp_net *in = icmp_pernet(net);
struct nf_proto_net *pn = &in->pn; struct nf_proto_net *pn = &in->pn;
in->timeout = nf_ct_icmp_timeout; in->timeout = nf_ct_icmp_timeout;
ret = icmp_kmemdup_compat_sysctl_table(pn, in); return icmp_kmemdup_sysctl_table(pn, in);
if (ret < 0)
return ret;
ret = icmp_kmemdup_sysctl_table(pn, in);
if (ret < 0)
nf_ct_kfree_compat_sysctl_table(pn);
return ret;
} }
static struct nf_proto_net *icmp_get_net_proto(struct net *net) static struct nf_proto_net *icmp_get_net_proto(struct net *net)
......
...@@ -161,10 +161,7 @@ static void nf_conntrack_all_unlock(void) ...@@ -161,10 +161,7 @@ static void nf_conntrack_all_unlock(void)
} }
unsigned int nf_conntrack_htable_size __read_mostly; unsigned int nf_conntrack_htable_size __read_mostly;
EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
unsigned int nf_conntrack_max __read_mostly; unsigned int nf_conntrack_max __read_mostly;
EXPORT_SYMBOL_GPL(nf_conntrack_max);
DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked); DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked); EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
......
...@@ -159,54 +159,6 @@ static int kill_l4proto(struct nf_conn *i, void *data) ...@@ -159,54 +159,6 @@ static int kill_l4proto(struct nf_conn *i, void *data)
nf_ct_l3num(i) == l4proto->l3proto; nf_ct_l3num(i) == l4proto->l3proto;
} }
static struct nf_ip_net *nf_ct_l3proto_net(struct net *net,
struct nf_conntrack_l3proto *l3proto)
{
if (l3proto->l3proto == PF_INET)
return &net->ct.nf_ct_proto;
else
return NULL;
}
static int nf_ct_l3proto_register_sysctl(struct net *net,
struct nf_conntrack_l3proto *l3proto)
{
int err = 0;
struct nf_ip_net *in = nf_ct_l3proto_net(net, l3proto);
/* nf_conntrack_l3proto_ipv6 doesn't support sysctl */
if (in == NULL)
return 0;
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
if (in->ctl_table != NULL) {
err = nf_ct_register_sysctl(net,
&in->ctl_table_header,
l3proto->ctl_table_path,
in->ctl_table);
if (err < 0) {
kfree(in->ctl_table);
in->ctl_table = NULL;
}
}
#endif
return err;
}
static void nf_ct_l3proto_unregister_sysctl(struct net *net,
struct nf_conntrack_l3proto *l3proto)
{
struct nf_ip_net *in = nf_ct_l3proto_net(net, l3proto);
if (in == NULL)
return;
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
if (in->ctl_table_header != NULL)
nf_ct_unregister_sysctl(&in->ctl_table_header,
&in->ctl_table,
0);
#endif
}
int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto) int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto)
{ {
int ret = 0; int ret = 0;
...@@ -241,7 +193,7 @@ EXPORT_SYMBOL_GPL(nf_ct_l3proto_register); ...@@ -241,7 +193,7 @@ EXPORT_SYMBOL_GPL(nf_ct_l3proto_register);
int nf_ct_l3proto_pernet_register(struct net *net, int nf_ct_l3proto_pernet_register(struct net *net,
struct nf_conntrack_l3proto *proto) struct nf_conntrack_l3proto *proto)
{ {
int ret = 0; int ret;
if (proto->init_net) { if (proto->init_net) {
ret = proto->init_net(net); ret = proto->init_net(net);
...@@ -249,7 +201,7 @@ int nf_ct_l3proto_pernet_register(struct net *net, ...@@ -249,7 +201,7 @@ int nf_ct_l3proto_pernet_register(struct net *net,
return ret; return ret;
} }
return nf_ct_l3proto_register_sysctl(net, proto); return 0;
} }
EXPORT_SYMBOL_GPL(nf_ct_l3proto_pernet_register); EXPORT_SYMBOL_GPL(nf_ct_l3proto_pernet_register);
...@@ -272,8 +224,6 @@ EXPORT_SYMBOL_GPL(nf_ct_l3proto_unregister); ...@@ -272,8 +224,6 @@ EXPORT_SYMBOL_GPL(nf_ct_l3proto_unregister);
void nf_ct_l3proto_pernet_unregister(struct net *net, void nf_ct_l3proto_pernet_unregister(struct net *net,
struct nf_conntrack_l3proto *proto) struct nf_conntrack_l3proto *proto)
{ {
nf_ct_l3proto_unregister_sysctl(net, proto);
/* Remove all contrack entries for this protocol */ /* Remove all contrack entries for this protocol */
nf_ct_iterate_cleanup(net, kill_l3proto, proto, 0, 0); nf_ct_iterate_cleanup(net, kill_l3proto, proto, 0, 0);
} }
...@@ -312,26 +262,6 @@ int nf_ct_l4proto_register_sysctl(struct net *net, ...@@ -312,26 +262,6 @@ int nf_ct_l4proto_register_sysctl(struct net *net,
} }
} }
} }
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
if (l4proto->l3proto != AF_INET6 && pn->ctl_compat_table != NULL) {
if (err < 0) {
nf_ct_kfree_compat_sysctl_table(pn);
goto out;
}
err = nf_ct_register_sysctl(net,
&pn->ctl_compat_header,
"net/ipv4/netfilter",
pn->ctl_compat_table);
if (err == 0)
goto out;
nf_ct_kfree_compat_sysctl_table(pn);
nf_ct_unregister_sysctl(&pn->ctl_table_header,
&pn->ctl_table,
pn->users);
}
out:
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
return err; return err;
} }
...@@ -346,13 +276,6 @@ void nf_ct_l4proto_unregister_sysctl(struct net *net, ...@@ -346,13 +276,6 @@ void nf_ct_l4proto_unregister_sysctl(struct net *net,
nf_ct_unregister_sysctl(&pn->ctl_table_header, nf_ct_unregister_sysctl(&pn->ctl_table_header,
&pn->ctl_table, &pn->ctl_table,
pn->users); pn->users);
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
if (l4proto->l3proto != AF_INET6 && pn->ctl_compat_header != NULL)
nf_ct_unregister_sysctl(&pn->ctl_compat_header,
&pn->ctl_compat_table,
0);
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
} }
......
...@@ -151,17 +151,6 @@ static struct ctl_table generic_sysctl_table[] = { ...@@ -151,17 +151,6 @@ static struct ctl_table generic_sysctl_table[] = {
}, },
{ } { }
}; };
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
static struct ctl_table generic_compat_sysctl_table[] = {
{
.procname = "ip_conntrack_generic_timeout",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{ }
};
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn, static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn,
...@@ -179,40 +168,14 @@ static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -179,40 +168,14 @@ static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn,
return 0; return 0;
} }
static int generic_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
struct nf_generic_net *gn)
{
#ifdef CONFIG_SYSCTL
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
pn->ctl_compat_table = kmemdup(generic_compat_sysctl_table,
sizeof(generic_compat_sysctl_table),
GFP_KERNEL);
if (!pn->ctl_compat_table)
return -ENOMEM;
pn->ctl_compat_table[0].data = &gn->timeout;
#endif
#endif
return 0;
}
static int generic_init_net(struct net *net, u_int16_t proto) static int generic_init_net(struct net *net, u_int16_t proto)
{ {
int ret;
struct nf_generic_net *gn = generic_pernet(net); struct nf_generic_net *gn = generic_pernet(net);
struct nf_proto_net *pn = &gn->pn; struct nf_proto_net *pn = &gn->pn;
gn->timeout = nf_ct_generic_timeout; gn->timeout = nf_ct_generic_timeout;
ret = generic_kmemdup_compat_sysctl_table(pn, gn); return generic_kmemdup_sysctl_table(pn, gn);
if (ret < 0)
return ret;
ret = generic_kmemdup_sysctl_table(pn, gn);
if (ret < 0)
nf_ct_kfree_compat_sysctl_table(pn);
return ret;
} }
static struct nf_proto_net *generic_get_net_proto(struct net *net) static struct nf_proto_net *generic_get_net_proto(struct net *net)
......
...@@ -705,54 +705,6 @@ static struct ctl_table sctp_sysctl_table[] = { ...@@ -705,54 +705,6 @@ static struct ctl_table sctp_sysctl_table[] = {
}, },
{ } { }
}; };
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
static struct ctl_table sctp_compat_sysctl_table[] = {
{
.procname = "ip_conntrack_sctp_timeout_closed",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_sctp_timeout_cookie_wait",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_sctp_timeout_cookie_echoed",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_sctp_timeout_established",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_sctp_timeout_shutdown_sent",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_sctp_timeout_shutdown_recd",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{ }
};
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif #endif
static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn, static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn,
...@@ -781,32 +733,8 @@ static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -781,32 +733,8 @@ static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn,
return 0; return 0;
} }
static int sctp_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
struct sctp_net *sn)
{
#ifdef CONFIG_SYSCTL
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
pn->ctl_compat_table = kmemdup(sctp_compat_sysctl_table,
sizeof(sctp_compat_sysctl_table),
GFP_KERNEL);
if (!pn->ctl_compat_table)
return -ENOMEM;
pn->ctl_compat_table[0].data = &sn->timeouts[SCTP_CONNTRACK_CLOSED];
pn->ctl_compat_table[1].data = &sn->timeouts[SCTP_CONNTRACK_COOKIE_WAIT];
pn->ctl_compat_table[2].data = &sn->timeouts[SCTP_CONNTRACK_COOKIE_ECHOED];
pn->ctl_compat_table[3].data = &sn->timeouts[SCTP_CONNTRACK_ESTABLISHED];
pn->ctl_compat_table[4].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT];
pn->ctl_compat_table[5].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD];
pn->ctl_compat_table[6].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT];
#endif
#endif
return 0;
}
static int sctp_init_net(struct net *net, u_int16_t proto) static int sctp_init_net(struct net *net, u_int16_t proto)
{ {
int ret;
struct sctp_net *sn = sctp_pernet(net); struct sctp_net *sn = sctp_pernet(net);
struct nf_proto_net *pn = &sn->pn; struct nf_proto_net *pn = &sn->pn;
...@@ -817,18 +745,7 @@ static int sctp_init_net(struct net *net, u_int16_t proto) ...@@ -817,18 +745,7 @@ static int sctp_init_net(struct net *net, u_int16_t proto)
sn->timeouts[i] = sctp_timeouts[i]; sn->timeouts[i] = sctp_timeouts[i];
} }
if (proto == AF_INET) { return sctp_kmemdup_sysctl_table(pn, sn);
ret = sctp_kmemdup_compat_sysctl_table(pn, sn);
if (ret < 0)
return ret;
ret = sctp_kmemdup_sysctl_table(pn, sn);
if (ret < 0)
nf_ct_kfree_compat_sysctl_table(pn);
} else
ret = sctp_kmemdup_sysctl_table(pn, sn);
return ret;
} }
static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = { static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
......
...@@ -1481,90 +1481,6 @@ static struct ctl_table tcp_sysctl_table[] = { ...@@ -1481,90 +1481,6 @@ static struct ctl_table tcp_sysctl_table[] = {
}, },
{ } { }
}; };
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
static struct ctl_table tcp_compat_sysctl_table[] = {
{
.procname = "ip_conntrack_tcp_timeout_syn_sent",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_syn_sent2",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_syn_recv",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_established",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_fin_wait",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_close_wait",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_last_ack",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_time_wait",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_close",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_timeout_max_retrans",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_tcp_loose",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{
.procname = "ip_conntrack_tcp_be_liberal",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{
.procname = "ip_conntrack_tcp_max_retrans",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{ }
};
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn, static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
...@@ -1597,38 +1513,8 @@ static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -1597,38 +1513,8 @@ static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
return 0; return 0;
} }
static int tcp_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
struct nf_tcp_net *tn)
{
#ifdef CONFIG_SYSCTL
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
pn->ctl_compat_table = kmemdup(tcp_compat_sysctl_table,
sizeof(tcp_compat_sysctl_table),
GFP_KERNEL);
if (!pn->ctl_compat_table)
return -ENOMEM;
pn->ctl_compat_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
pn->ctl_compat_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT2];
pn->ctl_compat_table[2].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
pn->ctl_compat_table[3].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
pn->ctl_compat_table[4].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
pn->ctl_compat_table[5].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
pn->ctl_compat_table[6].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
pn->ctl_compat_table[7].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
pn->ctl_compat_table[8].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
pn->ctl_compat_table[9].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
pn->ctl_compat_table[10].data = &tn->tcp_loose;
pn->ctl_compat_table[11].data = &tn->tcp_be_liberal;
pn->ctl_compat_table[12].data = &tn->tcp_max_retrans;
#endif
#endif
return 0;
}
static int tcp_init_net(struct net *net, u_int16_t proto) static int tcp_init_net(struct net *net, u_int16_t proto)
{ {
int ret;
struct nf_tcp_net *tn = tcp_pernet(net); struct nf_tcp_net *tn = tcp_pernet(net);
struct nf_proto_net *pn = &tn->pn; struct nf_proto_net *pn = &tn->pn;
...@@ -1643,18 +1529,7 @@ static int tcp_init_net(struct net *net, u_int16_t proto) ...@@ -1643,18 +1529,7 @@ static int tcp_init_net(struct net *net, u_int16_t proto)
tn->tcp_max_retrans = nf_ct_tcp_max_retrans; tn->tcp_max_retrans = nf_ct_tcp_max_retrans;
} }
if (proto == AF_INET) { return tcp_kmemdup_sysctl_table(pn, tn);
ret = tcp_kmemdup_compat_sysctl_table(pn, tn);
if (ret < 0)
return ret;
ret = tcp_kmemdup_sysctl_table(pn, tn);
if (ret < 0)
nf_ct_kfree_compat_sysctl_table(pn);
} else
ret = tcp_kmemdup_sysctl_table(pn, tn);
return ret;
} }
static struct nf_proto_net *tcp_get_net_proto(struct net *net) static struct nf_proto_net *tcp_get_net_proto(struct net *net)
......
...@@ -218,23 +218,6 @@ static struct ctl_table udp_sysctl_table[] = { ...@@ -218,23 +218,6 @@ static struct ctl_table udp_sysctl_table[] = {
}, },
{ } { }
}; };
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
static struct ctl_table udp_compat_sysctl_table[] = {
{
.procname = "ip_conntrack_udp_timeout",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{
.procname = "ip_conntrack_udp_timeout_stream",
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = proc_dointvec_jiffies,
},
{ }
};
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn, static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn,
...@@ -254,27 +237,8 @@ static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -254,27 +237,8 @@ static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn,
return 0; return 0;
} }
static int udp_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
struct nf_udp_net *un)
{
#ifdef CONFIG_SYSCTL
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
pn->ctl_compat_table = kmemdup(udp_compat_sysctl_table,
sizeof(udp_compat_sysctl_table),
GFP_KERNEL);
if (!pn->ctl_compat_table)
return -ENOMEM;
pn->ctl_compat_table[0].data = &un->timeouts[UDP_CT_UNREPLIED];
pn->ctl_compat_table[1].data = &un->timeouts[UDP_CT_REPLIED];
#endif
#endif
return 0;
}
static int udp_init_net(struct net *net, u_int16_t proto) static int udp_init_net(struct net *net, u_int16_t proto)
{ {
int ret;
struct nf_udp_net *un = udp_pernet(net); struct nf_udp_net *un = udp_pernet(net);
struct nf_proto_net *pn = &un->pn; struct nf_proto_net *pn = &un->pn;
...@@ -285,18 +249,7 @@ static int udp_init_net(struct net *net, u_int16_t proto) ...@@ -285,18 +249,7 @@ static int udp_init_net(struct net *net, u_int16_t proto)
un->timeouts[i] = udp_timeouts[i]; un->timeouts[i] = udp_timeouts[i];
} }
if (proto == AF_INET) { return udp_kmemdup_sysctl_table(pn, un);
ret = udp_kmemdup_compat_sysctl_table(pn, un);
if (ret < 0)
return ret;
ret = udp_kmemdup_sysctl_table(pn, un);
if (ret < 0)
nf_ct_kfree_compat_sysctl_table(pn);
} else
ret = udp_kmemdup_sysctl_table(pn, un);
return ret;
} }
static struct nf_proto_net *udp_get_net_proto(struct net *net) static struct nf_proto_net *udp_get_net_proto(struct net *net)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment