Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 44fb87f6 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: remove remaining l4proto indirect packet calls 



Now that all l4trackers are builtin, no need to use a mix of direct and
indirect calls.
This removes the last two users: gre and the generic l4 protocol
tracker.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b184356d

include/net/netfilter/nf_conntrack_l4proto.h

+5 −7
Original line number Diff line number Diff line
@@ -27,13 +27,6 @@ struct nf_conntrack_l4proto { 
	/* protoinfo nlattr size, closes a hole */

	u16 nlattr_size;



	/* Returns verdict for packet, or -1 for invalid. */

	int (*packet)(struct nf_conn *ct,

		      struct sk_buff *skb,

		      unsigned int dataoff,

		      enum ip_conntrack_info ctinfo,

		      const struct nf_hook_state *state);



	/* Called when a conntrack entry is destroyed */

	void (*destroy)(struct nf_conn *ct);
@@ -136,6 +129,11 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, 
			     unsigned int dataoff,

			     enum ip_conntrack_info ctinfo,

			     const struct nf_hook_state *state);

int nf_conntrack_gre_packet(struct nf_conn *ct,

			    struct sk_buff *skb,

			    unsigned int dataoff,

			    enum ip_conntrack_info ctinfo,

			    const struct nf_hook_state *state);



/* Existing built-in generic protocol */

extern const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic;

net/netfilter/nf_conntrack_core.c

+19 −7
Original line number Diff line number Diff line
@@ -1534,6 +1534,18 @@ nf_conntrack_handle_icmp(struct nf_conn *tmpl, 
	return ret;

}



static int generic_packet(struct nf_conn *ct, struct sk_buff *skb,

			  enum ip_conntrack_info ctinfo)

{

	const unsigned int *timeout = nf_ct_timeout_lookup(ct);



	if (!timeout)

		timeout = &nf_generic_pernet(nf_ct_net(ct))->timeout;



	nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);

	return NF_ACCEPT;

}



/* Returns verdict for packet, or -1 for invalid. */

static int nf_conntrack_handle_packet(struct nf_conn *ct,

				      struct sk_buff *skb,
@@ -1566,11 +1578,15 @@ static int nf_conntrack_handle_packet(struct nf_conn *ct, 
	case IPPROTO_DCCP:

		return nf_conntrack_dccp_packet(ct, skb, dataoff,

						ctinfo, state);

#endif

#ifdef CONFIG_NF_CT_PROTO_GRE

	case IPPROTO_GRE:

		return nf_conntrack_gre_packet(ct, skb, dataoff,

					       ctinfo, state);

#endif

	}



	WARN_ON_ONCE(1);

	return -NF_ACCEPT;

	return generic_packet(ct, skb, ctinfo);

}



unsigned int
@@ -1634,11 +1650,7 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state) 
		goto out;

	}



	if (l4proto->packet)

		ret = l4proto->packet(ct, skb, dataoff, ctinfo, state);

	else

	ret = nf_conntrack_handle_packet(ct, skb, dataoff, ctinfo, state);



	if (ret <= 0) {

		/* Invalid: inverse of the return code tells

		 * the netfilter core what to do */

net/netfilter/nf_conntrack_proto_generic.c

+0 −35
Original line number Diff line number Diff line
@@ -15,40 +15,6 @@ 


static const unsigned int nf_ct_generic_timeout = 600*HZ;



static bool nf_generic_should_process(u8 proto)

{

	switch (proto) {

#ifdef CONFIG_NF_CT_PROTO_GRE_MODULE

	case IPPROTO_GRE:

		return false;

#endif

	default:

		return true;

	}

}



/* Returns verdict for packet, or -1 for invalid. */

static int generic_packet(struct nf_conn *ct,

			  struct sk_buff *skb,

			  unsigned int dataoff,

			  enum ip_conntrack_info ctinfo,

			  const struct nf_hook_state *state)

{

	const unsigned int *timeout = nf_ct_timeout_lookup(ct);



	if (!nf_generic_should_process(nf_ct_protonum(ct))) {

		pr_warn_once("conntrack: generic helper won't handle protocol %d. Please consider loading the specific helper module.\n",

			     nf_ct_protonum(ct));

		return -NF_ACCEPT;

	}



	if (!timeout)

		timeout = &nf_generic_pernet(nf_ct_net(ct))->timeout;



	nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);

	return NF_ACCEPT;

}



#ifdef CONFIG_NF_CONNTRACK_TIMEOUT



#include <linux/netfilter/nfnetlink.h>
@@ -139,7 +105,6 @@ static struct nf_proto_net *generic_get_net_proto(struct net *net) 
const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =

{

	.l4proto		= 255,

	.packet			= generic_packet,

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT

	.ctnl_timeout		= {

		.nlattr_to_obj	= generic_timeout_nlattr_to_obj,

net/netfilter/nf_conntrack_proto_gre.c

+5 −6
Original line number Diff line number Diff line
@@ -213,7 +213,7 @@ static unsigned int *gre_get_timeouts(struct net *net) 
}



/* Returns verdict for packet, and may modify conntrack */

static int gre_packet(struct nf_conn *ct,

int nf_conntrack_gre_packet(struct nf_conn *ct,

			    struct sk_buff *skb,

			    unsigned int dataoff,

			    enum ip_conntrack_info ctinfo,
@@ -371,7 +371,6 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_gre = { 
#ifdef CONFIG_NF_CONNTRACK_PROCFS

	.print_conntrack = gre_print_conntrack,

#endif

	.packet		 = gre_packet,

	.destroy	 = gre_destroy,

#if IS_ENABLED(CONFIG_NF_CT_NETLINK)

	.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,