Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9b03f38d authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by Patrick McHardy
Browse files

netfilter: netns nf_conntrack: per-netns expectations 



Make per-netns a) expectation hash and b) expectations count.

Expectations always belongs to netns to which it's master conntrack belong.
This is natural and doesn't bloat expectation.

Proc files and leaf users are stubbed to init_net, this is temporary.

Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent b21f8901

include/net/netfilter/nf_conntrack_expect.h

+14 −6
Original line number Diff line number Diff line
@@ -6,7 +6,6 @@ 
#define _NF_CONNTRACK_EXPECT_H

#include <net/netfilter/nf_conntrack.h>



extern struct hlist_head *nf_ct_expect_hash;

extern unsigned int nf_ct_expect_hsize;

extern unsigned int nf_ct_expect_max;
@@ -56,6 +55,15 @@ struct nf_conntrack_expect 
	struct rcu_head rcu;

};



static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)

{

#ifdef CONFIG_NET_NS

	return exp->master->ct_net;	/* by definition */

#else

	return &init_net;

#endif

}



struct nf_conntrack_expect_policy

{

	unsigned int	max_expected;
@@ -67,17 +75,17 @@ struct nf_conntrack_expect_policy 
#define NF_CT_EXPECT_PERMANENT	0x1

#define NF_CT_EXPECT_INACTIVE	0x2



int nf_conntrack_expect_init(void);

void nf_conntrack_expect_fini(void);

int nf_conntrack_expect_init(struct net *net);

void nf_conntrack_expect_fini(struct net *net);



struct nf_conntrack_expect *

__nf_ct_expect_find(const struct nf_conntrack_tuple *tuple);

__nf_ct_expect_find(struct net *net, const struct nf_conntrack_tuple *tuple);



struct nf_conntrack_expect *

nf_ct_expect_find_get(const struct nf_conntrack_tuple *tuple);

nf_ct_expect_find_get(struct net *net, const struct nf_conntrack_tuple *tuple);



struct nf_conntrack_expect *

nf_ct_find_expectation(const struct nf_conntrack_tuple *tuple);

nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple);



void nf_ct_unlink_expect(struct nf_conntrack_expect *exp);

void nf_ct_remove_expectations(struct nf_conn *ct);

include/net/netns/conntrack.h

+3 −0
Original line number Diff line number Diff line
@@ -5,7 +5,10 @@ 


struct netns_ct {

	atomic_t		count;

	unsigned int		expect_count;

	struct hlist_head	*hash;

	struct hlist_head	*expect_hash;

	int			hash_vmalloc;

	int			expect_vmalloc;

};

#endif

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c

+4 −2
Original line number Diff line number Diff line
@@ -177,11 +177,12 @@ struct ct_expect_iter_state { 


static struct hlist_node *ct_expect_get_first(struct seq_file *seq)

{

	struct net *net = &init_net;

	struct ct_expect_iter_state *st = seq->private;

	struct hlist_node *n;



	for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {

		n = rcu_dereference(nf_ct_expect_hash[st->bucket].first);

		n = rcu_dereference(net->ct.expect_hash[st->bucket].first);

		if (n)

			return n;

	}
@@ -191,13 +192,14 @@ static struct hlist_node *ct_expect_get_first(struct seq_file *seq) 
static struct hlist_node *ct_expect_get_next(struct seq_file *seq,

					     struct hlist_node *head)

{

	struct net *net = &init_net;

	struct ct_expect_iter_state *st = seq->private;



	head = rcu_dereference(head->next);

	while (head == NULL) {

		if (++st->bucket >= nf_ct_expect_hsize)

			return NULL;

		head = rcu_dereference(nf_ct_expect_hash[st->bucket].first);

		head = rcu_dereference(net->ct.expect_hash[st->bucket].first);

	}

	return head;

}

net/ipv4/netfilter/nf_nat_pptp.c

+1 −1
Original line number Diff line number Diff line
@@ -73,7 +73,7 @@ static void pptp_nat_expected(struct nf_conn *ct, 


	pr_debug("trying to unexpect other dir: ");

	nf_ct_dump_tuple_ip(&t);

	other_exp = nf_ct_expect_find_get(&t);

	other_exp = nf_ct_expect_find_get(&init_net, &t);

	if (other_exp) {

		nf_ct_unexpect_related(other_exp);

		nf_ct_expect_put(other_exp);

net/netfilter/nf_conntrack_core.c

+4 −4
Original line number Diff line number Diff line
@@ -562,7 +562,7 @@ init_conntrack(struct net *net, 
	nf_ct_acct_ext_add(ct, GFP_ATOMIC);



	spin_lock_bh(&nf_conntrack_lock);

	exp = nf_ct_find_expectation(tuple);

	exp = nf_ct_find_expectation(net, tuple);

	if (exp) {

		pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",

			 ct, exp);
@@ -1038,7 +1038,7 @@ void nf_conntrack_cleanup(struct net *net) 
			     nf_conntrack_htable_size);



	nf_conntrack_acct_fini();

	nf_conntrack_expect_fini();

	nf_conntrack_expect_fini(net);

	nf_conntrack_helper_fini();

	nf_conntrack_proto_fini();

}
@@ -1173,7 +1173,7 @@ int nf_conntrack_init(struct net *net) 
	if (ret < 0)

		goto err_free_conntrack_slab;



	ret = nf_conntrack_expect_init();

	ret = nf_conntrack_expect_init(net);

	if (ret < 0)

		goto out_fini_proto;
@@ -1203,7 +1203,7 @@ int nf_conntrack_init(struct net *net) 
out_fini_helper:

	nf_conntrack_helper_fini();

out_fini_expect:

	nf_conntrack_expect_fini();

	nf_conntrack_expect_fini(net);

out_fini_proto:

	nf_conntrack_proto_fini();

err_free_conntrack_slab: