Skip to content

Commit adf0516

Browse files
ummakynesummakynes
committed
netfilter: remove ip_conntrack* sysctl compat code
This backward compatibility has been around for more than ten years, since Yasuyuki Kozakai introduced IPv6 in conntrack. These days, we have alternate /proc/net/nf_conntrack* entries, the ctnetlink interface and the conntrack utility got adopted by many people in the user community according to what I observed on the netfilter user mailing list. So let's get rid of this. Note that nf_conntrack_htable_size and unsigned int nf_conntrack_max do not need to be exported as symbol anymore. Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent cb1b69b commit adf0516

13 files changed

+7
-1009
lines changed

‎include/net/netfilter/nf_conntrack_l4proto.h

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -134,14 +134,6 @@ void nf_ct_l4proto_pernet_unregister(struct net *net,
134134
int nf_ct_l4proto_register(struct nf_conntrack_l4proto *proto);
135135
void nf_ct_l4proto_unregister(struct nf_conntrack_l4proto *proto);
136136

137-
static inline void nf_ct_kfree_compat_sysctl_table(struct nf_proto_net *pn)
138-
{
139-
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
140-
kfree(pn->ctl_compat_table);
141-
pn->ctl_compat_table = NULL;
142-
#endif
143-
}
144-
145137
/* Generic netlink helpers */
146138
int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
147139
const struct nf_conntrack_tuple *tuple);

‎include/net/netns/conntrack.h

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,6 @@ struct nf_proto_net {
1515
#ifdef CONFIG_SYSCTL
1616
struct ctl_table_header *ctl_table_header;
1717
struct ctl_table *ctl_table;
18-
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
19-
struct ctl_table_header *ctl_compat_header;
20-
struct ctl_table *ctl_compat_table;
21-
#endif
2218
#endif
2319
unsigned int users;
2420
};
@@ -58,10 +54,6 @@ struct nf_ip_net {
5854
struct nf_udp_net udp;
5955
struct nf_icmp_net icmp;
6056
struct nf_icmp_net icmpv6;
61-
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
62-
struct ctl_table_header *ctl_table_header;
63-
struct ctl_table *ctl_table;
64-
#endif
6557
};
6658

6759
struct ct_pcpu {

‎net/ipv4/netfilter/Kconfig

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,6 @@ config NF_CONNTRACK_IPV4
2525

2626
To compile it as a module, choose M here. If unsure, say N.
2727

28-
config NF_CONNTRACK_PROC_COMPAT
29-
bool "proc/sysctl compatibility with old connection tracking"
30-
depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4
31-
default y
32-
help
33-
This option enables /proc and sysctl compatibility with the old
34-
layer 3 dependent connection tracking. This is needed to keep
35-
old programs that have not been adapted to the new names working.
36-
37-
If unsure, say Y.
38-
3928
if NF_TABLES
4029

4130
config NF_TABLES_IPV4

‎net/ipv4/netfilter/Makefile

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,6 @@
44

55
# objects for l3 independent conntrack
66
nf_conntrack_ipv4-y := nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
7-
ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
8-
ifeq ($(CONFIG_PROC_FS),y)
9-
nf_conntrack_ipv4-objs += nf_conntrack_l3proto_ipv4_compat.o
10-
endif
11-
endif
127

138
# connection tracking
149
obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o

‎net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

Lines changed: 0 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -202,47 +202,6 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
202202
},
203203
};
204204

205-
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
206-
static int log_invalid_proto_min = 0;
207-
static int log_invalid_proto_max = 255;
208-
209-
static struct ctl_table ip_ct_sysctl_table[] = {
210-
{
211-
.procname = "ip_conntrack_max",
212-
.maxlen = sizeof(int),
213-
.mode = 0644,
214-
.proc_handler = proc_dointvec,
215-
},
216-
{
217-
.procname = "ip_conntrack_count",
218-
.maxlen = sizeof(int),
219-
.mode = 0444,
220-
.proc_handler = proc_dointvec,
221-
},
222-
{
223-
.procname = "ip_conntrack_buckets",
224-
.maxlen = sizeof(unsigned int),
225-
.mode = 0444,
226-
.proc_handler = proc_dointvec,
227-
},
228-
{
229-
.procname = "ip_conntrack_checksum",
230-
.maxlen = sizeof(int),
231-
.mode = 0644,
232-
.proc_handler = proc_dointvec,
233-
},
234-
{
235-
.procname = "ip_conntrack_log_invalid",
236-
.maxlen = sizeof(unsigned int),
237-
.mode = 0644,
238-
.proc_handler = proc_dointvec_minmax,
239-
.extra1 = &log_invalid_proto_min,
240-
.extra2 = &log_invalid_proto_max,
241-
},
242-
{ }
243-
};
244-
#endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */
245-
246205
/* Fast function for those who don't want to parse /proc (and I don't
247206
blame them). */
248207
/* Reversing the socket's dst/src point of view gives us the reply
@@ -350,20 +309,6 @@ static struct nf_sockopt_ops so_getorigdst = {
350309

351310
static int ipv4_init_net(struct net *net)
352311
{
353-
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
354-
struct nf_ip_net *in = &net->ct.nf_ct_proto;
355-
in->ctl_table = kmemdup(ip_ct_sysctl_table,
356-
sizeof(ip_ct_sysctl_table),
357-
GFP_KERNEL);
358-
if (!in->ctl_table)
359-
return -ENOMEM;
360-
361-
in->ctl_table[0].data = &nf_conntrack_max;
362-
in->ctl_table[1].data = &net->ct.count;
363-
in->ctl_table[2].data = &nf_conntrack_htable_size;
364-
in->ctl_table[3].data = &net->ct.sysctl_checksum;
365-
in->ctl_table[4].data = &net->ct.sysctl_log_invalid;
366-
#endif
367312
return 0;
368313
}
369314

@@ -379,9 +324,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
379324
.nlattr_tuple_size = ipv4_nlattr_tuple_size,
380325
.nlattr_to_tuple = ipv4_nlattr_to_tuple,
381326
.nla_policy = ipv4_nla_policy,
382-
#endif
383-
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
384-
.ctl_table_path = "net/ipv4/netfilter",
385327
#endif
386328
.init_net = ipv4_init_net,
387329
.me = THIS_MODULE,
@@ -492,16 +434,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
492434
goto cleanup_icmpv4;
493435
}
494436

495-
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
496-
ret = nf_conntrack_ipv4_compat_init();
497-
if (ret < 0)
498-
goto cleanup_proto;
499-
#endif
500437
return ret;
501-
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
502-
cleanup_proto:
503-
nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
504-
#endif
505438
cleanup_icmpv4:
506439
nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp);
507440
cleanup_udp4:
@@ -520,9 +453,6 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
520453
static void __exit nf_conntrack_l3proto_ipv4_fini(void)
521454
{
522455
synchronize_net();
523-
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
524-
nf_conntrack_ipv4_compat_fini();
525-
#endif
526456
nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
527457
nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp);
528458
nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udp4);

0 commit comments

Comments
 (0)