Skip to content

Commit b884fa4

Browse files
Florian Westphalummakynes
Florian Westphal
authored and
ummakynes
committed
netfilter: conntrack: unify sysctl handling
Due to historical reasons, all l4 trackers register their own sysctls. This leads to copy&pasted boilerplate code, that does exactly same thing, just with different data structure. Place all of this in a single file. This allows to remove the various ctl_table pointers from the ct_netns structure and reduces overall code size. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent 303e0c5 commit b884fa4

9 files changed

+391
-460
lines changed

‎net/netfilter/nf_conntrack_proto_dccp.c

Lines changed: 1 addition & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -724,90 +724,6 @@ dccp_timeout_nla_policy[CTA_TIMEOUT_DCCP_MAX+1] = {
724724
};
725725
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
726726

727-
#ifdef CONFIG_SYSCTL
728-
/* template, data assigned later */
729-
static struct ctl_table dccp_sysctl_table[] = {
730-
{
731-
.procname = "nf_conntrack_dccp_timeout_request",
732-
.maxlen = sizeof(unsigned int),
733-
.mode = 0644,
734-
.proc_handler = proc_dointvec_jiffies,
735-
},
736-
{
737-
.procname = "nf_conntrack_dccp_timeout_respond",
738-
.maxlen = sizeof(unsigned int),
739-
.mode = 0644,
740-
.proc_handler = proc_dointvec_jiffies,
741-
},
742-
{
743-
.procname = "nf_conntrack_dccp_timeout_partopen",
744-
.maxlen = sizeof(unsigned int),
745-
.mode = 0644,
746-
.proc_handler = proc_dointvec_jiffies,
747-
},
748-
{
749-
.procname = "nf_conntrack_dccp_timeout_open",
750-
.maxlen = sizeof(unsigned int),
751-
.mode = 0644,
752-
.proc_handler = proc_dointvec_jiffies,
753-
},
754-
{
755-
.procname = "nf_conntrack_dccp_timeout_closereq",
756-
.maxlen = sizeof(unsigned int),
757-
.mode = 0644,
758-
.proc_handler = proc_dointvec_jiffies,
759-
},
760-
{
761-
.procname = "nf_conntrack_dccp_timeout_closing",
762-
.maxlen = sizeof(unsigned int),
763-
.mode = 0644,
764-
.proc_handler = proc_dointvec_jiffies,
765-
},
766-
{
767-
.procname = "nf_conntrack_dccp_timeout_timewait",
768-
.maxlen = sizeof(unsigned int),
769-
.mode = 0644,
770-
.proc_handler = proc_dointvec_jiffies,
771-
},
772-
{
773-
.procname = "nf_conntrack_dccp_loose",
774-
.maxlen = sizeof(int),
775-
.mode = 0644,
776-
.proc_handler = proc_dointvec,
777-
},
778-
{ }
779-
};
780-
#endif /* CONFIG_SYSCTL */
781-
782-
static int dccp_kmemdup_sysctl_table(struct net *net, struct nf_proto_net *pn,
783-
struct nf_dccp_net *dn)
784-
{
785-
#ifdef CONFIG_SYSCTL
786-
if (pn->ctl_table)
787-
return 0;
788-
789-
pn->ctl_table = kmemdup(dccp_sysctl_table,
790-
sizeof(dccp_sysctl_table),
791-
GFP_KERNEL);
792-
if (!pn->ctl_table)
793-
return -ENOMEM;
794-
795-
pn->ctl_table[0].data = &dn->dccp_timeout[CT_DCCP_REQUEST];
796-
pn->ctl_table[1].data = &dn->dccp_timeout[CT_DCCP_RESPOND];
797-
pn->ctl_table[2].data = &dn->dccp_timeout[CT_DCCP_PARTOPEN];
798-
pn->ctl_table[3].data = &dn->dccp_timeout[CT_DCCP_OPEN];
799-
pn->ctl_table[4].data = &dn->dccp_timeout[CT_DCCP_CLOSEREQ];
800-
pn->ctl_table[5].data = &dn->dccp_timeout[CT_DCCP_CLOSING];
801-
pn->ctl_table[6].data = &dn->dccp_timeout[CT_DCCP_TIMEWAIT];
802-
pn->ctl_table[7].data = &dn->dccp_loose;
803-
804-
/* Don't export sysctls to unprivileged users */
805-
if (net->user_ns != &init_user_ns)
806-
pn->ctl_table[0].procname = NULL;
807-
#endif
808-
return 0;
809-
}
810-
811727
static int dccp_init_net(struct net *net)
812728
{
813729
struct nf_dccp_net *dn = nf_dccp_pernet(net);
@@ -830,7 +746,7 @@ static int dccp_init_net(struct net *net)
830746
dn->dccp_timeout[CT_DCCP_NONE] = dn->dccp_timeout[CT_DCCP_REQUEST];
831747
}
832748

833-
return dccp_kmemdup_sysctl_table(net, pn, dn);
749+
return 0;
834750
}
835751

836752
static struct nf_proto_net *dccp_get_net_proto(struct net *net)

‎net/netfilter/nf_conntrack_proto_generic.c

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -60,41 +60,13 @@ generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
6060
};
6161
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
6262

63-
#ifdef CONFIG_SYSCTL
64-
static struct ctl_table generic_sysctl_table[] = {
65-
{
66-
.procname = "nf_conntrack_generic_timeout",
67-
.maxlen = sizeof(unsigned int),
68-
.mode = 0644,
69-
.proc_handler = proc_dointvec_jiffies,
70-
},
71-
{ }
72-
};
73-
#endif /* CONFIG_SYSCTL */
74-
75-
static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn,
76-
struct nf_generic_net *gn)
77-
{
78-
#ifdef CONFIG_SYSCTL
79-
pn->ctl_table = kmemdup(generic_sysctl_table,
80-
sizeof(generic_sysctl_table),
81-
GFP_KERNEL);
82-
if (!pn->ctl_table)
83-
return -ENOMEM;
84-
85-
pn->ctl_table[0].data = &gn->timeout;
86-
#endif
87-
return 0;
88-
}
89-
9063
static int generic_init_net(struct net *net)
9164
{
9265
struct nf_generic_net *gn = nf_generic_pernet(net);
93-
struct nf_proto_net *pn = &gn->pn;
9466

9567
gn->timeout = nf_ct_generic_timeout;
9668

97-
return generic_kmemdup_sysctl_table(pn, gn);
69+
return 0;
9870
}
9971

10072
static struct nf_proto_net *generic_get_net_proto(struct net *net)

‎net/netfilter/nf_conntrack_proto_gre.c

Lines changed: 1 addition & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -313,46 +313,6 @@ gre_timeout_nla_policy[CTA_TIMEOUT_GRE_MAX+1] = {
313313
};
314314
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
315315

316-
#ifdef CONFIG_SYSCTL
317-
static struct ctl_table gre_sysctl_table[] = {
318-
{
319-
.procname = "nf_conntrack_gre_timeout",
320-
.maxlen = sizeof(unsigned int),
321-
.mode = 0644,
322-
.proc_handler = proc_dointvec_jiffies,
323-
},
324-
{
325-
.procname = "nf_conntrack_gre_timeout_stream",
326-
.maxlen = sizeof(unsigned int),
327-
.mode = 0644,
328-
.proc_handler = proc_dointvec_jiffies,
329-
},
330-
{}
331-
};
332-
#endif
333-
334-
static int gre_kmemdup_sysctl_table(struct net *net)
335-
{
336-
#ifdef CONFIG_SYSCTL
337-
struct nf_gre_net *net_gre = gre_pernet(net);
338-
struct nf_proto_net *nf = &net_gre->nf;
339-
int i;
340-
341-
if (nf->ctl_table)
342-
return 0;
343-
344-
nf->ctl_table = kmemdup(gre_sysctl_table,
345-
sizeof(gre_sysctl_table),
346-
GFP_KERNEL);
347-
if (!nf->ctl_table)
348-
return -ENOMEM;
349-
350-
for (i = 0; i < GRE_CT_MAX; i++)
351-
nf->ctl_table[i].data = &net_gre->timeouts[i];
352-
#endif
353-
return 0;
354-
}
355-
356316
static int gre_init_net(struct net *net)
357317
{
358318
struct nf_gre_net *net_gre = gre_pernet(net);
@@ -362,7 +322,7 @@ static int gre_init_net(struct net *net)
362322
for (i = 0; i < GRE_CT_MAX; i++)
363323
net_gre->timeouts[i] = gre_timeouts[i];
364324

365-
return gre_kmemdup_sysctl_table(net);
325+
return 0;
366326
}
367327

368328
/* protocol helper struct */

‎net/netfilter/nf_conntrack_proto_icmp.c

Lines changed: 1 addition & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -298,41 +298,14 @@ icmp_timeout_nla_policy[CTA_TIMEOUT_ICMP_MAX+1] = {
298298
};
299299
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
300300

301-
#ifdef CONFIG_SYSCTL
302-
static struct ctl_table icmp_sysctl_table[] = {
303-
{
304-
.procname = "nf_conntrack_icmp_timeout",
305-
.maxlen = sizeof(unsigned int),
306-
.mode = 0644,
307-
.proc_handler = proc_dointvec_jiffies,
308-
},
309-
{ }
310-
};
311-
#endif /* CONFIG_SYSCTL */
312-
313-
static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn,
314-
struct nf_icmp_net *in)
315-
{
316-
#ifdef CONFIG_SYSCTL
317-
pn->ctl_table = kmemdup(icmp_sysctl_table,
318-
sizeof(icmp_sysctl_table),
319-
GFP_KERNEL);
320-
if (!pn->ctl_table)
321-
return -ENOMEM;
322-
323-
pn->ctl_table[0].data = &in->timeout;
324-
#endif
325-
return 0;
326-
}
327301

328302
static int icmp_init_net(struct net *net)
329303
{
330304
struct nf_icmp_net *in = nf_icmp_pernet(net);
331-
struct nf_proto_net *pn = &in->pn;
332305

333306
in->timeout = nf_ct_icmp_timeout;
334307

335-
return icmp_kmemdup_sysctl_table(pn, in);
308+
return 0;
336309
}
337310

338311
static struct nf_proto_net *icmp_get_net_proto(struct net *net)

‎net/netfilter/nf_conntrack_proto_icmpv6.c

Lines changed: 1 addition & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -309,41 +309,14 @@ icmpv6_timeout_nla_policy[CTA_TIMEOUT_ICMPV6_MAX+1] = {
309309
};
310310
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
311311

312-
#ifdef CONFIG_SYSCTL
313-
static struct ctl_table icmpv6_sysctl_table[] = {
314-
{
315-
.procname = "nf_conntrack_icmpv6_timeout",
316-
.maxlen = sizeof(unsigned int),
317-
.mode = 0644,
318-
.proc_handler = proc_dointvec_jiffies,
319-
},
320-
{ }
321-
};
322-
#endif /* CONFIG_SYSCTL */
323-
324-
static int icmpv6_kmemdup_sysctl_table(struct nf_proto_net *pn,
325-
struct nf_icmp_net *in)
326-
{
327-
#ifdef CONFIG_SYSCTL
328-
pn->ctl_table = kmemdup(icmpv6_sysctl_table,
329-
sizeof(icmpv6_sysctl_table),
330-
GFP_KERNEL);
331-
if (!pn->ctl_table)
332-
return -ENOMEM;
333-
334-
pn->ctl_table[0].data = &in->timeout;
335-
#endif
336-
return 0;
337-
}
338312

339313
static int icmpv6_init_net(struct net *net)
340314
{
341315
struct nf_icmp_net *in = nf_icmpv6_pernet(net);
342-
struct nf_proto_net *pn = &in->pn;
343316

344317
in->timeout = nf_ct_icmpv6_timeout;
345318

346-
return icmpv6_kmemdup_sysctl_table(pn, in);
319+
return 0;
347320
}
348321

349322
static struct nf_proto_net *icmpv6_get_net_proto(struct net *net)

‎net/netfilter/nf_conntrack_proto_sctp.c

Lines changed: 1 addition & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -642,93 +642,6 @@ sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
642642
};
643643
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
644644

645-
646-
#ifdef CONFIG_SYSCTL
647-
static struct ctl_table sctp_sysctl_table[] = {
648-
{
649-
.procname = "nf_conntrack_sctp_timeout_closed",
650-
.maxlen = sizeof(unsigned int),
651-
.mode = 0644,
652-
.proc_handler = proc_dointvec_jiffies,
653-
},
654-
{
655-
.procname = "nf_conntrack_sctp_timeout_cookie_wait",
656-
.maxlen = sizeof(unsigned int),
657-
.mode = 0644,
658-
.proc_handler = proc_dointvec_jiffies,
659-
},
660-
{
661-
.procname = "nf_conntrack_sctp_timeout_cookie_echoed",
662-
.maxlen = sizeof(unsigned int),
663-
.mode = 0644,
664-
.proc_handler = proc_dointvec_jiffies,
665-
},
666-
{
667-
.procname = "nf_conntrack_sctp_timeout_established",
668-
.maxlen = sizeof(unsigned int),
669-
.mode = 0644,
670-
.proc_handler = proc_dointvec_jiffies,
671-
},
672-
{
673-
.procname = "nf_conntrack_sctp_timeout_shutdown_sent",
674-
.maxlen = sizeof(unsigned int),
675-
.mode = 0644,
676-
.proc_handler = proc_dointvec_jiffies,
677-
},
678-
{
679-
.procname = "nf_conntrack_sctp_timeout_shutdown_recd",
680-
.maxlen = sizeof(unsigned int),
681-
.mode = 0644,
682-
.proc_handler = proc_dointvec_jiffies,
683-
},
684-
{
685-
.procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
686-
.maxlen = sizeof(unsigned int),
687-
.mode = 0644,
688-
.proc_handler = proc_dointvec_jiffies,
689-
},
690-
{
691-
.procname = "nf_conntrack_sctp_timeout_heartbeat_sent",
692-
.maxlen = sizeof(unsigned int),
693-
.mode = 0644,
694-
.proc_handler = proc_dointvec_jiffies,
695-
},
696-
{
697-
.procname = "nf_conntrack_sctp_timeout_heartbeat_acked",
698-
.maxlen = sizeof(unsigned int),
699-
.mode = 0644,
700-
.proc_handler = proc_dointvec_jiffies,
701-
},
702-
{ }
703-
};
704-
#endif
705-
706-
static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn,
707-
struct nf_sctp_net *sn)
708-
{
709-
#ifdef CONFIG_SYSCTL
710-
if (pn->ctl_table)
711-
return 0;
712-
713-
pn->ctl_table = kmemdup(sctp_sysctl_table,
714-
sizeof(sctp_sysctl_table),
715-
GFP_KERNEL);
716-
if (!pn->ctl_table)
717-
return -ENOMEM;
718-
719-
pn->ctl_table[0].data = &sn->timeouts[SCTP_CONNTRACK_CLOSED];
720-
pn->ctl_table[1].data = &sn->timeouts[SCTP_CONNTRACK_COOKIE_WAIT];
721-
pn->ctl_table[2].data = &sn->timeouts[SCTP_CONNTRACK_COOKIE_ECHOED];
722-
pn->ctl_table[3].data = &sn->timeouts[SCTP_CONNTRACK_ESTABLISHED];
723-
pn->ctl_table[4].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT];
724-
pn->ctl_table[5].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD];
725-
pn->ctl_table[6].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT];
726-
pn->ctl_table[7].data = &sn->timeouts[SCTP_CONNTRACK_HEARTBEAT_SENT];
727-
pn->ctl_table[8].data = &sn->timeouts[SCTP_CONNTRACK_HEARTBEAT_ACKED];
728-
#endif
729-
return 0;
730-
}
731-
732645
static int sctp_init_net(struct net *net)
733646
{
734647
struct nf_sctp_net *sn = nf_sctp_pernet(net);
@@ -746,7 +659,7 @@ static int sctp_init_net(struct net *net)
746659
sn->timeouts[0] = sctp_timeouts[SCTP_CONNTRACK_CLOSED];
747660
}
748661

749-
return sctp_kmemdup_sysctl_table(pn, sn);
662+
return 0;
750663
}
751664

752665
static struct nf_proto_net *sctp_get_net_proto(struct net *net)

0 commit comments

Comments
 (0)