From d446a8202c81d95f91b1682fc67e7fadd9a31389 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 9 Jun 2011 21:03:07 +0200 Subject: [PATCH 1/5] netfilter: xtables: move ipt_ecn to xt_ecn Prepare the ECN match for augmentation by an IPv6 counterpart. Since no symbol dependencies to ipv6.ko are added, having a single ecn match module is the more so welcome. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/Kbuild | 1 + include/linux/netfilter/xt_ecn.h | 35 +++++++++++++++++++ include/linux/netfilter_ipv4/ipt_ecn.h | 31 +--------------- net/ipv4/netfilter/Kconfig | 10 +++--- net/ipv4/netfilter/Makefile | 1 - net/netfilter/Kconfig | 9 +++++ net/netfilter/Makefile | 1 + .../ipt_ecn.c => netfilter/xt_ecn.c} | 1 + 8 files changed, 53 insertions(+), 36 deletions(-) create mode 100644 include/linux/netfilter/xt_ecn.h rename net/{ipv4/netfilter/ipt_ecn.c => netfilter/xt_ecn.c} (99%) diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild index e630a2ed4f18..e144f54185c0 100644 --- a/include/linux/netfilter/Kbuild +++ b/include/linux/netfilter/Kbuild @@ -43,6 +43,7 @@ header-y += xt_cpu.h header-y += xt_dccp.h header-y += xt_devgroup.h header-y += xt_dscp.h +header-y += xt_ecn.h header-y += xt_esp.h header-y += xt_hashlimit.h header-y += xt_helper.h diff --git a/include/linux/netfilter/xt_ecn.h b/include/linux/netfilter/xt_ecn.h new file mode 100644 index 000000000000..065c1a537e5d --- /dev/null +++ b/include/linux/netfilter/xt_ecn.h @@ -0,0 +1,35 @@ +/* iptables module for matching the ECN header in IPv4 and TCP header + * + * (C) 2002 Harald Welte + * + * This software is distributed under GNU GPL v2, 1991 + * + * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp +*/ +#ifndef _XT_ECN_H +#define _XT_ECN_H + +#include +#include + +#define IPT_ECN_IP_MASK (~XT_DSCP_MASK) + +#define IPT_ECN_OP_MATCH_IP 0x01 +#define IPT_ECN_OP_MATCH_ECE 0x10 +#define IPT_ECN_OP_MATCH_CWR 0x20 + +#define IPT_ECN_OP_MATCH_MASK 0xce + +/* match info */ +struct ipt_ecn_info { + __u8 operation; + __u8 invert; + __u8 ip_ect; + union { + struct { + __u8 ect; + } tcp; + } proto; +}; + +#endif /* _XT_ECN_H */ diff --git a/include/linux/netfilter_ipv4/ipt_ecn.h b/include/linux/netfilter_ipv4/ipt_ecn.h index eabf95fb7d3e..b1124ec76190 100644 --- a/include/linux/netfilter_ipv4/ipt_ecn.h +++ b/include/linux/netfilter_ipv4/ipt_ecn.h @@ -1,35 +1,6 @@ -/* iptables module for matching the ECN header in IPv4 and TCP header - * - * (C) 2002 Harald Welte - * - * This software is distributed under GNU GPL v2, 1991 - * - * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp -*/ #ifndef _IPT_ECN_H #define _IPT_ECN_H -#include -#include - -#define IPT_ECN_IP_MASK (~XT_DSCP_MASK) - -#define IPT_ECN_OP_MATCH_IP 0x01 -#define IPT_ECN_OP_MATCH_ECE 0x10 -#define IPT_ECN_OP_MATCH_CWR 0x20 - -#define IPT_ECN_OP_MATCH_MASK 0xce - -/* match info */ -struct ipt_ecn_info { - __u8 operation; - __u8 invert; - __u8 ip_ect; - union { - struct { - __u8 ect; - } tcp; - } proto; -}; +#include #endif /* _IPT_ECN_H */ diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index 7e1f5cdaf11e..53b9c79c8025 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -76,11 +76,11 @@ config IP_NF_MATCH_AH config IP_NF_MATCH_ECN tristate '"ecn" match support' depends on NETFILTER_ADVANCED - help - This option adds a `ECN' match, which allows you to match against - the IPv4 and TCP header ECN fields. - - To compile it as a module, choose M here. If unsure, say N. + select NETFILTER_XT_MATCH_ECN + ---help--- + This is a backwards-compat option for the user's convenience + (e.g. when running oldconfig). It selects + CONFIG_NETFILTER_XT_MATCH_ECN. config IP_NF_MATCH_RPFILTER tristate '"rpfilter" reverse path filter match support' diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile index 123dd88cea53..213a462b739b 100644 --- a/net/ipv4/netfilter/Makefile +++ b/net/ipv4/netfilter/Makefile @@ -49,7 +49,6 @@ obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o # matches obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o -obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o obj-$(CONFIG_IP_NF_MATCH_RPFILTER) += ipt_rpfilter.o # targets diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index bac93ba60778..20388a97df66 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -778,6 +778,15 @@ config NETFILTER_XT_MATCH_DSCP To compile it as a module, choose M here. If unsure, say N. +config NETFILTER_XT_MATCH_ECN + tristate '"ecn" match support' + depends on NETFILTER_ADVANCED + ---help--- + This option adds an "ECN" match, which allows you to match against + the IPv4 and TCP header ECN fields. + + To compile it as a module, choose M here. If unsure, say N. + config NETFILTER_XT_MATCH_ESP tristate '"esp" match support' depends on NETFILTER_ADVANCED diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile index b2eee4df8168..40f4c3d636c5 100644 --- a/net/netfilter/Makefile +++ b/net/netfilter/Makefile @@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CPU) += xt_cpu.o obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o +obj-$(CONFIG_NETFILTER_XT_MATCH_ECN) += xt_ecn.o obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/netfilter/xt_ecn.c similarity index 99% rename from net/ipv4/netfilter/ipt_ecn.c rename to net/netfilter/xt_ecn.c index 2b57e52c746c..2c198f5e3efb 100644 --- a/net/ipv4/netfilter/ipt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -21,6 +21,7 @@ MODULE_AUTHOR("Harald Welte "); MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4"); MODULE_LICENSE("GPL"); +MODULE_ALIAS("ipt_ecn"); static inline bool match_ip(const struct sk_buff *skb, const struct ipt_ecn_info *einfo) From a4c6f9d3636db538025f9622c008192a0835cc23 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 9 Jun 2011 21:15:37 +0200 Subject: [PATCH 2/5] netfilter: xtables: give xt_ecn its own name Use the new macro and struct names in xt_ecn.h, and put the old definitions into a definition-forwarding ipt_ecn.h. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/xt_ecn.h | 12 ++++----- include/linux/netfilter_ipv4/ipt_ecn.h | 11 ++++++++- net/netfilter/xt_ecn.c | 34 +++++++++++++------------- 3 files changed, 33 insertions(+), 24 deletions(-) diff --git a/include/linux/netfilter/xt_ecn.h b/include/linux/netfilter/xt_ecn.h index 065c1a537e5d..7158fca364f2 100644 --- a/include/linux/netfilter/xt_ecn.h +++ b/include/linux/netfilter/xt_ecn.h @@ -12,16 +12,16 @@ #include #include -#define IPT_ECN_IP_MASK (~XT_DSCP_MASK) +#define XT_ECN_IP_MASK (~XT_DSCP_MASK) -#define IPT_ECN_OP_MATCH_IP 0x01 -#define IPT_ECN_OP_MATCH_ECE 0x10 -#define IPT_ECN_OP_MATCH_CWR 0x20 +#define XT_ECN_OP_MATCH_IP 0x01 +#define XT_ECN_OP_MATCH_ECE 0x10 +#define XT_ECN_OP_MATCH_CWR 0x20 -#define IPT_ECN_OP_MATCH_MASK 0xce +#define XT_ECN_OP_MATCH_MASK 0xce /* match info */ -struct ipt_ecn_info { +struct xt_ecn_info { __u8 operation; __u8 invert; __u8 ip_ect; diff --git a/include/linux/netfilter_ipv4/ipt_ecn.h b/include/linux/netfilter_ipv4/ipt_ecn.h index b1124ec76190..0e0c063dbf60 100644 --- a/include/linux/netfilter_ipv4/ipt_ecn.h +++ b/include/linux/netfilter_ipv4/ipt_ecn.h @@ -2,5 +2,14 @@ #define _IPT_ECN_H #include +#define ipt_ecn_info xt_ecn_info -#endif /* _IPT_ECN_H */ +enum { + IPT_ECN_IP_MASK = XT_ECN_IP_MASK, + IPT_ECN_OP_MATCH_IP = XT_ECN_OP_MATCH_IP, + IPT_ECN_OP_MATCH_ECE = XT_ECN_OP_MATCH_ECE, + IPT_ECN_OP_MATCH_CWR = XT_ECN_OP_MATCH_CWR, + IPT_ECN_OP_MATCH_MASK = XT_ECN_OP_MATCH_MASK, +}; + +#endif /* IPT_ECN_H */ diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c index 2c198f5e3efb..3ebb3dcace65 100644 --- a/net/netfilter/xt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -15,8 +15,8 @@ #include #include +#include #include -#include MODULE_AUTHOR("Harald Welte "); MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4"); @@ -24,14 +24,14 @@ MODULE_LICENSE("GPL"); MODULE_ALIAS("ipt_ecn"); static inline bool match_ip(const struct sk_buff *skb, - const struct ipt_ecn_info *einfo) + const struct xt_ecn_info *einfo) { - return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^ - !!(einfo->invert & IPT_ECN_OP_MATCH_IP); + return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ + !!(einfo->invert & XT_ECN_OP_MATCH_IP); } static inline bool match_tcp(const struct sk_buff *skb, - const struct ipt_ecn_info *einfo, + const struct xt_ecn_info *einfo, bool *hotdrop) { struct tcphdr _tcph; @@ -46,8 +46,8 @@ static inline bool match_tcp(const struct sk_buff *skb, return false; } - if (einfo->operation & IPT_ECN_OP_MATCH_ECE) { - if (einfo->invert & IPT_ECN_OP_MATCH_ECE) { + if (einfo->operation & XT_ECN_OP_MATCH_ECE) { + if (einfo->invert & XT_ECN_OP_MATCH_ECE) { if (th->ece == 1) return false; } else { @@ -56,8 +56,8 @@ static inline bool match_tcp(const struct sk_buff *skb, } } - if (einfo->operation & IPT_ECN_OP_MATCH_CWR) { - if (einfo->invert & IPT_ECN_OP_MATCH_CWR) { + if (einfo->operation & XT_ECN_OP_MATCH_CWR) { + if (einfo->invert & XT_ECN_OP_MATCH_CWR) { if (th->cwr == 1) return false; } else { @@ -71,13 +71,13 @@ static inline bool match_tcp(const struct sk_buff *skb, static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) { - const struct ipt_ecn_info *info = par->matchinfo; + const struct xt_ecn_info *info = par->matchinfo; - if (info->operation & IPT_ECN_OP_MATCH_IP) + if (info->operation & XT_ECN_OP_MATCH_IP) if (!match_ip(skb, info)) return false; - if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) { + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) { if (!match_tcp(skb, info, &par->hotdrop)) return false; } @@ -87,16 +87,16 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) static int ecn_mt_check(const struct xt_mtchk_param *par) { - const struct ipt_ecn_info *info = par->matchinfo; + const struct xt_ecn_info *info = par->matchinfo; const struct ipt_ip *ip = par->entryinfo; - if (info->operation & IPT_ECN_OP_MATCH_MASK) + if (info->operation & XT_ECN_OP_MATCH_MASK) return -EINVAL; - if (info->invert & IPT_ECN_OP_MATCH_MASK) + if (info->invert & XT_ECN_OP_MATCH_MASK) return -EINVAL; - if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) && + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) { pr_info("cannot match TCP bits in rule for non-tcp packets\n"); return -EINVAL; @@ -109,7 +109,7 @@ static struct xt_match ecn_mt_reg __read_mostly = { .name = "ecn", .family = NFPROTO_IPV4, .match = ecn_mt, - .matchsize = sizeof(struct ipt_ecn_info), + .matchsize = sizeof(struct xt_ecn_info), .checkentry = ecn_mt_check, .me = THIS_MODULE, }; From af0d29cd2a732f70882e6122b9f9df8b0d84515e Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Thu, 9 Jun 2011 15:20:27 +0200 Subject: [PATCH 3/5] netfilter: xtables: add an IPv6 capable version of the ECN match References: http://www.spinics.net/lists/netfilter-devel/msg18875.html Augment xt_ecn by facilities to match on IPv6 packets' DSCP/TOS field similar to how it is already done for the IPv4 packet field. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_ecn.c | 106 +++++++++++++++++++++++++++++++---------- 1 file changed, 80 insertions(+), 26 deletions(-) diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c index 3ebb3dcace65..6ccc35d6cb11 100644 --- a/net/netfilter/xt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -1,6 +1,8 @@ -/* IP tables module for matching the value of the IPv4 and TCP ECN bits +/* + * Xtables module for matching the value of the IPv4/IPv6 and TCP ECN bits * * (C) 2002 by Harald Welte + * (C) 2011 Patrick McHardy * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -17,32 +19,25 @@ #include #include #include +#include MODULE_AUTHOR("Harald Welte "); -MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4"); +MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match"); MODULE_LICENSE("GPL"); MODULE_ALIAS("ipt_ecn"); +MODULE_ALIAS("ip6t_ecn"); -static inline bool match_ip(const struct sk_buff *skb, - const struct xt_ecn_info *einfo) -{ - return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ - !!(einfo->invert & XT_ECN_OP_MATCH_IP); -} - -static inline bool match_tcp(const struct sk_buff *skb, - const struct xt_ecn_info *einfo, - bool *hotdrop) +static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par) { + const struct xt_ecn_info *einfo = par->matchinfo; struct tcphdr _tcph; const struct tcphdr *th; /* In practice, TCP match does this, so can't fail. But let's * be good citizens. */ - th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph); + th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph); if (th == NULL) { - *hotdrop = false; return false; } @@ -69,7 +64,14 @@ static inline bool match_tcp(const struct sk_buff *skb, return true; } -static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) +static inline bool match_ip(const struct sk_buff *skb, + const struct xt_ecn_info *einfo) +{ + return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ + !!(einfo->invert & XT_ECN_OP_MATCH_IP); +} + +static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par) { const struct xt_ecn_info *info = par->matchinfo; @@ -78,14 +80,14 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) return false; if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) { - if (!match_tcp(skb, info, &par->hotdrop)) + if (!match_tcp(skb, par)) return false; } return true; } -static int ecn_mt_check(const struct xt_mtchk_param *par) +static int ecn_mt_check4(const struct xt_mtchk_param *par) { const struct xt_ecn_info *info = par->matchinfo; const struct ipt_ip *ip = par->entryinfo; @@ -105,23 +107,75 @@ static int ecn_mt_check(const struct xt_mtchk_param *par) return 0; } -static struct xt_match ecn_mt_reg __read_mostly = { - .name = "ecn", - .family = NFPROTO_IPV4, - .match = ecn_mt, - .matchsize = sizeof(struct xt_ecn_info), - .checkentry = ecn_mt_check, - .me = THIS_MODULE, +static inline bool match_ipv6(const struct sk_buff *skb, + const struct xt_ecn_info *einfo) +{ + return (((ipv6_hdr(skb)->flow_lbl[0] >> 4) & XT_ECN_IP_MASK) == + einfo->ip_ect) ^ + !!(einfo->invert & XT_ECN_OP_MATCH_IP); +} + +static bool ecn_mt6(const struct sk_buff *skb, struct xt_action_param *par) +{ + const struct xt_ecn_info *info = par->matchinfo; + + if (info->operation & XT_ECN_OP_MATCH_IP && !match_ipv6(skb, info)) + return false; + + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && + !match_tcp(skb, par)) + return false; + + return true; +} + +static int ecn_mt_check6(const struct xt_mtchk_param *par) +{ + const struct xt_ecn_info *info = par->matchinfo; + const struct ip6t_ip6 *ip = par->entryinfo; + + if (info->operation & XT_ECN_OP_MATCH_MASK) + return -EINVAL; + + if (info->invert & XT_ECN_OP_MATCH_MASK) + return -EINVAL; + + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && + (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) { + pr_info("cannot match TCP bits in rule for non-tcp packets\n"); + return -EINVAL; + } + + return 0; +} + +static struct xt_match ecn_mt_reg[] __read_mostly = { + { + .name = "ecn", + .family = NFPROTO_IPV4, + .match = ecn_mt4, + .matchsize = sizeof(struct xt_ecn_info), + .checkentry = ecn_mt_check4, + .me = THIS_MODULE, + }, + { + .name = "ecn", + .family = NFPROTO_IPV6, + .match = ecn_mt6, + .matchsize = sizeof(struct xt_ecn_info), + .checkentry = ecn_mt_check6, + .me = THIS_MODULE, + }, }; static int __init ecn_mt_init(void) { - return xt_register_match(&ecn_mt_reg); + return xt_register_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg)); } static void __exit ecn_mt_exit(void) { - xt_unregister_match(&ecn_mt_reg); + xt_unregister_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg)); } module_init(ecn_mt_init); From 42c344a3bc6bb2eb4c0bef98d24d53adda255154 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 9 Jun 2011 22:16:50 +0200 Subject: [PATCH 4/5] netfilter: xtables: collapse conditions in xt_ecn One simplification of an if clause. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_ecn.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c index 6ccc35d6cb11..3c831a8efebc 100644 --- a/net/netfilter/xt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -37,9 +37,8 @@ static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par) * be good citizens. */ th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph); - if (th == NULL) { + if (th == NULL) return false; - } if (einfo->operation & XT_ECN_OP_MATCH_ECE) { if (einfo->invert & XT_ECN_OP_MATCH_ECE) { @@ -75,14 +74,12 @@ static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par) { const struct xt_ecn_info *info = par->matchinfo; - if (info->operation & XT_ECN_OP_MATCH_IP) - if (!match_ip(skb, info)) - return false; + if (info->operation & XT_ECN_OP_MATCH_IP && !match_ip(skb, info)) + return false; - if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) { - if (!match_tcp(skb, par)) - return false; - } + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && + !match_tcp(skb, par)) + return false; return true; } From 54b07dca68557b0952585b5f4834cd0dd86eba35 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 21 Apr 2011 09:32:45 +0200 Subject: [PATCH 5/5] netfilter: provide config option to disable ancient procfs parts Using /proc/net/nf_conntrack has been deprecated in favour of the conntrack(8) tool. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- net/ipv4/netfilter/Kconfig | 2 +- net/netfilter/Kconfig | 10 ++++++++++ net/netfilter/nf_conntrack_expect.c | 12 ++++++------ net/netfilter/nf_conntrack_standalone.c | 4 ++-- 4 files changed, 19 insertions(+), 9 deletions(-) diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index 53b9c79c8025..74dfc9e5211f 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -27,7 +27,7 @@ config NF_CONNTRACK_IPV4 config NF_CONNTRACK_PROC_COMPAT bool "proc/sysctl compatibility with old connection tracking" - depends on NF_CONNTRACK_IPV4 + depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4 default y help This option enables /proc and sysctl compatibility with the old diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index 20388a97df66..f6275a0f1ea7 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -83,6 +83,16 @@ config NF_CONNTRACK_ZONES If unsure, say `N'. +config NF_CONNTRACK_PROCFS + bool "Supply CT list in procfs (OBSOLETE)" + default y + depends on PROC_FS + ---help--- + This option enables for the list of known conntrack entries + to be shown in procfs under net/netfilter/nf_conntrack. This + is considered obsolete in favor of using the conntrack(8) + tool which uses Netlink. + config NF_CONNTRACK_EVENTS bool "Connection tracking events" depends on NETFILTER_ADVANCED diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index bebb1675e6ff..4147ba3f653c 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -455,7 +455,7 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, } EXPORT_SYMBOL_GPL(nf_ct_expect_related_report); -#ifdef CONFIG_PROC_FS +#ifdef CONFIG_NF_CONNTRACK_PROCFS struct ct_expect_iter_state { struct seq_net_private p; unsigned int bucket; @@ -583,25 +583,25 @@ static const struct file_operations exp_file_ops = { .llseek = seq_lseek, .release = seq_release_net, }; -#endif /* CONFIG_PROC_FS */ +#endif /* CONFIG_NF_CONNTRACK_PROCFS */ static int exp_proc_init(struct net *net) { -#ifdef CONFIG_PROC_FS +#ifdef CONFIG_NF_CONNTRACK_PROCFS struct proc_dir_entry *proc; proc = proc_net_fops_create(net, "nf_conntrack_expect", 0440, &exp_file_ops); if (!proc) return -ENOMEM; -#endif /* CONFIG_PROC_FS */ +#endif /* CONFIG_NF_CONNTRACK_PROCFS */ return 0; } static void exp_proc_remove(struct net *net) { -#ifdef CONFIG_PROC_FS +#ifdef CONFIG_NF_CONNTRACK_PROCFS proc_net_remove(net, "nf_conntrack_expect"); -#endif /* CONFIG_PROC_FS */ +#endif /* CONFIG_NF_CONNTRACK_PROCFS */ } module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400); diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index 05e9feb101c3..885f5ab9bc28 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -34,7 +34,7 @@ MODULE_LICENSE("GPL"); -#ifdef CONFIG_PROC_FS +#ifdef CONFIG_NF_CONNTRACK_PROCFS int print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple, const struct nf_conntrack_l3proto *l3proto, @@ -396,7 +396,7 @@ static int nf_conntrack_standalone_init_proc(struct net *net) static void nf_conntrack_standalone_fini_proc(struct net *net) { } -#endif /* CONFIG_PROC_FS */ +#endif /* CONFIG_NF_CONNTRACK_PROCFS */ /* Sysctl support */