Skip to content

L
linux
Commit 8264deb8 authored by Gao feng's avatar Gao feng Committed by Pablo Neira Ayuso
Browse files
Options

netfilter: nf_conntrack: add namespace support for cttimeout 

This patch adds namespace support for cttimeout.
Acked-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: default avatarGao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent e76d0af5
Hide whitespace changes
Inline Side-by-side
Showing with 48 additions and 27 deletions
include/net/netfilter/nf_conntrack_l4proto.h
View file @ 8264deb8
...@@ -87,7 +87,8 @@ struct nf_conntrack_l4proto { ...@@ -87,7 +87,8 @@ struct nf_conntrack_l4proto {
#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT) #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
struct { struct {
size_t obj_size; size_t obj_size;
int (*nlattr_to_obj)(struct nlattr *tb[], void *data); int (*nlattr_to_obj)(struct nlattr *tb[],
struct net *net, void *data);
int (*obj_to_nlattr)(struct sk_buff *skb, const void *data); int (*obj_to_nlattr)(struct sk_buff *skb, const void *data);
unsigned int nlattr_max; unsigned int nlattr_max;
......
net/ipv4/netfilter/nf_conntrack_proto_icmp.c
View file @ 8264deb8
...@@ -279,16 +279,18 @@ static int icmp_nlattr_tuple_size(void) ...@@ -279,16 +279,18 @@ static int icmp_nlattr_tuple_size(void)
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeout = data; unsigned int *timeout = data;
struct nf_icmp_net *in = icmp_pernet(net);
if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) { if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) {
*timeout = *timeout =
ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMP_TIMEOUT])) * HZ; ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMP_TIMEOUT])) * HZ;
} else { } else {
/* Set default ICMP timeout. */ /* Set default ICMP timeout. */
*timeout = nf_ct_icmp_timeout; *timeout = in->timeout;
} }
return 0; return 0;
} }
......
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
View file @ 8264deb8
...@@ -286,16 +286,18 @@ static int icmpv6_nlattr_tuple_size(void) ...@@ -286,16 +286,18 @@ static int icmpv6_nlattr_tuple_size(void)
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int icmpv6_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int icmpv6_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeout = data; unsigned int *timeout = data;
struct nf_icmp_net *in = icmpv6_pernet(net);
if (tb[CTA_TIMEOUT_ICMPV6_TIMEOUT]) { if (tb[CTA_TIMEOUT_ICMPV6_TIMEOUT]) {
*timeout = *timeout =
ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMPV6_TIMEOUT])) * HZ; ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMPV6_TIMEOUT])) * HZ;
} else { } else {
/* Set default ICMPv6 timeout. */ /* Set default ICMPv6 timeout. */
*timeout = nf_ct_icmpv6_timeout; *timeout = in->timeout;
} }
return 0; return 0;
} }
......
net/netfilter/nf_conntrack_proto_dccp.c
View file @ 8264deb8
...@@ -712,9 +712,10 @@ static int dccp_nlattr_size(void) ...@@ -712,9 +712,10 @@ static int dccp_nlattr_size(void)
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
struct dccp_net *dn = dccp_pernet(&init_net); struct dccp_net *dn = dccp_pernet(net);
unsigned int *timeouts = data; unsigned int *timeouts = data;
int i; int i;
......
net/netfilter/nf_conntrack_proto_generic.c
View file @ 8264deb8
...@@ -75,16 +75,18 @@ static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb, ...@@ -75,16 +75,18 @@ static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb,
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int generic_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int generic_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeout = data; unsigned int *timeout = data;
struct nf_generic_net *gn = generic_pernet(net);
if (tb[CTA_TIMEOUT_GENERIC_TIMEOUT]) if (tb[CTA_TIMEOUT_GENERIC_TIMEOUT])
*timeout = *timeout =
ntohl(nla_get_be32(tb[CTA_TIMEOUT_GENERIC_TIMEOUT])) * HZ; ntohl(nla_get_be32(tb[CTA_TIMEOUT_GENERIC_TIMEOUT])) * HZ;
else { else {
/* Set default generic timeout. */ /* Set default generic timeout. */
*timeout = nf_ct_generic_timeout; *timeout = gn->timeout;
} }
return 0; return 0;
......
net/netfilter/nf_conntrack_proto_gre.c
View file @ 8264deb8
...@@ -304,13 +304,15 @@ static void gre_destroy(struct nf_conn *ct) ...@@ -304,13 +304,15 @@ static void gre_destroy(struct nf_conn *ct)
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int gre_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int gre_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct netns_proto_gre *net_gre = gre_pernet(net);
/* set default timeouts for GRE. */ /* set default timeouts for GRE. */
timeouts[GRE_CT_UNREPLIED] = gre_timeouts[GRE_CT_UNREPLIED]; timeouts[GRE_CT_UNREPLIED] = net_gre->gre_timeouts[GRE_CT_UNREPLIED];
timeouts[GRE_CT_REPLIED] = gre_timeouts[GRE_CT_REPLIED]; timeouts[GRE_CT_REPLIED] = net_gre->gre_timeouts[GRE_CT_REPLIED];
if (tb[CTA_TIMEOUT_GRE_UNREPLIED]) { if (tb[CTA_TIMEOUT_GRE_UNREPLIED]) {
timeouts[GRE_CT_UNREPLIED] = timeouts[GRE_CT_UNREPLIED] =
......
net/netfilter/nf_conntrack_proto_sctp.c
View file @ 8264deb8
...@@ -562,14 +562,16 @@ static int sctp_nlattr_size(void) ...@@ -562,14 +562,16 @@ static int sctp_nlattr_size(void)
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct sctp_net *sn = sctp_pernet(net);
int i; int i;
/* set default SCTP timeouts. */ /* set default SCTP timeouts. */
for (i=0; i<SCTP_CONNTRACK_MAX; i++) for (i=0; i<SCTP_CONNTRACK_MAX; i++)
timeouts[i] = sctp_timeouts[i]; timeouts[i] = sn->timeouts[i];
/* there's a 1:1 mapping between attributes and protocol states. */ /* there's a 1:1 mapping between attributes and protocol states. */
for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) { for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) {
......
net/netfilter/nf_conntrack_proto_tcp.c
View file @ 8264deb8
...@@ -1260,14 +1260,16 @@ static int tcp_nlattr_tuple_size(void) ...@@ -1260,14 +1260,16 @@ static int tcp_nlattr_tuple_size(void)
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct nf_tcp_net *tn = tcp_pernet(net);
int i; int i;
/* set default TCP timeouts. */ /* set default TCP timeouts. */
for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++) for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++)
timeouts[i] = tcp_timeouts[i]; timeouts[i] = tn->timeouts[i];
if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) { if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) {
timeouts[TCP_CONNTRACK_SYN_SENT] = timeouts[TCP_CONNTRACK_SYN_SENT] =
......
net/netfilter/nf_conntrack_proto_udp.c
View file @ 8264deb8
...@@ -156,13 +156,15 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, ...@@ -156,13 +156,15 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int udp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int udp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct nf_udp_net *un = udp_pernet(net);
/* set default timeouts for UDP. */ /* set default timeouts for UDP. */
timeouts[UDP_CT_UNREPLIED] = udp_timeouts[UDP_CT_UNREPLIED]; timeouts[UDP_CT_UNREPLIED] = un->timeouts[UDP_CT_UNREPLIED];
timeouts[UDP_CT_REPLIED] = udp_timeouts[UDP_CT_REPLIED]; timeouts[UDP_CT_REPLIED] = un->timeouts[UDP_CT_REPLIED];
if (tb[CTA_TIMEOUT_UDP_UNREPLIED]) { if (tb[CTA_TIMEOUT_UDP_UNREPLIED]) {
timeouts[UDP_CT_UNREPLIED] = timeouts[UDP_CT_UNREPLIED] =
......
net/netfilter/nf_conntrack_proto_udplite.c
View file @ 8264deb8
...@@ -172,13 +172,15 @@ static int udplite_error(struct net *net, struct nf_conn *tmpl, ...@@ -172,13 +172,15 @@ static int udplite_error(struct net *net, struct nf_conn *tmpl,
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h> #include <linux/netfilter/nfnetlink_cttimeout.h>
static int udplite_timeout_nlattr_to_obj(struct nlattr *tb[], void *data) static int udplite_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct udplite_net *un = udplite_pernet(net);
/* set default timeouts for UDPlite. */ /* set default timeouts for UDPlite. */
timeouts[UDPLITE_CT_UNREPLIED] = udplite_timeouts[UDPLITE_CT_UNREPLIED]; timeouts[UDPLITE_CT_UNREPLIED] = un->timeouts[UDPLITE_CT_UNREPLIED];
timeouts[UDPLITE_CT_REPLIED] = udplite_timeouts[UDPLITE_CT_REPLIED]; timeouts[UDPLITE_CT_REPLIED] = un->timeouts[UDPLITE_CT_REPLIED];
if (tb[CTA_TIMEOUT_UDPLITE_UNREPLIED]) { if (tb[CTA_TIMEOUT_UDPLITE_UNREPLIED]) {
timeouts[UDPLITE_CT_UNREPLIED] = timeouts[UDPLITE_CT_UNREPLIED] =
......
net/netfilter/nfnetlink_cttimeout.c
View file @ 8264deb8
...@@ -49,8 +49,9 @@ static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = { ...@@ -49,8 +49,9 @@ static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
static int static int
ctnl_timeout_parse_policy(struct ctnl_timeout *timeout, ctnl_timeout_parse_policy(struct ctnl_timeout *timeout,
struct nf_conntrack_l4proto *l4proto, struct nf_conntrack_l4proto *l4proto,
const struct nlattr *attr) struct net *net,
const struct nlattr *attr)
{ {
int ret = 0; int ret = 0;
...@@ -60,7 +61,8 @@ ctnl_timeout_parse_policy(struct ctnl_timeout *timeout, ...@@ -60,7 +61,8 @@ ctnl_timeout_parse_policy(struct ctnl_timeout *timeout,
nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max, nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
attr, l4proto->ctnl_timeout.nla_policy); attr, l4proto->ctnl_timeout.nla_policy);
ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, &timeout->data); ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net,
&timeout->data);
} }
return ret; return ret;
} }
...@@ -74,6 +76,7 @@ cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb, ...@@ -74,6 +76,7 @@ cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb,
__u8 l4num; __u8 l4num;
struct nf_conntrack_l4proto *l4proto; struct nf_conntrack_l4proto *l4proto;
struct ctnl_timeout *timeout, *matching = NULL; struct ctnl_timeout *timeout, *matching = NULL;
struct net *net = sock_net(skb->sk);
char *name; char *name;
int ret; int ret;
...@@ -117,7 +120,7 @@ cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb, ...@@ -117,7 +120,7 @@ cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb,
goto err_proto_put; goto err_proto_put;
} }
ret = ctnl_timeout_parse_policy(matching, l4proto, ret = ctnl_timeout_parse_policy(matching, l4proto, net,
cda[CTA_TIMEOUT_DATA]); cda[CTA_TIMEOUT_DATA]);
return ret; return ret;
} }
...@@ -132,7 +135,7 @@ cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb, ...@@ -132,7 +135,7 @@ cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb,
goto err_proto_put; goto err_proto_put;
} }
ret = ctnl_timeout_parse_policy(timeout, l4proto, ret = ctnl_timeout_parse_policy(timeout, l4proto, net,
cda[CTA_TIMEOUT_DATA]); cda[CTA_TIMEOUT_DATA]);
if (ret < 0) if (ret < 0)
goto err; goto err;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7