netfilter: conntrack: make sysctls per-namespace again (478553fd) · Commits · 戴 / test

When I merged the extension sysctl tables with the main one I forgot to reset them on netns creation. They currently read/write init_net settings. Fixes: ("netfilter: conntrack: merge acct and helper sysctl table with main one") Fixes: ("netfilter: conntrack: merge ecache and timestamp sysctl tables with main one") Reported-by:

Shmulik Ladkani <shmulik.ladkani@gmail.com> Signed-off-by:

Florian Westphal <fw@strlen.de> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/nf_conntrack_standalone.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1037,8 +1037,13 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
		table[NF_SYSCTL_CT_COUNT].data = &net->ct.count;
		table[NF_SYSCTL_CT_CHECKSUM].data = &net->ct.sysctl_checksum;
		table[NF_SYSCTL_CT_LOG_INVALID].data = &net->ct.sysctl_log_invalid;
		table[NF_SYSCTL_CT_ACCT].data = &net->ct.sysctl_acct;
		table[NF_SYSCTL_CT_HELPER].data = &net->ct.sysctl_auto_assign_helper;
		#ifdef CONFIG_NF_CONNTRACK_EVENTS
		table[NF_SYSCTL_CT_EVENTS].data = &net->ct.sysctl_events;
		#endif
		#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
		table[NF_SYSCTL_CT_TIMESTAMP].data = &net->ct.sysctl_tstamp;
		#endif
		table[NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC].data = &nf_generic_pernet(net)->timeout;
		table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP].data = &nf_icmp_pernet(net)->timeout;

Admin message