Commit adf05168 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: remove ip_conntrack* sysctl compat code 



This backward compatibility has been around for more than ten years,
since Yasuyuki Kozakai introduced IPv6 in conntrack. These days, we have
alternate /proc/net/nf_conntrack* entries, the ctnetlink interface and
the conntrack utility got adopted by many people in the user community
according to what I observed on the netfilter user mailing list.

So let's get rid of this.

Note that nf_conntrack_htable_size and unsigned int nf_conntrack_max do
not need to be exported as symbol anymore.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cb1b69b0

include/net/netfilter/nf_conntrack_l4proto.h

+0 −8
Original line number Diff line number Diff line
@@ -134,14 +134,6 @@ void nf_ct_l4proto_pernet_unregister(struct net *net, 
int nf_ct_l4proto_register(struct nf_conntrack_l4proto *proto);

void nf_ct_l4proto_unregister(struct nf_conntrack_l4proto *proto);



static inline void nf_ct_kfree_compat_sysctl_table(struct nf_proto_net *pn)

{

#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

	kfree(pn->ctl_compat_table);

	pn->ctl_compat_table = NULL;

#endif

}



/* Generic netlink helpers */

int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,

			       const struct nf_conntrack_tuple *tuple);

include/net/netns/conntrack.h

+0 −8
Original line number Diff line number Diff line
@@ -15,10 +15,6 @@ struct nf_proto_net { 
#ifdef CONFIG_SYSCTL

	struct ctl_table_header *ctl_table_header;

	struct ctl_table        *ctl_table;

#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT

	struct ctl_table_header *ctl_compat_header;

	struct ctl_table        *ctl_compat_table;

#endif

#endif

	unsigned int		users;

};
@@ -58,10 +54,6 @@ struct nf_ip_net { 
	struct nf_udp_net	udp;

	struct nf_icmp_net	icmp;

	struct nf_icmp_net	icmpv6;

#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

	struct ctl_table_header *ctl_table_header;

	struct ctl_table	*ctl_table;

#endif

};



struct ct_pcpu {

net/ipv4/netfilter/Kconfig

+0 −11
Original line number Diff line number Diff line
@@ -25,17 +25,6 @@ config NF_CONNTRACK_IPV4 


	  To compile it as a module, choose M here.  If unsure, say N.



config NF_CONNTRACK_PROC_COMPAT

	bool "proc/sysctl compatibility with old connection tracking"

	depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4

	default y

	help

	  This option enables /proc and sysctl compatibility with the old

	  layer 3 dependent connection tracking. This is needed to keep

	  old programs that have not been adapted to the new names working.



	  If unsure, say Y.



if NF_TABLES



config NF_TABLES_IPV4

net/ipv4/netfilter/Makefile

+0 −5
Original line number Diff line number Diff line
@@ -4,11 +4,6 @@ 


# objects for l3 independent conntrack

nf_conntrack_ipv4-y	:=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o

ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)

ifeq ($(CONFIG_PROC_FS),y)

nf_conntrack_ipv4-objs	+= nf_conntrack_l3proto_ipv4_compat.o

endif

endif



# connection tracking

obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

+0 −70
Original line number Diff line number Diff line
@@ -202,47 +202,6 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = { 
	},

};



#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

static int log_invalid_proto_min = 0;

static int log_invalid_proto_max = 255;



static struct ctl_table ip_ct_sysctl_table[] = {

	{

		.procname	= "ip_conntrack_max",

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

	},

	{

		.procname	= "ip_conntrack_count",

		.maxlen		= sizeof(int),

		.mode		= 0444,

		.proc_handler	= proc_dointvec,

	},

	{

		.procname	= "ip_conntrack_buckets",

		.maxlen		= sizeof(unsigned int),

		.mode		= 0444,

		.proc_handler	= proc_dointvec,

	},

	{

		.procname	= "ip_conntrack_checksum",

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

	},

	{

		.procname	= "ip_conntrack_log_invalid",

		.maxlen		= sizeof(unsigned int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &log_invalid_proto_min,

		.extra2		= &log_invalid_proto_max,

	},

	{ }

};

#endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */



/* Fast function for those who don't want to parse /proc (and I don't

   blame them). */

/* Reversing the socket's dst/src point of view gives us the reply
@@ -350,20 +309,6 @@ static struct nf_sockopt_ops so_getorigdst = { 


static int ipv4_init_net(struct net *net)

{

#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

	struct nf_ip_net *in = &net->ct.nf_ct_proto;

	in->ctl_table = kmemdup(ip_ct_sysctl_table,

				sizeof(ip_ct_sysctl_table),

				GFP_KERNEL);

	if (!in->ctl_table)

		return -ENOMEM;



	in->ctl_table[0].data = &nf_conntrack_max;

	in->ctl_table[1].data = &net->ct.count;

	in->ctl_table[2].data = &nf_conntrack_htable_size;

	in->ctl_table[3].data = &net->ct.sysctl_checksum;

	in->ctl_table[4].data = &net->ct.sysctl_log_invalid;

#endif

	return 0;

}
@@ -379,9 +324,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = { 
	.nlattr_tuple_size = ipv4_nlattr_tuple_size,

	.nlattr_to_tuple = ipv4_nlattr_to_tuple,

	.nla_policy	 = ipv4_nla_policy,

#endif

#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

	.ctl_table_path  = "net/ipv4/netfilter",

#endif

	.init_net	 = ipv4_init_net,

	.me		 = THIS_MODULE,
@@ -492,16 +434,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void) 
		goto cleanup_icmpv4;

	}



#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

	ret = nf_conntrack_ipv4_compat_init();

	if (ret < 0)

		goto cleanup_proto;

#endif

	return ret;

#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

 cleanup_proto:

	nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4);

#endif

 cleanup_icmpv4:

	nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp);

 cleanup_udp4:
@@ -520,9 +453,6 @@ static int __init nf_conntrack_l3proto_ipv4_init(void) 
static void __exit nf_conntrack_l3proto_ipv4_fini(void)

{

	synchronize_net();

#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)

	nf_conntrack_ipv4_compat_fini();

#endif

	nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4);

	nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp);

	nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udp4);

CRA Git | Maintained and supported by SUSTech CRA and CCSE