niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

netfilter: nf_conntrack: provide modparam to always register conntrack hooks

Browse source 
The connection tracking hooks can be optionally registered per netns
when conntrack is specifically invoked from the ruleset since
0c66dc1ea3 ("netfilter: conntrack: register hooks in netns when needed
by ruleset"). Then, since 4d3a57f23d ("netfilter: conntrack: do not
enable connection tracking unless needed"), the default behaviour is
changed to always register them on demand.

This patch provides a toggle that allows users to always register them.
Without this toggle, in order to use conntrack for statistics
collection, you need a dummy rule that refers to conntrack, eg.

        iptables -I INPUT -m state --state NEW

This patch allows users to restore the original behaviour via modparam,
ie. always register connection tracking, eg.

        modprobe nf_conntrack enable_hooks=1

Hence, no dummy rule is required.

Reported-by: Laura Garcia <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2019-01-16 18:24:17 +01:00
parent 4a60dc748d
commit ba3fbe6636
1 changed files with 24 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
net/netfilter/nf_conntrack_standalone.c
View file

@ -24,6 +24,10 @@
#include <net/netfilter/nf_conntrack_timestamp.h> #include <net/netfilter/nf_conntrack_timestamp.h>
#include <linux/rculist_nulls.h> #include <linux/rculist_nulls.h>
static bool enable_hooks __read_mostly;
MODULE_PARM_DESC(enable_hooks, "Always enable conntrack hooks");
module_param(enable_hooks, bool, 0000);
unsigned int nf_conntrack_net_id __read_mostly; unsigned int nf_conntrack_net_id __read_mostly;
#ifdef CONFIG_NF_CONNTRACK_PROCFS #ifdef CONFIG_NF_CONNTRACK_PROCFS
@ -1075,6 +1079,15 @@ static void nf_conntrack_standalone_fini_sysctl(struct net *net)
} }
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
static void nf_conntrack_fini_net(struct net *net)
{
if (enable_hooks)
nf_ct_netns_put(net, NFPROTO_INET);
nf_conntrack_standalone_fini_proc(net);
nf_conntrack_standalone_fini_sysctl(net);
}
static int nf_conntrack_pernet_init(struct net *net) static int nf_conntrack_pernet_init(struct net *net)
{ {
int ret; int ret;
@ -1093,8 +1106,16 @@ static int nf_conntrack_pernet_init(struct net *net)
if (ret < 0) if (ret < 0)
goto out_init_net; goto out_init_net;
if (enable_hooks) {
ret = nf_ct_netns_get(net, NFPROTO_INET);
if (ret < 0)
goto out_hooks;
}
return 0; return 0;
out_hooks:
nf_conntrack_fini_net(net);
out_init_net: out_init_net:
nf_conntrack_standalone_fini_proc(net); nf_conntrack_standalone_fini_proc(net);
out_proc: out_proc:
@ -1106,10 +1127,9 @@ static void nf_conntrack_pernet_exit(struct list_head *net_exit_list)
{ {
struct net *net; struct net *net;
list_for_each_entry(net, net_exit_list, exit_list) { list_for_each_entry(net, net_exit_list, exit_list)
nf_conntrack_standalone_fini_sysctl(net); nf_conntrack_fini_net(net);
nf_conntrack_standalone_fini_proc(net);
}
nf_conntrack_cleanup_net_list(net_exit_list); nf_conntrack_cleanup_net_list(net_exit_list);
} }