netfilter: netns nf_conntrack: per-netns conntrack hash

* make per-netns conntrack hash

  Other solution is to add ->ct_net pointer to tuplehashes and still has one
  hash, I tried that it's ugly and requires more code deep down in protocol
  modules et al.

* propagate netns pointer to where needed, e. g. to conntrack iterators.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>

5 files changed, 7 insertions, 6 deletions

diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 9a4822f8243f..5e1c81791e5a 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -129,7 +129,8 @@ static int masq_device_event(struct notifier_block *this,
                    and forget them. */
                 NF_CT_ASSERT(dev->ifindex != 0);
 
-                nf_ct_iterate_cleanup(device_cmp, (void *)(long)dev->ifindex);
+                nf_ct_iterate_cleanup(&init_net, device_cmp,
+                                      (void *)(long)dev->ifindex);
         }
 
         return NOTIFY_DONE;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 31abee3e29f9..03dd108015c2 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -323,7 +323,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                 return -EINVAL;
         }
 
-        h = nf_conntrack_find_get(&tuple);
+        h = nf_conntrack_find_get(sock_net(sk), &tuple);
         if (h) {
                 struct sockaddr_in sin;
                 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 4556805027f7..8e0afdc2b134 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -32,7 +32,7 @@ static struct hlist_node *ct_get_first(struct seq_file *seq)
         for (st->bucket = 0;
              st->bucket < nf_conntrack_htable_size;
              st->bucket++) {
-                n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                n = rcu_dereference(init_net.ct.hash[st->bucket].first);
                 if (n)
                         return n;
         }
@@ -48,7 +48,7 @@ static struct hlist_node *ct_get_next(struct seq_file *seq,
         while (head == NULL) {
                 if (++st->bucket >= nf_conntrack_htable_size)
                         return NULL;
-                head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                head = rcu_dereference(init_net.ct.hash[st->bucket].first);
         }
         return head;
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index da8edcdaef32..daf346377b66 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -155,7 +155,7 @@ icmp_error_message(struct sk_buff *skb,
 
         *ctinfo = IP_CT_RELATED;
 
-        h = nf_conntrack_find_get(&innertuple);
+        h = nf_conntrack_find_get(&init_net, &innertuple);
         if (!h) {
                 pr_debug("icmp_error_message: no match\n");
                 return -NF_ACCEPT;
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 6c6a3cba8d50..5d4a5b70da2b 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -643,7 +643,7 @@ static int clean_nat(struct nf_conn *i, void *data)
 
 static void __exit nf_nat_cleanup(void)
 {
-        nf_ct_iterate_cleanup(&clean_nat, NULL);
+        nf_ct_iterate_cleanup(&init_net, &clean_nat, NULL);
         synchronize_rcu();
         nf_ct_free_hashtable(bysource, nf_nat_vmalloced, nf_nat_htable_size);
         nf_ct_l3proto_put(l3proto);