diff options
| author | Gao feng <gaofeng@cn.fujitsu.com> | 2012-05-28 17:04:14 -0400 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2012-06-07 08:58:40 -0400 |
| commit | 4b626b9c5d35b4f99b073dc5d6457abddcbcf429 (patch) | |
| tree | 774457d18f064a5a1ca8ee54724ab5ff3b5e0487 /net/ipv4 | |
| parent | 0ce490ad4387a67ee8ca5253476272d508fc0b6f (diff) | |
netfilter: nf_ct_icmp: add namespace support
This patch adds namespace support for ICMP protocol tracker.
Acked-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 38 |
1 files changed, 35 insertions, 3 deletions
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c index 0847e373d33c..a0eabeb36b9f 100644 --- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c +++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c | |||
| @@ -23,6 +23,11 @@ | |||
| 23 | 23 | ||
| 24 | static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ; | 24 | static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ; |
| 25 | 25 | ||
| 26 | static inline struct nf_icmp_net *icmp_pernet(struct net *net) | ||
| 27 | { | ||
| 28 | return &net->ct.nf_ct_proto.icmp; | ||
| 29 | } | ||
| 30 | |||
| 26 | static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff, | 31 | static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff, |
| 27 | struct nf_conntrack_tuple *tuple) | 32 | struct nf_conntrack_tuple *tuple) |
| 28 | { | 33 | { |
| @@ -77,7 +82,7 @@ static int icmp_print_tuple(struct seq_file *s, | |||
| 77 | 82 | ||
| 78 | static unsigned int *icmp_get_timeouts(struct net *net) | 83 | static unsigned int *icmp_get_timeouts(struct net *net) |
| 79 | { | 84 | { |
| 80 | return &nf_ct_icmp_timeout; | 85 | return &icmp_pernet(net)->timeout; |
| 81 | } | 86 | } |
| 82 | 87 | ||
| 83 | /* Returns verdict for packet, or -1 for invalid. */ | 88 | /* Returns verdict for packet, or -1 for invalid. */ |
| @@ -312,7 +317,6 @@ static struct ctl_table_header *icmp_sysctl_header; | |||
| 312 | static struct ctl_table icmp_sysctl_table[] = { | 317 | static struct ctl_table icmp_sysctl_table[] = { |
| 313 | { | 318 | { |
| 314 | .procname = "nf_conntrack_icmp_timeout", | 319 | .procname = "nf_conntrack_icmp_timeout", |
| 315 | .data = &nf_ct_icmp_timeout, | ||
| 316 | .maxlen = sizeof(unsigned int), | 320 | .maxlen = sizeof(unsigned int), |
| 317 | .mode = 0644, | 321 | .mode = 0644, |
| 318 | .proc_handler = proc_dointvec_jiffies, | 322 | .proc_handler = proc_dointvec_jiffies, |
| @@ -323,7 +327,6 @@ static struct ctl_table icmp_sysctl_table[] = { | |||
| 323 | static struct ctl_table icmp_compat_sysctl_table[] = { | 327 | static struct ctl_table icmp_compat_sysctl_table[] = { |
| 324 | { | 328 | { |
| 325 | .procname = "ip_conntrack_icmp_timeout", | 329 | .procname = "ip_conntrack_icmp_timeout", |
| 326 | .data = &nf_ct_icmp_timeout, | ||
| 327 | .maxlen = sizeof(unsigned int), | 330 | .maxlen = sizeof(unsigned int), |
| 328 | .mode = 0644, | 331 | .mode = 0644, |
| 329 | .proc_handler = proc_dointvec_jiffies, | 332 | .proc_handler = proc_dointvec_jiffies, |
| @@ -333,6 +336,34 @@ static struct ctl_table icmp_compat_sysctl_table[] = { | |||
| 333 | #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */ | 336 | #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */ |
| 334 | #endif /* CONFIG_SYSCTL */ | 337 | #endif /* CONFIG_SYSCTL */ |
| 335 | 338 | ||
| 339 | static int icmp_init_net(struct net *net) | ||
| 340 | { | ||
| 341 | struct nf_icmp_net *in = icmp_pernet(net); | ||
| 342 | struct nf_proto_net *pn = (struct nf_proto_net *)in; | ||
| 343 | in->timeout = nf_ct_icmp_timeout; | ||
| 344 | |||
| 345 | #ifdef CONFIG_SYSCTL | ||
| 346 | pn->ctl_table = kmemdup(icmp_sysctl_table, | ||
| 347 | sizeof(icmp_sysctl_table), | ||
| 348 | GFP_KERNEL); | ||
| 349 | if (!pn->ctl_table) | ||
| 350 | return -ENOMEM; | ||
| 351 | pn->ctl_table[0].data = &in->timeout; | ||
| 352 | #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT | ||
| 353 | pn->ctl_compat_table = kmemdup(icmp_compat_sysctl_table, | ||
| 354 | sizeof(icmp_compat_sysctl_table), | ||
| 355 | GFP_KERNEL); | ||
| 356 | if (!pn->ctl_compat_table) { | ||
| 357 | kfree(pn->ctl_table); | ||
| 358 | pn->ctl_table = NULL; | ||
| 359 | return -ENOMEM; | ||
| 360 | } | ||
| 361 | pn->ctl_compat_table[0].data = &in->timeout; | ||
| 362 | #endif | ||
| 363 | #endif | ||
| 364 | return 0; | ||
| 365 | } | ||
| 366 | |||
| 336 | struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly = | 367 | struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly = |
| 337 | { | 368 | { |
| 338 | .l3proto = PF_INET, | 369 | .l3proto = PF_INET, |
| @@ -369,4 +400,5 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly = | |||
| 369 | .ctl_compat_table = icmp_compat_sysctl_table, | 400 | .ctl_compat_table = icmp_compat_sysctl_table, |
| 370 | #endif | 401 | #endif |
| 371 | #endif | 402 | #endif |
| 403 | .init_net = icmp_init_net, | ||
| 372 | }; | 404 | }; |