netfilter: conntrack: handle ->destroy hook via nat_ops instead

The nat module already exposes a few functions to the conntrack core. Move the nat extension destroy hook to it. After this, no conntrack extension needs a destroy hook. 'struct nf_ct_ext_type' and the register/unregister api can be removed in a followup patch.

Florian Westphal committed 4 years ago

Commit 1bc91a51 parent 5f31edc5 files · +16 −36Browse files

Unified · Split

5 files

include/linux/netfilter.h +1 −0
include/net/netfilter/nf_conntrack_extend.h +0 −3
net/netfilter/nf_conntrack_core.c +12 −2
net/netfilter/nf_conntrack_extend.c +0 −21
net/netfilter/nf_nat_core.c +3 −10

include/linux/netfilter.h+1−0

@@ -379,6 +379,7 @@ struct nf_nat_hook { · 378 unmodified lines
379	unsigned int (manip_pkt)(struct sk_buff skb, struct nf_conn *ct,	379	unsigned int (manip_pkt)(struct sk_buff skb, struct nf_conn *ct,
380	enum nf_nat_manip_type mtype,	380	enum nf_nat_manip_type mtype,
381	enum ip_conntrack_dir dir);	381	enum ip_conntrack_dir dir);
		382	void (remove_nat_bysrc)(struct nf_conn ct);
382	};	383	};
383		384
384	extern const struct nf_nat_hook __rcu *nf_nat_hook;	385	extern const struct nf_nat_hook __rcu *nf_nat_hook;

include/net/netfilter/nf_conntrack_extend.h+0−3

@@ -79,9 +79,6 @@ void nf_ct_ext_destroy(struct nf_conn *ct); · 78 unmodified lines
79	void nf_ct_ext_add(struct nf_conn ct, enum nf_ct_ext_id id, gfp_t gfp);	79	void nf_ct_ext_add(struct nf_conn ct, enum nf_ct_ext_id id, gfp_t gfp);
80		80
81	struct nf_ct_ext_type {	81	struct nf_ct_ext_type {
82	/* Destroys relationships (can be NULL). */
83	void (destroy)(struct nf_conn ct);
84
85	enum nf_ct_ext_id id;	82	enum nf_ct_ext_id id;
86	};	83	};
87		84

net/netfilter/nf_conntrack_core.c+12−2

 void nf_ct_tmpl_free(struct nf_conn *tmpl)
 {
-	nf_ct_ext_destroy(tmpl);
+	kfree(tmpl->ext);
 	if (ARCH_KMALLOC_MINALIGN <= NFCT_INFOMASK)
 		kfree((char *)tmpl - tmpl->proto.tmpl_padto);
 	 */
 	WARN_ON(refcount_read(&ct->ct_general.use) != 0);
-	nf_ct_ext_destroy(ct);
+	if (ct->status & IPS_SRC_NAT_DONE) {
+		const struct nf_nat_hook *nat_hook;
+		rcu_read_lock();
+		nat_hook = rcu_dereference(nf_nat_hook);
+		if (nat_hook)
+			nat_hook->remove_nat_bysrc(ct);
+		rcu_read_unlock();
+	}
+	kfree(ct->ext);
 	kmem_cache_free(nf_conntrack_cachep, ct);
 	cnet = nf_ct_pernet(net);

net/netfilter/nf_conntrack_extend.c+0−21

@@ -89,27 +89,6 @@ static __always_inline unsigned int total_extension_size(void) · 88 unmodified lines
89	;	89	;
90	}	90	}
91		91
92	void nf_ct_ext_destroy(struct nf_conn *ct)
93	{
94	unsigned int i;
95	struct nf_ct_ext_type *t;
96
97	for (i = 0; i < NF_CT_EXT_NUM; i++) {
98	rcu_read_lock();
99	t = rcu_dereference(nf_ct_ext_types[i]);
100
101	/* Here the nf_ct_ext_type might have been unregisterd.
102	* I.e., it has responsible to cleanup private
103	* area in all conntracks when it is unregisterd.
104	*/
105	if (t && t->destroy)
106	t->destroy(ct);
107	rcu_read_unlock();
108	}
109
110	kfree(ct->ext);
111	}
112
113	void nf_ct_ext_add(struct nf_conn ct, enum nf_ct_ext_id id, gfp_t gfp)	92	void nf_ct_ext_add(struct nf_conn ct, enum nf_ct_ext_id id, gfp_t gfp)
114	{	93	{
115	unsigned int newlen, newoff, oldlen, alloc;	94	unsigned int newlen, newoff, oldlen, alloc;

net/netfilter/nf_nat_core.c+3−10

 	return i->status & IPS_NAT_MASK ? 1 : 0;
 }
-static void __nf_nat_cleanup_conntrack(struct nf_conn *ct)
+static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
 {
 	unsigned int h;
 	 * will delete entry from already-freed table.
 	 */
 	if (test_and_clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status))
-		__nf_nat_cleanup_conntrack(ct);
+		nf_nat_cleanup_conntrack(ct);
 	/* don't delete conntrack.  Although that would make things a lot
 	 * simpler, we'd end up flushing all conntracks on nat rmmod.
 	return 0;
 }
-/* No one using conntrack by the time this called. */
-static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
-{
-	if (ct->status & IPS_SRC_NAT_DONE)
-		__nf_nat_cleanup_conntrack(ct);
-}
 static struct nf_ct_ext_type nat_extend __read_mostly = {
-	.destroy	= nf_nat_cleanup_conntrack,
 	.id		= NF_CT_EXT_NAT,
 };
 	.decode_session		= __nf_nat_decode_session,
 #endif
 	.manip_pkt		= nf_nat_manip_pkt,
+	.remove_nat_bysrc	= nf_nat_cleanup_conntrack,
 };
 static int __init nf_nat_init(void)

netfilter: conntrack: handle ->destroy hook via nat_ops instead

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code