History

netfilter: remove nf_ct_is_untracked

This function is now obsolete and always returns false. This change has no effect on generated code.

Florian Westphal committed 9 years ago

Commit ab8bc7e1 parent cc41c8416 files · +17 −49Browse files

Unified · Split

16 files
  1. include/net/ip_vs.h +2 −2
  2. include/net/netfilter/nf_conntrack.h +0 −5
  3. include/net/netfilter/nf_conntrack_core.h +1 −1
  4. net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +0 −4
  5. net/ipv4/netfilter/nf_socket_ipv4.c +1 −1
  6. net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +0 −4
  7. net/netfilter/ipvs/ip_vs_ftp.c +1 −2
  8. net/netfilter/ipvs/ip_vs_nfct.c +2 −2
  9. net/netfilter/ipvs/ip_vs_xmit.c +4 −4
  10. net/netfilter/nf_conntrack_netlink.c +1 −11
  11. net/netfilter/xt_HMARK.c +1 −1
  12. net/netfilter/xt_cluster.c +0 −3
  13. net/netfilter/xt_connlabel.c +1 −1
  14. net/netfilter/xt_connmark.c +2 −2
  15. net/netfilter/xt_ipvs.c +1 −1
  16. net/openvswitch/conntrack.c +0 −5
include/net/ip_vs.h+2−2
@@ -1555,7 +1555,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb) · 1554 unmodified lines
1555 enum ip_conntrack_info ctinfo;1555 enum ip_conntrack_info ctinfo;
1556 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);1556 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1557 1557
1558 if (!ct || !nf_ct_is_untracked(ct)) {1558 if (ct) {
1559 nf_conntrack_put(&ct->ct_general);1559 nf_conntrack_put(&ct->ct_general);
1560 nf_ct_set(skb, NULL, IP_CT_UNTRACKED);1560 nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
1561 }1561 }
@@ -1616,7 +1616,7 @@ static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, · 54 unmodified lines
1616 if (!(cp->flags & IP_VS_CONN_F_NFCT))1616 if (!(cp->flags & IP_VS_CONN_F_NFCT))
1617 return false;1617 return false;
1618 ct = nf_ct_get(skb, &ctinfo);1618 ct = nf_ct_get(skb, &ctinfo);
1619 if (ct && !nf_ct_is_untracked(ct))1619 if (ct)
1620 return true;1620 return true;
1621#endif1621#endif
1622 return false;1622 return false;
include/net/netfilter/nf_conntrack.h+0−5
@@ -273,11 +273,6 @@ static inline int nf_ct_is_dying(const struct nf_conn *ct) · 272 unmodified lines
273 return test_bit(IPS_DYING_BIT, &ct->status);273 return test_bit(IPS_DYING_BIT, &ct->status);
274}274}
275 275
276static inline int nf_ct_is_untracked(const struct nf_conn *ct)
277{
278 return false;
279}
280
281/* Packet is received from loopback */276/* Packet is received from loopback */
282static inline bool nf_is_loopback_packet(const struct sk_buff *skb)277static inline bool nf_is_loopback_packet(const struct sk_buff *skb)
283{278{
include/net/netfilter/nf_conntrack_core.h+1−1
@@ -65,7 +65,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb) · 64 unmodified lines
65 struct nf_conn *ct = (struct nf_conn *)skb_nfct(skb);65 struct nf_conn *ct = (struct nf_conn *)skb_nfct(skb);
66 int ret = NF_ACCEPT;66 int ret = NF_ACCEPT;
67 67
68 if (ct && !nf_ct_is_untracked(ct)) {68 if (ct) {
69 if (!nf_ct_is_confirmed(ct))69 if (!nf_ct_is_confirmed(ct))
70 ret = __nf_conntrack_confirm(skb);70 ret = __nf_conntrack_confirm(skb);
71 if (likely(ret == NF_ACCEPT))71 if (likely(ret == NF_ACCEPT))
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c+0−4
@@ -264,10 +264,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb, · 263 unmodified lines
264 if (!ct)264 if (!ct)
265 return NF_ACCEPT;265 return NF_ACCEPT;
266 266
267 /* Don't try to NAT if this packet is not conntracked */
268 if (nf_ct_is_untracked(ct))
269 return NF_ACCEPT;
270
271 nat = nf_ct_nat_ext_add(ct);267 nat = nf_ct_nat_ext_add(ct);
272 if (nat == NULL)268 if (nat == NULL)
273 return NF_ACCEPT;269 return NF_ACCEPT;
net/ipv4/netfilter/nf_socket_ipv4.c+1−1
@@ -139,7 +139,7 @@ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb, · 138 unmodified lines
139 * SNAT-ted connection.139 * SNAT-ted connection.
140 */140 */
141 ct = nf_ct_get(skb, &ctinfo);141 ct = nf_ct_get(skb, &ctinfo);
142 if (ct && !nf_ct_is_untracked(ct) &&142 if (ct &&
143 ((iph->protocol != IPPROTO_ICMP &&143 ((iph->protocol != IPPROTO_ICMP &&
144 ctinfo == IP_CT_ESTABLISHED_REPLY) ||144 ctinfo == IP_CT_ESTABLISHED_REPLY) ||
145 (iph->protocol == IPPROTO_ICMP &&145 (iph->protocol == IPPROTO_ICMP &&
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c+0−4
@@ -273,10 +273,6 @@ nf_nat_ipv6_fn(void *priv, struct sk_buff *skb, · 272 unmodified lines
273 if (!ct)273 if (!ct)
274 return NF_ACCEPT;274 return NF_ACCEPT;
275 275
276 /* Don't try to NAT if this packet is not conntracked */
277 if (nf_ct_is_untracked(ct))
278 return NF_ACCEPT;
279
280 nat = nf_ct_nat_ext_add(ct);276 nat = nf_ct_nat_ext_add(ct);
281 if (nat == NULL)277 if (nat == NULL)
282 return NF_ACCEPT;278 return NF_ACCEPT;
net/netfilter/ipvs/ip_vs_ftp.c+1−2
@@ -260,9 +260,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, · 259 unmodified lines
260 buf_len = strlen(buf);260 buf_len = strlen(buf);
261 261
262 ct = nf_ct_get(skb, &ctinfo);262 ct = nf_ct_get(skb, &ctinfo);
263 if (ct && !nf_ct_is_untracked(ct) && (ct->status & IPS_NAT_MASK)) {263 if (ct && nfct_nat(ct)) {
264 bool mangled;264 bool mangled;
265
266 /* If mangling fails this function will return 0265 /* If mangling fails this function will return 0
267 * which will cause the packet to be dropped.266 * which will cause the packet to be dropped.
268 * Mangling can only fail under memory pressure,267 * Mangling can only fail under memory pressure,
net/netfilter/ipvs/ip_vs_nfct.c+2−2
@@ -85,7 +85,7 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin) · 84 unmodified lines
85 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);85 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
86 struct nf_conntrack_tuple new_tuple;86 struct nf_conntrack_tuple new_tuple;
87 87
88 if (ct == NULL || nf_ct_is_confirmed(ct) || nf_ct_is_untracked(ct) ||88 if (ct == NULL || nf_ct_is_confirmed(ct) ||
89 nf_ct_is_dying(ct))89 nf_ct_is_dying(ct))
90 return;90 return;
91 91
@@ -232,7 +232,7 @@ void ip_vs_nfct_expect_related(struct sk_buff *skb, struct nf_conn *ct, · 140 unmodified lines
232{232{
233 struct nf_conntrack_expect *exp;233 struct nf_conntrack_expect *exp;
234 234
235 if (ct == NULL || nf_ct_is_untracked(ct))235 if (ct == NULL)
236 return;236 return;
237 237
238 exp = nf_ct_expect_alloc(ct);238 exp = nf_ct_expect_alloc(ct);
net/netfilter/ipvs/ip_vs_xmit.c+4−4
@@ -775,7 +775,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, · 774 unmodified lines
775 enum ip_conntrack_info ctinfo;775 enum ip_conntrack_info ctinfo;
776 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);776 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
777 777
778 if (ct && !nf_ct_is_untracked(ct)) {778 if (ct) {
779 IP_VS_DBG_RL_PKT(10, AF_INET, pp, skb, ipvsh->off,779 IP_VS_DBG_RL_PKT(10, AF_INET, pp, skb, ipvsh->off,
780 "ip_vs_nat_xmit(): "780 "ip_vs_nat_xmit(): "
781 "stopping DNAT to local address");781 "stopping DNAT to local address");
@@ -866,7 +866,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, · 84 unmodified lines
866 enum ip_conntrack_info ctinfo;866 enum ip_conntrack_info ctinfo;
867 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);867 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
868 868
869 if (ct && !nf_ct_is_untracked(ct)) {869 if (ct) {
870 IP_VS_DBG_RL_PKT(10, AF_INET6, pp, skb, ipvsh->off,870 IP_VS_DBG_RL_PKT(10, AF_INET6, pp, skb, ipvsh->off,
871 "ip_vs_nat_xmit_v6(): "871 "ip_vs_nat_xmit_v6(): "
872 "stopping DNAT to local address");872 "stopping DNAT to local address");
@@ -1338,7 +1338,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, · 465 unmodified lines
1338 enum ip_conntrack_info ctinfo;1338 enum ip_conntrack_info ctinfo;
1339 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);1339 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1340 1340
1341 if (ct && !nf_ct_is_untracked(ct)) {1341 if (ct) {
1342 IP_VS_DBG(10, "%s(): "1342 IP_VS_DBG(10, "%s(): "
1343 "stopping DNAT to local address %pI4\n",1343 "stopping DNAT to local address %pI4\n",
1344 __func__, &cp->daddr.ip);1344 __func__, &cp->daddr.ip);
@@ -1429,7 +1429,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, · 84 unmodified lines
1429 enum ip_conntrack_info ctinfo;1429 enum ip_conntrack_info ctinfo;
1430 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);1430 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1431 1431
1432 if (ct && !nf_ct_is_untracked(ct)) {1432 if (ct) {
1433 IP_VS_DBG(10, "%s(): "1433 IP_VS_DBG(10, "%s(): "
1434 "stopping DNAT to local address %pI6\n",1434 "stopping DNAT to local address %pI6\n",
1435 __func__, &cp->daddr.in6);1435 __func__, &cp->daddr.in6);
net/netfilter/nf_conntrack_netlink.c+1−11
@@ -627,10 +627,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) · 626 unmodified lines
627 unsigned int flags = 0, group;627 unsigned int flags = 0, group;
628 int err;628 int err;
629 629
630 /* ignore our fake conntrack entry */
631 if (nf_ct_is_untracked(ct))
632 return 0;
633
634 if (events & (1 << IPCT_DESTROY)) {630 if (events & (1 << IPCT_DESTROY)) {
635 type = IPCTNL_MSG_CT_DELETE;631 type = IPCTNL_MSG_CT_DELETE;
636 group = NFNLGRP_CONNTRACK_DESTROY;632 group = NFNLGRP_CONNTRACK_DESTROY;
@@ -2173,13 +2169,7 @@ ctnetlink_glue_build_size(const struct nf_conn *ct) · 1536 unmodified lines
2173static struct nf_conn *ctnetlink_glue_get_ct(const struct sk_buff *skb,2169static struct nf_conn *ctnetlink_glue_get_ct(const struct sk_buff *skb,
2174 enum ip_conntrack_info *ctinfo)2170 enum ip_conntrack_info *ctinfo)
2175{2171{
2176 struct nf_conn *ct;2172 return nf_ct_get(skb, ctinfo);
2177
2178 ct = nf_ct_get(skb, ctinfo);
2179 if (ct && nf_ct_is_untracked(ct))
2180 ct = NULL;
2181
2182 return ct;
2183}2173}
2184 2174
2185static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)2175static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)
net/netfilter/xt_HMARK.c+1−1
@@ -84,7 +84,7 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t, · 83 unmodified lines
84 struct nf_conntrack_tuple *otuple;84 struct nf_conntrack_tuple *otuple;
85 struct nf_conntrack_tuple *rtuple;85 struct nf_conntrack_tuple *rtuple;
86 86
87 if (ct == NULL || nf_ct_is_untracked(ct))87 if (ct == NULL)
88 return -1;88 return -1;
89 89
90 otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;90 otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
net/netfilter/xt_cluster.c+0−3
@@ -121,9 +121,6 @@ xt_cluster_mt(const struct sk_buff *skb, struct xt_action_param *par) · 120 unmodified lines
121 if (ct == NULL)121 if (ct == NULL)
122 return false;122 return false;
123 123
124 if (nf_ct_is_untracked(ct))
125 return false;
126
127 if (ct->master)124 if (ct->master)
128 hash = xt_cluster_hash(ct->master, info);125 hash = xt_cluster_hash(ct->master, info);
129 else126 else
net/netfilter/xt_connlabel.c+1−1
@@ -29,7 +29,7 @@ connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) · 28 unmodified lines
29 bool invert = info->options & XT_CONNLABEL_OP_INVERT;29 bool invert = info->options & XT_CONNLABEL_OP_INVERT;
30 30
31 ct = nf_ct_get(skb, &ctinfo);31 ct = nf_ct_get(skb, &ctinfo);
32 if (ct == NULL || nf_ct_is_untracked(ct))32 if (ct == NULL)
33 return invert;33 return invert;
34 34
35 labels = nf_ct_labels_find(ct);35 labels = nf_ct_labels_find(ct);
net/netfilter/xt_connmark.c+2−2
@@ -44,7 +44,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) · 43 unmodified lines
44 u_int32_t newmark;44 u_int32_t newmark;
45 45
46 ct = nf_ct_get(skb, &ctinfo);46 ct = nf_ct_get(skb, &ctinfo);
47 if (ct == NULL || nf_ct_is_untracked(ct))47 if (ct == NULL)
48 return XT_CONTINUE;48 return XT_CONTINUE;
49 49
50 switch (info->mode) {50 switch (info->mode) {
@@ -97,7 +97,7 @@ connmark_mt(const struct sk_buff *skb, struct xt_action_param *par) · 46 unmodified lines
97 const struct nf_conn *ct;97 const struct nf_conn *ct;
98 98
99 ct = nf_ct_get(skb, &ctinfo);99 ct = nf_ct_get(skb, &ctinfo);
100 if (ct == NULL || nf_ct_is_untracked(ct))100 if (ct == NULL)
101 return false;101 return false;
102 102
103 return ((ct->mark & info->mask) == info->mark) ^ info->invert;103 return ((ct->mark & info->mask) == info->mark) ^ info->invert;
net/netfilter/xt_ipvs.c+1−1
@@ -116,7 +116,7 @@ ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par) · 115 unmodified lines
116 enum ip_conntrack_info ctinfo;116 enum ip_conntrack_info ctinfo;
117 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);117 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
118 118
119 if (ct == NULL || nf_ct_is_untracked(ct)) {119 if (ct == NULL) {
120 match = false;120 match = false;
121 goto out_put_cp;121 goto out_put_cp;
122 }122 }
net/openvswitch/conntrack.c+0−5
@@ -795,11 +795,6 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, · 794 unmodified lines
795 enum nf_nat_manip_type maniptype;795 enum nf_nat_manip_type maniptype;
796 int err;796 int err;
797 797
798 if (nf_ct_is_untracked(ct)) {
799 /* A NAT action may only be performed on tracked packets. */
800 return NF_ACCEPT;
801 }
802
803 /* Add NAT extension if not confirmed yet. */798 /* Add NAT extension if not confirmed yet. */
804 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))799 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
805 return NF_ACCEPT; /* Can't NAT. */800 return NF_ACCEPT; /* Can't NAT. */