hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_checksum sysctl 

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Alexey Dobriyan 2008-10-08 11:35:08 +02:00 committed by Patrick McHardy
parent 802507071b
commit c04d05529a
10 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/netfilter/nf_conntrack.h
View File

@ -287,7 +287,6 @@ static inline int nf_ct_is_untracked(const struct sk_buff *skb)
extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp); extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
extern unsigned int nf_conntrack_htable_size; extern unsigned int nf_conntrack_htable_size;
extern int nf_conntrack_checksum;
extern int nf_conntrack_max; extern int nf_conntrack_max;
#define NF_CT_STAT_INC(net, count) \ #define NF_CT_STAT_INC(net, count) \

1
include/net/netns/conntrack.h
View File

@ -17,6 +17,7 @@ struct netns_ct {
#ifdef CONFIG_NF_CONNTRACK_EVENTS #ifdef CONFIG_NF_CONNTRACK_EVENTS
struct nf_conntrack_ecache *ecache; struct nf_conntrack_ecache *ecache;
#endif #endif
int sysctl_checksum;
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
struct ctl_table_header *sysctl_header; struct ctl_table_header *sysctl_header;
#endif #endif

2
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
View File

@ -270,7 +270,7 @@ static ctl_table ip_ct_sysctl_table[] = {
{ {
.ctl_name = NET_IPV4_NF_CONNTRACK_CHECKSUM, .ctl_name = NET_IPV4_NF_CONNTRACK_CHECKSUM,
.procname = "ip_conntrack_checksum", .procname = "ip_conntrack_checksum",
.data = &nf_conntrack_checksum, .data = &init_net.ct.sysctl_checksum,
.maxlen = sizeof(int), .maxlen = sizeof(int),
.mode = 0644, .mode = 0644,
.proc_handler = &proc_dointvec, .proc_handler = &proc_dointvec,

2
net/ipv4/netfilter/nf_conntrack_proto_icmp.c
View File

@ -188,7 +188,7 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
} }
/* See ip_conntrack_proto_tcp.c */ /* See ip_conntrack_proto_tcp.c */
if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_ip_checksum(skb, hooknum, dataoff, 0)) { nf_ip_checksum(skb, hooknum, dataoff, 0)) {
if (LOG_INVALID(IPPROTO_ICMP)) if (LOG_INVALID(IPPROTO_ICMP))
nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,

2
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
View File

@ -187,7 +187,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
return -NF_ACCEPT; return -NF_ACCEPT;
} }
if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) { nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
"nf_ct_icmpv6: ICMPv6 checksum failed\n"); "nf_ct_icmpv6: ICMPv6 checksum failed\n");

2
net/netfilter/nf_conntrack_proto_dccp.c
View File

@ -575,7 +575,7 @@ static int dccp_error(struct net *net, struct sk_buff *skb,
} }
} }
if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_DCCP, nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_DCCP,
pf)) { pf)) {
msg = "nf_ct_dccp: bad checksum "; msg = "nf_ct_dccp: bad checksum ";

2
net/netfilter/nf_conntrack_proto_tcp.c
View File

@ -780,7 +780,7 @@ static int tcp_error(struct net *net,
* because the checksum is assumed to be correct. * because the checksum is assumed to be correct.
*/ */
/* FIXME: Source route IP option packets --RR */ /* FIXME: Source route IP option packets --RR */
if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) { nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,

2
net/netfilter/nf_conntrack_proto_udp.c
View File

@ -123,7 +123,7 @@ static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
* We skip checking packets on the outgoing path * We skip checking packets on the outgoing path
* because the checksum is assumed to be correct. * because the checksum is assumed to be correct.
* FIXME: Source route IP option packets --RR */ * FIXME: Source route IP option packets --RR */
if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) { nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
if (LOG_INVALID(IPPROTO_UDP)) if (LOG_INVALID(IPPROTO_UDP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,

2
net/netfilter/nf_conntrack_proto_udplite.c
View File

@ -129,7 +129,7 @@ static int udplite_error(struct net *net,
} }
/* Checksum invalid? Ignore. */ /* Checksum invalid? Ignore. */
if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP, nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP,
pf)) { pf)) {
if (LOG_INVALID(IPPROTO_UDPLITE)) if (LOG_INVALID(IPPROTO_UDPLITE))

7
net/netfilter/nf_conntrack_standalone.c
View File

@ -322,9 +322,6 @@ static void nf_conntrack_standalone_fini_proc(struct net *net)
/* Sysctl support */ /* Sysctl support */
int nf_conntrack_checksum __read_mostly = 1;
EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
/* Log invalid packets of a given protocol */ /* Log invalid packets of a given protocol */
static int log_invalid_proto_min = 0; static int log_invalid_proto_min = 0;
@ -360,7 +357,7 @@ static ctl_table nf_ct_sysctl_table[] = {
{ {
.ctl_name = NET_NF_CONNTRACK_CHECKSUM, .ctl_name = NET_NF_CONNTRACK_CHECKSUM,
.procname = "nf_conntrack_checksum", .procname = "nf_conntrack_checksum",
.data = &nf_conntrack_checksum, .data = &init_net.ct.sysctl_checksum,
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = &proc_dointvec, .proc_handler = &proc_dointvec,
@ -425,6 +422,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
goto out_kmemdup; goto out_kmemdup;
table[1].data = &net->ct.count; table[1].data = &net->ct.count;
table[3].data = &net->ct.sysctl_checksum;
net->ct.sysctl_header = register_net_sysctl_table(net, net->ct.sysctl_header = register_net_sysctl_table(net,
nf_net_netfilter_sysctl_path, table); nf_net_netfilter_sysctl_path, table);
@ -474,6 +472,7 @@ static int nf_conntrack_net_init(struct net *net)
ret = nf_conntrack_standalone_init_proc(net); ret = nf_conntrack_standalone_init_proc(net);
if (ret < 0) if (ret < 0)
goto out_proc; goto out_proc;
net->ct.sysctl_checksum = 1;
ret = nf_conntrack_standalone_init_sysctl(net); ret = nf_conntrack_standalone_init_sysctl(net);
if (ret < 0) if (ret < 0)
goto out_sysctl; goto out_sysctl;