option to disable /proc/net/nf_conntrack procfs [was Re: netfilter patches for 3.0.0-rc1]

[Pablo Neira Ayuso <pablo@netfilter.org>]

On 03/06/11 10:53, Jan Engelhardt wrote:
> netfilter: provide config option to disable ancient procfs parts
> 
> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
> ---
>  net/netfilter/Kconfig                   |   10 ++++++++++
>  net/netfilter/nf_conntrack_expect.c     |   12 ++++++------
>  net/netfilter/nf_conntrack_standalone.c |    4 ++--
>  3 files changed, 18 insertions(+), 8 deletions(-)
> 
> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> index 32bff6d..e4b1076 100644
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -75,6 +75,16 @@ config NF_CONNTRACK_ZONES
>  
>  	  If unsure, say `N'.
>  
> +config NF_CONNTRACK_PROCFS
> +	bool "Supply CT list in procfs (OBSOLETE)"
> +	default y
> +	depends on PROC_FS
> +	---help---
> +	This option enables for the list of known conntrack entries
> +	to be shown in procfs under net/netfilter/nf_conntrack. This
> +	is considered obsolete in favor of using the conntrack(8)
> +	tool which uses Netlink.
> +

This still misses /proc/net/ip_conntrack which would be available. See
nf_conntrack_l3proto_ipv4_compat.c