From: Gao feng <gaofeng@cn.fujitsu.com>
To: Gao feng <gaofeng@cn.fujitsu.com>
Cc: pablo@netfilter.org, netfilter-devel@vger.kernel.org,
netdev@vger.kernel.org, ebiederm@xmission.com,
serge.hallyn@canonical.com, dlezcano@fr.ibm.com
Subject: Re: [PATCH 10/12] netfilter: sctp proto sysctl support for net namespace
Date: Tue, 17 Apr 2012 18:30:14 +0800 [thread overview]
Message-ID: <4F8D4636.2080906@cn.fujitsu.com> (raw)
In-Reply-To: <1334631383-12326-11-git-send-email-gaofeng@cn.fujitsu.com>
于 2012年04月17日 10:56, Gao feng 写道:
> register pernet_operations nf_conntrack_net_proto_sctp_ops
> when loading nf_conntrack_proto_sctp module,and unregister
> it when removing.
>
> It makes no senes to register subsys for sctp and sctp6,because
> the nf_conntrack_l4proto_sctp4 and nf_conntrack_l4proto_sctp6 are
> register or unregister together.
>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
I think it's better to impletement this as dccp,
dccp stores the timeouts and ctl_table in net_generic.
This will don't cause waste when sctp module is not loaded.
> ---
> net/netfilter/nf_conntrack_proto_sctp.c | 205 ++++++++++++++++++++++++++-----
> 1 files changed, 175 insertions(+), 30 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> index 72b5088..866d151 100644
> --- a/net/netfilter/nf_conntrack_proto_sctp.c
> +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> @@ -281,7 +281,7 @@ static int sctp_new_state(enum ip_conntrack_dir dir,
>
> static unsigned int *sctp_get_timeouts(struct net *net)
> {
> - return sctp_timeouts;
> + return net->ct.proto.sysctl_sctp_timeouts;
> }
>
> /* Returns verdict for packet, or -NF_ACCEPT for invalid. */
> @@ -599,56 +599,60 @@ sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
> };
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
>
> -
> #ifdef CONFIG_SYSCTL
> -static unsigned int sctp_sysctl_table_users;
> -static struct ctl_table_header *sctp_sysctl_header;
> static struct ctl_table sctp_sysctl_table[] = {
> {
> .procname = "nf_conntrack_sctp_timeout_closed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_cookie_wait",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_established",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> @@ -660,49 +664,56 @@ static struct ctl_table sctp_sysctl_table[] = {
> static struct ctl_table sctp_compat_sysctl_table[] = {
> {
> .procname = "ip_conntrack_sctp_timeout_closed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_cookie_wait",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_cookie_echoed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_established",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_shutdown_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_shutdown_recd",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> @@ -742,14 +753,6 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
> .nla_policy = sctp_timeout_nla_policy,
> },
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
> -#ifdef CONFIG_SYSCTL
> - .ctl_table_users = &sctp_sysctl_table_users,
> - .ctl_table_header = &sctp_sysctl_header,
> - .ctl_table = sctp_sysctl_table,
> -#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> - .ctl_compat_table = sctp_compat_sysctl_table,
> -#endif
> -#endif
> };
>
> static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
> @@ -782,11 +785,146 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
> },
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
> #endif
> +};
> +
> +static int nf_conntrack_proto_sctp_net_init(struct net *net)
> +{
> + struct ctl_table *table;
> + int i, ret = 0;
> + for (i = 0; i < SCTP_CONNTRACK_MAX; i++)
> + net->ct.proto.sysctl_sctp_timeouts[i] = sctp_timeouts[i];
> +
> #ifdef CONFIG_SYSCTL
> - .ctl_table_users = &sctp_sysctl_table_users,
> - .ctl_table_header = &sctp_sysctl_header,
> - .ctl_table = sctp_sysctl_table,
> + table = kmemdup(sctp_sysctl_table,
> + sizeof(sctp_sysctl_table),
> + GFP_KERNEL);
> + if (!table)
> + return -ENOMEM;
> + table[0].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED];
> + table[1].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT];
> + table[2].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED];
> + table[3].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED];
> + table[4].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT];
> + table[5].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD];
> + table[6].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT];
> +
> + ret = nf_ct_register_net_sysctl(net,
> + &net->ct.proto.sctp_sysctl_header,
> + nf_net_netfilter_sysctl_path,
> + table,
> + NULL);
> + if (ret < 0) {
> + printk(KERN_ERR
> + "nf_conntrack_proto_sctp:"
> + " can't register to sysctl.\n");
> + goto out_register;
> + }
> + return 0;
> +out_register:
> + kfree(table);
> #endif
> + return ret;
> +}
> +
> +static void nf_conntrack_proto_sctp_net_fini(struct net *net)
> +{
> +#ifdef CONFIG_SYSCTL
> + struct ctl_table *table;
> + table = net->ct.proto.sctp_sysctl_header->ctl_table_arg;
> +
> + nf_ct_unregister_net_sysctl(&net->ct.proto.sctp_sysctl_header,
> + table,
> + NULL);
> +#endif
> +}
> +
> +static int nf_conntrack_proto_sctp_compat_init(struct net *net)
> +{
> + int ret = 0;
> +#ifdef CONFIG_SYSCTL
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + struct ctl_table *compat_table;
> + compat_table = kmemdup(sctp_compat_sysctl_table,
> + sizeof(sctp_compat_sysctl_table),
> + GFP_KERNEL);
> + if (!compat_table)
> + return -ENOMEM;
> +
> + compat_table[0].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED];
> + compat_table[1].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT];
> + compat_table[2].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED];
> + compat_table[3].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED];
> + compat_table[4].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT];
> + compat_table[5].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD];
> + compat_table[6].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT];
> +
> + ret = nf_ct_register_net_sysctl(net,
> + &net->ct.proto.sctp_compat_header,
> + nf_net_ipv4_netfilter_sysctl_path,
> + compat_table,
> + NULL);
> + if (ret < 0) {
> + printk(KERN_ERR
> + "nf_conntrack_proto_sctp:"
> + " can't register to compat sysctl.\n");
> + goto out_register;
> + }
> + return 0;
> +out_register:
> + kfree(compat_table);
> +#endif
> +#endif
> + return ret;
> +}
> +
> +static void nf_conntrack_proto_sctp_compat_fini(struct net *net)
> +{
> +#ifdef CONFIG_SYSCTL
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + struct ctl_table *compat_table;
> + compat_table = net->ct.proto.sctp_compat_header->ctl_table_arg;
> + nf_ct_unregister_net_sysctl(&net->ct.proto.sctp_compat_header,
> + compat_table,
> + NULL);
> +#endif
> +#endif
> +}
> +
> +static int nf_conntrack_net_proto_sctp_init(struct net *net)
> +{
> + int ret;
> + ret = nf_conntrack_proto_sctp_net_init(net);
> + if (ret < 0)
> + return ret;
> + ret = nf_conntrack_proto_sctp_compat_init(net);
> + if (ret < 0)
> + nf_conntrack_proto_sctp_net_fini(net);
> + return ret;
> +}
> +
> +static void nf_conntrack_net_proto_sctp_fini(struct net *net)
> +{
> + nf_conntrack_proto_sctp_compat_fini(net);
> + nf_conntrack_proto_sctp_net_fini(net);
> +}
> +
> +static struct pernet_operations nf_conntrack_net_proto_sctp_ops = {
> + .init = nf_conntrack_net_proto_sctp_init,
> + .exit = nf_conntrack_net_proto_sctp_fini,
> };
>
> static int __init nf_conntrack_proto_sctp_init(void)
> @@ -803,9 +941,15 @@ static int __init nf_conntrack_proto_sctp_init(void)
> pr_err("nf_conntrack_l4proto_sctp6: protocol register failed\n");
> goto cleanup_sctp4;
> }
> -
> + ret = register_pernet_subsys(&nf_conntrack_net_proto_sctp_ops);
> + if (ret) {
> + pr_err("nf_conntrack: sctp pernet subsys register failed\n");
> + goto cleanup_sctp6;
> + }
> return ret;
>
> + cleanup_sctp6:
> + nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
> cleanup_sctp4:
> nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
> out:
> @@ -814,6 +958,7 @@ static int __init nf_conntrack_proto_sctp_init(void)
>
> static void __exit nf_conntrack_proto_sctp_fini(void)
> {
> + unregister_pernet_subsys(&nf_conntrack_net_proto_sctp_ops);
> nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
> nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
> }
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2012-04-17 10:29 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-17 2:56 [PATCH 00/12] add namespace support for netfilter protos Gao feng
2012-04-17 2:56 ` [PATCH 01/12] netfilter: add struct netns_ct_proto to support netfilter namespace Gao feng
2012-04-17 8:54 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 02/12] netfilter: don't register sysctl when register proto Gao feng
2012-04-17 8:56 ` Pablo Neira Ayuso
2012-04-17 10:25 ` Gao feng
2012-04-17 11:26 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 03/12] netfilter: generic proto sysctl support for net namespace Gao feng
2012-04-17 8:58 ` Pablo Neira Ayuso
2012-04-17 10:22 ` Gao feng
2012-04-17 11:35 ` Pablo Neira Ayuso
2012-04-18 0:20 ` Gao feng
2012-04-17 2:56 ` [PATCH 04/12] netfilter: tcp " Gao feng
2012-04-17 2:56 ` [PATCH 05/12] netfilter: udp " Gao feng
2012-04-17 2:56 ` [PATCH 06/12] netfilter: icmp " Gao feng
2012-04-17 2:56 ` [PATCH 07/12] netfilter: icmpv6 proto sysctl support for net Gao feng
2012-04-17 2:56 ` [PATCH 08/12] netfilter: ipv4 sysctl support for net namespace Gao feng
2012-04-17 2:56 ` [PATCH 09/12] netfilter: ipv6 " Gao feng
2012-04-17 2:56 ` [PATCH 10/12] netfilter: sctp proto " Gao feng
2012-04-17 10:30 ` Gao feng [this message]
2012-04-17 11:29 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 11/12] netfilter: udplite proto sysctl support for net Gao feng
2012-04-17 2:56 ` [PATCH 12/12] netfilter: export necessary function for generic proto Gao feng
2012-04-17 9:01 ` Pablo Neira Ayuso
2012-04-17 8:52 ` [PATCH 00/12] add namespace support for netfilter protos Pablo Neira Ayuso
2012-04-17 10:12 ` Gao feng
2012-04-17 10:34 ` Jan Engelhardt
2012-04-17 10:59 ` Pablo Neira Ayuso
2012-04-17 14:35 ` Serge Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F8D4636.2080906@cn.fujitsu.com \
--to=gaofeng@cn.fujitsu.com \
--cc=dlezcano@fr.ibm.com \
--cc=ebiederm@xmission.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=serge.hallyn@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.