From: Alexey Dobriyan <adobriyan@gmail.com>
To: Patrick McHardy <kaber@trash.net>
Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org,
containers@lists.linux-foundation.org
Subject: [PATCH v2 4/6] netns ct: per-netns net.netfilter.nf_conntrack_checksum sysctl
Date: Sat, 13 Sep 2008 14:52:39 +0400 [thread overview]
Message-ID: <20080913105239.GE7440@x200.localdomain> (raw)
In-Reply-To: <48C62B1C.7070104@trash.net>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
---
include/net/netfilter/nf_conntrack.h | 1 -
include/net/netns/conntrack.h | 1 +
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 +-
net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 2 +-
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 2 +-
net/netfilter/nf_conntrack_proto_dccp.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 2 +-
net/netfilter/nf_conntrack_proto_udplite.c | 2 +-
net/netfilter/nf_conntrack_standalone.c | 7 +++----
10 files changed, 11 insertions(+), 12 deletions(-)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -287,7 +287,6 @@ static inline int nf_ct_is_untracked(const struct sk_buff *skb)
extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
extern unsigned int nf_conntrack_htable_size;
-extern int nf_conntrack_checksum;
extern int nf_conntrack_max;
#define NF_CT_STAT_INC(net, count) \
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -17,6 +17,7 @@ struct netns_ct {
#ifdef CONFIG_NF_CONNTRACK_EVENTS
struct nf_conntrack_ecache *ecache;
#endif
+ int sysctl_checksum;
#ifdef CONFIG_SYSCTL
struct ctl_table_header *sysctl_header;
#endif
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -270,7 +270,7 @@ static ctl_table ip_ct_sysctl_table[] = {
{
.ctl_name = NET_IPV4_NF_CONNTRACK_CHECKSUM,
.procname = "ip_conntrack_checksum",
- .data = &nf_conntrack_checksum,
+ .data = &init_net.ct.sysctl_checksum,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = &proc_dointvec,
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -188,7 +188,7 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
}
/* See ip_conntrack_proto_tcp.c */
- if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+ if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_ip_checksum(skb, hooknum, dataoff, 0)) {
if (LOG_INVALID(IPPROTO_ICMP))
nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -187,7 +187,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
return -NF_ACCEPT;
}
- if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+ if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
"nf_ct_icmpv6: ICMPv6 checksum failed\n");
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -575,7 +575,7 @@ static int dccp_error(struct net *net, struct sk_buff *skb,
}
}
- if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+ if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_DCCP,
pf)) {
msg = "nf_ct_dccp: bad checksum ";
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -780,7 +780,7 @@ static int tcp_error(struct net *net,
* because the checksum is assumed to be correct.
*/
/* FIXME: Source route IP option packets --RR */
- if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+ if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
if (LOG_INVALID(IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -123,7 +123,7 @@ static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
* We skip checking packets on the outgoing path
* because the checksum is assumed to be correct.
* FIXME: Source route IP option packets --RR */
- if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+ if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
if (LOG_INVALID(IPPROTO_UDP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -129,7 +129,7 @@ static int udplite_error(struct net *net,
}
/* Checksum invalid? Ignore. */
- if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+ if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP,
pf)) {
if (LOG_INVALID(IPPROTO_UDPLITE))
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -322,9 +322,6 @@ static void nf_conntrack_standalone_fini_proc(struct net *net)
/* Sysctl support */
-int nf_conntrack_checksum __read_mostly = 1;
-EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
-
#ifdef CONFIG_SYSCTL
/* Log invalid packets of a given protocol */
static int log_invalid_proto_min = 0;
@@ -360,7 +357,7 @@ static ctl_table nf_ct_sysctl_table[] = {
{
.ctl_name = NET_NF_CONNTRACK_CHECKSUM,
.procname = "nf_conntrack_checksum",
- .data = &nf_conntrack_checksum,
+ .data = &init_net.ct.sysctl_checksum,
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = &proc_dointvec,
@@ -425,6 +422,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
goto out_kmemdup;
table[1].data = &net->ct.count;
+ table[3].data = &net->ct.sysctl_checksum;
net->ct.sysctl_header = register_net_sysctl_table(net,
nf_net_netfilter_sysctl_path, table);
@@ -474,6 +472,7 @@ static int nf_conntrack_net_init(struct net *net)
ret = nf_conntrack_standalone_init_proc(net);
if (ret < 0)
goto out_proc;
+ net->ct.sysctl_checksum = 1;
ret = nf_conntrack_standalone_init_sysctl(net);
if (ret < 0)
goto out_sysctl;
next prev parent reply other threads:[~2008-09-13 10:50 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-08-21 22:00 [PATCH 10/38] netns ct: per-netns expectations adobriyan
2008-09-04 16:43 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 01/33] nf_conntrack_sip: de-static helper pointers Alexey Dobriyan
2008-09-08 3:02 ` [PATCH 02/33] nf_conntrack_gre: more locking around keymap list Alexey Dobriyan
2008-09-08 3:02 ` [PATCH 03/33] nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet Alexey Dobriyan
2008-09-09 5:39 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 04/33] Fix {ip,6}_route_me_harder() in netns Alexey Dobriyan
2008-09-09 5:44 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 05/33] netns ct: per-netns expectations Alexey Dobriyan
2008-09-09 5:49 ` Patrick McHardy
2008-09-09 7:07 ` Alexey Dobriyan
2008-09-09 7:10 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 06/33] netns ct: per-netns unconfirmed list Alexey Dobriyan
2008-09-09 5:50 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 07/33] netns ct: pass netns pointer to nf_conntrack_in() Alexey Dobriyan
2008-09-09 5:52 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 08/33] netns ct: pass netns pointer to L4 protocol's ->error hook Alexey Dobriyan
2008-09-09 5:54 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 09/33] netns ct: per-netns /proc/net/nf_conntrack, /proc/net/stat/nf_conntrack Alexey Dobriyan
2008-09-09 5:56 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 10/33] netns ct: per-netns /proc/net/nf_conntrack_expect Alexey Dobriyan
2008-09-09 5:57 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 11/33] netns ct: per-netns /proc/net/ip_conntrack, /proc/net/stat/ip_conntrack, /proc/net/ip_conntrack_expect Alexey Dobriyan
2008-09-09 5:59 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 12/33] netns ct: export netns list Alexey Dobriyan
2008-09-09 5:59 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 13/33] netns ct: unregister helper in every netns Alexey Dobriyan
2008-09-09 6:01 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 14/33] netns ct: cleanup after L3 and L4 proto unregister " Alexey Dobriyan
2008-09-09 6:03 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 15/33] netns ct: pass conntrack to nf_conntrack_event_cache() not skb Alexey Dobriyan
2008-09-09 6:04 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 16/33] netns ct: per-netns event cache Alexey Dobriyan
[not found] ` <1220842990-30500-16-git-send-email-adobriyan-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2008-09-09 6:12 ` Patrick McHardy
2008-09-09 7:07 ` Alexey Dobriyan
2008-09-09 7:07 ` Patrick McHardy
2008-09-09 7:16 ` Patrick McHardy
2008-09-08 3:02 ` [PATCH 17/33] netns ct: final init_net tweaks Alexey Dobriyan
2008-09-09 7:20 ` Patrick McHardy
2008-09-09 7:32 ` Alexey Dobriyan
2008-09-09 7:51 ` Patrick McHardy
2008-09-13 10:45 ` Alexey Dobriyan
2008-09-27 0:00 ` Alexey Dobriyan
2008-09-28 10:31 ` Patrick McHardy
2008-09-13 10:48 ` [PATCH v2 1/6] netns ct: per-netns statistics Alexey Dobriyan
2008-10-02 7:58 ` Patrick McHardy
2008-09-13 10:49 ` [PATCH v2 2/6] netns ct: per-netns /proc/net/stat/nf_conntrack , /proc/net/stat/ip_conntrack Alexey Dobriyan
2008-10-02 7:59 ` Patrick McHardy
2008-09-13 10:51 ` [PATCH v2 3/6] netns ct: per-netns net.netfilter.nf_conntrack_count sysctl Alexey Dobriyan
2008-10-02 8:00 ` Patrick McHardy
2008-09-13 10:52 ` Alexey Dobriyan [this message]
2008-10-02 8:02 ` [PATCH v2 4/6] netns ct: per-netns net.netfilter.nf_conntrack_checksum sysctl Patrick McHardy
2008-09-13 10:53 ` [PATCH v2 5/6] netns ct: per-netns net.netfilter.nf_conntrack_log_invalid sysctl Alexey Dobriyan
2008-10-02 8:04 ` Patrick McHardy
2008-09-13 10:55 ` [PATCH v2 6/6] netns ct: per-netns conntrack accounting Alexey Dobriyan
2008-09-26 23:59 ` [PATCH v2 7/6] netns ct: final netns tweaks Alexey Dobriyan
2008-10-02 8:11 ` Patrick McHardy
2008-10-02 8:06 ` [PATCH v2 6/6] netns ct: per-netns conntrack accounting Patrick McHardy
2008-09-08 3:02 ` [PATCH 17/33] netns ct: final init_net tweaks Alexey Dobriyan
2008-09-08 3:02 ` [PATCH 19/33] netns ct: per-netns /proc/net/stat/nf_conntrack, /proc/net/stat/ip_conntrack Alexey Dobriyan
2008-09-08 3:02 ` [PATCH 20/33] netns ct: per-netns net.netfilter.nf_conntrack_count sysctl Alexey Dobriyan
2008-09-08 3:02 ` [PATCH 21/33] netns ct: per-netns net.netfilter.nf_conntrack_checksum sysctl Alexey Dobriyan
2008-09-08 3:02 ` [PATCH 22/33] netns ct: per-netns net.netfilter.nf_conntrack_log_invalid sysctl Alexey Dobriyan
2008-09-08 3:03 ` Alexey Dobriyan
2008-09-08 3:03 ` [PATCH 24/33] netns ct: SIP conntracking in netns Alexey Dobriyan
2008-10-02 8:52 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 25/33] netns ct: H323 " Alexey Dobriyan
2008-10-02 8:52 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 26/33] netns ct: GRE " Alexey Dobriyan
2008-10-02 8:53 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 27/33] netns ct: PPTP " Alexey Dobriyan
2008-10-02 8:54 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 28/33] netns nat: fix ipt_MASQUERADE " Alexey Dobriyan
2008-10-02 9:06 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 29/33] netns nat: per-netns NAT table Alexey Dobriyan
2008-10-02 9:08 ` Patrick McHardy
2008-10-02 9:09 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 30/33] netns nat: per-netns bysource hash Alexey Dobriyan
2008-10-02 9:09 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 31/33] netns ct: fixup DNAT in netns Alexey Dobriyan
2008-10-02 9:10 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 32/33] netns nat: PPTP NAT " Alexey Dobriyan
2008-10-02 9:11 ` Patrick McHardy
2008-09-08 3:03 ` [PATCH 33/33] Enable netfilter " Alexey Dobriyan
2008-10-02 9:12 ` Patrick McHardy
2008-10-02 9:51 ` Alexey Dobriyan
2008-10-02 10:00 ` Patrick McHardy
2008-10-02 9:53 ` Alexey Dobriyan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080913105239.GE7440@x200.localdomain \
--to=adobriyan@gmail.com \
--cc=containers@lists.linux-foundation.org \
--cc=kaber@trash.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).