Skip to content

Commit

Permalink
netfilter: remove nf_ct_unconfirmed_destroy helper
Browse files Browse the repository at this point in the history
This helper tags connections not yet in the conntrack table as
dying.  These nf_conn entries will be dropped instead when the
core attempts to insert them from the input or postrouting
'confirm' hook.

After the previous change, the entries get unlinked from the
list earlier, so that by the time the actual exit hook runs,
new connections no longer have a timeout policy assigned.

Its enough to walk the hashtable instead.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Florian Westphal authored and Pablo Neira Ayuso committed May 13, 2022
1 parent 78222ba commit 17438b4
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 18 deletions.
3 changes: 0 additions & 3 deletions include/net/netfilter/nf_conntrack.h
Original file line number Diff line number Diff line change
Expand Up @@ -237,9 +237,6 @@ static inline bool nf_ct_kill(struct nf_conn *ct)
return nf_ct_delete(ct, 0, 0);
}

/* Set all unconfirmed conntrack as dying */
void nf_ct_unconfirmed_destroy(struct net *);

/* Iterate over all conntracks: if iter returns true, it's deleted. */
void nf_ct_iterate_cleanup_net(struct net *net,
int (*iter)(struct nf_conn *i, void *data),
Expand Down
14 changes: 0 additions & 14 deletions net/netfilter/nf_conntrack_core.c
Original file line number Diff line number Diff line change
Expand Up @@ -2431,20 +2431,6 @@ __nf_ct_unconfirmed_destroy(struct net *net)
}
}

void nf_ct_unconfirmed_destroy(struct net *net)
{
struct nf_conntrack_net *cnet = nf_ct_pernet(net);

might_sleep();

if (atomic_read(&cnet->count) > 0) {
__nf_ct_unconfirmed_destroy(net);
nf_queue_nf_hook_drop(net);
synchronize_net();
}
}
EXPORT_SYMBOL_GPL(nf_ct_unconfirmed_destroy);

void nf_ct_iterate_cleanup_net(struct net *net,
int (*iter)(struct nf_conn *i, void *data),
void *data, u32 portid, int report)
Expand Down
4 changes: 3 additions & 1 deletion net/netfilter/nfnetlink_cttimeout.c
Original file line number Diff line number Diff line change
Expand Up @@ -608,7 +608,9 @@ static void __net_exit cttimeout_net_exit(struct net *net)
struct nfct_timeout_pernet *pernet = nfct_timeout_pernet(net);
struct ctnl_timeout *cur, *tmp;

nf_ct_unconfirmed_destroy(net);
if (list_empty(&pernet->nfct_timeout_freelist))
return;

nf_ct_untimeout(net, NULL);

list_for_each_entry_safe(cur, tmp, &pernet->nfct_timeout_freelist, head) {
Expand Down

0 comments on commit 17438b4

Please sign in to comment.