netfilter: nf_ct_helper: allow to disable automatic helper assignment

[deliverable/linux.git] / net / netfilter / nf_conntrack_helper.c

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 436b7cb79ba43833018477832d3e4ffa185bcb97..317f6e43db877b4b59d7f82971f68ffd5a68fb31 100644 (file)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -34,6 +34,67 @@ static struct hlist_head *nf_ct_helper_hash __read_mostly;
 static unsigned int nf_ct_helper_hsize __read_mostly;
 static unsigned int nf_ct_helper_count __read_mostly;
 
+static bool nf_ct_auto_assign_helper __read_mostly = true;
+module_param_named(nf_conntrack_helper, nf_ct_auto_assign_helper, bool, 0644);
+MODULE_PARM_DESC(nf_conntrack_helper,
+                "Enable automatic conntrack helper assignment (default 1)");
+
+#ifdef CONFIG_SYSCTL
+static struct ctl_table helper_sysctl_table[] = {
+       {
+               .procname       = "nf_conntrack_helper",
+               .data           = &init_net.ct.sysctl_auto_assign_helper,
+               .maxlen         = sizeof(unsigned int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec,
+       },
+       {}
+};
+
+static int nf_conntrack_helper_init_sysctl(struct net *net)
+{
+       struct ctl_table *table;
+
+       table = kmemdup(helper_sysctl_table, sizeof(helper_sysctl_table),
+                       GFP_KERNEL);
+       if (!table)
+               goto out;
+
+       table[0].data = &net->ct.sysctl_auto_assign_helper;
+
+       net->ct.helper_sysctl_header =
+               register_net_sysctl(net, "net/netfilter", table);
+
+       if (!net->ct.helper_sysctl_header) {
+               pr_err("nf_conntrack_helper: can't register to sysctl.\n");
+               goto out_register;
+       }
+       return 0;
+
+out_register:
+       kfree(table);
+out:
+       return -ENOMEM;
+}
+
+static void nf_conntrack_helper_fini_sysctl(struct net *net)
+{
+       struct ctl_table *table;
+
+       table = net->ct.helper_sysctl_header->ctl_table_arg;
+       unregister_net_sysctl_table(net->ct.helper_sysctl_header);
+       kfree(table);
+}
+#else
+static int nf_conntrack_helper_init_sysctl(struct net *net)
+{
+       return 0;
+}
+
+static void nf_conntrack_helper_fini_sysctl(struct net *net)
+{
+}
+#endif /* CONFIG_SYSCTL */
 
 /* Stupid hash, but collision free for the default registrations of the
  * helpers currently in the kernel. */
@@ -118,6 +179,7 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 {
        struct nf_conntrack_helper *helper = NULL;
        struct nf_conn_help *help;
+       struct net *net = nf_ct_net(ct);
        int ret = 0;
 
        if (tmpl != NULL) {
@@ -127,8 +189,17 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
        }
 
        help = nfct_help(ct);
-       if (helper == NULL)
+       if (net->ct.sysctl_auto_assign_helper && helper == NULL) {
                helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+               if (unlikely(!net->ct.auto_assign_helper_warned && helper)) {
+                       pr_info("nf_conntrack: automatic helper "
+                               "assignment is deprecated and it will "
+                               "be removed soon. Use the iptables CT target "
+                               "to attach helpers instead.\n");
+                       net->ct.auto_assign_helper_warned = true;
+               }
+       }
+
        if (helper == NULL) {
                if (help)
                        RCU_INIT_POINTER(help->helper, NULL);
@@ -315,28 +386,44 @@ static struct nf_ct_ext_type helper_extend __read_mostly = {
        .id     = NF_CT_EXT_HELPER,
 };
 
-int nf_conntrack_helper_init(void)
+int nf_conntrack_helper_init(struct net *net)
 {
        int err;
 
-       nf_ct_helper_hsize = 1; /* gets rounded up to use one page */
-       nf_ct_helper_hash = nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 0);
-       if (!nf_ct_helper_hash)
-               return -ENOMEM;
+       net->ct.auto_assign_helper_warned = false;
+       net->ct.sysctl_auto_assign_helper = nf_ct_auto_assign_helper;
 
-       err = nf_ct_extend_register(&helper_extend);
+       if (net_eq(net, &init_net)) {
+               nf_ct_helper_hsize = 1; /* gets rounded up to use one page */
+               nf_ct_helper_hash =
+                       nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 0);
+               if (!nf_ct_helper_hash)
+                       return -ENOMEM;
+
+               err = nf_ct_extend_register(&helper_extend);
+               if (err < 0)
+                       goto err1;
+       }
+
+       err = nf_conntrack_helper_init_sysctl(net);
        if (err < 0)
-               goto err1;
+               goto out_sysctl;
 
        return 0;
 
+out_sysctl:
+       if (net_eq(net, &init_net))
+               nf_ct_extend_unregister(&helper_extend);
 err1:
        nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_hsize);
        return err;
 }
 
-void nf_conntrack_helper_fini(void)
+void nf_conntrack_helper_fini(struct net *net)
 {
-       nf_ct_extend_unregister(&helper_extend);
-       nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_hsize);
+       nf_conntrack_helper_fini_sysctl(net);
+       if (net_eq(net, &init_net)) {
+               nf_ct_extend_unregister(&helper_extend);
+               nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_hsize);
+       }
 }