if CONFIG_NF_QUEUE_CONNBYTES_BYPASS add conntrack extensions to allow bypass nf_queue Signed-off-by: Karl Hiramoto <karl@xxxxxxxxxxxx> --- include/net/netfilter/nf_conntrack_extend.h | 2 + net/netfilter/nf_conntrack_core.c | 37 ++++++++++++++++++++++++++- 2 files changed, 38 insertions(+), 1 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h index 32d15bd..81f3698 100644 --- a/include/net/netfilter/nf_conntrack_extend.h +++ b/include/net/netfilter/nf_conntrack_extend.h @@ -11,6 +11,7 @@ enum nf_ct_ext_id { NF_CT_EXT_ACCT, NF_CT_EXT_ECACHE, NF_CT_EXT_ZONE, + NF_CT_EXT_QUEUE, NF_CT_EXT_NUM, }; @@ -19,6 +20,7 @@ enum nf_ct_ext_id { #define NF_CT_EXT_ACCT_TYPE struct nf_conn_counter #define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache #define NF_CT_EXT_ZONE_TYPE struct nf_conntrack_zone +#define NF_CT_EXT_QUEUE_TYPE struct nf_conntrack_queue /* Extensions: optional stuff which isn't permanently in struct. */ struct nf_ct_ext { diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index eeeb8bc..5b7b105 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -42,6 +42,7 @@ #include <net/netfilter/nf_conntrack_extend.h> #include <net/netfilter/nf_conntrack_acct.h> #include <net/netfilter/nf_conntrack_ecache.h> +#include <net/netfilter/nf_conntrack_queue.h> #include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_nat.h> #include <net/netfilter/nf_nat_core.h> @@ -632,6 +633,11 @@ struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone, nf_ct_zone->id = zone; } #endif + +#if defined(CONFIG_NF_QUEUE_CONNBYTES_BYPASS) + if (!nf_ct_ext_add(ct, NF_CT_EXT_QUEUE, gfp)) + goto out_free; +#endif /* * changes to lookup keys must be done before setting refcnt to 1 */ @@ -639,11 +645,14 @@ struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone, atomic_set(&ct->ct_general.use, 1); return ct; -#ifdef CONFIG_NF_CONNTRACK_ZONES +#if defined(CONFIG_NF_QUEUE_CONNBYTES_BYPASS) \ + || defined(CONFIG_NF_CONNTRACK_ZONES) + out_free: kmem_cache_free(net->ct.nf_conntrack_cachep, ct); return ERR_PTR(-ENOMEM); #endif + } EXPORT_SYMBOL_GPL(nf_conntrack_alloc); @@ -1010,6 +1019,14 @@ static struct nf_ct_ext_type nf_ct_zone_extend __read_mostly = { }; #endif +#if defined(CONFIG_NF_QUEUE_CONNBYTES_BYPASS) +static struct nf_ct_ext_type nf_conntrack_queue_extend __read_mostly = { + .len = sizeof(struct nf_conntrack_queue), + .align = __alignof__(struct nf_conntrack_queue), + .id = NF_CT_EXT_QUEUE, +}; +#endif + #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) #include <linux/netfilter/nfnetlink.h> @@ -1194,6 +1211,11 @@ static void nf_conntrack_cleanup_init_net(void) #ifdef CONFIG_NF_CONNTRACK_ZONES nf_ct_extend_unregister(&nf_ct_zone_extend); #endif + +#if defined(CONFIG_NF_QUEUE_CONNBYTES_BYPASS) + nf_ct_extend_unregister(&nf_conntrack_queue_extend); +#endif + } static void nf_conntrack_cleanup_net(struct net *net) @@ -1362,6 +1384,15 @@ static int nf_conntrack_init_init_net(void) if (ret < 0) goto err_extend; #endif + +#if defined(CONFIG_NF_QUEUE_CONNBYTES_BYPASS) + ret = nf_ct_extend_register(&nf_conntrack_queue_extend); + if (ret < 0) { + printk(KERN_ERR "nfnetlink_queue: failed to register CT ext.\n"); + goto err_extend_queue; + } +#endif + /* Set up fake conntrack: to never be deleted, not in any hashes */ #ifdef CONFIG_NET_NS nf_conntrack_untracked.ct_net = &init_net; @@ -1372,7 +1403,11 @@ static int nf_conntrack_init_init_net(void) return 0; +#if defined(CONFIG_NF_QUEUE_CONNBYTES_BYPASS) +err_extend_queue: +#endif #ifdef CONFIG_NF_CONNTRACK_ZONES + nf_ct_extend_unregister(&nf_ct_zone_extend); err_extend: nf_conntrack_helper_fini(); #endif -- 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html