netfilter: netns nf_conntrack: per-netns conntrack hash

[safe/jmp/linux-2.6] / net / netfilter / nf_conntrack_standalone.c

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 869ef93..5456e4b 100644 (file)
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -51,7 +51,7 @@ static struct hlist_node *ct_get_first(struct seq_file *seq)
        for (st->bucket = 0;
             st->bucket < nf_conntrack_htable_size;
             st->bucket++) {
-               n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+               n = rcu_dereference(init_net.ct.hash[st->bucket].first);
                if (n)
                        return n;
        }
@@ -67,7 +67,7 @@ static struct hlist_node *ct_get_next(struct seq_file *seq,
        while (head == NULL) {
                if (++st->bucket >= nf_conntrack_htable_size)
                        return NULL;
-               head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+               head = rcu_dereference(init_net.ct.hash[st->bucket].first);
        }
        return head;
 }
@@ -226,7 +226,7 @@ static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 
 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 {
-       unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
+       unsigned int nr_conntracks = atomic_read(&init_net.ct.count);
        const struct ip_conntrack_stat *st = v;
 
        if (v == SEQ_START_TOKEN) {
@@ -324,6 +324,7 @@ static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
 static struct ctl_table_header *nf_ct_sysctl_header;
+static struct ctl_table_header *nf_ct_netfilter_header;
 
 static ctl_table nf_ct_sysctl_table[] = {
        {
@@ -337,7 +338,7 @@ static ctl_table nf_ct_sysctl_table[] = {
        {
                .ctl_name       = NET_NF_CONNTRACK_COUNT,
                .procname       = "nf_conntrack_count",
-               .data           = &nf_conntrack_count,
+               .data           = &init_net.ct.count,
                .maxlen         = sizeof(int),
                .mode           = 0444,
                .proc_handler   = &proc_dointvec,
@@ -384,12 +385,6 @@ static ctl_table nf_ct_sysctl_table[] = {
 
 static ctl_table nf_ct_netfilter_table[] = {
        {
-               .ctl_name       = NET_NETFILTER,
-               .procname       = "netfilter",
-               .mode           = 0555,
-               .child          = nf_ct_sysctl_table,
-       },
-       {
                .ctl_name       = NET_NF_CONNTRACK_MAX,
                .procname       = "nf_conntrack_max",
                .data           = &nf_conntrack_max,
@@ -409,18 +404,29 @@ EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
 
 static int nf_conntrack_standalone_init_sysctl(void)
 {
-       nf_ct_sysctl_header =
+       nf_ct_netfilter_header =
                register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
-       if (nf_ct_sysctl_header == NULL) {
-               printk("nf_conntrack: can't register to sysctl.\n");
-               return -ENOMEM;
-       }
+       if (!nf_ct_netfilter_header)
+               goto out;
+
+       nf_ct_sysctl_header =
+                register_sysctl_paths(nf_net_netfilter_sysctl_path,
+                                       nf_ct_sysctl_table);
+       if (!nf_ct_sysctl_header)
+               goto out_unregister_netfilter;
+
        return 0;
 
+out_unregister_netfilter:
+       unregister_sysctl_table(nf_ct_netfilter_header);
+out:
+       printk("nf_conntrack: can't register to sysctl.\n");
+       return -ENOMEM;
 }
 
 static void nf_conntrack_standalone_fini_sysctl(void)
 {
+       unregister_sysctl_table(nf_ct_netfilter_header);
        unregister_sysctl_table(nf_ct_sysctl_header);
 }
 #else
@@ -434,11 +440,26 @@ static void nf_conntrack_standalone_fini_sysctl(void)
 }
 #endif /* CONFIG_SYSCTL */
 
+static int nf_conntrack_net_init(struct net *net)
+{
+       return nf_conntrack_init(net);
+}
+
+static void nf_conntrack_net_exit(struct net *net)
+{
+       nf_conntrack_cleanup(net);
+}
+
+static struct pernet_operations nf_conntrack_net_ops = {
+       .init = nf_conntrack_net_init,
+       .exit = nf_conntrack_net_exit,
+};
+
 static int __init nf_conntrack_standalone_init(void)
 {
        int ret;
 
-       ret = nf_conntrack_init();
+       ret = register_pernet_subsys(&nf_conntrack_net_ops);
        if (ret < 0)
                goto out;
        ret = nf_conntrack_standalone_init_proc();
@@ -452,7 +473,7 @@ static int __init nf_conntrack_standalone_init(void)
 out_sysctl:
        nf_conntrack_standalone_fini_proc();
 out_proc:
-       nf_conntrack_cleanup();
+       unregister_pernet_subsys(&nf_conntrack_net_ops);
 out:
        return ret;
 }
@@ -461,7 +482,7 @@ static void __exit nf_conntrack_standalone_fini(void)
 {
        nf_conntrack_standalone_fini_sysctl();
        nf_conntrack_standalone_fini_proc();
-       nf_conntrack_cleanup();
+       unregister_pernet_subsys(&nf_conntrack_net_ops);
 }
 
 module_init(nf_conntrack_standalone_init);