netfilter: add and use nf_ct_unconfirmed_destroy

This also removes __nf_ct_unconfirmed_destroy() call from
nf_ct_iterate_cleanup_net, so that function can be used only
when missing conntracks from unconfirmed list isn't a problem.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 48407569585da8b44db8ee089e96fdf53c7469de..6e6f678aaac71a2716edd574151c2aa61d84976d 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -224,6 +224,9 @@ extern s32 (*nf_ct_nat_offset)(const struct nf_conn *ct,
                               enum ip_conntrack_dir dir,
                               u32 seq);
 
+/* Set all unconfirmed conntrack as dying */
+void nf_ct_unconfirmed_destroy(struct net *);
+
 /* Iterate over all conntracks: if iter returns true, it's deleted. */
 void nf_ct_iterate_cleanup_net(struct net *net,
                               int (*iter)(struct nf_conn *i, void *data),

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index c6f1cf0bff569416f350f15e8d5b2848f2ee29d0..80ab4e937765d679b3ecd349fc81ae61b0b9c2cc 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1686,6 +1686,17 @@ __nf_ct_unconfirmed_destroy(struct net *net)
        }
 }
 
+void nf_ct_unconfirmed_destroy(struct net *net)
+{
+       might_sleep();
+
+       if (atomic_read(&net->ct.count) > 0) {
+               __nf_ct_unconfirmed_destroy(net);
+               synchronize_net();
+       }
+}
+EXPORT_SYMBOL_GPL(nf_ct_unconfirmed_destroy);
+
 void nf_ct_iterate_cleanup_net(struct net *net,
                               int (*iter)(struct nf_conn *i, void *data),
                               void *data, u32 portid, int report)
@@ -1697,14 +1708,10 @@ void nf_ct_iterate_cleanup_net(struct net *net,
        if (atomic_read(&net->ct.count) == 0)
                return;
 
-       __nf_ct_unconfirmed_destroy(net);
-
        d.iter = iter;
        d.data = data;
        d.net = net;
 
-       synchronize_net();
-
        nf_ct_iterate_cleanup(iter_net_only, &d, portid, report);
 }
 EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup_net);

diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 7ce9e86d374c23f088a99cc38c5354bb6f8d58da..f4fb6d4dd0b9fe4c88240d2521ac992cf397650e 100644 (file)
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -570,6 +570,7 @@ static void __net_exit cttimeout_net_exit(struct net *net)
 {
        struct ctnl_timeout *cur, *tmp;
 
+       nf_ct_unconfirmed_destroy(net);
        ctnl_untimeout(net, NULL);
 
        list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {