netfilter: remove nf_ct_unconfirmed_destroy helper

This helper tags connections not yet in the conntrack table as
dying.  These nf_conn entries will be dropped instead when the
core attempts to insert them from the input or postrouting
'confirm' hook.

After the previous change, the entries get unlinked from the
list earlier, so that by the time the actual exit hook runs,
new connections no longer have a timeout policy assigned.

Its enough to walk the hashtable instead.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 28672a94449974d501fcf334942a264cda4d5ff6..f60212244b13f6262648ebf0561bf8dacbec4041 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -237,9 +237,6 @@ static inline bool nf_ct_kill(struct nf_conn *ct)
        return nf_ct_delete(ct, 0, 0);
 }
 
-/* Set all unconfirmed conntrack as dying */
-void nf_ct_unconfirmed_destroy(struct net *);
-
 /* Iterate over all conntracks: if iter returns true, it's deleted. */
 void nf_ct_iterate_cleanup_net(struct net *net,
                               int (*iter)(struct nf_conn *i, void *data),

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 9010b6e5a072e0fa8854eef9ff084b9055106694..b3cc318ceb4526eb89f1bce88168f64fd3e4c080 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -2431,20 +2431,6 @@ __nf_ct_unconfirmed_destroy(struct net *net)
        }
 }
 
-void nf_ct_unconfirmed_destroy(struct net *net)
-{
-       struct nf_conntrack_net *cnet = nf_ct_pernet(net);
-
-       might_sleep();
-
-       if (atomic_read(&cnet->count) > 0) {
-               __nf_ct_unconfirmed_destroy(net);
-               nf_queue_nf_hook_drop(net);
-               synchronize_net();
-       }
-}
-EXPORT_SYMBOL_GPL(nf_ct_unconfirmed_destroy);
-
 void nf_ct_iterate_cleanup_net(struct net *net,
                               int (*iter)(struct nf_conn *i, void *data),
                               void *data, u32 portid, int report)

diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 83fa15c4193cd07ca7177db5c2fe3be9145ec54f..f366b8187915576cfde8ec21457e68000c3a9125 100644 (file)
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -608,7 +608,9 @@ static void __net_exit cttimeout_net_exit(struct net *net)
        struct nfct_timeout_pernet *pernet = nfct_timeout_pernet(net);
        struct ctnl_timeout *cur, *tmp;
 
-       nf_ct_unconfirmed_destroy(net);
+       if (list_empty(&pernet->nfct_timeout_freelist))
+               return;
+
        nf_ct_untimeout(net, NULL);
 
        list_for_each_entry_safe(cur, tmp, &pernet->nfct_timeout_freelist, head) {