aboutsummaryrefslogtreecommitdiffstats
path: root/net/netfilter/core.c
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2016-11-15 21:36:45 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2016-12-06 21:42:00 +0100
commit834184b1f3a4635efbdfdae5fb437f109f6605fa (patch)
tree6ea25a837123c698a7feead4ee5e2d0f2e74cda4 /net/netfilter/core.c
parentnetfilter: conntrack: add nf_conntrack_default_on sysctl (diff)
downloadlinux-dev-834184b1f3a4635efbdfdae5fb437f109f6605fa.tar.xz
linux-dev-834184b1f3a4635efbdfdae5fb437f109f6605fa.zip
netfilter: defrag: only register defrag functionality if needed
nf_defrag modules for ipv4 and ipv6 export an empty stub function. Any module that needs the defragmentation hooks registered simply 'calls' this empty function to create a phony module dependency -- modprobe will then load the defrag module too. This extends netfilter ipv4/ipv6 defragmentation modules to delay the hook registration until the functionality is requested within a network namespace instead of module load time for all namespaces. Hooks are only un-registered on module unload or when a namespace that used such defrag functionality exits. We have to use struct net for this as the register hooks can be called before netns initialization here from the ipv4/ipv6 conntrack module init path. There is no unregister functionality support, defrag will always be active once it was requested inside a net namespace. The reason is that defrag has impact on nft and iptables rulesets (without defrag we might see framents). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/core.c')
0 files changed, 0 insertions, 0 deletions