netfilter: netns nf_conntrack: per-netns conntrack accounting

[linux-2.6-omap-h63xx.git] / net / netfilter / nf_conntrack_acct.c

diff --git a/net/netfilter/nf_conntrack_acct.c b/net/netfilter/nf_conntrack_acct.c
index 59bd8b903a190b4565ace0296247667240f50b15..03591d37b9cc661f2b28b8d26b23aade24482781 100644 (file)
--- a/net/netfilter/nf_conntrack_acct.c
+++ b/net/netfilter/nf_conntrack_acct.c
@@ -22,19 +22,17 @@
 #define NF_CT_ACCT_DEFAULT 0
 #endif
 
-int nf_ct_acct __read_mostly = NF_CT_ACCT_DEFAULT;
-EXPORT_SYMBOL_GPL(nf_ct_acct);
+static int nf_ct_acct __read_mostly = NF_CT_ACCT_DEFAULT;
 
 module_param_named(acct, nf_ct_acct, bool, 0644);
 MODULE_PARM_DESC(acct, "Enable connection tracking flow accounting.");
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_table_header *acct_sysctl_header;
 static struct ctl_table acct_sysctl_table[] = {
        {
                .ctl_name       = CTL_UNNUMBERED,
                .procname       = "nf_conntrack_acct",
-               .data           = &nf_ct_acct,
+               .data           = &init_net.ct.sysctl_acct,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec,
@@ -64,41 +62,87 @@ static struct nf_ct_ext_type acct_extend __read_mostly = {
        .id     = NF_CT_EXT_ACCT,
 };
 
-int nf_conntrack_acct_init(void)
+#ifdef CONFIG_SYSCTL
+static int nf_conntrack_acct_init_sysctl(struct net *net)
 {
-       int ret;
+       struct ctl_table *table;
 
-#ifdef CONFIG_NF_CT_ACCT
-       printk(KERN_WARNING "CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use\n");
-       printk(KERN_WARNING "nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or\n");
-       printk(KERN_WARNING "sysctl net.netfilter.nf_conntrack_acct=1 to enable it.\n");
-#endif
+       table = kmemdup(acct_sysctl_table, sizeof(acct_sysctl_table),
+                       GFP_KERNEL);
+       if (!table)
+               goto out;
+
+       table[0].data = &net->ct.sysctl_acct;
 
-       ret = nf_ct_extend_register(&acct_extend);
-       if (ret < 0) {
-               printk(KERN_ERR "nf_conntrack_acct: Unable to register extension\n");
-               return ret;
+       net->ct.acct_sysctl_header = register_net_sysctl_table(net,
+                       nf_net_netfilter_sysctl_path, table);
+       if (!net->ct.acct_sysctl_header) {
+               printk(KERN_ERR "nf_conntrack_acct: can't register to sysctl.\n");
+               goto out_register;
        }
+       return 0;
 
-#ifdef CONFIG_SYSCTL
-       acct_sysctl_header = register_sysctl_paths(nf_net_netfilter_sysctl_path,
-                               acct_sysctl_table);
+out_register:
+       kfree(table);
+out:
+       return -ENOMEM;
+}
 
-       if (!acct_sysctl_header) {
-               nf_ct_extend_unregister(&acct_extend);
+static void nf_conntrack_acct_fini_sysctl(struct net *net)
+{
+       struct ctl_table *table;
 
-               printk(KERN_ERR "nf_conntrack_acct: can't register to sysctl.\n");
-               return -ENOMEM;
-       }
+       table = net->ct.acct_sysctl_header->ctl_table_arg;
+       unregister_net_sysctl_table(net->ct.acct_sysctl_header);
+       kfree(table);
+}
+#else
+static int nf_conntrack_acct_init_sysctl(struct net *net)
+{
+       return 0;
+}
+
+static void nf_conntrack_acct_fini_sysctl(struct net *net)
+{
+}
+#endif
+
+int nf_conntrack_acct_init(struct net *net)
+{
+       int ret;
+
+       net->ct.sysctl_acct = nf_ct_acct;
+
+       if (net_eq(net, &init_net)) {
+#ifdef CONFIG_NF_CT_ACCT
+               printk(KERN_WARNING "CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use\n");
+               printk(KERN_WARNING "nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or\n");
+               printk(KERN_WARNING "sysctl net.netfilter.nf_conntrack_acct=1 to enable it.\n");
 #endif
 
+               ret = nf_ct_extend_register(&acct_extend);
+               if (ret < 0) {
+                       printk(KERN_ERR "nf_conntrack_acct: Unable to register extension\n");
+                       goto out_extend_register;
+               }
+       }
+
+       ret = nf_conntrack_acct_init_sysctl(net);
+       if (ret < 0)
+               goto out_sysctl;
+
        return 0;
+
+out_sysctl:
+       if (net_eq(net, &init_net))
+               nf_ct_extend_unregister(&acct_extend);
+out_extend_register:
+       return ret;
 }
 
-void nf_conntrack_acct_fini(void)
+void nf_conntrack_acct_fini(struct net *net)
 {
-#ifdef CONFIG_SYSCTL
-       unregister_sysctl_table(acct_sysctl_header);
-#endif
-       nf_ct_extend_unregister(&acct_extend);
+       nf_conntrack_acct_fini_sysctl(net);
+       if (net_eq(net, &init_net))
+               nf_ct_extend_unregister(&acct_extend);
 }