netfilter: conntrack: move autoassign warning member to net_generic data

Not accessed in fast path, place this is generic_net data instead.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 86d86c860ede0e0944bc61e97ccfdaaff16ddb68..c532b629db7bdb7ca214ad19f048192b8c7e813e 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -44,6 +44,10 @@ union nf_conntrack_expect_proto {
 };
 
 struct nf_conntrack_net {
+       /* only used when new connection is allocated: */
+       bool auto_assign_helper_warned;
+
+       /* only used from work queues, configuration plane, and so on: */
        unsigned int users4;
        unsigned int users6;
        unsigned int users_bridge;

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index b055187235f87c0def9fef5f72d583b1ac2cf13a..ad91964eaa92dce0bb5d1eb147189bf5a5dc3c07 100644 (file)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -43,6 +43,8 @@ MODULE_PARM_DESC(nf_conntrack_helper,
 static DEFINE_MUTEX(nf_ct_nat_helpers_mutex);
 static struct list_head nf_ct_nat_helpers __read_mostly;
 
+extern unsigned int nf_conntrack_net_id;
+
 /* Stupid hash, but collision free for the default registrations of the
  * helpers currently in the kernel. */
 static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple)
@@ -212,8 +214,10 @@ EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
 static struct nf_conntrack_helper *
 nf_ct_lookup_helper(struct nf_conn *ct, struct net *net)
 {
+       struct nf_conntrack_net *cnet = net_generic(net, nf_conntrack_net_id);
+
        if (!net->ct.sysctl_auto_assign_helper) {
-               if (net->ct.auto_assign_helper_warned)
+               if (cnet->auto_assign_helper_warned)
                        return NULL;
                if (!__nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple))
                        return NULL;
@@ -221,7 +225,7 @@ nf_ct_lookup_helper(struct nf_conn *ct, struct net *net)
                        "has been turned off for security reasons and CT-based "
                        "firewall rule not found. Use the iptables CT target "
                        "to attach helpers instead.\n");
-               net->ct.auto_assign_helper_warned = 1;
+               cnet->auto_assign_helper_warned = true;
                return NULL;
        }
 
@@ -556,7 +560,6 @@ static const struct nf_ct_ext_type helper_extend = {
 
 void nf_conntrack_helper_pernet_init(struct net *net)
 {
-       net->ct.auto_assign_helper_warned = false;
        net->ct.sysctl_auto_assign_helper = nf_ct_auto_assign_helper;
 }