leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: conntrack: add nf_ct_iterate_destroy

Browse Source 
sledgehammer to be used on module unload (to remove affected conntracks
from all namespaces).

It will also flag all unconfirmed conntracks as dying, i.e. they will
not be committed to main table.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal
2017-05-21 12:52:57 +02:00
committed by Pablo Neira Ayuso
parent b0feacaad1
commit 2843fb6998
2 changed files with 79 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/net/netfilter/nf_conntrack.h
View File

@@ -229,6 +229,10 @@ void nf_ct_iterate_cleanup_net(struct net *net,
int (*iter)(struct nf_conn *i, void *data),
void *data, u32 portid, int report);
/* also set unconfirmed conntracks as dying. Only use in module exit path. */
void nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data),
void *data);
struct nf_conntrack_zone;
void nf_conntrack_free(struct nf_conn *ct);