conntrackd: deprecate `Family' in configuration file

This patch deprecates the `Family' tweak in the configuration file.

Several reasons for this:

* If not specified, this was default to IPv4 only in table dumps from
  the kernel. However, non-IPv4 events were still received. This is
  inconsistent.

* It's an early tweak that was not documented (not included in any
  of the example files).

If we want to support any sort of consistent filtering based on the
family, this should happen in the filtering code.

After this patch, conntrackd uses AF_UNSPEC to dump the conntrack and
expectation tables from the kernel.

Reported-by: Bill Fink <billfink@mindspring.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2 files changed, 7 insertions, 14 deletions

diff --git a/src/netlink.c b/src/netlink.c
index bd38d99..5be102e 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -146,9 +146,11 @@ void nl_resize_socket_buffer(struct nfct_handle *h)
 			 "to %u bytes", CONFIG(netlink_buffer_size));
 }
 
+static const int family = AF_UNSPEC;
+
 int nl_dump_conntrack_table(struct nfct_handle *h)
 {
-	return nfct_query(h, NFCT_Q_DUMP, &CONFIG(family));
+	return nfct_query(h, NFCT_Q_DUMP, &family);
 }
 
 static int
@@ -182,7 +184,7 @@ int nl_flush_conntrack_table_selective(void)
 	}
 	nfct_callback_register(h, NFCT_T_ALL, nl_flush_selective_cb, NULL);
 
-	ret = nfct_query(h, NFCT_Q_DUMP, &CONFIG(family));
+	ret = nfct_query(h, NFCT_Q_DUMP, &family);
 
 	nfct_close(h);
 
@@ -191,7 +193,6 @@ int nl_flush_conntrack_table_selective(void)
 
 int nl_send_resync(struct nfct_handle *h)
 {
-	int family = CONFIG(family);
 	return nfct_send(h, NFCT_Q_DUMP, &family);
 }
 
@@ -380,16 +381,15 @@ int nl_get_expect(struct nfct_handle *h, const struct nf_expect *exp)
 
 int nl_dump_expect_table(struct nfct_handle *h)
 {
-	return nfexp_query(h, NFCT_Q_DUMP, &CONFIG(family));
+	return nfexp_query(h, NFCT_Q_DUMP, &family);
 }
 
 int nl_flush_expect_table(struct nfct_handle *h)
 {
-	return nfexp_query(h, NFCT_Q_FLUSH, &CONFIG(family));
+	return nfexp_query(h, NFCT_Q_FLUSH, &family);
 }
 
 int nl_send_expect_resync(struct nfct_handle *h)
 {
-	int family = CONFIG(family);
 	return nfexp_send(h, NFCT_Q_DUMP, &family);
 }
diff --git a/src/read_config_yy.y b/src/read_config_yy.y
index 72a9654..b824150 100644
--- a/src/read_config_yy.y
+++ b/src/read_config_yy.y
@@ -1193,10 +1193,7 @@ scheduler_line : T_PRIO T_NUMBER
 
 family : T_FAMILY T_STRING
 {
-	if (strncmp($2, "IPv6", strlen("IPv6")) == 0)
-		conf.family = AF_INET6;
-	else
-		conf.family = AF_INET;
+	print_err(CTD_CFG_WARN, "`Family' is deprecated, ignoring");
 };
 
 event_iterations_limit : T_EVENT_ITER_LIMIT T_NUMBER
@@ -1863,10 +1860,6 @@ init_config(char *filename)
 	yyparse();
 	fclose(fp);
 
-	/* default to IPv4 */
-	if (CONFIG(family) == 0)
-		CONFIG(family) = AF_INET;
-
 	/* set to default is not specified */
 	if (strcmp(CONFIG(lockfile), "") == 0)
 		strncpy(CONFIG(lockfile), DEFAULT_LOCKFILE, FILENAME_MAXLEN);