netfilter: ipt_CLUSTERIP: deprecate it in favour of xt_cluster

xt_cluster supersedes ipt_CLUSTERIP since it can be also used in
gateway configurations (not only from the backend side).

ipt_CLUSTER is also known to leak the netdev that it uses on
device removal, which requires a rather large fix to workaround
the problem: http://patchwork.ozlabs.org/patch/358629/

So let's deprecate this so we can probably kill code this in the
future.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netns/x_tables.h b/include/net/netns/x_tables.h
index c24060ee411e9e15a91a0fc5bd189eef8425869b..4d6597ad6067a838f0ab32ec5bb2ab2cbd0d070d 100644 (file)
--- a/include/net/netns/x_tables.h
+++ b/include/net/netns/x_tables.h
@@ -9,6 +9,7 @@ struct ebt_table;
 struct netns_xt {
        struct list_head tables[NFPROTO_NUMPROTO];
        bool notrack_deprecated_warning;
+       bool clusterip_deprecated_warning;
 #if defined(CONFIG_BRIDGE_NF_EBTABLES) || \
     defined(CONFIG_BRIDGE_NF_EBTABLES_MODULE)
        struct ebt_table *broute_table;

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e90f83a3415b464014cecf0f072b2188f6889b7a..f75e9df5e0179d3f8a40640dee61b355a3077784 100644 (file)
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -418,6 +418,13 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
        if (ret < 0)
                pr_info("cannot load conntrack support for proto=%u\n",
                        par->family);
+
+       if (!par->net->xt.clusterip_deprecated_warning) {
+               pr_info("ipt_CLUSTERIP is deprecated and it will removed soon, "
+                       "use xt_cluster instead\n");
+               par->net->xt.clusterip_deprecated_warning = true;
+       }
+
        return ret;
 }