[NETFILTER]: x_tables: add port of hashlimit match for IPv4 and IPv6

[linux-2.6-omap-h63xx.git] / net / netfilter / nf_conntrack_ftp.c

diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 11d3be2435364ca09063026e09becee25c7b1939..2d2350152b908b99d2aa6a8bc609f1cdc0798b2f 100644 (file)
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -15,17 +15,19 @@
  * Derived from net/ipv4/netfilter/ip_conntrack_ftp.c
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/ctype.h>
+#include <linux/inet.h>
 #include <net/checksum.h>
 #include <net/tcp.h>
 
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <linux/netfilter/nf_conntrack_ftp.h>
 
@@ -112,101 +114,14 @@ static struct ftp_search {
        },
 };
 
-/* This code is based on inet_pton() in glibc-2.2.4 */
 static int
 get_ipv6_addr(const char *src, size_t dlen, struct in6_addr *dst, u_int8_t term)
 {
-       static const char xdigits[] = "0123456789abcdef";
-       u_int8_t tmp[16], *tp, *endp, *colonp;
-       int ch, saw_xdigit;
-       u_int32_t val;
-       size_t clen = 0;
-
-       tp = memset(tmp, '\0', sizeof(tmp));
-       endp = tp + sizeof(tmp);
-       colonp = NULL;
-
-       /* Leading :: requires some special handling. */
-       if (*src == ':'){
-               if (*++src != ':') {
-                       DEBUGP("invalid \":\" at the head of addr\n");
-                       return 0;
-               }
-               clen++;
-       }
-
-       saw_xdigit = 0;
-       val = 0;
-       while ((clen < dlen) && (*src != term)) {
-               const char *pch;
-
-               ch = tolower(*src++);
-               clen++;
-
-                pch = strchr(xdigits, ch);
-                if (pch != NULL) {
-                        val <<= 4;
-                        val |= (pch - xdigits);
-                        if (val > 0xffff)
-                                return 0;
-
-                       saw_xdigit = 1;
-                        continue;
-                }
-               if (ch != ':') {
-                       DEBUGP("get_ipv6_addr: invalid char. \'%c\'\n", ch);
-                       return 0;
-               }
-
-               if (!saw_xdigit) {
-                       if (colonp) {
-                               DEBUGP("invalid location of \"::\".\n");
-                               return 0;
-                       }
-                       colonp = tp;
-                       continue;
-               } else if (*src == term) {
-                       DEBUGP("trancated IPv6 addr\n");
-                       return 0;
-               }
-
-               if (tp + 2 > endp)
-                       return 0;
-               *tp++ = (u_int8_t) (val >> 8) & 0xff;
-               *tp++ = (u_int8_t) val & 0xff;
-
-               saw_xdigit = 0;
-               val = 0;
-               continue;
-        }
-        if (saw_xdigit) {
-                if (tp + 2 > endp)
-                        return 0;
-                *tp++ = (u_int8_t) (val >> 8) & 0xff;
-                *tp++ = (u_int8_t) val & 0xff;
-        }
-        if (colonp != NULL) {
-                /*
-                 * Since some memmove()'s erroneously fail to handle
-                 * overlapping regions, we'll do the shift by hand.
-                 */
-                const int n = tp - colonp;
-                int i;
-
-                if (tp == endp)
-                        return 0;
-
-                for (i = 1; i <= n; i++) {
-                        endp[- i] = colonp[n - i];
-                        colonp[n - i] = 0;
-                }
-                tp = endp;
-        }
-        if (tp != endp || (*src != term))
-                return 0;
-
-        memcpy(dst->s6_addr, tmp, sizeof(dst->s6_addr));
-        return clen;
+       const char *end;
+       int ret = in6_pton(src, min_t(size_t, dlen, 0xffff), (u8 *)dst, term, &end);
+       if (ret > 0)
+               return (int)(end - src);
+       return 0;
 }
 
 static int try_number(const char *data, size_t dlen, u_int32_t array[],
@@ -454,9 +369,9 @@ static int help(struct sk_buff **pskb,
        struct ip_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
        struct nf_conntrack_expect *exp;
        struct nf_conntrack_man cmd = {};
-
        unsigned int i;
        int found = 0, ends_in_nl;
+       typeof(nf_nat_ftp_hook) nf_nat_ftp;
 
        /* Until there's been traffic both ways, don't look in packets. */
        if (ctinfo != IP_CT_ESTABLISHED
@@ -605,9 +520,10 @@ static int help(struct sk_buff **pskb,
 
        /* Now, NAT might want to mangle the packet, and register the
         * (possibly changed) expectation itself. */
-       if (nf_nat_ftp_hook)
-               ret = nf_nat_ftp_hook(pskb, ctinfo, search[dir][i].ftptype,
-                                     matchoff, matchlen, exp, &seq);
+       nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
+       if (nf_nat_ftp)
+               ret = nf_nat_ftp(pskb, ctinfo, search[dir][i].ftptype,
+                                matchoff, matchlen, exp, &seq);
        else {
                /* Can't expect this?  Best to drop packet now. */
                if (nf_conntrack_expect_related(exp) != 0)
@@ -671,6 +587,7 @@ static int __init nf_conntrack_ftp_init(void)
                for (j = 0; j < 2; j++) {
                        ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]);
                        ftp[i][j].tuple.dst.protonum = IPPROTO_TCP;
+                       ftp[i][j].mask.src.l3num = 0xFFFF;
                        ftp[i][j].mask.src.u.tcp.port = 0xFFFF;
                        ftp[i][j].mask.dst.protonum = 0xFF;
                        ftp[i][j].max_expected = 1;