[NETFILTER]: xt_hashlimit should use time_after_eq()

[linux-2.6-omap-h63xx.git] / net / netfilter / nfnetlink_log.c

diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index a90a26bd618b6c714f41de41e438a6194b423409..2c7bd2eb0294400ed1175749f41281ed4f7b735b 100644 (file)
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -37,8 +37,9 @@
 #endif
 
 #define NFULNL_NLBUFSIZ_DEFAULT        NLMSG_GOODSIZE
-#define NFULNL_TIMEOUT_DEFAULT         100     /* every second */
+#define NFULNL_TIMEOUT_DEFAULT         HZ      /* every second */
 #define NFULNL_QTHRESH_DEFAULT         100     /* 100 packets */
+#define NFULNL_COPY_RANGE_MAX  0xFFFF  /* max packet size is limited by 16-bit struct nfattr nfa_len field */
 
 #define PRINTR(x, args...)     do { if (net_ratelimit()) \
                                     printk(x, ## args); } while (0);
@@ -152,6 +153,11 @@ instance_create(u_int16_t group_num, int pid)
        if (!inst)
                goto out_unlock;
 
+       if (!try_module_get(THIS_MODULE)) {
+               kfree(inst);
+               goto out_unlock;
+       }
+
        INIT_HLIST_NODE(&inst->hlist);
        spin_lock_init(&inst->lock);
        /* needs to be two, since we _put() after creation */
@@ -166,10 +172,7 @@ instance_create(u_int16_t group_num, int pid)
        inst->flushtimeout      = NFULNL_TIMEOUT_DEFAULT;
        inst->nlbufsiz          = NFULNL_NLBUFSIZ_DEFAULT;
        inst->copy_mode         = NFULNL_COPY_PACKET;
-       inst->copy_range        = 0xffff;
-
-       if (!try_module_get(THIS_MODULE))
-               goto out_free;
+       inst->copy_range        = NFULNL_COPY_RANGE_MAX;
 
        hlist_add_head(&inst->hlist,
                       &instance_table[instance_hashfn(group_num)]);
@@ -181,14 +184,12 @@ instance_create(u_int16_t group_num, int pid)
 
        return inst;
 
-out_free:
-       instance_put(inst);
 out_unlock:
        write_unlock_bh(&instances_lock);
        return NULL;
 }
 
-static int __nfulnl_send(struct nfulnl_instance *inst);
+static void __nfulnl_flush(struct nfulnl_instance *inst);
 
 static void
 __instance_destroy(struct nfulnl_instance *inst)
@@ -202,17 +203,8 @@ __instance_destroy(struct nfulnl_instance *inst)
        /* then flush all pending packets from skb */
 
        spin_lock_bh(&inst->lock);
-       if (inst->skb) {
-               /* timer "holds" one reference (we have one more) */
-               if (del_timer(&inst->timer))
-                       instance_put(inst);
-               if (inst->qlen)
-                       __nfulnl_send(inst);
-               if (inst->skb) {
-                       kfree_skb(inst->skb);
-                       inst->skb = NULL;
-               }
-       }
+       if (inst->skb)
+               __nfulnl_flush(inst);
        spin_unlock_bh(&inst->lock);
 
        /* and finally put the refcount */
@@ -244,11 +236,8 @@ nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode,
 
        case NFULNL_COPY_PACKET:
                inst->copy_mode = mode;
-               /* we're using struct nlattr which has 16bit nfa_len */
-               if (range > 0xffff)
-                       inst->copy_range = 0xffff;
-               else
-                       inst->copy_range = range;
+               inst->copy_range = min_t(unsigned int,
+                                        range, NFULNL_COPY_RANGE_MAX);
                break;
 
        default:
@@ -310,8 +299,8 @@ nfulnl_set_flags(struct nfulnl_instance *inst, u_int16_t flags)
        return 0;
 }
 
-static struct sk_buff *nfulnl_alloc_skb(unsigned int inst_size,
-                                       unsigned int pkt_size)
+static struct sk_buff *
+nfulnl_alloc_skb(unsigned int inst_size, unsigned int pkt_size)
 {
        struct sk_buff *skb;
        unsigned int n;
@@ -364,7 +353,18 @@ nlmsg_failure:
        return status;
 }
 
-static void nfulnl_timer(unsigned long data)
+static void
+__nfulnl_flush(struct nfulnl_instance *inst)
+{
+       /* timer holds a reference */
+       if (del_timer(&inst->timer))
+               instance_put(inst);
+       if (inst->skb)
+               __nfulnl_send(inst);
+}
+
+static void
+nfulnl_timer(unsigned long data)
 {
        struct nfulnl_instance *inst = (struct nfulnl_instance *)data;
 
@@ -643,17 +643,13 @@ nfulnl_log_packet(unsigned int pf,
                goto unlock_and_release;
        }
 
-       if (inst->qlen >= qthreshold ||
-           (inst->skb && size >
-            skb_tailroom(inst->skb) - sizeof(struct nfgenmsg))) {
+       if (inst->skb &&
+           size > skb_tailroom(inst->skb) - sizeof(struct nfgenmsg)) {
                /* either the queue len is too high or we don't have
                 * enough room in the skb left. flush to userspace. */
                UDEBUG("flushing old skb\n");
 
-               /* timer "holds" one reference (we have another one) */
-               if (del_timer(&inst->timer))
-                       instance_put(inst);
-               __nfulnl_send(inst);
+               __nfulnl_flush(inst);
        }
 
        if (!inst->skb) {
@@ -668,9 +664,11 @@ nfulnl_log_packet(unsigned int pf,
        __build_packet_message(inst, skb, data_len, pf,
                                hooknum, in, out, li, prefix, plen);
 
+       if (inst->qlen >= qthreshold)
+               __nfulnl_flush(inst);
        /* timer_pending always called within inst->lock, so there
         * is no chance of a race here */
-       if (!timer_pending(&inst->timer)) {
+       else if (!timer_pending(&inst->timer)) {
                instance_get(inst);
                inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100);
                add_timer(&inst->timer);
@@ -953,22 +951,8 @@ static const struct seq_operations nful_seq_ops = {
 
 static int nful_open(struct inode *inode, struct file *file)
 {
-       struct seq_file *seq;
-       struct iter_state *is;
-       int ret;
-
-       is = kzalloc(sizeof(*is), GFP_KERNEL);
-       if (!is)
-               return -ENOMEM;
-       ret = seq_open(file, &nful_seq_ops);
-       if (ret < 0)
-               goto out_free;
-       seq = file->private_data;
-       seq->private = is;
-       return ret;
-out_free:
-       kfree(is);
-       return ret;
+       return seq_open_private(file, &nful_seq_ops,
+                       sizeof(struct iter_state));
 }
 
 static const struct file_operations nful_file_ops = {