[NETFILTER]: Rename ipt_iprange to xt_iprange

[linux-2.6-omap-h63xx.git] / net / ipv4 / netfilter / nf_conntrack_l3proto_ipv4.c

diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 2fcb9249a8da8184f22b17734a34863b8f098e12..78e64951137a896e61c796cd283ec1b7f85acf4a 100644 (file)
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -63,19 +63,20 @@ static int ipv4_print_conntrack(struct seq_file *s,
 }
 
 /* Returns new sk_buff, or NULL */
-static struct sk_buff *
-nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
+static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
 {
+       int err;
+
        skb_orphan(skb);
 
        local_bh_disable();
-       skb = ip_defrag(skb, user);
+       err = ip_defrag(skb, user);
        local_bh_enable();
 
-       if (skb)
+       if (!err)
                ip_send_check(ip_hdr(skb));
 
-       return skb;
+       return err;
 }
 
 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
@@ -99,17 +100,17 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 }
 
 static unsigned int ipv4_confirm(unsigned int hooknum,
-                                struct sk_buff **pskb,
+                                struct sk_buff *skb,
                                 const struct net_device *in,
                                 const struct net_device *out,
                                 int (*okfn)(struct sk_buff *))
 {
        /* We've seen it coming out the other side: confirm it */
-       return nf_conntrack_confirm(pskb);
+       return nf_conntrack_confirm(skb);
 }
 
 static unsigned int ipv4_conntrack_help(unsigned int hooknum,
-                                     struct sk_buff **pskb,
+                                     struct sk_buff *skb,
                                      const struct net_device *in,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
@@ -120,7 +121,7 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
        struct nf_conntrack_helper *helper;
 
        /* This is where we call the helper: as the packet goes out. */
-       ct = nf_ct_get(*pskb, &ctinfo);
+       ct = nf_ct_get(skb, &ctinfo);
        if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
                return NF_ACCEPT;
 
@@ -131,115 +132,114 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
        helper = rcu_dereference(help->helper);
        if (!helper)
                return NF_ACCEPT;
-       return helper->help(pskb, skb_network_offset(*pskb) + ip_hdrlen(*pskb),
+       return helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
                            ct, ctinfo);
 }
 
 static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
-                                         struct sk_buff **pskb,
+                                         struct sk_buff *skb,
                                          const struct net_device *in,
                                          const struct net_device *out,
                                          int (*okfn)(struct sk_buff *))
 {
        /* Previously seen (loopback)?  Ignore.  Do this before
           fragment check. */
-       if ((*pskb)->nfct)
+       if (skb->nfct)
                return NF_ACCEPT;
 
        /* Gather fragments. */
-       if (ip_hdr(*pskb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-               *pskb = nf_ct_ipv4_gather_frags(*pskb,
-                                               hooknum == NF_IP_PRE_ROUTING ?
-                                               IP_DEFRAG_CONNTRACK_IN :
-                                               IP_DEFRAG_CONNTRACK_OUT);
-               if (!*pskb)
+       if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
+               if (nf_ct_ipv4_gather_frags(skb,
+                                           hooknum == NF_INET_PRE_ROUTING ?
+                                           IP_DEFRAG_CONNTRACK_IN :
+                                           IP_DEFRAG_CONNTRACK_OUT))
                        return NF_STOLEN;
        }
        return NF_ACCEPT;
 }
 
 static unsigned int ipv4_conntrack_in(unsigned int hooknum,
-                                     struct sk_buff **pskb,
+                                     struct sk_buff *skb,
                                      const struct net_device *in,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
-       return nf_conntrack_in(PF_INET, hooknum, pskb);
+       return nf_conntrack_in(PF_INET, hooknum, skb);
 }
 
 static unsigned int ipv4_conntrack_local(unsigned int hooknum,
-                                        struct sk_buff **pskb,
+                                        struct sk_buff *skb,
                                         const struct net_device *in,
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
        /* root is playing with raw sockets. */
-       if ((*pskb)->len < sizeof(struct iphdr)
-           || ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
+       if (skb->len < sizeof(struct iphdr) ||
+           ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("ipt_hook: happy cracking.\n");
                return NF_ACCEPT;
        }
-       return nf_conntrack_in(PF_INET, hooknum, pskb);
+       return nf_conntrack_in(PF_INET, hooknum, skb);
 }
 
 /* Connection tracking may drop packets, but never alters them, so
    make it the first hook. */
-static struct nf_hook_ops ipv4_conntrack_ops[] = {
+static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
        {
                .hook           = ipv4_conntrack_defrag,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_PRE_ROUTING,
+               .hooknum        = NF_INET_PRE_ROUTING,
                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
        },
        {
                .hook           = ipv4_conntrack_in,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_PRE_ROUTING,
+               .hooknum        = NF_INET_PRE_ROUTING,
                .priority       = NF_IP_PRI_CONNTRACK,
        },
        {
                .hook           = ipv4_conntrack_defrag,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_LOCAL_OUT,
+               .hooknum        = NF_INET_LOCAL_OUT,
                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
        },
        {
                .hook           = ipv4_conntrack_local,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_LOCAL_OUT,
+               .hooknum        = NF_INET_LOCAL_OUT,
                .priority       = NF_IP_PRI_CONNTRACK,
        },
        {
                .hook           = ipv4_conntrack_help,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_POST_ROUTING,
+               .hooknum        = NF_INET_POST_ROUTING,
                .priority       = NF_IP_PRI_CONNTRACK_HELPER,
        },
        {
                .hook           = ipv4_conntrack_help,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_LOCAL_IN,
+               .hooknum        = NF_INET_LOCAL_IN,
                .priority       = NF_IP_PRI_CONNTRACK_HELPER,
        },
        {
                .hook           = ipv4_confirm,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_POST_ROUTING,
+               .hooknum        = NF_INET_POST_ROUTING,
                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
        },
        {
                .hook           = ipv4_confirm,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_LOCAL_IN,
+               .hooknum        = NF_INET_LOCAL_IN,
                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
        },
 };
@@ -363,10 +363,8 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 static int ipv4_tuple_to_nlattr(struct sk_buff *skb,
                                const struct nf_conntrack_tuple *tuple)
 {
-       NLA_PUT(skb, CTA_IP_V4_SRC, sizeof(u_int32_t),
-               &tuple->src.u3.ip);
-       NLA_PUT(skb, CTA_IP_V4_DST, sizeof(u_int32_t),
-               &tuple->dst.u3.ip);
+       NLA_PUT_BE32(skb, CTA_IP_V4_SRC, tuple->src.u3.ip);
+       NLA_PUT_BE32(skb, CTA_IP_V4_DST, tuple->dst.u3.ip);
        return 0;
 
 nla_put_failure:
@@ -384,8 +382,8 @@ static int ipv4_nlattr_to_tuple(struct nlattr *tb[],
        if (!tb[CTA_IP_V4_SRC] || !tb[CTA_IP_V4_DST])
                return -EINVAL;
 
-       t->src.u3.ip = *(__be32 *)nla_data(tb[CTA_IP_V4_SRC]);
-       t->dst.u3.ip = *(__be32 *)nla_data(tb[CTA_IP_V4_DST]);
+       t->src.u3.ip = nla_get_be32(tb[CTA_IP_V4_SRC]);
+       t->dst.u3.ip = nla_get_be32(tb[CTA_IP_V4_DST]);
 
        return 0;
 }
@@ -419,6 +417,9 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
        .me              = THIS_MODULE,
 };
 
+module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
+                 &nf_conntrack_htable_size, 0600);
+
 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
 MODULE_ALIAS("ip_conntrack");
 MODULE_LICENSE("GPL");