Merge branch 'nfs-server-stable' of git://linux-nfs.org/~bfields/linux

[mv-sheeva.git] / net / netfilter / nf_conntrack_core.c

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3d1411012a2c496d5bdf98649321e63074e63e60..83c30b45d170985da545b76c7910d1684175b7cd 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -63,7 +63,6 @@ unsigned int nf_ct_log_invalid __read_mostly;
 HLIST_HEAD(unconfirmed);
 static int nf_conntrack_vmalloc __read_mostly;
 static struct kmem_cache *nf_conntrack_cachep __read_mostly;
-static unsigned int nf_conntrack_next_id;
 
 DEFINE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
 EXPORT_PER_CPU_SYMBOL(nf_conntrack_stat);
@@ -79,7 +78,8 @@ static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
        a = jhash2(tuple->src.u3.all, ARRAY_SIZE(tuple->src.u3.all),
                   (tuple->src.l3num << 16) | tuple->dst.protonum);
        b = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
-                  (tuple->src.u.all << 16) | tuple->dst.u.all);
+                  ((__force __u16)tuple->src.u.all << 16) |
+                   (__force __u16)tuple->dst.u.all);
 
        return jhash_2words(a, b, rnd) % size;
 }
@@ -113,6 +113,36 @@ nf_ct_get_tuple(const struct sk_buff *skb,
 }
 EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
 
+int nf_ct_get_tuplepr(const struct sk_buff *skb,
+                     unsigned int nhoff,
+                     u_int16_t l3num,
+                     struct nf_conntrack_tuple *tuple)
+{
+       struct nf_conntrack_l3proto *l3proto;
+       struct nf_conntrack_l4proto *l4proto;
+       unsigned int protoff;
+       u_int8_t protonum;
+       int ret;
+
+       rcu_read_lock();
+
+       l3proto = __nf_ct_l3proto_find(l3num);
+       ret = l3proto->get_l4proto(skb, nhoff, &protoff, &protonum);
+       if (ret != NF_ACCEPT) {
+               rcu_read_unlock();
+               return 0;
+       }
+
+       l4proto = __nf_ct_l4proto_find(l3num, protonum);
+
+       ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, tuple,
+                             l3proto, l4proto);
+
+       rcu_read_unlock();
+       return ret;
+}
+EXPORT_SYMBOL_GPL(nf_ct_get_tuplepr);
+
 int
 nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
                   const struct nf_conntrack_tuple *orig,
@@ -256,7 +286,6 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                                       unsigned int hash,
                                       unsigned int repl_hash)
 {
-       ct->id = ++nf_conntrack_next_id;
        hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
                       &nf_conntrack_hash[hash]);
        hlist_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
@@ -622,9 +651,12 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
 
        /* rcu_read_lock()ed by nf_hook_slow */
        l3proto = __nf_ct_l3proto_find((u_int16_t)pf);
-
-       if ((ret = l3proto->prepare(pskb, hooknum, &dataoff, &protonum)) <= 0) {
+       ret = l3proto->get_l4proto(*pskb, skb_network_offset(*pskb),
+                                  &dataoff, &protonum);
+       if (ret <= 0) {
                pr_debug("not prepared to track yet or error occured\n");
+               NF_CT_STAT_INC_ATOMIC(error);
+               NF_CT_STAT_INC_ATOMIC(invalid);
                return -ret;
        }
 
@@ -793,44 +825,41 @@ EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <linux/mutex.h>
 
-
 /* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
  * in ip_conntrack_core, since we don't want the protocols to autoload
  * or depend on ctnetlink */
-int nf_ct_port_tuple_to_nfattr(struct sk_buff *skb,
+int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
                               const struct nf_conntrack_tuple *tuple)
 {
-       NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),
+       NLA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),
                &tuple->src.u.tcp.port);
-       NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),
+       NLA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),
                &tuple->dst.u.tcp.port);
        return 0;
 
-nfattr_failure:
+nla_put_failure:
        return -1;
 }
-EXPORT_SYMBOL_GPL(nf_ct_port_tuple_to_nfattr);
+EXPORT_SYMBOL_GPL(nf_ct_port_tuple_to_nlattr);
 
-static const size_t cta_min_proto[CTA_PROTO_MAX] = {
-       [CTA_PROTO_SRC_PORT-1]  = sizeof(u_int16_t),
-       [CTA_PROTO_DST_PORT-1]  = sizeof(u_int16_t)
+const struct nla_policy nf_ct_port_nla_policy[CTA_PROTO_MAX+1] = {
+       [CTA_PROTO_SRC_PORT]  = { .type = NLA_U16 },
+       [CTA_PROTO_DST_PORT]  = { .type = NLA_U16 },
 };
+EXPORT_SYMBOL_GPL(nf_ct_port_nla_policy);
 
-int nf_ct_port_nfattr_to_tuple(struct nfattr *tb[],
+int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
                               struct nf_conntrack_tuple *t)
 {
-       if (!tb[CTA_PROTO_SRC_PORT-1] || !tb[CTA_PROTO_DST_PORT-1])
-               return -EINVAL;
-
-       if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
+       if (!tb[CTA_PROTO_SRC_PORT] || !tb[CTA_PROTO_DST_PORT])
                return -EINVAL;
 
-       t->src.u.tcp.port = *(__be16 *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);
-       t->dst.u.tcp.port = *(__be16 *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);
+       t->src.u.tcp.port = *(__be16 *)nla_data(tb[CTA_PROTO_SRC_PORT]);
+       t->dst.u.tcp.port = *(__be16 *)nla_data(tb[CTA_PROTO_DST_PORT]);
 
        return 0;
 }
-EXPORT_SYMBOL_GPL(nf_ct_port_nfattr_to_tuple);
+EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_to_tuple);
 #endif
 
 /* Used by ipt_REJECT and ip6t_REJECT. */
@@ -1075,7 +1104,7 @@ int __init nf_conntrack_init(void)
 
        nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
                                                sizeof(struct nf_conn),
-                                               0, 0, NULL, NULL);
+                                               0, 0, NULL);
        if (!nf_conntrack_cachep) {
                printk(KERN_ERR "Unable to create nf_conn slab cache\n");
                goto err_free_hash;