Discussion:
[NETFILTER 00/69]: Netfilter Update
Patrick McHardy
2008-01-30 20:16:52 UTC
Permalink
Hi Dave,

following is the final netfilter update for 2.6.25. containing the ipta=
bles
netns work by Alexey Dobriyan, lots of sparse warning fixes by Stephen,=
Eric
and myself, const annotations throughout netfilter by Jan Engelhardt,
a set of patches to finally use RCU for the conntrack and NAT hashes, s=
ome
conntrack optimizations and some minor misc cleanups.

Please apply, thanks.


include/linux/netfilter/nf_conntrack_pptp.h | 2 +-
include/linux/netfilter/nf_conntrack_sip.h | 6 +-
include/linux/netfilter/x_tables.h | 28 +-
include/linux/netfilter/xt_conntrack.h | 30 +-
include/linux/netfilter/xt_hashlimit.h | 37 ++-
include/linux/netfilter/xt_owner.h | 4 +-
include/linux/netfilter_arp/arp_tables.h | 5 +-
include/linux/netfilter_ipv4/ip_tables.h | 5 +-
include/linux/netfilter_ipv6/ip6_tables.h | 5 +-
include/linux/skbuff.h | 3 -
include/linux/types.h | 2 +-
include/net/arp.h | 8 +-
include/net/net_namespace.h | 4 +
include/net/netfilter/nf_conntrack.h | 15 +-
include/net/netfilter/nf_conntrack_core.h | 6 +-
include/net/netfilter/nf_conntrack_expect.h | 2 +
include/net/netfilter/nf_conntrack_helper.h | 4 -
include/net/netfilter/nf_conntrack_l3proto.h | 4 +-
include/net/netfilter/nf_conntrack_l4proto.h | 25 +-
include/net/netfilter/nf_conntrack_tuple.h | 17 +-
include/net/netfilter/nf_log.h | 2 +-
include/net/netns/ipv4.h | 6 +
include/net/netns/ipv6.h | 5 +
include/net/netns/x_tables.h | 10 +
net/bridge/br_netfilter.c | 4 -
net/bridge/netfilter/ebt_802_3.c | 10 +-
net/bridge/netfilter/ebt_among.c | 27 +-
net/bridge/netfilter/ebt_arp.c | 17 +-
net/bridge/netfilter/ebt_arpreply.c | 17 +-
net/bridge/netfilter/ebt_dnat.c | 8 +-
net/bridge/netfilter/ebt_ip.c | 14 +-
net/bridge/netfilter/ebt_limit.c | 6 +-
net/bridge/netfilter/ebt_log.c | 19 +-
net/bridge/netfilter/ebt_mark.c | 8 +-
net/bridge/netfilter/ebt_mark_m.c | 8 +-
net/bridge/netfilter/ebt_pkttype.c | 8 +-
net/bridge/netfilter/ebt_redirect.c | 8 +-
net/bridge/netfilter/ebt_snat.c | 11 +-
net/bridge/netfilter/ebt_stp.c | 28 +-
net/bridge/netfilter/ebt_ulog.c | 9 +-
net/bridge/netfilter/ebt_vlan.c | 12 +-
net/ipv4/arp.c | 9 +-
net/ipv4/netfilter/arp_tables.c | 102 ++++--
net/ipv4/netfilter/arptable_filter.c | 31 ++-
net/ipv4/netfilter/ip_queue.c | 18 +-
net/ipv4/netfilter/ip_tables.c | 112 ++++---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 7 -
net/ipv4/netfilter/ipt_recent.c | 6 +-
net/ipv4/netfilter/iptable_filter.c | 33 ++-
net/ipv4/netfilter/iptable_mangle.c | 33 ++-
net/ipv4/netfilter/iptable_raw.c | 33 ++-
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 14 +-
.../netfilter/nf_conntrack_l3proto_ipv4_compat.c | 40 ++-
net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 22 +-
net/ipv4/netfilter/nf_nat_core.c | 42 +--
net/ipv4/netfilter/nf_nat_h323.c | 5 +-
net/ipv4/netfilter/nf_nat_helper.c | 3 +-
net/ipv4/netfilter/nf_nat_pptp.c | 10 +-
net/ipv4/netfilter/nf_nat_proto_gre.c | 16 +-
net/ipv4/netfilter/nf_nat_proto_icmp.c | 2 +-
net/ipv4/netfilter/nf_nat_proto_tcp.c | 2 +-
net/ipv4/netfilter/nf_nat_proto_udp.c | 2 +-
net/ipv4/netfilter/nf_nat_rule.c | 16 +-
net/ipv4/netfilter/nf_nat_sip.c | 4 +-
net/ipv4/netfilter/nf_nat_snmp_basic.c | 2 +-
net/ipv4/netfilter/nf_nat_tftp.c | 2 +-
net/ipv6/netfilter/ip6_queue.c | 18 +-
net/ipv6/netfilter/ip6_tables.c | 113 ++++---
net/ipv6/netfilter/ip6table_filter.c | 33 ++-
net/ipv6/netfilter/ip6table_mangle.c | 33 ++-
net/ipv6/netfilter/ip6table_raw.c | 31 ++-
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 7 +-
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 22 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 16 +-
net/netfilter/nf_conntrack_core.c | 234 +++++++-----=
-
net/netfilter/nf_conntrack_expect.c | 53 ++--
net/netfilter/nf_conntrack_h323_asn1.c | 156 +++++----
net/netfilter/nf_conntrack_h323_main.c | 23 +-
net/netfilter/nf_conntrack_h323_types.c | 346 ++++++++++--=
--------
net/netfilter/nf_conntrack_helper.c | 60 +---
net/netfilter/nf_conntrack_irc.c | 2 +-
net/netfilter/nf_conntrack_netlink.c | 68 ++--
net/netfilter/nf_conntrack_pptp.c | 14 +-
net/netfilter/nf_conntrack_proto_generic.c | 6 +-
net/netfilter/nf_conntrack_proto_gre.c | 6 +-
net/netfilter/nf_conntrack_proto_sctp.c | 6 +-
net/netfilter/nf_conntrack_proto_tcp.c | 192 ++++++------
net/netfilter/nf_conntrack_proto_udp.c | 19 +-
net/netfilter/nf_conntrack_proto_udplite.c | 19 +-
net/netfilter/nf_conntrack_sane.c | 9 +-
net/netfilter/nf_conntrack_sip.c | 29 +-
net/netfilter/nf_conntrack_standalone.c | 66 ++--
net/netfilter/nf_conntrack_tftp.c | 5 +-
net/netfilter/nf_log.c | 2 +
net/netfilter/nfnetlink_log.c | 4 +-
net/netfilter/nfnetlink_queue.c | 6 +-
net/netfilter/x_tables.c | 313 ++++++++++++=
-------
net/netfilter/xt_TCPMSS.c | 62 ++++-
net/netfilter/xt_connlimit.c | 6 +-
net/netfilter/xt_conntrack.c | 50 +++-
net/netfilter/xt_hashlimit.c | 324 ++++++++++++=
++++--
net/netfilter/xt_iprange.c | 2 +-
net/netfilter/xt_owner.c | 14 +-
103 files changed, 2089 insertions(+), 1295 deletions(-)
create mode 100644 include/net/netns/x_tables.h

Alexey Dobriyan (13):
[NETFILTER]: x_tables: change xt_table_register() return value co=
nvention
[NETFILTER]: x_tables: per-netns xt_tables
[NETFILTER]: x_tables: return new table from {arp,ip,ip6}t_regist=
er_table()
[NETFILTER]: ip_tables: propagate netns from userspace
[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW
[NETFILTER]: ip6_tables: netns preparation
[NETFILTER]: ip6_tables: per-netns IPv6 FILTER, MANGLE, RAW
[NETFILTER]: arp_tables: netns preparation
[NETFILTER]: arp_tables: per-netns arp_tables FILTER
[NETFILTER]: netns: put table module on netns stop
[NETFILTER]: x_tables: semi-rewrite of /proc/net/foo_tables_*
[NETFILTER]: x_tables: netns propagation for /proc/net/*_tables_n=
ames
[NETFILTER]: x_tables: create per-netns /proc/net/*_tables_*

Eric Dumazet (1):
[NETFILTER]: Supress some sparse warnings

Eric Leblond (1):
[NETFILTER]: nf_conntrack_netlink: transmit mark during all event=
s

Helge Deller (1):
[NETFILTER]: nf_log: add netfilter gcc printf format checking

Ilpo J=E4rvinen (2):
[NETFILTER]: ipt_CLUSTERIP: kill clusterip_config_entry_get
[NETFILTER]: nf_conntrack: kill unused static inline (do_iter)

Jan Engelhardt (20):
[NETFILTER]: Use const in struct xt_match, xt_target, xt_table
linux/types.h: Use __u64 for aligned_u64
[NETFILTER]: xt_conntrack: add port and direction matching
[NETFILTER]: ebtables: remove casts, use consts
[NETFILTER]: ebtables: Update modules' descriptions
[NETFILTER]: ebtables: mark matches, targets and watchers __read_=
mostly
[NETFILTER]: xt_TCPMSS: consider reverse route's MTU in clamp-to-=
pmtu
[NETFILTER]: xt_owner: allow matching UID/GID ranges
[NETFILTER]: nf_conntrack_h323: clean up code a bit
[NETFILTER]: xt_hashlimit match, revision 1
[NETFILTER]: nf_conntrack_h323: constify and annotate H.323 helpe=
r
[NETFILTER]: nf_{conntrack,nat}_sip: annotate SIP helper with con=
st
[NETFILTER]: nf_{conntrack,nat}_tftp: annotate TFTP helper with c=
onst
[NETFILTER]: nf_{conntrack,nat}_pptp: annotate PPtP helper with c=
onst
[NETFILTER]: nf_conntrack_sane: annotate SANE helper with const
[NETFILTER]: nf_{conntrack,nat}_proto_tcp: constify and annotate =
TCP modules
[NETFILTER]: nf_{conntrack,nat}_proto_udp{,lite}: annotate with c=
onst
[NETFILTER]: nf_{conntrack,nat}_proto_gre: annotate with const
[NETFILTER]: nf_{conntrack,nat}_icmp: constify and annotate
[NETFILTER]: nf_conntrack: annotate l3protos with const

Patrick McHardy (25):
[NETFILTER]: nf_nat: remove double bysource hash initialization
[NETFILTER]: bridge netfilter: remove nf_bridge_info read-only ne=
toutdev member
[NETFILTER]: nfnetlink_log: fix typo
[NETFILTER]: ipt_recent: fix sparse warnings
[NETFILTER]: {ip,arp,ip6}_tables: fix sparse warnings in compat c=
ode
[NETFILTER]: nf_conntrack_ipv6: fix sparse warnings
[NETFILTER]: nf_conntrack_netlink: fix unbalanced locking
[NETFILTER]: nf_conntrack: fix accounting with fixed timeouts
[NETFILTER]: nf_conntrack: use RCU for conntrack helpers
[NETFILTER]: nf_conntrack_core: avoid taking nf_conntrack_lock in=
nf_conntrack_alter_reply
[NETFILTER]: nf_conntrack_expect: use RCU for expectation hash
[NETFILTER]: nf_conntrack: use RCU for conntrack hash
[NETFILTER]: nf_conntrack: switch rwlock to spinlock
[NETFILTER]: nf_conntrack: optimize __nf_conntrack_find()
[NETFILTER]: nf_conntrack: avoid duplicate protocol comparison in=
nf_ct_tuple_equal()
[NETFILTER]: nf_conntrack: optimize hash_conntrack()
[NETFILTER]: nf_conntrack: reorder struct nf_conntrack_l4proto
[NETFILTER]: nf_conntrack: don't inline early_drop()
[NETFILTER]: nf_conntrack: naming unification
[NETFILTER]: nf_nat: use RCU for bysource hash
[NETFILTER]: nf_nat: switch rwlock to spinlock
[NETFILTER]: {ip,ip6}_queue: fix build error
[NETFILTER]: nf_conntrack: fix sparse warning
[NETFILTER]: nf_nat: fix sparse warning
[NETFILTER]: xt_iprange: fix sparse warnings

Stephen Hemminger (6):
[NETFILTER]: nf_nat_snmp: sparse warning
[NETFILTER]: nf_conntrack: sparse warnings
[NETFILTER]: nfnetlink_log: sparse warning fixes
[NETFILTER]: conntrack: get rid of sparse warnings
[NETFILTER]: more sparse fixes
[NETFILTER]: nf_conntrack_h3223: sparse fixes
-
To unsubscribe from this list: send the line "unsubscribe netfilter-dev=
el" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:16:54 UTC
Permalink
[NETFILTER]: Supress some sparse warnings

CHECK net/netfilter/nf_conntrack_expect.c
net/netfilter/nf_conntrack_expect.c:429:13: warning: context imbalance in 'exp_seq_start' - wrong count at exit
net/netfilter/nf_conntrack_expect.c:441:13: warning: context imbalance in 'exp_seq_stop' - unexpected unlock
CHECK net/netfilter/nf_log.c
net/netfilter/nf_log.c:105:13: warning: context imbalance in 'seq_start' - wrong count at exit
net/netfilter/nf_log.c:125:13: warning: context imbalance in 'seq_stop' - unexpected unlock
CHECK net/netfilter/nfnetlink_queue.c
net/netfilter/nfnetlink_queue.c:363:7: warning: symbol 'size' shadows an earlier one
net/netfilter/nfnetlink_queue.c:217:9: originally declared here
net/netfilter/nfnetlink_queue.c:847:13: warning: context imbalance in 'seq_start' - wrong count at exit
net/netfilter/nfnetlink_queue.c:859:13: warning: context imbalance in 'seq_stop' - unexpected unlock

Signed-off-by: Eric Dumazet <***@cosmosbay.com>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 529b54d47425038bf231b8ce446447e957b3c89d
tree 939739c042fb1ec1423af3794e14dc9304b5c3fe
parent dd430ca20c40ecccd6954a7efd13d4398f507728
author Eric Dumazet <***@cosmosbay.com> Tue, 29 Jan 2008 16:21:48 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:11 +0100

net/netfilter/nf_conntrack_expect.c | 2 ++
net/netfilter/nf_log.c | 2 ++
net/netfilter/nfnetlink_queue.c | 6 ++++--
3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e0cd9d0..e405079 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -427,6 +427,7 @@ static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
}

static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(nf_conntrack_lock)
{
read_lock_bh(&nf_conntrack_lock);
return ct_expect_get_idx(seq, *pos);
@@ -439,6 +440,7 @@ static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
}

static void exp_seq_stop(struct seq_file *seq, void *v)
+ __releases(nf_conntrack_lock)
{
read_unlock_bh(&nf_conntrack_lock);
}
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 4f5f288..cec9976 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -103,6 +103,7 @@ EXPORT_SYMBOL(nf_log_packet);

#ifdef CONFIG_PROC_FS
static void *seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(RCU)
{
rcu_read_lock();

@@ -123,6 +124,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
}

static void seq_stop(struct seq_file *s, void *v)
+ __releases(RCU)
{
rcu_read_unlock();
}
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 51476f8..a48b20f 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -360,7 +360,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,

if (data_len) {
struct nlattr *nla;
- int size = nla_attr_size(data_len);
+ int sz = nla_attr_size(data_len);

if (skb_tailroom(skb) < nla_total_size(data_len)) {
printk(KERN_WARNING "nf_queue: no tailroom!\n");
@@ -369,7 +369,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,

nla = (struct nlattr *)skb_put(skb, nla_total_size(data_len));
nla->nla_type = NFQA_PAYLOAD;
- nla->nla_len = size;
+ nla->nla_len = sz;

if (skb_copy_bits(entskb, 0, nla_data(nla), data_len))
BUG();
@@ -845,6 +845,7 @@ static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
}

static void *seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(instances_lock)
{
spin_lock(&instances_lock);
return get_idx(seq, *pos);
@@ -857,6 +858,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
}

static void seq_stop(struct seq_file *s, void *v)
+ __releases(instances_lock)
{
spin_unlock(&instances_lock);
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:16:58 UTC
Permalink
[NETFILTER]: nf_nat: remove double bysource hash initialization

The hash table is already initialized by nf_ct_alloc_hashtable().

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 4639b794086800b0bef00c06c880a47be1517853
tree 70dd7a1fda33819c1b1715722ca5b77f491a7c8f
parent 6276f9ebe13419b94f58dd9ef713c1c56c74e4ca
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:21:50 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:12 +0100

net/ipv4/netfilter/nf_nat_core.c | 4 ----
1 files changed, 0 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index e53ae1e..c07575d 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -654,10 +654,6 @@ static int __init nf_nat_init(void)
rcu_assign_pointer(nf_nat_protos[IPPROTO_ICMP], &nf_nat_protocol_icmp);
write_unlock_bh(&nf_nat_lock);

- for (i = 0; i < nf_nat_htable_size; i++) {
- INIT_HLIST_HEAD(&bysource[i]);
- }
-
/* Initialize fake conntrack so that NAT will skip it */
nf_conntrack_untracked.status |= IPS_NAT_DONE_MASK;

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:16:55 UTC
Permalink
[NETFILTER]: Use const in struct xt_match, xt_target, xt_table

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit a2a8ddee99386b740ec6242b2a185617ba59edac
tree cd3566e5dd481ca08cb0c4e9baeb424c354895cf
parent 529b54d47425038bf231b8ce446447e957b3c89d
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:21:49 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:12 +0100

include/linux/netfilter/x_tables.h | 6 +++---
net/ipv4/netfilter/ip_tables.c | 2 +-
net/ipv6/netfilter/ip6_tables.c | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index b99ede5..90dc6ea 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -214,7 +214,7 @@ struct xt_match
/* Free to use by each match */
unsigned long data;

- char *table;
+ const char *table;
unsigned int matchsize;
unsigned int compatsize;
unsigned int hooks;
@@ -261,7 +261,7 @@ struct xt_target
/* Set this to THIS_MODULE if you are a module, otherwise NULL */
struct module *me;

- char *table;
+ const char *table;
unsigned int targetsize;
unsigned int compatsize;
unsigned int hooks;
@@ -277,7 +277,7 @@ struct xt_table
struct list_head list;

/* A unique name... */
- char name[XT_TABLE_MAXNAMELEN];
+ const char name[XT_TABLE_MAXNAMELEN];

/* What hooks you will enter on */
unsigned int valid_hooks;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 982b7f9..628a6b5 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -291,7 +291,7 @@ static void trace_packet(struct sk_buff *skb,
unsigned int hook,
const struct net_device *in,
const struct net_device *out,
- char *tablename,
+ const char *tablename,
struct xt_table_info *private,
struct ipt_entry *e)
{
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index dd7860f..92b4898 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -320,7 +320,7 @@ static void trace_packet(struct sk_buff *skb,
unsigned int hook,
const struct net_device *in,
const struct net_device *out,
- char *tablename,
+ const char *tablename,
struct xt_table_info *private,
struct ip6t_entry *e)
{
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:01 UTC
Permalink
[NETFILTER]: nfnetlink_log: fix typo

It should use htonl for the GID, not htons.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit b64a07de84c00708be436ec05a75c093430e262d
tree 0bfbb96d69717d2146e0f9683d8b0a22a3216910
parent 55a3ad929c35527e0ac6ccdb5535779ed1523be5
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:21:52 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:13 +0100

net/netfilter/nfnetlink_log.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 5013cb9..2348fcb 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -467,7 +467,7 @@ __build_packet_message(struct nfulnl_instance *inst,
read_lock_bh(&skb->sk->sk_callback_lock);
if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
__be32 uid = htonl(skb->sk->sk_socket->file->f_uid);
- __be32 gid = htons(skb->sk->sk_socket->file->f_gid);
+ __be32 gid = htonl(skb->sk->sk_socket->file->f_gid);
/* need to unlock here since NLA_PUT may goto */
read_unlock_bh(&skb->sk->sk_callback_lock);
NLA_PUT_BE32(inst->skb, NFULA_UID, uid);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:16:57 UTC
Permalink
linux/types.h: Use __u64 for aligned_u64

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 6276f9ebe13419b94f58dd9ef713c1c56c74e4ca
tree 359d6748c8f98414b144ba3cac969c7bccc0f311
parent a2a8ddee99386b740ec6242b2a185617ba59edac
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:21:49 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:12 +0100

include/linux/types.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/include/linux/types.h b/include/linux/types.h
index f4f8d19..b94c0e4 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -126,7 +126,7 @@ typedef __s64 int64_t;
#endif

/* this is a special 64bit data type that is 8-byte aligned */
-#define aligned_u64 unsigned long long __attribute__((aligned(8)))
+#define aligned_u64 __u64 __attribute__((aligned(8)))
#define aligned_be64 __be64 __attribute__((aligned(8)))
#define aligned_le64 __le64 __attribute__((aligned(8)))

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:16:59 UTC
Permalink
[NETFILTER]: bridge netfilter: remove nf_bridge_info read-only netoutdev member

Before the removal of the deferred output hooks, netoutdev was used in case
of VLANs on top of a bridge to store the VLAN device, so the deferred hooks
would see the correct output device. This isn't necessary anymore since we're
calling the output hooks for the correct device directly in the IP stack.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 55a3ad929c35527e0ac6ccdb5535779ed1523be5
tree 3db79be7f7c220b1bbfbac83b4040e67ad65c127
parent 4639b794086800b0bef00c06c880a47be1517853
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:21:51 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:12 +0100

include/linux/skbuff.h | 3 ---
net/bridge/br_netfilter.c | 4 ----
2 files changed, 0 insertions(+), 7 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c618fbf..dfe975a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -108,9 +108,6 @@ struct nf_bridge_info {
atomic_t use;
struct net_device *physindev;
struct net_device *physoutdev;
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
- struct net_device *netoutdev;
-#endif
unsigned int mask;
unsigned long data[32 / sizeof(unsigned long)];
};
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 80014ba..1c0efd8 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -828,10 +828,6 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
nf_bridge_pull_encap_header(skb);
nf_bridge_save_header(skb);

-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
- if (nf_bridge->netoutdev)
- realoutdev = nf_bridge->netoutdev;
-#endif
NF_HOOK(pf, NF_INET_POST_ROUTING, skb, NULL, realoutdev,
br_nf_dev_queue_xmit);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:03 UTC
Permalink
[NETFILTER]: xt_conntrack: add port and direction matching

Extend the xt_conntrack match revision 1 by port matching (all four
{orig,repl}{src,dst}) and by packet direction matching.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 62069912fa544382934395362fb73205475474d4
tree fb265d4b459d2eb956f4f79102d60b6fcebcc9fd
parent b64a07de84c00708be436ec05a75c093430e262d
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:21:=
53 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:13 +=
0100

include/linux/netfilter/xt_conntrack.h | 30 ++++++++++++-------
net/netfilter/xt_conntrack.c | 50 ++++++++++++++++++++++++=
+++++---
2 files changed, 63 insertions(+), 17 deletions(-)

diff --git a/include/linux/netfilter/xt_conntrack.h b/include/linux/net=
filter/xt_conntrack.h
index d2492a3..f3fd83e 100644
--- a/include/linux/netfilter/xt_conntrack.h
+++ b/include/linux/netfilter/xt_conntrack.h
@@ -6,9 +6,6 @@
#define _XT_CONNTRACK_H
=20
#include <linux/netfilter/nf_conntrack_tuple_common.h>
-#ifdef __KERNEL__
-# include <linux/in.h>
-#endif
=20
#define XT_CONNTRACK_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+=
1))
#define XT_CONNTRACK_STATE_INVALID (1 << 0)
@@ -18,14 +15,21 @@
#define XT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
=20
/* flags, invflags: */
-#define XT_CONNTRACK_STATE 0x01
-#define XT_CONNTRACK_PROTO 0x02
-#define XT_CONNTRACK_ORIGSRC 0x04
-#define XT_CONNTRACK_ORIGDST 0x08
-#define XT_CONNTRACK_REPLSRC 0x10
-#define XT_CONNTRACK_REPLDST 0x20
-#define XT_CONNTRACK_STATUS 0x40
-#define XT_CONNTRACK_EXPIRES 0x80
+enum {
+ XT_CONNTRACK_STATE =3D 1 << 0,
+ XT_CONNTRACK_PROTO =3D 1 << 1,
+ XT_CONNTRACK_ORIGSRC =3D 1 << 2,
+ XT_CONNTRACK_ORIGDST =3D 1 << 3,
+ XT_CONNTRACK_REPLSRC =3D 1 << 4,
+ XT_CONNTRACK_REPLDST =3D 1 << 5,
+ XT_CONNTRACK_STATUS =3D 1 << 6,
+ XT_CONNTRACK_EXPIRES =3D 1 << 7,
+ XT_CONNTRACK_ORIGSRC_PORT =3D 1 << 8,
+ XT_CONNTRACK_ORIGDST_PORT =3D 1 << 9,
+ XT_CONNTRACK_REPLSRC_PORT =3D 1 << 10,
+ XT_CONNTRACK_REPLDST_PORT =3D 1 << 11,
+ XT_CONNTRACK_DIRECTION =3D 1 << 12,
+};
=20
/* This is exposed to userspace, so remains frozen in time. */
struct ip_conntrack_old_tuple
@@ -70,8 +74,10 @@ struct xt_conntrack_mtinfo1 {
union nf_inet_addr repldst_addr, repldst_mask;
u_int32_t expires_min, expires_max;
u_int16_t l4proto;
+ __be16 origsrc_port, origdst_port;
+ __be16 replsrc_port, repldst_port;
+ u_int16_t match_flags, invert_flags;
u_int8_t state_mask, status_mask;
- u_int8_t match_flags, invert_flags;
};
=20
#endif /*_XT_CONNTRACK_H*/
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.=
c
index e92190e..8533085 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -4,7 +4,6 @@
*
* (C) 2001 Marc Boucher (***@mbsi.ca).
* Copyright =C2=A9 CC Computer Consultants GmbH, 2007 - 2008
- * Jan Engelhardt <***@computergmbh.de>
*
* This program is free software; you can redistribute it and/or modif=
y
* it under the terms of the GNU General Public License version 2 as
@@ -20,6 +19,7 @@
=20
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marc Boucher <***@mbsi.ca>");
+MODULE_AUTHOR("Jan Engelhardt <***@computergmbh.de>");
MODULE_DESCRIPTION("Xtables: connection tracking state match");
MODULE_ALIAS("ipt_conntrack");
MODULE_ALIAS("ip6t_conntrack");
@@ -166,6 +166,44 @@ conntrack_mt_repldst(const struct nf_conn *ct,
&info->repldst_addr, &info->repldst_mask, family);
}
=20
+static inline bool
+ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
+ const struct nf_conn *ct)
+{
+ const struct nf_conntrack_tuple *tuple;
+
+ tuple =3D &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ if ((info->match_flags & XT_CONNTRACK_PROTO) &&
+ (tuple->dst.protonum =3D=3D info->l4proto) ^
+ !(info->invert_flags & XT_CONNTRACK_PROTO))
+ return false;
+
+ /* Shortcut to match all recognized protocols by using ->src.all. */
+ if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
+ (tuple->src.u.all =3D=3D info->origsrc_port) ^
+ !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
+ return false;
+
+ if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
+ (tuple->dst.u.all =3D=3D info->origdst_port) ^
+ !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
+ return false;
+
+ tuple =3D &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+ if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
+ (tuple->src.u.all =3D=3D info->replsrc_port) ^
+ !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
+ return false;
+
+ if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
+ (tuple->dst.u.all =3D=3D info->repldst_port) ^
+ !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
+ return false;
+
+ return true;
+}
+
static bool
conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *matc=
h,
@@ -200,10 +238,9 @@ conntrack_mt(const struct sk_buff *skb, const stru=
ct net_device *in,
=20
if (ct =3D=3D NULL)
return info->match_flags & XT_CONNTRACK_STATE;
-
- if ((info->match_flags & XT_CONNTRACK_PROTO) &&
- ((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum =3D=3D
- info->l4proto) ^ !(info->invert_flags & XT_CONNTRACK_PROTO)))
+ if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
+ (CTINFO2DIR(ctinfo) =3D=3D IP_CT_DIR_ORIGINAL) ^
+ !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
return false;
=20
if (info->match_flags & XT_CONNTRACK_ORIGSRC)
@@ -226,6 +263,9 @@ conntrack_mt(const struct sk_buff *skb, const struc=
t net_device *in,
!(info->invert_flags & XT_CONNTRACK_REPLDST))
return false;
=20
+ if (!ct_proto_port_check(info, ct))
+ return false;
+
if ((info->match_flags & XT_CONNTRACK_STATUS) &&
(!!(info->status_mask & ct->status) ^
!(info->invert_flags & XT_CONNTRACK_STATUS)))
-
To unsubscribe from this list: send the line "unsubscribe netfilter-dev=
el" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:20 UTC
Permalink
[NETFILTER]: ip6_tables: per-netns IPv6 FILTER, MANGLE, RAW

Now it's possible to list and manipulate per-netns ip6tables rules.
Filtering decisions are based on init_net's table so far.

P.S.: remove init_net check in inet6_create() to see the effect

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 084d68b97043319020232289b1f63c8c7afa2e97
tree c7eccef90b4c867d5c7ded7b65824f2d80ac4c69
parent 9b50679c5240114dfca105cd2f7e9df0d187eded
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:22:00 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:17 +0100

include/net/netns/ipv6.h | 5 ++++
net/ipv6/netfilter/ip6table_filter.c | 40 +++++++++++++++++++++++++---------
net/ipv6/netfilter/ip6table_mangle.c | 40 +++++++++++++++++++++++++---------
net/ipv6/netfilter/ip6table_raw.c | 38 ++++++++++++++++++++++++--------
4 files changed, 91 insertions(+), 32 deletions(-)

diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index 187c424..1dd7de4 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -31,5 +31,10 @@ struct netns_ipv6 {
struct ipv6_devconf *devconf_all;
struct ipv6_devconf *devconf_dflt;
struct netns_frags frags;
+#ifdef CONFIG_NETFILTER
+ struct xt_table *ip6table_filter;
+ struct xt_table *ip6table_mangle;
+ struct xt_table *ip6table_raw;
+#endif
};
#endif
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index d0bf71d..2d9cd09 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -26,7 +26,7 @@ static struct
struct ip6t_replace repl;
struct ip6t_standard entries[3];
struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
.repl = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
@@ -51,14 +51,13 @@ static struct
.term = IP6T_ERROR_INIT, /* ERROR */
};

-static struct xt_table __packet_filter = {
+static struct xt_table packet_filter = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET6,
};
-static struct xt_table *packet_filter;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -68,7 +67,7 @@ ip6t_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ip6t_do_table(skb, hook, in, out, packet_filter);
+ return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);
}

static unsigned int
@@ -88,7 +87,7 @@ ip6t_local_out_hook(unsigned int hook,
}
#endif

- return ip6t_do_table(skb, hook, in, out, packet_filter);
+ return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);
}

static struct nf_hook_ops ip6t_ops[] __read_mostly = {
@@ -119,6 +118,26 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
static int forward = NF_ACCEPT;
module_param(forward, bool, 0000);

+static int __net_init ip6table_filter_net_init(struct net *net)
+{
+ /* Register table */
+ net->ipv6.ip6table_filter =
+ ip6t_register_table(net, &packet_filter, &initial_table.repl);
+ if (IS_ERR(net->ipv6.ip6table_filter))
+ return PTR_ERR(net->ipv6.ip6table_filter);
+ return 0;
+}
+
+static void __net_exit ip6table_filter_net_exit(struct net *net)
+{
+ ip6t_unregister_table(net->ipv6.ip6table_filter);
+}
+
+static struct pernet_operations ip6table_filter_net_ops = {
+ .init = ip6table_filter_net_init,
+ .exit = ip6table_filter_net_exit,
+};
+
static int __init ip6table_filter_init(void)
{
int ret;
@@ -131,10 +150,9 @@ static int __init ip6table_filter_init(void)
/* Entry 1 is the FORWARD hook */
initial_table.entries[1].target.verdict = -forward - 1;

- /* Register table */
- packet_filter = ip6t_register_table(&init_net, &__packet_filter, &initial_table.repl);
- if (IS_ERR(packet_filter))
- return PTR_ERR(packet_filter);
+ ret = register_pernet_subsys(&ip6table_filter_net_ops);
+ if (ret < 0)
+ return ret;

/* Register hooks */
ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
@@ -144,14 +162,14 @@ static int __init ip6table_filter_init(void)
return ret;

cleanup_table:
- ip6t_unregister_table(packet_filter);
+ unregister_pernet_subsys(&ip6table_filter_net_ops);
return ret;
}

static void __exit ip6table_filter_fini(void)
{
nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
- ip6t_unregister_table(packet_filter);
+ unregister_pernet_subsys(&ip6table_filter_net_ops);
}

module_init(ip6table_filter_init);
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index abdfece..035343a 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -26,7 +26,7 @@ static struct
struct ip6t_replace repl;
struct ip6t_standard entries[5];
struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
.repl = {
.name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS,
@@ -57,14 +57,13 @@ static struct
.term = IP6T_ERROR_INIT, /* ERROR */
};

-static struct xt_table __packet_mangler = {
+static struct xt_table packet_mangler = {
.name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET6,
};
-static struct xt_table *packet_mangler;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -74,7 +73,7 @@ ip6t_route_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ip6t_do_table(skb, hook, in, out, packet_mangler);
+ return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_mangle);
}

static unsigned int
@@ -109,7 +108,7 @@ ip6t_local_hook(unsigned int hook,
/* flowlabel and prio (includes version, which shouldn't change either */
flowlabel = *((u_int32_t *)ipv6_hdr(skb));

- ret = ip6t_do_table(skb, hook, in, out, packet_mangler);
+ ret = ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_mangle);

if (ret != NF_DROP && ret != NF_STOLEN
&& (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
@@ -159,14 +158,33 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
},
};

+static int __net_init ip6table_mangle_net_init(struct net *net)
+{
+ /* Register table */
+ net->ipv6.ip6table_mangle =
+ ip6t_register_table(net, &packet_mangler, &initial_table.repl);
+ if (IS_ERR(net->ipv6.ip6table_mangle))
+ return PTR_ERR(net->ipv6.ip6table_mangle);
+ return 0;
+}
+
+static void __net_exit ip6table_mangle_net_exit(struct net *net)
+{
+ ip6t_unregister_table(net->ipv6.ip6table_mangle);
+}
+
+static struct pernet_operations ip6table_mangle_net_ops = {
+ .init = ip6table_mangle_net_init,
+ .exit = ip6table_mangle_net_exit,
+};
+
static int __init ip6table_mangle_init(void)
{
int ret;

- /* Register table */
- packet_mangler = ip6t_register_table(&init_net, &__packet_mangler, &initial_table.repl);
- if (IS_ERR(packet_mangler))
- return PTR_ERR(packet_mangler);
+ ret = register_pernet_subsys(&ip6table_mangle_net_ops);
+ if (ret < 0)
+ return ret;

/* Register hooks */
ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
@@ -176,14 +194,14 @@ static int __init ip6table_mangle_init(void)
return ret;

cleanup_table:
- ip6t_unregister_table(packet_mangler);
+ unregister_pernet_subsys(&ip6table_mangle_net_ops);
return ret;
}

static void __exit ip6table_mangle_fini(void)
{
nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
- ip6t_unregister_table(packet_mangler);
+ unregister_pernet_subsys(&ip6table_mangle_net_ops);
}

module_init(ip6table_mangle_init);
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 12acd63..5cd8420 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -13,7 +13,7 @@ static struct
struct ip6t_replace repl;
struct ip6t_standard entries[2];
struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
.repl = {
.name = "raw",
.valid_hooks = RAW_VALID_HOOKS,
@@ -35,14 +35,13 @@ static struct
.term = IP6T_ERROR_INIT, /* ERROR */
};

-static struct xt_table __packet_raw = {
+static struct xt_table packet_raw = {
.name = "raw",
.valid_hooks = RAW_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET6,
};
-static struct xt_table *packet_raw;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -52,7 +51,7 @@ ip6t_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ip6t_do_table(skb, hook, in, out, packet_raw);
+ return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_raw);
}

static struct nf_hook_ops ip6t_ops[] __read_mostly = {
@@ -72,14 +71,33 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
},
};

+static int __net_init ip6table_raw_net_init(struct net *net)
+{
+ /* Register table */
+ net->ipv6.ip6table_raw =
+ ip6t_register_table(net, &packet_raw, &initial_table.repl);
+ if (IS_ERR(net->ipv6.ip6table_raw))
+ return PTR_ERR(net->ipv6.ip6table_raw);
+ return 0;
+}
+
+static void __net_exit ip6table_raw_net_exit(struct net *net)
+{
+ ip6t_unregister_table(net->ipv6.ip6table_raw);
+}
+
+static struct pernet_operations ip6table_raw_net_ops = {
+ .init = ip6table_raw_net_init,
+ .exit = ip6table_raw_net_exit,
+};
+
static int __init ip6table_raw_init(void)
{
int ret;

- /* Register table */
- packet_raw = ip6t_register_table(&init_net, &__packet_raw, &initial_table.repl);
- if (IS_ERR(packet_raw))
- return PTR_ERR(packet_raw);
+ ret = register_pernet_subsys(&ip6table_raw_net_ops);
+ if (ret < 0)
+ return ret;

/* Register hooks */
ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
@@ -89,14 +107,14 @@ static int __init ip6table_raw_init(void)
return ret;

cleanup_table:
- ip6t_unregister_table(packet_raw);
+ unregister_pernet_subsys(&ip6table_raw_net_ops);
return ret;
}

static void __exit ip6table_raw_fini(void)
{
nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
- ip6t_unregister_table(packet_raw);
+ unregister_pernet_subsys(&ip6table_raw_net_ops);
}

module_init(ip6table_raw_init);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:31 UTC
Permalink
[NETFILTER]: nf_nat_snmp: sparse warning

Signed-off-by: Stephen Hemminger <***@vyatta.com>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 1ba99fa44b76ee7a7dddffc965a296d46c70fd40
tree 8d6c2f8042f36119de85fdba76d46dfca177ac80
parent c1e9e8f11d30d54eb79e53ca02f0fd17a60407ef
author Stephen Hemminger <***@vyatta.com> Tue, 29 Jan 2008 16:22:04 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:18 +0100

net/ipv4/netfilter/nf_nat_snmp_basic.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 07f2a49..540ce6a 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -260,7 +260,7 @@ static unsigned char asn1_eoc_decode(struct asn1_ctx *ctx, unsigned char *eoc)
{
unsigned char ch;

- if (eoc == 0) {
+ if (eoc == NULL) {
if (!asn1_octet_decode(ctx, &ch))
return 0;

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:04 UTC
Permalink
[NETFILTER]: nf_log: add netfilter gcc printf format checking

Signed-off-by: Helge Deller <***@gmx.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 1b8b1c29feb7a42aceb8f62ea9378d492437acbe
tree b56dae8df90443115cb7eff3199a160be17b9631
parent 62069912fa544382934395362fb73205475474d4
author Helge Deller <***@gmx.de> Tue, 29 Jan 2008 16:21:53 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:13 +0100

include/net/netfilter/nf_log.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index 037e824..8c6b5ae 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -54,6 +54,6 @@ void nf_log_packet(int pf,
const struct net_device *in,
const struct net_device *out,
const struct nf_loginfo *li,
- const char *fmt, ...);
+ const char *fmt, ...) __attribute__ ((format(printf,7,8)));

#endif /* _NF_LOG_H */
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:25 UTC
Permalink
[NETFILTER]: netns: put table module on netns stop

When number of entries exceeds number of initial entries, foo-tables code
will pin table module. But during table unregister on netns stop,
that additional pin was forgotten.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 5925cf9534dffe7165056399a6911609bd1fb44b
tree f3085e7975b409f6ea2f5d6c56adc9abdd13aadc
parent e612deed898a9b2984bd7c2f4fef1a5a93f8160b
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:22:02 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:17 +0100

net/ipv4/netfilter/arp_tables.c | 3 +++
net/ipv4/netfilter/ip_tables.c | 3 +++
net/ipv6/netfilter/ip6_tables.c | 3 +++
3 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index ec64b67..3608675 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1773,6 +1773,7 @@ void arpt_unregister_table(struct arpt_table *table)
{
struct xt_table_info *private;
void *loc_cpu_entry;
+ struct module *table_owner = table->me;

private = xt_unregister_table(table);

@@ -1780,6 +1781,8 @@ void arpt_unregister_table(struct arpt_table *table)
loc_cpu_entry = private->entries[raw_smp_processor_id()];
ARPT_ENTRY_ITERATE(loc_cpu_entry, private->size,
cleanup_entry, NULL);
+ if (private->number > private->initial_entries)
+ module_put(table_owner);
xt_free_table_info(private);
}

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index c1b80f4..427bc9b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2095,12 +2095,15 @@ void ipt_unregister_table(struct xt_table *table)
{
struct xt_table_info *private;
void *loc_cpu_entry;
+ struct module *table_owner = table->me;

private = xt_unregister_table(table);

/* Decrease module usage counts and free resources */
loc_cpu_entry = private->entries[raw_smp_processor_id()];
IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+ if (private->number > private->initial_entries)
+ module_put(table_owner);
xt_free_table_info(private);
}

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 2453dfd..6fabb73 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -2121,12 +2121,15 @@ void ip6t_unregister_table(struct xt_table *table)
{
struct xt_table_info *private;
void *loc_cpu_entry;
+ struct module *table_owner = table->me;

private = xt_unregister_table(table);

/* Decrease module usage counts and free resources */
loc_cpu_entry = private->entries[raw_smp_processor_id()];
IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+ if (private->number > private->initial_entries)
+ module_put(table_owner);
xt_free_table_info(private);
}

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:07 UTC
Permalink
[NETFILTER]: ebtables: Update modules' descriptions

Update the MODULES_DESCRIPTION() tags for all Ebtables modules.

Reference to previous related commit: 3e53176b24b94f660ba61bfab5bcaf5c135bbcf2.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit ddc4e00ab9447d62118a6a0506369726065d1df5
tree b5ed55dca07bd2bdb9e9a082ba05c9e1aba71c5b
parent b98625021b5c086ec97c2121eaf9f06873339d3e
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:21:55 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:14 +0100

net/bridge/netfilter/ebt_802_3.c | 1 +
net/bridge/netfilter/ebt_among.c | 1 +
net/bridge/netfilter/ebt_arp.c | 1 +
net/bridge/netfilter/ebt_arpreply.c | 1 +
net/bridge/netfilter/ebt_dnat.c | 1 +
net/bridge/netfilter/ebt_ip.c | 1 +
net/bridge/netfilter/ebt_limit.c | 1 +
net/bridge/netfilter/ebt_log.c | 1 +
net/bridge/netfilter/ebt_mark.c | 1 +
net/bridge/netfilter/ebt_mark_m.c | 1 +
net/bridge/netfilter/ebt_pkttype.c | 1 +
net/bridge/netfilter/ebt_redirect.c | 1 +
net/bridge/netfilter/ebt_snat.c | 1 +
net/bridge/netfilter/ebt_stp.c | 1 +
net/bridge/netfilter/ebt_ulog.c | 3 +--
net/bridge/netfilter/ebt_vlan.c | 3 +--
16 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index ac1730b..ef73592 100644
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -70,4 +70,5 @@ static void __exit ebt_802_3_fini(void)

module_init(ebt_802_3_init);
module_exit(ebt_802_3_fini);
+MODULE_DESCRIPTION("Ebtables: DSAP/SSAP field and SNAP type matching");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index 318157e..bf0d1d9 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -231,4 +231,5 @@ static void __exit ebt_among_fini(void)

module_init(ebt_among_init);
module_exit(ebt_among_fini);
+MODULE_DESCRIPTION("Ebtables: Combined MAC/IP address list matching");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index 933433e..8d6ab64 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -136,4 +136,5 @@ static void __exit ebt_arp_fini(void)

module_init(ebt_arp_init);
module_exit(ebt_arp_fini);
+MODULE_DESCRIPTION("Ebtables: ARP protocol packet match");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 7b6a8c1..9f25423 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -96,4 +96,5 @@ static void __exit ebt_arpreply_fini(void)

module_init(ebt_arpreply_init);
module_exit(ebt_arpreply_fini);
+MODULE_DESCRIPTION("Ebtables: ARP reply target");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index 6ad9160..285378d 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -66,4 +66,5 @@ static void __exit ebt_dnat_fini(void)

module_init(ebt_dnat_init);
module_exit(ebt_dnat_fini);
+MODULE_DESCRIPTION("Ebtables: Destination MAC address translation");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index 82934f9..78efe9b 100644
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -127,4 +127,5 @@ static void __exit ebt_ip_fini(void)

module_init(ebt_ip_init);
module_exit(ebt_ip_fini);
+MODULE_DESCRIPTION("Ebtables: IPv4 protocol packet match");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index 2eb5cb7..3c44bd6 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -110,4 +110,5 @@ static void __exit ebt_limit_fini(void)

module_init(ebt_limit_init);
module_exit(ebt_limit_fini);
+MODULE_DESCRIPTION("Ebtables: Rate-limit match");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 40560d6..0b209e4 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -212,4 +212,5 @@ static void __exit ebt_log_fini(void)

module_init(ebt_log_init);
module_exit(ebt_log_fini);
+MODULE_DESCRIPTION("Ebtables: Packet logging to syslog");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 6fe93df..93ea763 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -77,4 +77,5 @@ static void __exit ebt_mark_fini(void)

module_init(ebt_mark_init);
module_exit(ebt_mark_fini);
+MODULE_DESCRIPTION("Ebtables: Packet mark modification");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_mark_m.c b/net/bridge/netfilter/ebt_mark_m.c
index 0acab09..914c244 100644
--- a/net/bridge/netfilter/ebt_mark_m.c
+++ b/net/bridge/netfilter/ebt_mark_m.c
@@ -59,4 +59,5 @@ static void __exit ebt_mark_m_fini(void)

module_init(ebt_mark_m_init);
module_exit(ebt_mark_m_fini);
+MODULE_DESCRIPTION("Ebtables: Packet mark match");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_pkttype.c b/net/bridge/netfilter/ebt_pkttype.c
index a15cf06..19a69ea 100644
--- a/net/bridge/netfilter/ebt_pkttype.c
+++ b/net/bridge/netfilter/ebt_pkttype.c
@@ -56,4 +56,5 @@ static void __exit ebt_pkttype_fini(void)

module_init(ebt_pkttype_init);
module_exit(ebt_pkttype_fini);
+MODULE_DESCRIPTION("Ebtables: Link layer packet type match");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index c1f9ca2..f206a27 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -71,4 +71,5 @@ static void __exit ebt_redirect_fini(void)

module_init(ebt_redirect_init);
module_exit(ebt_redirect_fini);
+MODULE_DESCRIPTION("Ebtables: Packet redirection to localhost");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index 6bc263c..ed85858 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -88,4 +88,5 @@ static void __exit ebt_snat_fini(void)

module_init(ebt_snat_init);
module_exit(ebt_snat_fini);
+MODULE_DESCRIPTION("Ebtables: Source MAC address translation");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index fe323c4..c264797 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -194,4 +194,5 @@ static void __exit ebt_stp_fini(void)

module_init(ebt_stp_init);
module_exit(ebt_stp_fini);
+MODULE_DESCRIPTION("Ebtables: Spanning Tree Protocol packet match");
MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 2015711..748eecd 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -340,5 +340,4 @@ module_init(ebt_ulog_init);
module_exit(ebt_ulog_fini);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Bart De Schuymer <***@pandora.be>");
-MODULE_DESCRIPTION("ebtables userspace logging module for bridged Ethernet"
- " frames");
+MODULE_DESCRIPTION("Ebtables: Packet logging to netlink using ULOG");
diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index 097d067..96897e2 100644
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -31,8 +31,7 @@ static int debug;
module_param(debug, int, 0);
MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
MODULE_AUTHOR("Nick Fedchik <***@fedchik.org.ua>");
-MODULE_DESCRIPTION("802.1Q match module (ebtables extension), v"
- MODULE_VERS);
+MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match");
MODULE_LICENSE("GPL");


-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:37 UTC
Permalink
[NETFILTER]: more sparse fixes

Some lock annotations, and make initializers static.

Signed-off-by: Stephen Hemminger <***@vyatta.com>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit cba4c67b58eee186ca8ff3e4588a01406d96a886
tree ed40d2d70fccb6aa1cb3c520ffc39b5a517b0018
parent a56984be5dde4c3ab631f9c66e15c1fa7a12f17e
author Stephen Hemminger <***@vyatta.com> Tue, 29 Jan 2008 16:22:06 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:19 +0100

net/ipv4/netfilter/nf_nat_proto_gre.c | 4 ++--
net/netfilter/xt_hashlimit.c | 2 ++
2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index 9fa272e..c9dbd55 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -148,12 +148,12 @@ static const struct nf_nat_protocol gre = {
#endif
};

-int __init nf_nat_proto_gre_init(void)
+static int __init nf_nat_proto_gre_init(void)
{
return nf_nat_protocol_register(&gre);
}

-void __exit nf_nat_proto_gre_fini(void)
+static void __exit nf_nat_proto_gre_fini(void)
{
nf_nat_protocol_unregister(&gre);
}
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index d479ca9..b224b8f 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -624,6 +624,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {

/* PROC stuff */
static void *dl_seq_start(struct seq_file *s, loff_t *pos)
+ __acquires(htable->lock)
{
struct proc_dir_entry *pde = s->private;
struct xt_hashlimit_htable *htable = pde->data;
@@ -656,6 +657,7 @@ static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
}

static void dl_seq_stop(struct seq_file *s, void *v)
+ __releases(htable->lock)
{
struct proc_dir_entry *pde = s->private;
struct xt_hashlimit_htable *htable = pde->data;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:18 UTC
Permalink
[NETFILTER]: ip6_tables: netns preparation

* Propagate netns from userspace down to xt_find_table_lock()
* Register ip6 tables in netns (modules still use init_net)

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 9b50679c5240114dfca105cd2f7e9df0d187eded
tree ba5e0ad150b5efffa8cc57c44e45f435682d9ea3
parent 4885531d4b5ac7058b8d2414d6f6404eba84d0e8
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:21:59 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:16 +0100

include/linux/netfilter_ipv6/ip6_tables.h | 3 +-
net/ipv6/netfilter/ip6_tables.c | 51 +++++++++++++++--------------
net/ipv6/netfilter/ip6table_filter.c | 2 +
net/ipv6/netfilter/ip6table_mangle.c | 2 +
net/ipv6/netfilter/ip6table_raw.c | 2 +
5 files changed, 32 insertions(+), 28 deletions(-)

diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index f716c75..f2507dc 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -305,7 +305,8 @@ ip6t_get_target(struct ip6t_entry *e)
#include <linux/init.h>
extern void ip6t_init(void) __init;

-extern struct xt_table *ip6t_register_table(struct xt_table *table,
+extern struct xt_table *ip6t_register_table(struct net *net,
+ struct xt_table *table,
const struct ip6t_replace *repl);
extern void ip6t_unregister_table(struct xt_table *table);
extern unsigned int ip6t_do_table(struct sk_buff *skb,
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index b89f133..2453dfd 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1118,7 +1118,7 @@ static int compat_table_info(const struct xt_table_info *info,
}
#endif

-static int get_info(void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user, int *len, int compat)
{
char name[IP6T_TABLE_MAXNAMELEN];
struct xt_table *t;
@@ -1138,7 +1138,7 @@ static int get_info(void __user *user, int *len, int compat)
if (compat)
xt_compat_lock(AF_INET6);
#endif
- t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET6, name),
+ t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
"ip6table_%s", name);
if (t && !IS_ERR(t)) {
struct ip6t_getinfo info;
@@ -1178,7 +1178,7 @@ static int get_info(void __user *user, int *len, int compat)
}

static int
-get_entries(struct ip6t_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ip6t_get_entries __user *uptr, int *len)
{
int ret;
struct ip6t_get_entries get;
@@ -1196,7 +1196,7 @@ get_entries(struct ip6t_get_entries __user *uptr, int *len)
return -EINVAL;
}

- t = xt_find_table_lock(&init_net, AF_INET6, get.name);
+ t = xt_find_table_lock(net, AF_INET6, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
duprintf("t->private->number = %u\n", private->number);
@@ -1217,7 +1217,7 @@ get_entries(struct ip6t_get_entries __user *uptr, int *len)
}

static int
-__do_replace(const char *name, unsigned int valid_hooks,
+__do_replace(struct net *net, const char *name, unsigned int valid_hooks,
struct xt_table_info *newinfo, unsigned int num_counters,
void __user *counters_ptr)
{
@@ -1235,7 +1235,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
goto out;
}

- t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET6, name),
+ t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
"ip6table_%s", name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1288,7 +1288,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
}

static int
-do_replace(void __user *user, unsigned int len)
+do_replace(struct net *net, void __user *user, unsigned int len)
{
int ret;
struct ip6t_replace tmp;
@@ -1322,7 +1322,7 @@ do_replace(void __user *user, unsigned int len)

duprintf("ip_tables: Translated table\n");

- ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+ ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
tmp.num_counters, tmp.counters);
if (ret)
goto free_newinfo_untrans;
@@ -1358,7 +1358,8 @@ add_counter_to_entry(struct ip6t_entry *e,
}

static int
-do_add_counters(void __user *user, unsigned int len, int compat)
+do_add_counters(struct net *net, void __user *user, unsigned int len,
+ int compat)
{
unsigned int i;
struct xt_counters_info tmp;
@@ -1410,7 +1411,7 @@ do_add_counters(void __user *user, unsigned int len, int compat)
goto free;
}

- t = xt_find_table_lock(&init_net, AF_INET6, name);
+ t = xt_find_table_lock(net, AF_INET6, name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
goto free;
@@ -1815,7 +1816,7 @@ out_unlock:
}

static int
-compat_do_replace(void __user *user, unsigned int len)
+compat_do_replace(struct net *net, void __user *user, unsigned int len)
{
int ret;
struct compat_ip6t_replace tmp;
@@ -1852,7 +1853,7 @@ compat_do_replace(void __user *user, unsigned int len)

duprintf("compat_do_replace: Translated table\n");

- ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+ ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
tmp.num_counters, compat_ptr(tmp.counters));
if (ret)
goto free_newinfo_untrans;
@@ -1876,11 +1877,11 @@ compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,

switch (cmd) {
case IP6T_SO_SET_REPLACE:
- ret = compat_do_replace(user, len);
+ ret = compat_do_replace(sk->sk_net, user, len);
break;

case IP6T_SO_SET_ADD_COUNTERS:
- ret = do_add_counters(user, len, 1);
+ ret = do_add_counters(sk->sk_net, user, len, 1);
break;

default:
@@ -1929,7 +1930,8 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
}

static int
-compat_get_entries(struct compat_ip6t_get_entries __user *uptr, int *len)
+compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
+ int *len)
{
int ret;
struct compat_ip6t_get_entries get;
@@ -1950,7 +1952,7 @@ compat_get_entries(struct compat_ip6t_get_entries __user *uptr, int *len)
}

xt_compat_lock(AF_INET6);
- t = xt_find_table_lock(&init_net, AF_INET6, get.name);
+ t = xt_find_table_lock(net, AF_INET6, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
struct xt_table_info info;
@@ -1986,10 +1988,10 @@ compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)

switch (cmd) {
case IP6T_SO_GET_INFO:
- ret = get_info(user, len, 1);
+ ret = get_info(sk->sk_net, user, len, 1);
break;
case IP6T_SO_GET_ENTRIES:
- ret = compat_get_entries(user, len);
+ ret = compat_get_entries(sk->sk_net, user, len);
break;
default:
ret = do_ip6t_get_ctl(sk, cmd, user, len);
@@ -2008,11 +2010,11 @@ do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)

switch (cmd) {
case IP6T_SO_SET_REPLACE:
- ret = do_replace(user, len);
+ ret = do_replace(sk->sk_net, user, len);
break;

case IP6T_SO_SET_ADD_COUNTERS:
- ret = do_add_counters(user, len, 0);
+ ret = do_add_counters(sk->sk_net, user, len, 0);
break;

default:
@@ -2033,11 +2035,11 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)

switch (cmd) {
case IP6T_SO_GET_INFO:
- ret = get_info(user, len, 0);
+ ret = get_info(sk->sk_net, user, len, 0);
break;

case IP6T_SO_GET_ENTRIES:
- ret = get_entries(user, len);
+ ret = get_entries(sk->sk_net, user, len);
break;

case IP6T_SO_GET_REVISION_MATCH:
@@ -2074,7 +2076,8 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
return ret;
}

-struct xt_table *ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
+struct xt_table *ip6t_register_table(struct net *net, struct xt_table *table,
+ const struct ip6t_replace *repl)
{
int ret;
struct xt_table_info *newinfo;
@@ -2101,7 +2104,7 @@ struct xt_table *ip6t_register_table(struct xt_table *table, const struct ip6t_r
if (ret != 0)
goto out_free;

- new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
+ new_table = xt_register_table(net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
ret = PTR_ERR(new_table);
goto out_free;
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index bffd67f..d0bf71d 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -132,7 +132,7 @@ static int __init ip6table_filter_init(void)
initial_table.entries[1].target.verdict = -forward - 1;

/* Register table */
- packet_filter = ip6t_register_table(&__packet_filter, &initial_table.repl);
+ packet_filter = ip6t_register_table(&init_net, &__packet_filter, &initial_table.repl);
if (IS_ERR(packet_filter))
return PTR_ERR(packet_filter);

diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 63d334d..abdfece 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -164,7 +164,7 @@ static int __init ip6table_mangle_init(void)
int ret;

/* Register table */
- packet_mangler = ip6t_register_table(&__packet_mangler, &initial_table.repl);
+ packet_mangler = ip6t_register_table(&init_net, &__packet_mangler, &initial_table.repl);
if (IS_ERR(packet_mangler))
return PTR_ERR(packet_mangler);

diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 7f55b23..12acd63 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -77,7 +77,7 @@ static int __init ip6table_raw_init(void)
int ret;

/* Register table */
- packet_raw = ip6t_register_table(&__packet_raw, &initial_table.repl);
+ packet_raw = ip6t_register_table(&init_net, &__packet_raw, &initial_table.repl);
if (IS_ERR(packet_raw))
return PTR_ERR(packet_raw);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:14 UTC
Permalink
[NETFILTER]: x_tables: return new table from {arp,ip,ip6}t_register_table()

Typical table module registers xt_table structure (i.e. packet_filter)
and link it to list during it. We can't use one template for it because
corresponding list_head will become corrupted. We also can't unregister
with template because it wasn't changed at all and thus doesn't know in
which list it is.

So, we duplicate template at the very first step of table registration.
Table modules will save it for use during unregistration time and actual
filtering.

Do it at once to not screw bisection.

P.S.: renaming i.e. packet_filter => __packet_filter is temporary until
full netnsization of table modules is done.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit f4b4da65588dd50d6be047d9159315ba2909a944
tree 5ececddb8fbebe223455663ea9a3dcdf80ed44e5
parent bba40bde2fa36b10ecdca675e0cea782e562735b
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:21:57 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:15 +0100

include/linux/netfilter_arp/arp_tables.h | 4 ++--
include/linux/netfilter_ipv4/ip_tables.h | 5 +++--
include/linux/netfilter_ipv6/ip6_tables.h | 4 ++--
net/ipv4/netfilter/arp_tables.c | 22 ++++++++++++----------
net/ipv4/netfilter/arptable_filter.c | 15 ++++++++-------
net/ipv4/netfilter/ip_tables.c | 28 +++++++++++++++++-----------
net/ipv4/netfilter/iptable_filter.c | 18 ++++++++++--------
net/ipv4/netfilter/iptable_mangle.c | 18 ++++++++++--------
net/ipv4/netfilter/iptable_raw.c | 18 ++++++++++--------
net/ipv4/netfilter/nf_nat_rule.c | 16 +++++++++-------
net/ipv6/netfilter/ip6_tables.c | 24 ++++++++++++++----------
net/ipv6/netfilter/ip6table_filter.c | 17 +++++++++--------
net/ipv6/netfilter/ip6table_mangle.c | 17 +++++++++--------
net/ipv6/netfilter/ip6table_raw.c | 15 ++++++++-------
net/netfilter/x_tables.c | 12 +++++++++++-
15 files changed, 134 insertions(+), 99 deletions(-)

diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 53dd4df..f35486b 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -271,8 +271,8 @@ struct arpt_error
xt_register_target(tgt); })
#define arpt_unregister_target(tgt) xt_unregister_target(tgt)

-extern int arpt_register_table(struct arpt_table *table,
- const struct arpt_replace *repl);
+extern struct arpt_table *arpt_register_table(struct arpt_table *table,
+ const struct arpt_replace *repl);
extern void arpt_unregister_table(struct arpt_table *table);
extern unsigned int arpt_do_table(struct sk_buff *skb,
unsigned int hook,
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index 45fcad9..bfc889f 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -244,8 +244,9 @@ ipt_get_target(struct ipt_entry *e)
#include <linux/init.h>
extern void ipt_init(void) __init;

-extern int ipt_register_table(struct xt_table *table,
- const struct ipt_replace *repl);
+extern struct xt_table *ipt_register_table(struct net *net,
+ struct xt_table *table,
+ const struct ipt_replace *repl);
extern void ipt_unregister_table(struct xt_table *table);

/* Standard entry. */
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index 110801d..f716c75 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -305,8 +305,8 @@ ip6t_get_target(struct ip6t_entry *e)
#include <linux/init.h>
extern void ip6t_init(void) __init;

-extern int ip6t_register_table(struct xt_table *table,
- const struct ip6t_replace *repl);
+extern struct xt_table *ip6t_register_table(struct xt_table *table,
+ const struct ip6t_replace *repl);
extern void ip6t_unregister_table(struct xt_table *table);
extern unsigned int ip6t_do_table(struct sk_buff *skb,
unsigned int hook,
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 0da50a4..3a5afb8 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1719,8 +1719,8 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
return ret;
}

-int arpt_register_table(struct arpt_table *table,
- const struct arpt_replace *repl)
+struct arpt_table *arpt_register_table(struct arpt_table *table,
+ const struct arpt_replace *repl)
{
int ret;
struct xt_table_info *newinfo;
@@ -1732,7 +1732,7 @@ int arpt_register_table(struct arpt_table *table,
newinfo = xt_alloc_table_info(repl->size);
if (!newinfo) {
ret = -ENOMEM;
- return ret;
+ goto out;
}

/* choose the copy on our node/cpu */
@@ -1746,18 +1746,20 @@ int arpt_register_table(struct arpt_table *table,
repl->underflow);

duprintf("arpt_register_table: translate table gives %d\n", ret);
- if (ret != 0) {
- xt_free_table_info(newinfo);
- return ret;
- }
+ if (ret != 0)
+ goto out_free;

new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
- xt_free_table_info(newinfo);
- return PTR_ERR(new_table);
+ ret = PTR_ERR(new_table);
+ goto out_free;
}
+ return new_table;

- return 0;
+out_free:
+ xt_free_table_info(newinfo);
+out:
+ return ERR_PTR(ret);
}

void arpt_unregister_table(struct arpt_table *table)
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 7201511..b003215 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -45,7 +45,7 @@ static struct
.term = ARPT_ERROR_INIT,
};

-static struct arpt_table packet_filter = {
+static struct arpt_table __packet_filter = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
@@ -53,6 +53,7 @@ static struct arpt_table packet_filter = {
.me = THIS_MODULE,
.af = NF_ARP,
};
+static struct arpt_table *packet_filter;

/* The work comes in here from netfilter.c */
static unsigned int arpt_hook(unsigned int hook,
@@ -61,7 +62,7 @@ static unsigned int arpt_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return arpt_do_table(skb, hook, in, out, &packet_filter);
+ return arpt_do_table(skb, hook, in, out, packet_filter);
}

static struct nf_hook_ops arpt_ops[] __read_mostly = {
@@ -90,9 +91,9 @@ static int __init arptable_filter_init(void)
int ret;

/* Register table */
- ret = arpt_register_table(&packet_filter, &initial_table.repl);
- if (ret < 0)
- return ret;
+ packet_filter = arpt_register_table(&__packet_filter, &initial_table.repl);
+ if (IS_ERR(packet_filter))
+ return PTR_ERR(packet_filter);

ret = nf_register_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
if (ret < 0)
@@ -100,14 +101,14 @@ static int __init arptable_filter_init(void)
return ret;

cleanup_table:
- arpt_unregister_table(&packet_filter);
+ arpt_unregister_table(packet_filter);
return ret;
}

static void __exit arptable_filter_fini(void)
{
nf_unregister_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
- arpt_unregister_table(&packet_filter);
+ arpt_unregister_table(packet_filter);
}

module_init(arptable_filter_init);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index bc22ea4..99dd62d 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2048,7 +2048,8 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
return ret;
}

-int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
+struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
+ const struct ipt_replace *repl)
{
int ret;
struct xt_table_info *newinfo;
@@ -2058,8 +2059,10 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
struct xt_table *new_table;

newinfo = xt_alloc_table_info(repl->size);
- if (!newinfo)
- return -ENOMEM;
+ if (!newinfo) {
+ ret = -ENOMEM;
+ goto out;
+ }

/* choose the copy on our node/cpu, but dont care about preemption */
loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
@@ -2070,18 +2073,21 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
repl->num_entries,
repl->hook_entry,
repl->underflow);
- if (ret != 0) {
- xt_free_table_info(newinfo);
- return ret;
- }
+ if (ret != 0)
+ goto out_free;

- new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
+ new_table = xt_register_table(net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
- xt_free_table_info(newinfo);
- return PTR_ERR(new_table);
+ ret = PTR_ERR(new_table);
+ goto out_free;
}

- return 0;
+ return new_table;
+
+out_free:
+ xt_free_table_info(newinfo);
+out:
+ return ERR_PTR(ret);
}

void ipt_unregister_table(struct xt_table *table)
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 29bb4f9..3b43ca0 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -53,13 +53,14 @@ static struct
.term = IPT_ERROR_INIT, /* ERROR */
};

-static struct xt_table packet_filter = {
+static struct xt_table __packet_filter = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET,
};
+static struct xt_table *packet_filter;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -69,7 +70,7 @@ ipt_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ipt_do_table(skb, hook, in, out, &packet_filter);
+ return ipt_do_table(skb, hook, in, out, packet_filter);
}

static unsigned int
@@ -88,7 +89,7 @@ ipt_local_out_hook(unsigned int hook,
return NF_ACCEPT;
}

- return ipt_do_table(skb, hook, in, out, &packet_filter);
+ return ipt_do_table(skb, hook, in, out, packet_filter);
}

static struct nf_hook_ops ipt_ops[] __read_mostly = {
@@ -132,9 +133,10 @@ static int __init iptable_filter_init(void)
initial_table.entries[1].target.verdict = -forward - 1;

/* Register table */
- ret = ipt_register_table(&packet_filter, &initial_table.repl);
- if (ret < 0)
- return ret;
+ packet_filter = ipt_register_table(&init_net, &__packet_filter,
+ &initial_table.repl);
+ if (IS_ERR(packet_filter))
+ return PTR_ERR(packet_filter);

/* Register hooks */
ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
@@ -144,14 +146,14 @@ static int __init iptable_filter_init(void)
return ret;

cleanup_table:
- ipt_unregister_table(&packet_filter);
+ ipt_unregister_table(packet_filter);
return ret;
}

static void __exit iptable_filter_fini(void)
{
nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
- ipt_unregister_table(&packet_filter);
+ ipt_unregister_table(packet_filter);
}

module_init(iptable_filter_init);
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 5c4be20..292f2ed 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -64,13 +64,14 @@ static struct
.term = IPT_ERROR_INIT, /* ERROR */
};

-static struct xt_table packet_mangler = {
+static struct xt_table __packet_mangler = {
.name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET,
};
+static struct xt_table *packet_mangler;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -80,7 +81,7 @@ ipt_route_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ipt_do_table(skb, hook, in, out, &packet_mangler);
+ return ipt_do_table(skb, hook, in, out, packet_mangler);
}

static unsigned int
@@ -112,7 +113,7 @@ ipt_local_hook(unsigned int hook,
daddr = iph->daddr;
tos = iph->tos;

- ret = ipt_do_table(skb, hook, in, out, &packet_mangler);
+ ret = ipt_do_table(skb, hook, in, out, packet_mangler);
/* Reroute for ANY change. */
if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
iph = ip_hdr(skb);
@@ -171,9 +172,10 @@ static int __init iptable_mangle_init(void)
int ret;

/* Register table */
- ret = ipt_register_table(&packet_mangler, &initial_table.repl);
- if (ret < 0)
- return ret;
+ packet_mangler = ipt_register_table(&init_net, &__packet_mangler,
+ &initial_table.repl);
+ if (IS_ERR(packet_mangler))
+ return PTR_ERR(packet_mangler);

/* Register hooks */
ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
@@ -183,14 +185,14 @@ static int __init iptable_mangle_init(void)
return ret;

cleanup_table:
- ipt_unregister_table(&packet_mangler);
+ ipt_unregister_table(packet_mangler);
return ret;
}

static void __exit iptable_mangle_fini(void)
{
nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
- ipt_unregister_table(&packet_mangler);
+ ipt_unregister_table(packet_mangler);
}

module_init(iptable_mangle_init);
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index dc34aa2..dab863d 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -36,13 +36,14 @@ static struct
.term = IPT_ERROR_INIT, /* ERROR */
};

-static struct xt_table packet_raw = {
+static struct xt_table __packet_raw = {
.name = "raw",
.valid_hooks = RAW_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET,
};
+static struct xt_table *packet_raw;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -52,7 +53,7 @@ ipt_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ipt_do_table(skb, hook, in, out, &packet_raw);
+ return ipt_do_table(skb, hook, in, out, packet_raw);
}

static unsigned int
@@ -70,7 +71,7 @@ ipt_local_hook(unsigned int hook,
"packet.\n");
return NF_ACCEPT;
}
- return ipt_do_table(skb, hook, in, out, &packet_raw);
+ return ipt_do_table(skb, hook, in, out, packet_raw);
}

/* 'raw' is the very first table. */
@@ -96,9 +97,10 @@ static int __init iptable_raw_init(void)
int ret;

/* Register table */
- ret = ipt_register_table(&packet_raw, &initial_table.repl);
- if (ret < 0)
- return ret;
+ packet_raw = ipt_register_table(&init_net, &__packet_raw,
+ &initial_table.repl);
+ if (IS_ERR(packet_raw))
+ return PTR_ERR(packet_raw);

/* Register hooks */
ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
@@ -108,14 +110,14 @@ static int __init iptable_raw_init(void)
return ret;

cleanup_table:
- ipt_unregister_table(&packet_raw);
+ ipt_unregister_table(packet_raw);
return ret;
}

static void __exit iptable_raw_fini(void)
{
nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
- ipt_unregister_table(&packet_raw);
+ ipt_unregister_table(packet_raw);
}

module_init(iptable_raw_init);
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 5191822..f8fda57 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -58,13 +58,14 @@ static struct
.term = IPT_ERROR_INIT, /* ERROR */
};

-static struct xt_table nat_table = {
+static struct xt_table __nat_table = {
.name = "nat",
.valid_hooks = NAT_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET,
};
+static struct xt_table *nat_table;

/* Source NAT */
static unsigned int ipt_snat_target(struct sk_buff *skb,
@@ -214,7 +215,7 @@ int nf_nat_rule_find(struct sk_buff *skb,
{
int ret;

- ret = ipt_do_table(skb, hooknum, in, out, &nat_table);
+ ret = ipt_do_table(skb, hooknum, in, out, nat_table);

if (ret == NF_ACCEPT) {
if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
@@ -248,9 +249,10 @@ int __init nf_nat_rule_init(void)
{
int ret;

- ret = ipt_register_table(&nat_table, &nat_initial_table.repl);
- if (ret != 0)
- return ret;
+ nat_table = ipt_register_table(&init_net, &__nat_table,
+ &nat_initial_table.repl);
+ if (IS_ERR(nat_table))
+ return PTR_ERR(nat_table);
ret = xt_register_target(&ipt_snat_reg);
if (ret != 0)
goto unregister_table;
@@ -264,7 +266,7 @@ int __init nf_nat_rule_init(void)
unregister_snat:
xt_unregister_target(&ipt_snat_reg);
unregister_table:
- ipt_unregister_table(&nat_table);
+ ipt_unregister_table(nat_table);

return ret;
}
@@ -273,5 +275,5 @@ void nf_nat_rule_cleanup(void)
{
xt_unregister_target(&ipt_dnat_reg);
xt_unregister_target(&ipt_snat_reg);
- ipt_unregister_table(&nat_table);
+ ipt_unregister_table(nat_table);
}
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 1aac3ef..b89f133 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -2074,7 +2074,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
return ret;
}

-int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
+struct xt_table *ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
{
int ret;
struct xt_table_info *newinfo;
@@ -2084,8 +2084,10 @@ int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
struct xt_table *new_table;

newinfo = xt_alloc_table_info(repl->size);
- if (!newinfo)
- return -ENOMEM;
+ if (!newinfo) {
+ ret = -ENOMEM;
+ goto out;
+ }

/* choose the copy on our node/cpu, but dont care about preemption */
loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
@@ -2096,18 +2098,20 @@ int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
repl->num_entries,
repl->hook_entry,
repl->underflow);
- if (ret != 0) {
- xt_free_table_info(newinfo);
- return ret;
- }
+ if (ret != 0)
+ goto out_free;

new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
- xt_free_table_info(newinfo);
- return PTR_ERR(new_table);
+ ret = PTR_ERR(new_table);
+ goto out_free;
}
+ return new_table;

- return 0;
+out_free:
+ xt_free_table_info(newinfo);
+out:
+ return ERR_PTR(ret);
}

void ip6t_unregister_table(struct xt_table *table)
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 87d38d0..bffd67f 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -51,13 +51,14 @@ static struct
.term = IP6T_ERROR_INIT, /* ERROR */
};

-static struct xt_table packet_filter = {
+static struct xt_table __packet_filter = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET6,
};
+static struct xt_table *packet_filter;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -67,7 +68,7 @@ ip6t_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ip6t_do_table(skb, hook, in, out, &packet_filter);
+ return ip6t_do_table(skb, hook, in, out, packet_filter);
}

static unsigned int
@@ -87,7 +88,7 @@ ip6t_local_out_hook(unsigned int hook,
}
#endif

- return ip6t_do_table(skb, hook, in, out, &packet_filter);
+ return ip6t_do_table(skb, hook, in, out, packet_filter);
}

static struct nf_hook_ops ip6t_ops[] __read_mostly = {
@@ -131,9 +132,9 @@ static int __init ip6table_filter_init(void)
initial_table.entries[1].target.verdict = -forward - 1;

/* Register table */
- ret = ip6t_register_table(&packet_filter, &initial_table.repl);
- if (ret < 0)
- return ret;
+ packet_filter = ip6t_register_table(&__packet_filter, &initial_table.repl);
+ if (IS_ERR(packet_filter))
+ return PTR_ERR(packet_filter);

/* Register hooks */
ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
@@ -143,14 +144,14 @@ static int __init ip6table_filter_init(void)
return ret;

cleanup_table:
- ip6t_unregister_table(&packet_filter);
+ ip6t_unregister_table(packet_filter);
return ret;
}

static void __exit ip6table_filter_fini(void)
{
nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
- ip6t_unregister_table(&packet_filter);
+ ip6t_unregister_table(packet_filter);
}

module_init(ip6table_filter_init);
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index d608260..63d334d 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -57,13 +57,14 @@ static struct
.term = IP6T_ERROR_INIT, /* ERROR */
};

-static struct xt_table packet_mangler = {
+static struct xt_table __packet_mangler = {
.name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET6,
};
+static struct xt_table *packet_mangler;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -73,7 +74,7 @@ ip6t_route_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ip6t_do_table(skb, hook, in, out, &packet_mangler);
+ return ip6t_do_table(skb, hook, in, out, packet_mangler);
}

static unsigned int
@@ -108,7 +109,7 @@ ip6t_local_hook(unsigned int hook,
/* flowlabel and prio (includes version, which shouldn't change either */
flowlabel = *((u_int32_t *)ipv6_hdr(skb));

- ret = ip6t_do_table(skb, hook, in, out, &packet_mangler);
+ ret = ip6t_do_table(skb, hook, in, out, packet_mangler);

if (ret != NF_DROP && ret != NF_STOLEN
&& (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
@@ -163,9 +164,9 @@ static int __init ip6table_mangle_init(void)
int ret;

/* Register table */
- ret = ip6t_register_table(&packet_mangler, &initial_table.repl);
- if (ret < 0)
- return ret;
+ packet_mangler = ip6t_register_table(&__packet_mangler, &initial_table.repl);
+ if (IS_ERR(packet_mangler))
+ return PTR_ERR(packet_mangler);

/* Register hooks */
ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
@@ -175,14 +176,14 @@ static int __init ip6table_mangle_init(void)
return ret;

cleanup_table:
- ip6t_unregister_table(&packet_mangler);
+ ip6t_unregister_table(packet_mangler);
return ret;
}

static void __exit ip6table_mangle_fini(void)
{
nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
- ip6t_unregister_table(&packet_mangler);
+ ip6t_unregister_table(packet_mangler);
}

module_init(ip6table_mangle_init);
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index eccbaaa..7f55b23 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -35,13 +35,14 @@ static struct
.term = IP6T_ERROR_INIT, /* ERROR */
};

-static struct xt_table packet_raw = {
+static struct xt_table __packet_raw = {
.name = "raw",
.valid_hooks = RAW_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET6,
};
+static struct xt_table *packet_raw;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -51,7 +52,7 @@ ip6t_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ip6t_do_table(skb, hook, in, out, &packet_raw);
+ return ip6t_do_table(skb, hook, in, out, packet_raw);
}

static struct nf_hook_ops ip6t_ops[] __read_mostly = {
@@ -76,9 +77,9 @@ static int __init ip6table_raw_init(void)
int ret;

/* Register table */
- ret = ip6t_register_table(&packet_raw, &initial_table.repl);
- if (ret < 0)
- return ret;
+ packet_raw = ip6t_register_table(&__packet_raw, &initial_table.repl);
+ if (IS_ERR(packet_raw))
+ return PTR_ERR(packet_raw);

/* Register hooks */
ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
@@ -88,14 +89,14 @@ static int __init ip6table_raw_init(void)
return ret;

cleanup_table:
- ip6t_unregister_table(&packet_raw);
+ ip6t_unregister_table(packet_raw);
return ret;
}

static void __exit ip6table_raw_fini(void)
{
nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
- ip6t_unregister_table(&packet_raw);
+ ip6t_unregister_table(packet_raw);
}

module_init(ip6table_raw_init);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d62f722..d7fbb1b 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -667,9 +667,16 @@ struct xt_table *xt_register_table(struct net *net, struct xt_table *table,
struct xt_table_info *private;
struct xt_table *t;

+ /* Don't add one object to multiple lists. */
+ table = kmemdup(table, sizeof(struct xt_table), GFP_KERNEL);
+ if (!table) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
ret = mutex_lock_interruptible(&xt[table->af].mutex);
if (ret != 0)
- goto out;
+ goto out_free;

/* Don't autoload: we'd eat our tail... */
list_for_each_entry(t, &net->xt.tables[table->af], list) {
@@ -697,6 +704,8 @@ struct xt_table *xt_register_table(struct net *net, struct xt_table *table,

unlock:
mutex_unlock(&xt[table->af].mutex);
+out_free:
+ kfree(table);
out:
return ERR_PTR(ret);
}
@@ -710,6 +719,7 @@ void *xt_unregister_table(struct xt_table *table)
private = table->private;
list_del(&table->list);
mutex_unlock(&xt[table->af].mutex);
+ kfree(table);

return private;
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:12 UTC
Permalink
[NETFILTER]: x_tables: per-netns xt_tables

In fact all we want is per-netns set of rules, however doing that will
unnecessary complicate routines such as ipt_hook()/ipt_do_table, so
make full xt_table array per-netns.

Every user stubbed with init_net for a while.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit bba40bde2fa36b10ecdca675e0cea782e562735b
tree a8c25f8bab188f8c0a02cb3bd52fc02a19247f8f
parent cb3634bafebc5decaaaa94c6b31885cfcc573712
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:21:57 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:14 +0100

include/linux/netfilter/x_tables.h | 6 ++++--
include/net/net_namespace.h | 4 ++++
include/net/netns/x_tables.h | 10 ++++++++++
net/ipv4/netfilter/arp_tables.c | 12 ++++++------
net/ipv4/netfilter/ip_tables.c | 12 ++++++------
net/ipv6/netfilter/ip6_tables.c | 12 ++++++------
net/netfilter/x_tables.c | 34 ++++++++++++++++++++++++----------
7 files changed, 60 insertions(+), 30 deletions(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 937cebb..91a1dd5 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -335,7 +335,8 @@ extern int xt_check_target(const struct xt_target *target, unsigned short family
unsigned int size, const char *table, unsigned int hook,
unsigned short proto, int inv_proto);

-extern struct xt_table *xt_register_table(struct xt_table *table,
+extern struct xt_table *xt_register_table(struct net *net,
+ struct xt_table *table,
struct xt_table_info *bootstrap,
struct xt_table_info *newinfo);
extern void *xt_unregister_table(struct xt_table *table);
@@ -352,7 +353,8 @@ extern struct xt_target *xt_request_find_target(int af, const char *name,
extern int xt_find_revision(int af, const char *name, u8 revision, int target,
int *err);

-extern struct xt_table *xt_find_table_lock(int af, const char *name);
+extern struct xt_table *xt_find_table_lock(struct net *net, int af,
+ const char *name);
extern void xt_table_unlock(struct xt_table *t);

extern int xt_proto_init(int af);
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index b8c1d60..28738b7 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -12,6 +12,7 @@
#include <net/netns/packet.h>
#include <net/netns/ipv4.h>
#include <net/netns/ipv6.h>
+#include <net/netns/x_tables.h>

struct proc_dir_entry;
struct net_device;
@@ -56,6 +57,9 @@ struct net {
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
struct netns_ipv6 ipv6;
#endif
+#ifdef CONFIG_NETFILTER
+ struct netns_xt xt;
+#endif
};

#ifdef CONFIG_NET
diff --git a/include/net/netns/x_tables.h b/include/net/netns/x_tables.h
new file mode 100644
index 0000000..0cb63ed
--- /dev/null
+++ b/include/net/netns/x_tables.h
@@ -0,0 +1,10 @@
+#ifndef __NETNS_X_TABLES_H
+#define __NETNS_X_TABLES_H
+
+#include <linux/list.h>
+#include <linux/net.h>
+
+struct netns_xt {
+ struct list_head tables[NPROTO];
+};
+#endif
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 060de95..0da50a4 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -870,7 +870,7 @@ static int get_info(void __user *user, int *len, int compat)
if (compat)
xt_compat_lock(NF_ARP);
#endif
- t = try_then_request_module(xt_find_table_lock(NF_ARP, name),
+ t = try_then_request_module(xt_find_table_lock(&init_net, NF_ARP, name),
"arptable_%s", name);
if (t && !IS_ERR(t)) {
struct arpt_getinfo info;
@@ -926,7 +926,7 @@ static int get_entries(struct arpt_get_entries __user *uptr, int *len)
return -EINVAL;
}

- t = xt_find_table_lock(NF_ARP, get.name);
+ t = xt_find_table_lock(&init_net, NF_ARP, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
duprintf("t->private->number = %u\n",
@@ -966,7 +966,7 @@ static int __do_replace(const char *name, unsigned int valid_hooks,
goto out;
}

- t = try_then_request_module(xt_find_table_lock(NF_ARP, name),
+ t = try_then_request_module(xt_find_table_lock(&init_net, NF_ARP, name),
"arptable_%s", name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1132,7 +1132,7 @@ static int do_add_counters(void __user *user, unsigned int len, int compat)
goto free;
}

- t = xt_find_table_lock(NF_ARP, name);
+ t = xt_find_table_lock(&init_net, NF_ARP, name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
goto free;
@@ -1604,7 +1604,7 @@ static int compat_get_entries(struct compat_arpt_get_entries __user *uptr,
}

xt_compat_lock(NF_ARP);
- t = xt_find_table_lock(NF_ARP, get.name);
+ t = xt_find_table_lock(&init_net, NF_ARP, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
struct xt_table_info info;
@@ -1751,7 +1751,7 @@ int arpt_register_table(struct arpt_table *table,
return ret;
}

- new_table = xt_register_table(table, &bootstrap, newinfo);
+ new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
xt_free_table_info(newinfo);
return PTR_ERR(new_table);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 1b7c09e..bc22ea4 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1112,7 +1112,7 @@ static int get_info(void __user *user, int *len, int compat)
if (compat)
xt_compat_lock(AF_INET);
#endif
- t = try_then_request_module(xt_find_table_lock(AF_INET, name),
+ t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET, name),
"iptable_%s", name);
if (t && !IS_ERR(t)) {
struct ipt_getinfo info;
@@ -1170,7 +1170,7 @@ get_entries(struct ipt_get_entries __user *uptr, int *len)
return -EINVAL;
}

- t = xt_find_table_lock(AF_INET, get.name);
+ t = xt_find_table_lock(&init_net, AF_INET, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
duprintf("t->private->number = %u\n", private->number);
@@ -1208,7 +1208,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
goto out;
}

- t = try_then_request_module(xt_find_table_lock(AF_INET, name),
+ t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET, name),
"iptable_%s", name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1383,7 +1383,7 @@ do_add_counters(void __user *user, unsigned int len, int compat)
goto free;
}

- t = xt_find_table_lock(AF_INET, name);
+ t = xt_find_table_lock(&init_net, AF_INET, name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
goto free;
@@ -1924,7 +1924,7 @@ compat_get_entries(struct compat_ipt_get_entries __user *uptr, int *len)
}

xt_compat_lock(AF_INET);
- t = xt_find_table_lock(AF_INET, get.name);
+ t = xt_find_table_lock(&init_net, AF_INET, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
struct xt_table_info info;
@@ -2075,7 +2075,7 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
return ret;
}

- new_table = xt_register_table(table, &bootstrap, newinfo);
+ new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
xt_free_table_info(newinfo);
return PTR_ERR(new_table);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index f7a6239..1aac3ef 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1138,7 +1138,7 @@ static int get_info(void __user *user, int *len, int compat)
if (compat)
xt_compat_lock(AF_INET6);
#endif
- t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
+ t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET6, name),
"ip6table_%s", name);
if (t && !IS_ERR(t)) {
struct ip6t_getinfo info;
@@ -1196,7 +1196,7 @@ get_entries(struct ip6t_get_entries __user *uptr, int *len)
return -EINVAL;
}

- t = xt_find_table_lock(AF_INET6, get.name);
+ t = xt_find_table_lock(&init_net, AF_INET6, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
duprintf("t->private->number = %u\n", private->number);
@@ -1235,7 +1235,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
goto out;
}

- t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
+ t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET6, name),
"ip6table_%s", name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1410,7 +1410,7 @@ do_add_counters(void __user *user, unsigned int len, int compat)
goto free;
}

- t = xt_find_table_lock(AF_INET6, name);
+ t = xt_find_table_lock(&init_net, AF_INET6, name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
goto free;
@@ -1950,7 +1950,7 @@ compat_get_entries(struct compat_ip6t_get_entries __user *uptr, int *len)
}

xt_compat_lock(AF_INET6);
- t = xt_find_table_lock(AF_INET6, get.name);
+ t = xt_find_table_lock(&init_net, AF_INET6, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
struct xt_table_info info;
@@ -2101,7 +2101,7 @@ int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
return ret;
}

- new_table = xt_register_table(table, &bootstrap, newinfo);
+ new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
xt_free_table_info(newinfo);
return PTR_ERR(new_table);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d8d8637..d62f722 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -44,7 +44,6 @@ struct xt_af {
struct mutex mutex;
struct list_head match;
struct list_head target;
- struct list_head tables;
#ifdef CONFIG_COMPAT
struct mutex compat_mutex;
struct compat_delta *compat_offsets;
@@ -597,14 +596,14 @@ void xt_free_table_info(struct xt_table_info *info)
EXPORT_SYMBOL(xt_free_table_info);

/* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
-struct xt_table *xt_find_table_lock(int af, const char *name)
+struct xt_table *xt_find_table_lock(struct net *net, int af, const char *name)
{
struct xt_table *t;

if (mutex_lock_interruptible(&xt[af].mutex) != 0)
return ERR_PTR(-EINTR);

- list_for_each_entry(t, &xt[af].tables, list)
+ list_for_each_entry(t, &net->xt.tables[af], list)
if (strcmp(t->name, name) == 0 && try_module_get(t->me))
return t;
mutex_unlock(&xt[af].mutex);
@@ -660,7 +659,7 @@ xt_replace_table(struct xt_table *table,
}
EXPORT_SYMBOL_GPL(xt_replace_table);

-struct xt_table *xt_register_table(struct xt_table *table,
+struct xt_table *xt_register_table(struct net *net, struct xt_table *table,
struct xt_table_info *bootstrap,
struct xt_table_info *newinfo)
{
@@ -673,7 +672,7 @@ struct xt_table *xt_register_table(struct xt_table *table,
goto out;

/* Don't autoload: we'd eat our tail... */
- list_for_each_entry(t, &xt[table->af].tables, list) {
+ list_for_each_entry(t, &net->xt.tables[table->af], list) {
if (strcmp(t->name, table->name) == 0) {
ret = -EEXIST;
goto unlock;
@@ -692,7 +691,7 @@ struct xt_table *xt_register_table(struct xt_table *table,
/* save number of initial entries */
private->initial_entries = private->number;

- list_add(&table->list, &xt[table->af].tables);
+ list_add(&table->list, &net->xt.tables[table->af]);
mutex_unlock(&xt[table->af].mutex);
return table;

@@ -744,7 +743,7 @@ static struct list_head *type2list(u_int16_t af, u_int16_t type)
list = &xt[af].match;
break;
case TABLE:
- list = &xt[af].tables;
+ list = &init_net.xt.tables[af];
break;
default:
list = NULL;
@@ -919,10 +918,22 @@ void xt_proto_fini(int af)
}
EXPORT_SYMBOL_GPL(xt_proto_fini);

+static int __net_init xt_net_init(struct net *net)
+{
+ int i;
+
+ for (i = 0; i < NPROTO; i++)
+ INIT_LIST_HEAD(&net->xt.tables[i]);
+ return 0;
+}
+
+static struct pernet_operations xt_net_ops = {
+ .init = xt_net_init,
+};

static int __init xt_init(void)
{
- int i;
+ int i, rv;

xt = kmalloc(sizeof(struct xt_af) * NPROTO, GFP_KERNEL);
if (!xt)
@@ -936,13 +947,16 @@ static int __init xt_init(void)
#endif
INIT_LIST_HEAD(&xt[i].target);
INIT_LIST_HEAD(&xt[i].match);
- INIT_LIST_HEAD(&xt[i].tables);
}
- return 0;
+ rv = register_pernet_subsys(&xt_net_ops);
+ if (rv < 0)
+ kfree(xt);
+ return rv;
}

static void __exit xt_fini(void)
{
+ unregister_pernet_subsys(&xt_net_ops);
kfree(xt);
}

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:39 UTC
Permalink
[NETFILTER]: nf_conntrack_h3223: sparse fixes

Sparse complains when a function is not really static. Putting static
on the function prototype is not enough.

Signed-off-by: Stephen Hemminger <***@vyatta.com>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit a0b8676ce8423a544c283c59ac3d0c97e2e64b21
tree db319ec2ba9e665323bb671638ebfcbc36dcc8d8
parent cba4c67b58eee186ca8ff3e4588a01406d96a886
author Stephen Hemminger <***@vyatta.com> Tue, 29 Jan 2008 16:22:07 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:19 +0100

net/netfilter/nf_conntrack_h323_asn1.c | 36 ++++++++++++++++----------------
1 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index ff66fba..f73e130 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -126,7 +126,7 @@ static int decode_choice(bitstr_t * bs, field_t * f, char *base, int level);

/* Decoder Functions Vector */
typedef int (*decoder_t) (bitstr_t *, field_t *, char *, int);
-static decoder_t Decoders[] = {
+static const decoder_t Decoders[] = {
decode_nul,
decode_bool,
decode_oid,
@@ -150,7 +150,7 @@ static decoder_t Decoders[] = {
* Functions
****************************************************************************/
/* Assume bs is aligned && v < 16384 */
-unsigned get_len(bitstr_t * bs)
+static unsigned get_len(bitstr_t * bs)
{
unsigned v;

@@ -166,7 +166,7 @@ unsigned get_len(bitstr_t * bs)
}

/****************************************************************************/
-unsigned get_bit(bitstr_t * bs)
+static unsigned get_bit(bitstr_t * bs)
{
unsigned b = (*bs->cur) & (0x80 >> bs->bit);

@@ -177,7 +177,7 @@ unsigned get_bit(bitstr_t * bs)

/****************************************************************************/
/* Assume b <= 8 */
-unsigned get_bits(bitstr_t * bs, unsigned b)
+static unsigned get_bits(bitstr_t * bs, unsigned b)
{
unsigned v, l;

@@ -203,7 +203,7 @@ unsigned get_bits(bitstr_t * bs, unsigned b)

/****************************************************************************/
/* Assume b <= 32 */
-unsigned get_bitmap(bitstr_t * bs, unsigned b)
+static unsigned get_bitmap(bitstr_t * bs, unsigned b)
{
unsigned v, l, shift, bytes;

@@ -242,7 +242,7 @@ unsigned get_bitmap(bitstr_t * bs, unsigned b)
/****************************************************************************
* Assume bs is aligned and sizeof(unsigned int) == 4
****************************************************************************/
-unsigned get_uint(bitstr_t * bs, int b)
+static unsigned get_uint(bitstr_t * bs, int b)
{
unsigned v = 0;

@@ -264,7 +264,7 @@ unsigned get_uint(bitstr_t * bs, int b)
}

/****************************************************************************/
-int decode_nul(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_nul(bitstr_t * bs, field_t * f, char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -272,7 +272,7 @@ int decode_nul(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_bool(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bool(bitstr_t * bs, field_t * f, char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -283,7 +283,7 @@ int decode_bool(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_oid(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_oid(bitstr_t * bs, field_t * f, char *base, int level)
{
int len;

@@ -299,7 +299,7 @@ int decode_oid(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned len;

@@ -342,7 +342,7 @@ int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_enum(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_enum(bitstr_t * bs, field_t * f, char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -357,7 +357,7 @@ int decode_enum(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned len;

@@ -390,7 +390,7 @@ int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned len;

@@ -407,7 +407,7 @@ int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned len;

@@ -455,7 +455,7 @@ int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned len;

@@ -480,7 +480,7 @@ int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned ext, bmp, i, opt, len = 0, bmp2, bmp2_len;
int err;
@@ -596,7 +596,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned count, effective_count = 0, i, len = 0;
int err;
@@ -685,7 +685,7 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)


/****************************************************************************/
-int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
{
unsigned type, ext, len = 0;
int err;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:11 UTC
Permalink
[NETFILTER]: x_tables: change xt_table_register() return value convention

Switch from 0/-E to ptr/PTR_ERR convention.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit cb3634bafebc5decaaaa94c6b31885cfcc573712
tree 9ef47e68b1d6306b8893cc48539af00f097202e4
parent 343530ff0e7ba8c4efd3ebac683f9a9b7295b73d
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:21:56 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:14 +0100

include/linux/netfilter/x_tables.h | 6 +++---
net/ipv4/netfilter/arp_tables.c | 7 ++++---
net/ipv4/netfilter/ip_tables.c | 7 ++++---
net/ipv6/netfilter/ip6_tables.c | 7 ++++---
net/netfilter/x_tables.c | 14 ++++++++------
5 files changed, 23 insertions(+), 18 deletions(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 90dc6ea..937cebb 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -335,9 +335,9 @@ extern int xt_check_target(const struct xt_target *target, unsigned short family
unsigned int size, const char *table, unsigned int hook,
unsigned short proto, int inv_proto);

-extern int xt_register_table(struct xt_table *table,
- struct xt_table_info *bootstrap,
- struct xt_table_info *newinfo);
+extern struct xt_table *xt_register_table(struct xt_table *table,
+ struct xt_table_info *bootstrap,
+ struct xt_table_info *newinfo);
extern void *xt_unregister_table(struct xt_table *table);

extern struct xt_table_info *xt_replace_table(struct xt_table *table,
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index b4a810c..060de95 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1727,6 +1727,7 @@ int arpt_register_table(struct arpt_table *table,
struct xt_table_info bootstrap
= { 0, 0, 0, { 0 }, { 0 }, { } };
void *loc_cpu_entry;
+ struct xt_table *new_table;

newinfo = xt_alloc_table_info(repl->size);
if (!newinfo) {
@@ -1750,10 +1751,10 @@ int arpt_register_table(struct arpt_table *table,
return ret;
}

- ret = xt_register_table(table, &bootstrap, newinfo);
- if (ret != 0) {
+ new_table = xt_register_table(table, &bootstrap, newinfo);
+ if (IS_ERR(new_table)) {
xt_free_table_info(newinfo);
- return ret;
+ return PTR_ERR(new_table);
}

return 0;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 628a6b5..1b7c09e 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2055,6 +2055,7 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
struct xt_table_info bootstrap
= { 0, 0, 0, { 0 }, { 0 }, { } };
void *loc_cpu_entry;
+ struct xt_table *new_table;

newinfo = xt_alloc_table_info(repl->size);
if (!newinfo)
@@ -2074,10 +2075,10 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
return ret;
}

- ret = xt_register_table(table, &bootstrap, newinfo);
- if (ret != 0) {
+ new_table = xt_register_table(table, &bootstrap, newinfo);
+ if (IS_ERR(new_table)) {
xt_free_table_info(newinfo);
- return ret;
+ return PTR_ERR(new_table);
}

return 0;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 92b4898..f7a6239 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -2081,6 +2081,7 @@ int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
struct xt_table_info bootstrap
= { 0, 0, 0, { 0 }, { 0 }, { } };
void *loc_cpu_entry;
+ struct xt_table *new_table;

newinfo = xt_alloc_table_info(repl->size);
if (!newinfo)
@@ -2100,10 +2101,10 @@ int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
return ret;
}

- ret = xt_register_table(table, &bootstrap, newinfo);
- if (ret != 0) {
+ new_table = xt_register_table(table, &bootstrap, newinfo);
+ if (IS_ERR(new_table)) {
xt_free_table_info(newinfo);
- return ret;
+ return PTR_ERR(new_table);
}

return 0;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8d4fca9..d8d8637 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -660,9 +660,9 @@ xt_replace_table(struct xt_table *table,
}
EXPORT_SYMBOL_GPL(xt_replace_table);

-int xt_register_table(struct xt_table *table,
- struct xt_table_info *bootstrap,
- struct xt_table_info *newinfo)
+struct xt_table *xt_register_table(struct xt_table *table,
+ struct xt_table_info *bootstrap,
+ struct xt_table_info *newinfo)
{
int ret;
struct xt_table_info *private;
@@ -670,7 +670,7 @@ int xt_register_table(struct xt_table *table,

ret = mutex_lock_interruptible(&xt[table->af].mutex);
if (ret != 0)
- return ret;
+ goto out;

/* Don't autoload: we'd eat our tail... */
list_for_each_entry(t, &xt[table->af].tables, list) {
@@ -693,11 +693,13 @@ int xt_register_table(struct xt_table *table,
private->initial_entries = private->number;

list_add(&table->list, &xt[table->af].tables);
+ mutex_unlock(&xt[table->af].mutex);
+ return table;

- ret = 0;
unlock:
mutex_unlock(&xt[table->af].mutex);
- return ret;
+out:
+ return ERR_PTR(ret);
}
EXPORT_SYMBOL_GPL(xt_register_table);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:09 UTC
Permalink
[NETFILTER]: ebtables: mark matches, targets and watchers __read_mostly

Reference to previous related commit: 9f15c5302de4e8b0aac7ca24c36bf26a7fe1a513.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 343530ff0e7ba8c4efd3ebac683f9a9b7295b73d
tree 5eb23713f2427f996cc477c40506440eeeedb256
parent ddc4e00ab9447d62118a6a0506369726065d1df5
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:21:55 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:14 +0100

net/bridge/netfilter/ebt_802_3.c | 3 +--
net/bridge/netfilter/ebt_among.c | 2 +-
net/bridge/netfilter/ebt_arp.c | 3 +--
net/bridge/netfilter/ebt_arpreply.c | 3 +--
net/bridge/netfilter/ebt_dnat.c | 3 +--
net/bridge/netfilter/ebt_ip.c | 3 +--
net/bridge/netfilter/ebt_limit.c | 3 +--
net/bridge/netfilter/ebt_mark.c | 3 +--
net/bridge/netfilter/ebt_mark_m.c | 3 +--
net/bridge/netfilter/ebt_pkttype.c | 3 +--
net/bridge/netfilter/ebt_redirect.c | 3 +--
net/bridge/netfilter/ebt_snat.c | 3 +--
net/bridge/netfilter/ebt_stp.c | 3 +--
net/bridge/netfilter/ebt_ulog.c | 2 +-
net/bridge/netfilter/ebt_vlan.c | 2 +-
15 files changed, 15 insertions(+), 27 deletions(-)

diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index ef73592..9853402 100644
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -50,8 +50,7 @@ static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match filter_802_3 =
-{
+static struct ebt_match filter_802_3 __read_mostly = {
.name = EBT_802_3_MATCH,
.match = ebt_filter_802_3,
.check = ebt_802_3_check,
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index bf0d1d9..70b6dca 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -212,7 +212,7 @@ static int ebt_among_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match filter_among = {
+static struct ebt_match filter_among __read_mostly = {
.name = EBT_AMONG_MATCH,
.match = ebt_filter_among,
.check = ebt_among_check,
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index 8d6ab64..7c535be 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -116,8 +116,7 @@ static int ebt_arp_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match filter_arp =
-{
+static struct ebt_match filter_arp __read_mostly = {
.name = EBT_ARP_MATCH,
.match = ebt_filter_arp,
.check = ebt_arp_check,
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 9f25423..0c42795 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -76,8 +76,7 @@ static int ebt_target_reply_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_target reply_target =
-{
+static struct ebt_target reply_target __read_mostly = {
.name = EBT_ARPREPLY_TARGET,
.target = ebt_target_reply,
.check = ebt_target_reply_check,
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index 285378d..e700cbf 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -46,8 +46,7 @@ static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_target dnat =
-{
+static struct ebt_target dnat __read_mostly = {
.name = EBT_DNAT_TARGET,
.target = ebt_target_dnat,
.check = ebt_target_dnat_check,
diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index 78efe9b..65caa00 100644
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -107,8 +107,7 @@ static int ebt_ip_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match filter_ip =
-{
+static struct ebt_match filter_ip __read_mostly = {
.name = EBT_IP_MATCH,
.match = ebt_filter_ip,
.check = ebt_ip_check,
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index 3c44bd6..8cbdc01 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -90,8 +90,7 @@ static int ebt_limit_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match ebt_limit_reg =
-{
+static struct ebt_match ebt_limit_reg __read_mostly = {
.name = EBT_LIMIT_MATCH,
.match = ebt_limit_match,
.check = ebt_limit_check,
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 93ea763..36723f4 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -57,8 +57,7 @@ static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_target mark_target =
-{
+static struct ebt_target mark_target __read_mostly = {
.name = EBT_MARK_TARGET,
.target = ebt_target_mark,
.check = ebt_target_mark_check,
diff --git a/net/bridge/netfilter/ebt_mark_m.c b/net/bridge/netfilter/ebt_mark_m.c
index 914c244..9b0a454 100644
--- a/net/bridge/netfilter/ebt_mark_m.c
+++ b/net/bridge/netfilter/ebt_mark_m.c
@@ -39,8 +39,7 @@ static int ebt_mark_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match filter_mark =
-{
+static struct ebt_match filter_mark __read_mostly = {
.name = EBT_MARK_MATCH,
.match = ebt_filter_mark,
.check = ebt_mark_check,
diff --git a/net/bridge/netfilter/ebt_pkttype.c b/net/bridge/netfilter/ebt_pkttype.c
index 19a69ea..676db32 100644
--- a/net/bridge/netfilter/ebt_pkttype.c
+++ b/net/bridge/netfilter/ebt_pkttype.c
@@ -36,8 +36,7 @@ static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match filter_pkttype =
-{
+static struct ebt_match filter_pkttype __read_mostly = {
.name = EBT_PKTTYPE_MATCH,
.match = ebt_filter_pkttype,
.check = ebt_pkttype_check,
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index f206a27..bfdf2fb 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -51,8 +51,7 @@ static int ebt_target_redirect_check(const char *tablename, unsigned int hookmas
return 0;
}

-static struct ebt_target redirect_target =
-{
+static struct ebt_target redirect_target __read_mostly = {
.name = EBT_REDIRECT_TARGET,
.target = ebt_target_redirect,
.check = ebt_target_redirect_check,
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index ed85858..e252dab 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -68,8 +68,7 @@ static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_target snat =
-{
+static struct ebt_target snat __read_mostly = {
.name = EBT_SNAT_TARGET,
.target = ebt_target_snat,
.check = ebt_target_snat_check,
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index c264797..40f36d3 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -174,8 +174,7 @@ static int ebt_stp_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_match filter_stp =
-{
+static struct ebt_match filter_stp __read_mostly = {
.name = EBT_STP_MATCH,
.match = ebt_filter_stp,
.check = ebt_stp_check,
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 748eecd..2d4c9ef 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -272,7 +272,7 @@ static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
return 0;
}

-static struct ebt_watcher ulog = {
+static struct ebt_watcher ulog __read_mostly = {
.name = EBT_ULOG_WATCHER,
.watcher = ebt_ulog,
.check = ebt_ulog_check,
diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index 96897e2..ab60b0d 100644
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -169,7 +169,7 @@ ebt_check_vlan(const char *tablename,
return 0;
}

-static struct ebt_match filter_vlan = {
+static struct ebt_match filter_vlan __read_mostly = {
.name = EBT_VLAN_MATCH,
.match = ebt_filter_vlan,
.check = ebt_check_vlan,
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:28 UTC
Permalink
[NETFILTER]: xt_TCPMSS: consider reverse route's MTU in clamp-to-pmtu

The TCPMSS target in Xtables should consider the MTU of the reverse
route on forwarded packets as part of the path MTU.

Point in case: IN=ppp0, OUT=eth0. MSS set to 1460 in spite of MTU of
ppp0 being 1392.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 09a855c601cbbf240e7f127705dea74317658c45
tree ee82dc3cf0ff1e97e3bfa126678b4625d3a6d7b1
parent 5925cf9534dffe7165056399a6911609bd1fb44b
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:22:03 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:18 +0100

net/netfilter/xt_TCPMSS.c | 62 +++++++++++++++++++++++++++++++++++++++++++--
1 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 60e3767..217e2b6 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -13,7 +13,10 @@
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
+#include <net/dst.h>
+#include <net/flow.h>
#include <net/ipv6.h>
+#include <net/route.h>
#include <net/tcp.h>

#include <linux/netfilter_ipv4/ip_tables.h>
@@ -41,6 +44,7 @@ optlen(const u_int8_t *opt, unsigned int offset)
static int
tcpmss_mangle_packet(struct sk_buff *skb,
const struct xt_tcpmss_info *info,
+ unsigned int in_mtu,
unsigned int tcphoff,
unsigned int minlen)
{
@@ -76,7 +80,13 @@ tcpmss_mangle_packet(struct sk_buff *skb,
dst_mtu(skb->dst));
return -1;
}
- newmss = dst_mtu(skb->dst) - minlen;
+ if (in_mtu <= minlen) {
+ if (net_ratelimit())
+ printk(KERN_ERR "xt_TCPMSS: unknown or "
+ "invalid path-MTU (%u)\n", in_mtu);
+ return -1;
+ }
+ newmss = min(dst_mtu(skb->dst), in_mtu) - minlen;
} else
newmss = info->mss;

@@ -137,6 +147,28 @@ tcpmss_mangle_packet(struct sk_buff *skb,
return TCPOLEN_MSS;
}

+static u_int32_t tcpmss_reverse_mtu4(const struct iphdr *iph)
+{
+ struct flowi fl = {
+ .fl4_dst = iph->saddr,
+ };
+ const struct nf_afinfo *ai;
+ struct rtable *rt = NULL;
+ u_int32_t mtu = ~0U;
+
+ rcu_read_lock();
+ ai = nf_get_afinfo(AF_INET);
+ if (ai != NULL)
+ ai->route((struct dst_entry **)&rt, &fl);
+ rcu_read_unlock();
+
+ if (rt != NULL) {
+ mtu = dst_mtu(&rt->u.dst);
+ dst_release(&rt->u.dst);
+ }
+ return mtu;
+}
+
static unsigned int
tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, unsigned int hooknum,
@@ -146,7 +178,8 @@ tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
__be16 newlen;
int ret;

- ret = tcpmss_mangle_packet(skb, targinfo, iph->ihl * 4,
+ ret = tcpmss_mangle_packet(skb, targinfo, tcpmss_reverse_mtu4(iph),
+ iph->ihl * 4,
sizeof(*iph) + sizeof(struct tcphdr));
if (ret < 0)
return NF_DROP;
@@ -160,6 +193,28 @@ tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
}

#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+static u_int32_t tcpmss_reverse_mtu6(const struct ipv6hdr *iph)
+{
+ struct flowi fl = {
+ .fl6_dst = iph->saddr,
+ };
+ const struct nf_afinfo *ai;
+ struct rtable *rt = NULL;
+ u_int32_t mtu = ~0U;
+
+ rcu_read_lock();
+ ai = nf_get_afinfo(AF_INET6);
+ if (ai != NULL)
+ ai->route((struct dst_entry **)&rt, &fl);
+ rcu_read_unlock();
+
+ if (rt != NULL) {
+ mtu = dst_mtu(&rt->u.dst);
+ dst_release(&rt->u.dst);
+ }
+ return mtu;
+}
+
static unsigned int
tcpmss_tg6(struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, unsigned int hooknum,
@@ -174,7 +229,8 @@ tcpmss_tg6(struct sk_buff *skb, const struct net_device *in,
tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
if (tcphoff < 0)
return NF_DROP;
- ret = tcpmss_mangle_packet(skb, targinfo, tcphoff,
+ ret = tcpmss_mangle_packet(skb, targinfo, tcpmss_reverse_mtu6(ipv6h),
+ tcphoff,
sizeof(*ipv6h) + sizeof(struct tcphdr));
if (ret < 0)
return NF_DROP;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:23 UTC
Permalink
[NETFILTER]: arp_tables: per-netns arp_tables FILTER

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit e612deed898a9b2984bd7c2f4fef1a5a93f8160b
tree 044a732a14be924f70a60258ac8424de575ac8f4
parent 5f826e6f0ca7a6d45279d1c4ed6860a4bf7bbf26
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:22:01 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:17 +0100

include/net/netns/ipv4.h | 1 +
net/ipv4/netfilter/arptable_filter.c | 38 +++++++++++++++++++++++++---------
2 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index aeb0c3b..a9b4f60 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -31,6 +31,7 @@ struct netns_ipv4 {
struct xt_table *iptable_filter;
struct xt_table *iptable_mangle;
struct xt_table *iptable_raw;
+ struct xt_table *arptable_filter;
#endif
};
#endif
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 1a68860..4e9c496 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -20,7 +20,7 @@ static struct
struct arpt_replace repl;
struct arpt_standard entries[3];
struct arpt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
.repl = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
@@ -45,7 +45,7 @@ static struct
.term = ARPT_ERROR_INIT,
};

-static struct arpt_table __packet_filter = {
+static struct arpt_table packet_filter = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
@@ -53,7 +53,6 @@ static struct arpt_table __packet_filter = {
.me = THIS_MODULE,
.af = NF_ARP,
};
-static struct arpt_table *packet_filter;

/* The work comes in here from netfilter.c */
static unsigned int arpt_hook(unsigned int hook,
@@ -62,7 +61,7 @@ static unsigned int arpt_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return arpt_do_table(skb, hook, in, out, packet_filter);
+ return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
}

static struct nf_hook_ops arpt_ops[] __read_mostly = {
@@ -86,14 +85,33 @@ static struct nf_hook_ops arpt_ops[] __read_mostly = {
},
};

+static int __net_init arptable_filter_net_init(struct net *net)
+{
+ /* Register table */
+ net->ipv4.arptable_filter =
+ arpt_register_table(net, &packet_filter, &initial_table.repl);
+ if (IS_ERR(net->ipv4.arptable_filter))
+ return PTR_ERR(net->ipv4.arptable_filter);
+ return 0;
+}
+
+static void __net_exit arptable_filter_net_exit(struct net *net)
+{
+ arpt_unregister_table(net->ipv4.arptable_filter);
+}
+
+static struct pernet_operations arptable_filter_net_ops = {
+ .init = arptable_filter_net_init,
+ .exit = arptable_filter_net_exit,
+};
+
static int __init arptable_filter_init(void)
{
int ret;

- /* Register table */
- packet_filter = arpt_register_table(&init_net, &__packet_filter, &initial_table.repl);
- if (IS_ERR(packet_filter))
- return PTR_ERR(packet_filter);
+ ret = register_pernet_subsys(&arptable_filter_net_ops);
+ if (ret < 0)
+ return ret;

ret = nf_register_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
if (ret < 0)
@@ -101,14 +119,14 @@ static int __init arptable_filter_init(void)
return ret;

cleanup_table:
- arpt_unregister_table(packet_filter);
+ unregister_pernet_subsys(&arptable_filter_net_ops);
return ret;
}

static void __exit arptable_filter_fini(void)
{
nf_unregister_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
- arpt_unregister_table(packet_filter);
+ unregister_pernet_subsys(&arptable_filter_net_ops);
}

module_init(arptable_filter_init);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:34 UTC
Permalink
[NETFILTER]: nfnetlink_log: sparse warning fixes

Signed-off-by: Stephen Hemminger <***@vyatta.com>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 7f16025ab2a78e16a58f5c4d655d568945ecc9dc
tree 64cf943b261f105fbfe0c076e78d71a5c414d1ba
parent 70d4a3d143164c03c11ad8d14a646e46453f4c76
author Stephen Hemminger <***@vyatta.com> Tue, 29 Jan 2008 16:22:05 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:18 +0100

net/netfilter/nfnetlink_log.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 2348fcb..7efa40d 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -866,6 +866,7 @@ static struct hlist_node *get_idx(struct iter_state *st, loff_t pos)
}

static void *seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(instances_lock)
{
read_lock_bh(&instances_lock);
return get_idx(seq->private, *pos);
@@ -878,6 +879,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
}

static void seq_stop(struct seq_file *s, void *v)
+ __releases(instances_lock)
{
read_unlock_bh(&instances_lock);
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:06 UTC
Permalink
[NETFILTER]: ebtables: remove casts, use consts

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit b98625021b5c086ec97c2121eaf9f06873339d3e
tree d6d438e305b31a69c641d6461c30688ed2174501
parent 1b8b1c29feb7a42aceb8f62ea9378d492437acbe
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:21:54 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:13 +0100

include/net/arp.h | 8 +++++---
net/bridge/netfilter/ebt_802_3.c | 6 +++---
net/bridge/netfilter/ebt_among.c | 24 +++++++++++++++---------
net/bridge/netfilter/ebt_arp.c | 13 ++++++++-----
net/bridge/netfilter/ebt_arpreply.c | 13 ++++++++-----
net/bridge/netfilter/ebt_dnat.c | 4 ++--
net/bridge/netfilter/ebt_ip.c | 10 ++++++----
net/bridge/netfilter/ebt_limit.c | 2 +-
net/bridge/netfilter/ebt_log.c | 18 +++++++++++-------
net/bridge/netfilter/ebt_mark.c | 4 ++--
net/bridge/netfilter/ebt_mark_m.c | 4 ++--
net/bridge/netfilter/ebt_pkttype.c | 4 ++--
net/bridge/netfilter/ebt_redirect.c | 4 ++--
net/bridge/netfilter/ebt_snat.c | 7 ++++---
net/bridge/netfilter/ebt_stp.c | 24 +++++++++++++-----------
net/bridge/netfilter/ebt_ulog.c | 4 ++--
net/bridge/netfilter/ebt_vlan.c | 7 ++++---
net/ipv4/arp.c | 9 +++++----
18 files changed, 95 insertions(+), 70 deletions(-)

diff --git a/include/net/arp.h b/include/net/arp.h
index 752eb47..c236270 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -13,15 +13,17 @@ extern int arp_find(unsigned char *haddr, struct sk_buff *skb);
extern int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg);
extern void arp_send(int type, int ptype, __be32 dest_ip,
struct net_device *dev, __be32 src_ip,
- unsigned char *dest_hw, unsigned char *src_hw, unsigned char *th);
+ const unsigned char *dest_hw,
+ const unsigned char *src_hw, const unsigned char *th);
extern int arp_bind_neighbour(struct dst_entry *dst);
extern int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir);
extern void arp_ifdown(struct net_device *dev);

extern struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
struct net_device *dev, __be32 src_ip,
- unsigned char *dest_hw, unsigned char *src_hw,
- unsigned char *target_hw);
+ const unsigned char *dest_hw,
+ const unsigned char *src_hw,
+ const unsigned char *target_hw);
extern void arp_xmit(struct sk_buff *skb);

extern struct neigh_ops arp_broken_ops;
diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index 41a7807..ac1730b 100644
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -15,8 +15,8 @@
static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const void *data, unsigned int datalen)
{
- struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
- struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb);
+ const struct ebt_802_3_info *info = data;
+ const struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb);
__be16 type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;

if (info->bitmask & EBT_802_3_SAP) {
@@ -40,7 +40,7 @@ static struct ebt_match filter_802_3;
static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
+ const struct ebt_802_3_info *info = data;

if (datalen < sizeof(struct ebt_802_3_info))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index 6436d30..318157e 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -25,7 +25,7 @@ static int ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
const struct ebt_mac_wormhash_tuple *p;
int start, limit, i;
uint32_t cmp[2] = { 0, 0 };
- int key = (const unsigned char) mac[5];
+ int key = ((const unsigned char *)mac)[5];

memcpy(((char *) cmp) + 2, mac, 6);
start = wh->table[key];
@@ -73,15 +73,18 @@ static int ebt_mac_wormhash_check_integrity(const struct ebt_mac_wormhash
static int get_ip_dst(const struct sk_buff *skb, __be32 *addr)
{
if (eth_hdr(skb)->h_proto == htons(ETH_P_IP)) {
- struct iphdr _iph, *ih;
+ const struct iphdr *ih;
+ struct iphdr _iph;

ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
if (ih == NULL)
return -1;
*addr = ih->daddr;
} else if (eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
- struct arphdr _arph, *ah;
- __be32 buf, *bp;
+ const struct arphdr *ah;
+ struct arphdr _arph;
+ const __be32 *bp;
+ __be32 buf;

ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
if (ah == NULL ||
@@ -101,15 +104,18 @@ static int get_ip_dst(const struct sk_buff *skb, __be32 *addr)
static int get_ip_src(const struct sk_buff *skb, __be32 *addr)
{
if (eth_hdr(skb)->h_proto == htons(ETH_P_IP)) {
- struct iphdr _iph, *ih;
+ const struct iphdr *ih;
+ struct iphdr _iph;

ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
if (ih == NULL)
return -1;
*addr = ih->saddr;
} else if (eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
- struct arphdr _arph, *ah;
- __be32 buf, *bp;
+ const struct arphdr *ah;
+ struct arphdr _arph;
+ const __be32 *bp;
+ __be32 buf;

ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
if (ah == NULL ||
@@ -130,7 +136,7 @@ static int ebt_filter_among(const struct sk_buff *skb,
const struct net_device *out, const void *data,
unsigned int datalen)
{
- struct ebt_among_info *info = (struct ebt_among_info *) data;
+ const struct ebt_among_info *info = data;
const char *dmac, *smac;
const struct ebt_mac_wormhash *wh_dst, *wh_src;
__be32 dip = 0, sip = 0;
@@ -175,7 +181,7 @@ static int ebt_among_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data,
unsigned int datalen)
{
- struct ebt_among_info *info = (struct ebt_among_info *) data;
+ const struct ebt_among_info *info = data;
int expected_length = sizeof(struct ebt_among_info);
const struct ebt_mac_wormhash *wh_dst, *wh_src;
int err;
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index 1814139..933433e 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -18,8 +18,9 @@
static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const void *data, unsigned int datalen)
{
- struct ebt_arp_info *info = (struct ebt_arp_info *)data;
- struct arphdr _arph, *ah;
+ const struct ebt_arp_info *info = data;
+ const struct arphdr *ah;
+ struct arphdr _arph;

ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
if (ah == NULL)
@@ -35,7 +36,8 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
return EBT_NOMATCH;

if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_GRAT)) {
- __be32 saddr, daddr, *sap, *dap;
+ const __be32 *sap, *dap;
+ __be32 saddr, daddr;

if (ah->ar_pln != sizeof(__be32) || ah->ar_pro != htons(ETH_P_IP))
return EBT_NOMATCH;
@@ -61,7 +63,8 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
}

if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)) {
- unsigned char _mac[ETH_ALEN], *mp;
+ const unsigned char *mp;
+ unsigned char _mac[ETH_ALEN];
uint8_t verdict, i;

if (ah->ar_hln != ETH_ALEN || ah->ar_hrd != htons(ARPHRD_ETHER))
@@ -100,7 +103,7 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
static int ebt_arp_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_arp_info *info = (struct ebt_arp_info *)data;
+ const struct ebt_arp_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 48a80e4..7b6a8c1 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -19,10 +19,13 @@ static int ebt_target_reply(struct sk_buff *skb, unsigned int hooknr,
const struct net_device *in, const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
- __be32 _sip, *siptr, _dip, *diptr;
- struct arphdr _ah, *ap;
- unsigned char _sha[ETH_ALEN], *shp;
+ struct ebt_arpreply_info *info = (void *)data;
+ const __be32 *siptr, *diptr;
+ __be32 _sip, _dip;
+ const struct arphdr *ap;
+ struct arphdr _ah;
+ const unsigned char *shp;
+ unsigned char _sha[ETH_ALEN];

ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
if (ap == NULL)
@@ -58,7 +61,7 @@ static int ebt_target_reply(struct sk_buff *skb, unsigned int hooknr,
static int ebt_target_reply_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
+ const struct ebt_arpreply_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_arpreply_info)))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index 74262e9..6ad9160 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -18,7 +18,7 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
const struct net_device *in, const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_nat_info *info = (struct ebt_nat_info *)data;
+ const struct ebt_nat_info *info = data;

if (skb_make_writable(skb, 0))
return NF_DROP;
@@ -30,7 +30,7 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_nat_info *info = (struct ebt_nat_info *)data;
+ const struct ebt_nat_info *info = data;

if (BASE_CHAIN && info->target == EBT_RETURN)
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index 69f7f0a..82934f9 100644
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -28,9 +28,11 @@ static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const void *data,
unsigned int datalen)
{
- struct ebt_ip_info *info = (struct ebt_ip_info *)data;
- struct iphdr _iph, *ih;
- struct tcpudphdr _ports, *pptr;
+ const struct ebt_ip_info *info = data;
+ const struct iphdr *ih;
+ struct iphdr _iph;
+ const struct tcpudphdr *pptr;
+ struct tcpudphdr _ports;

ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
if (ih == NULL)
@@ -79,7 +81,7 @@ static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
static int ebt_ip_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_ip_info *info = (struct ebt_ip_info *)data;
+ const struct ebt_ip_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index d48fa5c..2eb5cb7 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -69,7 +69,7 @@ user2credits(u_int32_t user)
static int ebt_limit_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_limit_info *info = (struct ebt_limit_info *)data;
+ struct ebt_limit_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_limit_info)))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 3be9e98..40560d6 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -24,7 +24,7 @@ static DEFINE_SPINLOCK(ebt_log_lock);
static int ebt_log_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_log_info *info = (struct ebt_log_info *)data;
+ struct ebt_log_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
return -EINVAL;
@@ -50,7 +50,7 @@ struct arppayload
unsigned char ip_dst[4];
};

-static void print_MAC(unsigned char *p)
+static void print_MAC(const unsigned char *p)
{
int i;

@@ -84,7 +84,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,

if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto ==
htons(ETH_P_IP)){
- struct iphdr _iph, *ih;
+ const struct iphdr *ih;
+ struct iphdr _iph;

ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
if (ih == NULL) {
@@ -99,7 +100,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,
ih->protocol == IPPROTO_UDPLITE ||
ih->protocol == IPPROTO_SCTP ||
ih->protocol == IPPROTO_DCCP) {
- struct tcpudphdr _ports, *pptr;
+ const struct tcpudphdr *pptr;
+ struct tcpudphdr _ports;

pptr = skb_header_pointer(skb, ih->ihl*4,
sizeof(_ports), &_ports);
@@ -116,7 +118,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,
if ((bitmask & EBT_LOG_ARP) &&
((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) ||
(eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) {
- struct arphdr _arph, *ah;
+ const struct arphdr *ah;
+ struct arphdr _arph;

ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
if (ah == NULL) {
@@ -132,7 +135,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,
if (ah->ar_hrd == htons(1) &&
ah->ar_hln == ETH_ALEN &&
ah->ar_pln == sizeof(__be32)) {
- struct arppayload _arpp, *ap;
+ const struct arppayload *ap;
+ struct arppayload _arpp;

ap = skb_header_pointer(skb, sizeof(_arph),
sizeof(_arpp), &_arpp);
@@ -160,7 +164,7 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
const struct net_device *in, const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_log_info *info = (struct ebt_log_info *)data;
+ const struct ebt_log_info *info = data;
struct nf_loginfo li;

li.type = NF_LOG_TYPE_LOG;
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 6cba543..6fe93df 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -21,7 +21,7 @@ static int ebt_target_mark(struct sk_buff *skb, unsigned int hooknr,
const struct net_device *in, const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
+ const struct ebt_mark_t_info *info = data;
int action = info->target & -16;

if (action == MARK_SET_VALUE)
@@ -39,7 +39,7 @@ static int ebt_target_mark(struct sk_buff *skb, unsigned int hooknr,
static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
+ const struct ebt_mark_t_info *info = data;
int tmp;

if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
diff --git a/net/bridge/netfilter/ebt_mark_m.c b/net/bridge/netfilter/ebt_mark_m.c
index 6b0d216..0acab09 100644
--- a/net/bridge/netfilter/ebt_mark_m.c
+++ b/net/bridge/netfilter/ebt_mark_m.c
@@ -16,7 +16,7 @@ static int ebt_filter_mark(const struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const void *data,
unsigned int datalen)
{
- struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
+ const struct ebt_mark_m_info *info = data;

if (info->bitmask & EBT_MARK_OR)
return !(!!(skb->mark & info->mask) ^ info->invert);
@@ -26,7 +26,7 @@ static int ebt_filter_mark(const struct sk_buff *skb,
static int ebt_mark_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
+ const struct ebt_mark_m_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_m_info)))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_pkttype.c b/net/bridge/netfilter/ebt_pkttype.c
index 4fffd70..a15cf06 100644
--- a/net/bridge/netfilter/ebt_pkttype.c
+++ b/net/bridge/netfilter/ebt_pkttype.c
@@ -18,7 +18,7 @@ static int ebt_filter_pkttype(const struct sk_buff *skb,
const void *data,
unsigned int datalen)
{
- struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
+ const struct ebt_pkttype_info *info = data;

return (skb->pkt_type != info->pkt_type) ^ info->invert;
}
@@ -26,7 +26,7 @@ static int ebt_filter_pkttype(const struct sk_buff *skb,
static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
+ const struct ebt_pkttype_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_pkttype_info)))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 422cb83..c1f9ca2 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -19,7 +19,7 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
const struct net_device *in, const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
+ const struct ebt_redirect_info *info = data;

if (skb_make_writable(skb, 0))
return NF_DROP;
@@ -36,7 +36,7 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
+ const struct ebt_redirect_info *info = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_redirect_info)))
return -EINVAL;
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index 425ac92..6bc263c 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -20,7 +20,7 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
const struct net_device *in, const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_nat_info *info = (struct ebt_nat_info *) data;
+ const struct ebt_nat_info *info = data;

if (skb_make_writable(skb, 0))
return NF_DROP;
@@ -28,7 +28,8 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
if (!(info->target & NAT_ARP_BIT) &&
eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
- struct arphdr _ah, *ap;
+ const struct arphdr *ap;
+ struct arphdr _ah;

ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
if (ap == NULL)
@@ -45,7 +46,7 @@ out:
static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_nat_info *info = (struct ebt_nat_info *) data;
+ const struct ebt_nat_info *info = data;
int tmp;

if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index 31b7736..fe323c4 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -40,10 +40,10 @@ struct stp_config_pdu {
#define NR16(p) (p[0] << 8 | p[1])
#define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])

-static int ebt_filter_config(struct ebt_stp_info *info,
- struct stp_config_pdu *stpc)
+static int ebt_filter_config(const struct ebt_stp_info *info,
+ const struct stp_config_pdu *stpc)
{
- struct ebt_stp_config_info *c;
+ const struct ebt_stp_config_info *c;
uint16_t v16;
uint32_t v32;
int verdict, i;
@@ -122,9 +122,10 @@ static int ebt_filter_config(struct ebt_stp_info *info,
static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const void *data, unsigned int datalen)
{
- struct ebt_stp_info *info = (struct ebt_stp_info *)data;
- struct stp_header _stph, *sp;
- uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
+ const struct ebt_stp_info *info = data;
+ const struct stp_header *sp;
+ struct stp_header _stph;
+ const uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};

sp = skb_header_pointer(skb, 0, sizeof(_stph), &_stph);
if (sp == NULL)
@@ -140,7 +141,8 @@ static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in

if (sp->type == BPDU_TYPE_CONFIG &&
info->bitmask & EBT_STP_CONFIG_MASK) {
- struct stp_config_pdu _stpc, *st;
+ const struct stp_config_pdu *st;
+ struct stp_config_pdu _stpc;

st = skb_header_pointer(skb, sizeof(_stph),
sizeof(_stpc), &_stpc);
@@ -154,10 +156,10 @@ static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in
static int ebt_stp_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_stp_info *info = (struct ebt_stp_info *)data;
- int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
- uint8_t bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
- uint8_t msk[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+ const struct ebt_stp_info *info = data;
+ const unsigned int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
+ const uint8_t bridge_ula[6] = {0x01, 0x80, 0xc2, 0x00, 0x00, 0x00};
+ const uint8_t msk[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};

if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
!(info->bitmask & EBT_STP_MASK))
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 8e7b00b..2015711 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -249,7 +249,7 @@ static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
const struct net_device *in, const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_ulog_info *uloginfo = (struct ebt_ulog_info *)data;
+ const struct ebt_ulog_info *uloginfo = data;

ebt_ulog_packet(hooknr, skb, in, out, uloginfo, NULL);
}
@@ -258,7 +258,7 @@ static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_ulog_info *uloginfo = (struct ebt_ulog_info *)data;
+ struct ebt_ulog_info *uloginfo = data;

if (datalen != EBT_ALIGN(sizeof(struct ebt_ulog_info)) ||
uloginfo->nlgroup > 31)
diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index 0ddf749..097d067 100644
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -46,8 +46,9 @@ ebt_filter_vlan(const struct sk_buff *skb,
const struct net_device *out,
const void *data, unsigned int datalen)
{
- struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
- struct vlan_hdr _frame, *fp;
+ const struct ebt_vlan_info *info = data;
+ const struct vlan_hdr *fp;
+ struct vlan_hdr _frame;

unsigned short TCI; /* Whole TCI, given from parsed frame */
unsigned short id; /* VLAN ID, given from frame TCI */
@@ -91,7 +92,7 @@ ebt_check_vlan(const char *tablename,
unsigned int hooknr,
const struct ebt_entry *e, void *data, unsigned int datalen)
{
- struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
+ struct ebt_vlan_info *info = data;

/* Parameters buffer overflow check */
if (datalen != EBT_ALIGN(sizeof(struct ebt_vlan_info))) {
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 5976c59..8e17f65 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -558,8 +558,9 @@ static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
*/
struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
struct net_device *dev, __be32 src_ip,
- unsigned char *dest_hw, unsigned char *src_hw,
- unsigned char *target_hw)
+ const unsigned char *dest_hw,
+ const unsigned char *src_hw,
+ const unsigned char *target_hw)
{
struct sk_buff *skb;
struct arphdr *arp;
@@ -672,8 +673,8 @@ void arp_xmit(struct sk_buff *skb)
*/
void arp_send(int type, int ptype, __be32 dest_ip,
struct net_device *dev, __be32 src_ip,
- unsigned char *dest_hw, unsigned char *src_hw,
- unsigned char *target_hw)
+ const unsigned char *dest_hw, const unsigned char *src_hw,
+ const unsigned char *target_hw)
{
struct sk_buff *skb;

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:36 UTC
Permalink
[NETFILTER]: conntrack: get rid of sparse warnings

Teach sparse about locking here, and fix signed/unsigned warnings.

Signed-off-by: Stephen Hemminger <***@vyatta.com>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit a56984be5dde4c3ab631f9c66e15c1fa7a12f17e
tree 686c306b6e89f19951950a971d69785256387b2d
parent 7f16025ab2a78e16a58f5c4d655d568945ecc9dc
author Stephen Hemminger <***@vyatta.com> Tue, 29 Jan 2008 16:22:06 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:19 +0100

net/netfilter/nf_conntrack_irc.c | 2 +-
net/netfilter/nf_conntrack_proto_sctp.c | 4 ++--
net/netfilter/nf_conntrack_proto_tcp.c | 6 +++---
net/netfilter/nf_conntrack_sip.c | 4 ++--
net/netfilter/nf_conntrack_standalone.c | 2 ++
net/netfilter/nf_conntrack_tftp.c | 2 +-
6 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index dfaed4b..c336b07 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -23,7 +23,7 @@

#define MAX_PORTS 8
static unsigned short ports[MAX_PORTS];
-static int ports_c;
+static unsigned int ports_c;
static unsigned int max_dcc_channels = 8;
static unsigned int dcc_timeout __read_mostly = 300;
/* This is slow, but it's simple. --RR */
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 21d29e7..7017b16 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -624,7 +624,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
#endif
};

-int __init nf_conntrack_proto_sctp_init(void)
+static int __init nf_conntrack_proto_sctp_init(void)
{
int ret;

@@ -647,7 +647,7 @@ int __init nf_conntrack_proto_sctp_init(void)
return ret;
}

-void __exit nf_conntrack_proto_sctp_fini(void)
+static void __exit nf_conntrack_proto_sctp_fini(void)
{
nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 64c9b91..8e22075 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1098,16 +1098,16 @@ static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {

static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
{
- struct nlattr *attr = cda[CTA_PROTOINFO_TCP];
+ struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
int err;

/* updates could not contain anything about the private
* protocol info, in that case skip the parsing */
- if (!attr)
+ if (!pattr)
return 0;

- err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr, tcp_nla_policy);
+ err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
if (err < 0)
return err;

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 47d8947..775f7d4 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -28,7 +28,7 @@ MODULE_ALIAS("ip_conntrack_sip");

#define MAX_PORTS 8
static unsigned short ports[MAX_PORTS];
-static int ports_c;
+static unsigned int ports_c;
module_param_array(ports, ushort, &ports_c, 0400);
MODULE_PARM_DESC(ports, "port numbers of SIP servers");

@@ -407,7 +407,7 @@ static int sip_help(struct sk_buff *skb,
unsigned int dataoff, datalen;
const char *dptr;
int ret = NF_ACCEPT;
- int matchoff, matchlen;
+ unsigned int matchoff, matchlen;
u_int16_t port;
enum sip_header_pos pos;
typeof(nf_nat_sip_hook) nf_nat_sip;
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 696074a..28c5ae8 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -93,6 +93,7 @@ static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
}

static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(nf_conntrack_lock)
{
read_lock_bh(&nf_conntrack_lock);
return ct_get_idx(seq, *pos);
@@ -105,6 +106,7 @@ static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
}

static void ct_seq_stop(struct seq_file *s, void *v)
+ __releases(nf_conntrack_lock)
{
read_unlock_bh(&nf_conntrack_lock);
}
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index e894aa1..176f769 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -25,7 +25,7 @@ MODULE_ALIAS("ip_conntrack_tftp");

#define MAX_PORTS 8
static unsigned short ports[MAX_PORTS];
-static int ports_c;
+static unsigned int ports_c;
module_param_array(ports, ushort, &ports_c, 0400);
MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:32 UTC
Permalink
[NETFILTER]: nf_conntrack: sparse warnings

The hashtable size is really unsigned so sparse complains when you pass
a signed integer. Change all uses to make it consistent.

Signed-off-by: Stephen Hemminger <***@vyatta.com>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 70d4a3d143164c03c11ad8d14a646e46453f4c76
tree f2d2e1053d51c51dfdc934d0713a6bbec711b4c1
parent 1ba99fa44b76ee7a7dddffc965a296d46c70fd40
author Stephen Hemminger <***@vyatta.com> Tue, 29 Jan 2008 16:22:05 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:18 +0100

include/net/netfilter/nf_conntrack.h | 4 ++--
net/netfilter/nf_conntrack_core.c | 10 +++++-----
2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 857d899..dada041 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -171,9 +171,9 @@ static inline void nf_ct_put(struct nf_conn *ct)
extern int nf_ct_l3proto_try_module_get(unsigned short l3proto);
extern void nf_ct_l3proto_module_put(unsigned short l3proto);

-extern struct hlist_head *nf_ct_alloc_hashtable(int *sizep, int *vmalloced);
+extern struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced);
extern void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced,
- int size);
+ unsigned int size);

extern struct nf_conntrack_tuple_hash *
__nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 078fff0..7b1f7e8 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -939,7 +939,7 @@ static int kill_all(struct nf_conn *i, void *data)
return 1;
}

-void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, int size)
+void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, unsigned int size)
{
if (vmalloced)
vfree(hash);
@@ -988,7 +988,7 @@ void nf_conntrack_cleanup(void)
nf_conntrack_expect_fini();
}

-struct hlist_head *nf_ct_alloc_hashtable(int *sizep, int *vmalloced)
+struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced)
{
struct hlist_head *hash;
unsigned int size, i;
@@ -1015,8 +1015,8 @@ EXPORT_SYMBOL_GPL(nf_ct_alloc_hashtable);

int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
{
- int i, bucket, hashsize, vmalloced;
- int old_vmalloced, old_size;
+ int i, bucket, vmalloced, old_vmalloced;
+ unsigned int hashsize, old_size;
int rnd;
struct hlist_head *hash, *old_hash;
struct nf_conntrack_tuple_hash *h;
@@ -1025,7 +1025,7 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
if (!nf_conntrack_htable_size)
return param_set_uint(val, kp);

- hashsize = simple_strtol(val, NULL, 0);
+ hashsize = simple_strtoul(val, NULL, 0);
if (!hashsize)
return -EINVAL;

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:17 UTC
Permalink
[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW

Now, iptables show and configure different set of rules in different
netnss'. Filtering decisions are still made by consulting only
init_net's set.

Changes are identical except naming so no splitting.

P.S.: one need to remove init_net checks in nf_sockopt.c and inet_create()
to see the effect.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 4885531d4b5ac7058b8d2414d6f6404eba84d0e8
tree 66ed2423ba98c9a6a61d63310f5f4ecbe755427c
parent 5420d0d7491f2c9bf23ad1895c48438d9a09b9e2
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:21:59 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:16 +0100

include/net/netns/ipv4.h | 5 ++++
net/ipv4/netfilter/iptable_filter.c | 41 +++++++++++++++++++++++++----------
net/ipv4/netfilter/iptable_mangle.c | 41 +++++++++++++++++++++++++----------
net/ipv4/netfilter/iptable_raw.c | 41 +++++++++++++++++++++++++----------
4 files changed, 92 insertions(+), 36 deletions(-)

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 15a0b05..aeb0c3b 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -27,5 +27,10 @@ struct netns_ipv4 {
struct sock *fibnl;

struct netns_frags frags;
+#ifdef CONFIG_NETFILTER
+ struct xt_table *iptable_filter;
+ struct xt_table *iptable_mangle;
+ struct xt_table *iptable_raw;
+#endif
};
#endif
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 3b43ca0..69f3d7e 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -28,7 +28,7 @@ static struct
struct ipt_replace repl;
struct ipt_standard entries[3];
struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
.repl = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
@@ -53,14 +53,13 @@ static struct
.term = IPT_ERROR_INIT, /* ERROR */
};

-static struct xt_table __packet_filter = {
+static struct xt_table packet_filter = {
.name = "filter",
.valid_hooks = FILTER_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET,
};
-static struct xt_table *packet_filter;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -70,7 +69,7 @@ ipt_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ipt_do_table(skb, hook, in, out, packet_filter);
+ return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_filter);
}

static unsigned int
@@ -89,7 +88,7 @@ ipt_local_out_hook(unsigned int hook,
return NF_ACCEPT;
}

- return ipt_do_table(skb, hook, in, out, packet_filter);
+ return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_filter);
}

static struct nf_hook_ops ipt_ops[] __read_mostly = {
@@ -120,6 +119,26 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
static int forward = NF_ACCEPT;
module_param(forward, bool, 0000);

+static int __net_init iptable_filter_net_init(struct net *net)
+{
+ /* Register table */
+ net->ipv4.iptable_filter =
+ ipt_register_table(net, &packet_filter, &initial_table.repl);
+ if (IS_ERR(net->ipv4.iptable_filter))
+ return PTR_ERR(net->ipv4.iptable_filter);
+ return 0;
+}
+
+static void __net_exit iptable_filter_net_exit(struct net *net)
+{
+ ipt_unregister_table(net->ipv4.iptable_filter);
+}
+
+static struct pernet_operations iptable_filter_net_ops = {
+ .init = iptable_filter_net_init,
+ .exit = iptable_filter_net_exit,
+};
+
static int __init iptable_filter_init(void)
{
int ret;
@@ -132,11 +151,9 @@ static int __init iptable_filter_init(void)
/* Entry 1 is the FORWARD hook */
initial_table.entries[1].target.verdict = -forward - 1;

- /* Register table */
- packet_filter = ipt_register_table(&init_net, &__packet_filter,
- &initial_table.repl);
- if (IS_ERR(packet_filter))
- return PTR_ERR(packet_filter);
+ ret = register_pernet_subsys(&iptable_filter_net_ops);
+ if (ret < 0)
+ return ret;

/* Register hooks */
ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
@@ -146,14 +163,14 @@ static int __init iptable_filter_init(void)
return ret;

cleanup_table:
- ipt_unregister_table(packet_filter);
+ unregister_pernet_subsys(&iptable_filter_net_ops);
return ret;
}

static void __exit iptable_filter_fini(void)
{
nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
- ipt_unregister_table(packet_filter);
+ unregister_pernet_subsys(&iptable_filter_net_ops);
}

module_init(iptable_filter_init);
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 292f2ed..c55a210 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -33,7 +33,7 @@ static struct
struct ipt_replace repl;
struct ipt_standard entries[5];
struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
.repl = {
.name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS,
@@ -64,14 +64,13 @@ static struct
.term = IPT_ERROR_INIT, /* ERROR */
};

-static struct xt_table __packet_mangler = {
+static struct xt_table packet_mangler = {
.name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET,
};
-static struct xt_table *packet_mangler;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -81,7 +80,7 @@ ipt_route_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ipt_do_table(skb, hook, in, out, packet_mangler);
+ return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
}

static unsigned int
@@ -113,7 +112,7 @@ ipt_local_hook(unsigned int hook,
daddr = iph->daddr;
tos = iph->tos;

- ret = ipt_do_table(skb, hook, in, out, packet_mangler);
+ ret = ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
/* Reroute for ANY change. */
if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
iph = ip_hdr(skb);
@@ -167,15 +166,33 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
},
};

+static int __net_init iptable_mangle_net_init(struct net *net)
+{
+ /* Register table */
+ net->ipv4.iptable_mangle =
+ ipt_register_table(net, &packet_mangler, &initial_table.repl);
+ if (IS_ERR(net->ipv4.iptable_mangle))
+ return PTR_ERR(net->ipv4.iptable_mangle);
+ return 0;
+}
+
+static void __net_exit iptable_mangle_net_exit(struct net *net)
+{
+ ipt_unregister_table(net->ipv4.iptable_mangle);
+}
+
+static struct pernet_operations iptable_mangle_net_ops = {
+ .init = iptable_mangle_net_init,
+ .exit = iptable_mangle_net_exit,
+};
+
static int __init iptable_mangle_init(void)
{
int ret;

- /* Register table */
- packet_mangler = ipt_register_table(&init_net, &__packet_mangler,
- &initial_table.repl);
- if (IS_ERR(packet_mangler))
- return PTR_ERR(packet_mangler);
+ ret = register_pernet_subsys(&iptable_mangle_net_ops);
+ if (ret < 0)
+ return ret;

/* Register hooks */
ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
@@ -185,14 +202,14 @@ static int __init iptable_mangle_init(void)
return ret;

cleanup_table:
- ipt_unregister_table(packet_mangler);
+ unregister_pernet_subsys(&iptable_mangle_net_ops);
return ret;
}

static void __exit iptable_mangle_fini(void)
{
nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
- ipt_unregister_table(packet_mangler);
+ unregister_pernet_subsys(&iptable_mangle_net_ops);
}

module_init(iptable_mangle_init);
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index dab863d..e41fe8c 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -14,7 +14,7 @@ static struct
struct ipt_replace repl;
struct ipt_standard entries[2];
struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
.repl = {
.name = "raw",
.valid_hooks = RAW_VALID_HOOKS,
@@ -36,14 +36,13 @@ static struct
.term = IPT_ERROR_INIT, /* ERROR */
};

-static struct xt_table __packet_raw = {
+static struct xt_table packet_raw = {
.name = "raw",
.valid_hooks = RAW_VALID_HOOKS,
.lock = RW_LOCK_UNLOCKED,
.me = THIS_MODULE,
.af = AF_INET,
};
-static struct xt_table *packet_raw;

/* The work comes in here from netfilter.c. */
static unsigned int
@@ -53,7 +52,7 @@ ipt_hook(unsigned int hook,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- return ipt_do_table(skb, hook, in, out, packet_raw);
+ return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_raw);
}

static unsigned int
@@ -71,7 +70,7 @@ ipt_local_hook(unsigned int hook,
"packet.\n");
return NF_ACCEPT;
}
- return ipt_do_table(skb, hook, in, out, packet_raw);
+ return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_raw);
}

/* 'raw' is the very first table. */
@@ -92,15 +91,33 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
},
};

+static int __net_init iptable_raw_net_init(struct net *net)
+{
+ /* Register table */
+ net->ipv4.iptable_raw =
+ ipt_register_table(net, &packet_raw, &initial_table.repl);
+ if (IS_ERR(net->ipv4.iptable_raw))
+ return PTR_ERR(net->ipv4.iptable_raw);
+ return 0;
+}
+
+static void __net_exit iptable_raw_net_exit(struct net *net)
+{
+ ipt_unregister_table(net->ipv4.iptable_raw);
+}
+
+static struct pernet_operations iptable_raw_net_ops = {
+ .init = iptable_raw_net_init,
+ .exit = iptable_raw_net_exit,
+};
+
static int __init iptable_raw_init(void)
{
int ret;

- /* Register table */
- packet_raw = ipt_register_table(&init_net, &__packet_raw,
- &initial_table.repl);
- if (IS_ERR(packet_raw))
- return PTR_ERR(packet_raw);
+ ret = register_pernet_subsys(&iptable_raw_net_ops);
+ if (ret < 0)
+ return ret;

/* Register hooks */
ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
@@ -110,14 +127,14 @@ static int __init iptable_raw_init(void)
return ret;

cleanup_table:
- ipt_unregister_table(packet_raw);
+ unregister_pernet_subsys(&iptable_raw_net_ops);
return ret;
}

static void __exit iptable_raw_fini(void)
{
nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
- ipt_unregister_table(packet_raw);
+ unregister_pernet_subsys(&iptable_raw_net_ops);
}

module_init(iptable_raw_init);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:22 UTC
Permalink
[NETFILTER]: arp_tables: netns preparation

* Propagate netns from userspace.
* arpt_register_table() registers table in supplied netns.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 5f826e6f0ca7a6d45279d1c4ed6860a4bf7bbf26
tree a679f8f22cd3df21b5a13648dfa59ed6c8ec78e5
parent 084d68b97043319020232289b1f63c8c7afa2e97
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:22:01 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:17 +0100

include/linux/netfilter_arp/arp_tables.h | 3 +-
net/ipv4/netfilter/arp_tables.c | 55 +++++++++++++++++-------------
net/ipv4/netfilter/arptable_filter.c | 2 +
3 files changed, 34 insertions(+), 26 deletions(-)

diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index f35486b..db223ca 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -271,7 +271,8 @@ struct arpt_error
xt_register_target(tgt); })
#define arpt_unregister_target(tgt) xt_unregister_target(tgt)

-extern struct arpt_table *arpt_register_table(struct arpt_table *table,
+extern struct arpt_table *arpt_register_table(struct net *net,
+ struct arpt_table *table,
const struct arpt_replace *repl);
extern void arpt_unregister_table(struct arpt_table *table);
extern unsigned int arpt_do_table(struct sk_buff *skb,
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 3a5afb8..ec64b67 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -22,6 +22,7 @@
#include <linux/mutex.h>
#include <linux/err.h>
#include <net/compat.h>
+#include <net/sock.h>
#include <asm/uaccess.h>

#include <linux/netfilter/x_tables.h>
@@ -850,7 +851,7 @@ static int compat_table_info(const struct xt_table_info *info,
}
#endif

-static int get_info(void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user, int *len, int compat)
{
char name[ARPT_TABLE_MAXNAMELEN];
struct arpt_table *t;
@@ -870,7 +871,7 @@ static int get_info(void __user *user, int *len, int compat)
if (compat)
xt_compat_lock(NF_ARP);
#endif
- t = try_then_request_module(xt_find_table_lock(&init_net, NF_ARP, name),
+ t = try_then_request_module(xt_find_table_lock(net, NF_ARP, name),
"arptable_%s", name);
if (t && !IS_ERR(t)) {
struct arpt_getinfo info;
@@ -908,7 +909,8 @@ static int get_info(void __user *user, int *len, int compat)
return ret;
}

-static int get_entries(struct arpt_get_entries __user *uptr, int *len)
+static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
+ int *len)
{
int ret;
struct arpt_get_entries get;
@@ -926,7 +928,7 @@ static int get_entries(struct arpt_get_entries __user *uptr, int *len)
return -EINVAL;
}

- t = xt_find_table_lock(&init_net, NF_ARP, get.name);
+ t = xt_find_table_lock(net, NF_ARP, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
duprintf("t->private->number = %u\n",
@@ -947,7 +949,8 @@ static int get_entries(struct arpt_get_entries __user *uptr, int *len)
return ret;
}

-static int __do_replace(const char *name, unsigned int valid_hooks,
+static int __do_replace(struct net *net, const char *name,
+ unsigned int valid_hooks,
struct xt_table_info *newinfo,
unsigned int num_counters,
void __user *counters_ptr)
@@ -966,7 +969,7 @@ static int __do_replace(const char *name, unsigned int valid_hooks,
goto out;
}

- t = try_then_request_module(xt_find_table_lock(&init_net, NF_ARP, name),
+ t = try_then_request_module(xt_find_table_lock(net, NF_ARP, name),
"arptable_%s", name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1019,7 +1022,7 @@ static int __do_replace(const char *name, unsigned int valid_hooks,
return ret;
}

-static int do_replace(void __user *user, unsigned int len)
+static int do_replace(struct net *net, void __user *user, unsigned int len)
{
int ret;
struct arpt_replace tmp;
@@ -1053,7 +1056,7 @@ static int do_replace(void __user *user, unsigned int len)

duprintf("arp_tables: Translated table\n");

- ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+ ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
tmp.num_counters, tmp.counters);
if (ret)
goto free_newinfo_untrans;
@@ -1080,7 +1083,8 @@ static inline int add_counter_to_entry(struct arpt_entry *e,
return 0;
}

-static int do_add_counters(void __user *user, unsigned int len, int compat)
+static int do_add_counters(struct net *net, void __user *user, unsigned int len,
+ int compat)
{
unsigned int i;
struct xt_counters_info tmp;
@@ -1132,7 +1136,7 @@ static int do_add_counters(void __user *user, unsigned int len, int compat)
goto free;
}

- t = xt_find_table_lock(&init_net, NF_ARP, name);
+ t = xt_find_table_lock(net, NF_ARP, name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
goto free;
@@ -1435,7 +1439,8 @@ struct compat_arpt_replace {
struct compat_arpt_entry entries[0];
};

-static int compat_do_replace(void __user *user, unsigned int len)
+static int compat_do_replace(struct net *net, void __user *user,
+ unsigned int len)
{
int ret;
struct compat_arpt_replace tmp;
@@ -1471,7 +1476,7 @@ static int compat_do_replace(void __user *user, unsigned int len)

duprintf("compat_do_replace: Translated table\n");

- ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+ ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
tmp.num_counters, compat_ptr(tmp.counters));
if (ret)
goto free_newinfo_untrans;
@@ -1494,11 +1499,11 @@ static int compat_do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user,

switch (cmd) {
case ARPT_SO_SET_REPLACE:
- ret = compat_do_replace(user, len);
+ ret = compat_do_replace(sk->sk_net, user, len);
break;

case ARPT_SO_SET_ADD_COUNTERS:
- ret = do_add_counters(user, len, 1);
+ ret = do_add_counters(sk->sk_net, user, len, 1);
break;

default:
@@ -1584,7 +1589,8 @@ struct compat_arpt_get_entries {
struct compat_arpt_entry entrytable[0];
};

-static int compat_get_entries(struct compat_arpt_get_entries __user *uptr,
+static int compat_get_entries(struct net *net,
+ struct compat_arpt_get_entries __user *uptr,
int *len)
{
int ret;
@@ -1604,7 +1610,7 @@ static int compat_get_entries(struct compat_arpt_get_entries __user *uptr,
}

xt_compat_lock(NF_ARP);
- t = xt_find_table_lock(&init_net, NF_ARP, get.name);
+ t = xt_find_table_lock(net, NF_ARP, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
struct xt_table_info info;
@@ -1641,10 +1647,10 @@ static int compat_do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user,

switch (cmd) {
case ARPT_SO_GET_INFO:
- ret = get_info(user, len, 1);
+ ret = get_info(sk->sk_net, user, len, 1);
break;
case ARPT_SO_GET_ENTRIES:
- ret = compat_get_entries(user, len);
+ ret = compat_get_entries(sk->sk_net, user, len);
break;
default:
ret = do_arpt_get_ctl(sk, cmd, user, len);
@@ -1662,11 +1668,11 @@ static int do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned

switch (cmd) {
case ARPT_SO_SET_REPLACE:
- ret = do_replace(user, len);
+ ret = do_replace(sk->sk_net, user, len);
break;

case ARPT_SO_SET_ADD_COUNTERS:
- ret = do_add_counters(user, len, 0);
+ ret = do_add_counters(sk->sk_net, user, len, 0);
break;

default:
@@ -1686,11 +1692,11 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len

switch (cmd) {
case ARPT_SO_GET_INFO:
- ret = get_info(user, len, 0);
+ ret = get_info(sk->sk_net, user, len, 0);
break;

case ARPT_SO_GET_ENTRIES:
- ret = get_entries(user, len);
+ ret = get_entries(sk->sk_net, user, len);
break;

case ARPT_SO_GET_REVISION_TARGET: {
@@ -1719,7 +1725,8 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
return ret;
}

-struct arpt_table *arpt_register_table(struct arpt_table *table,
+struct arpt_table *arpt_register_table(struct net *net,
+ struct arpt_table *table,
const struct arpt_replace *repl)
{
int ret;
@@ -1749,7 +1756,7 @@ struct arpt_table *arpt_register_table(struct arpt_table *table,
if (ret != 0)
goto out_free;

- new_table = xt_register_table(&init_net, table, &bootstrap, newinfo);
+ new_table = xt_register_table(net, table, &bootstrap, newinfo);
if (IS_ERR(new_table)) {
ret = PTR_ERR(new_table);
goto out_free;
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index b003215..1a68860 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -91,7 +91,7 @@ static int __init arptable_filter_init(void)
int ret;

/* Register table */
- packet_filter = arpt_register_table(&__packet_filter, &initial_table.repl);
+ packet_filter = arpt_register_table(&init_net, &__packet_filter, &initial_table.repl);
if (IS_ERR(packet_filter))
return PTR_ERR(packet_filter);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:15 UTC
Permalink
[NETFILTER]: ip_tables: propagate netns from userspace

.. all the way down to table searching functions.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 5420d0d7491f2c9bf23ad1895c48438d9a09b9e2
tree 17e3b2e308a6c16662bf7d567706cc787b9ed380
parent f4b4da65588dd50d6be047d9159315ba2909a944
author Alexey Dobriyan <***@sw.ru> Tue, 29 Jan 2008 16:21:58 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:16 +0100

net/ipv4/netfilter/ip_tables.c | 45 ++++++++++++++++++++--------------------
1 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 99dd62d..c1b80f4 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1092,7 +1092,7 @@ static int compat_table_info(const struct xt_table_info *info,
}
#endif

-static int get_info(void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user, int *len, int compat)
{
char name[IPT_TABLE_MAXNAMELEN];
struct xt_table *t;
@@ -1112,7 +1112,7 @@ static int get_info(void __user *user, int *len, int compat)
if (compat)
xt_compat_lock(AF_INET);
#endif
- t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET, name),
+ t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
"iptable_%s", name);
if (t && !IS_ERR(t)) {
struct ipt_getinfo info;
@@ -1152,7 +1152,7 @@ static int get_info(void __user *user, int *len, int compat)
}

static int
-get_entries(struct ipt_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
{
int ret;
struct ipt_get_entries get;
@@ -1170,7 +1170,7 @@ get_entries(struct ipt_get_entries __user *uptr, int *len)
return -EINVAL;
}

- t = xt_find_table_lock(&init_net, AF_INET, get.name);
+ t = xt_find_table_lock(net, AF_INET, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
duprintf("t->private->number = %u\n", private->number);
@@ -1191,7 +1191,7 @@ get_entries(struct ipt_get_entries __user *uptr, int *len)
}

static int
-__do_replace(const char *name, unsigned int valid_hooks,
+__do_replace(struct net *net, const char *name, unsigned int valid_hooks,
struct xt_table_info *newinfo, unsigned int num_counters,
void __user *counters_ptr)
{
@@ -1208,7 +1208,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
goto out;
}

- t = try_then_request_module(xt_find_table_lock(&init_net, AF_INET, name),
+ t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
"iptable_%s", name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1261,7 +1261,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
}

static int
-do_replace(void __user *user, unsigned int len)
+do_replace(struct net *net, void __user *user, unsigned int len)
{
int ret;
struct ipt_replace tmp;
@@ -1295,7 +1295,7 @@ do_replace(void __user *user, unsigned int len)

duprintf("ip_tables: Translated table\n");

- ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+ ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
tmp.num_counters, tmp.counters);
if (ret)
goto free_newinfo_untrans;
@@ -1331,7 +1331,7 @@ add_counter_to_entry(struct ipt_entry *e,
}

static int
-do_add_counters(void __user *user, unsigned int len, int compat)
+do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
{
unsigned int i;
struct xt_counters_info tmp;
@@ -1383,7 +1383,7 @@ do_add_counters(void __user *user, unsigned int len, int compat)
goto free;
}

- t = xt_find_table_lock(&init_net, AF_INET, name);
+ t = xt_find_table_lock(net, AF_INET, name);
if (!t || IS_ERR(t)) {
ret = t ? PTR_ERR(t) : -ENOENT;
goto free;
@@ -1789,7 +1789,7 @@ out_unlock:
}

static int
-compat_do_replace(void __user *user, unsigned int len)
+compat_do_replace(struct net *net, void __user *user, unsigned int len)
{
int ret;
struct compat_ipt_replace tmp;
@@ -1826,7 +1826,7 @@ compat_do_replace(void __user *user, unsigned int len)

duprintf("compat_do_replace: Translated table\n");

- ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+ ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
tmp.num_counters, compat_ptr(tmp.counters));
if (ret)
goto free_newinfo_untrans;
@@ -1850,11 +1850,11 @@ compat_do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user,

switch (cmd) {
case IPT_SO_SET_REPLACE:
- ret = compat_do_replace(user, len);
+ ret = compat_do_replace(sk->sk_net, user, len);
break;

case IPT_SO_SET_ADD_COUNTERS:
- ret = do_add_counters(user, len, 1);
+ ret = do_add_counters(sk->sk_net, user, len, 1);
break;

default:
@@ -1903,7 +1903,8 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
}

static int
-compat_get_entries(struct compat_ipt_get_entries __user *uptr, int *len)
+compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
+ int *len)
{
int ret;
struct compat_ipt_get_entries get;
@@ -1924,7 +1925,7 @@ compat_get_entries(struct compat_ipt_get_entries __user *uptr, int *len)
}

xt_compat_lock(AF_INET);
- t = xt_find_table_lock(&init_net, AF_INET, get.name);
+ t = xt_find_table_lock(net, AF_INET, get.name);
if (t && !IS_ERR(t)) {
struct xt_table_info *private = t->private;
struct xt_table_info info;
@@ -1960,10 +1961,10 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)

switch (cmd) {
case IPT_SO_GET_INFO:
- ret = get_info(user, len, 1);
+ ret = get_info(sk->sk_net, user, len, 1);
break;
case IPT_SO_GET_ENTRIES:
- ret = compat_get_entries(user, len);
+ ret = compat_get_entries(sk->sk_net, user, len);
break;
default:
ret = do_ipt_get_ctl(sk, cmd, user, len);
@@ -1982,11 +1983,11 @@ do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)

switch (cmd) {
case IPT_SO_SET_REPLACE:
- ret = do_replace(user, len);
+ ret = do_replace(sk->sk_net, user, len);
break;

case IPT_SO_SET_ADD_COUNTERS:
- ret = do_add_counters(user, len, 0);
+ ret = do_add_counters(sk->sk_net, user, len, 0);
break;

default:
@@ -2007,11 +2008,11 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)

switch (cmd) {
case IPT_SO_GET_INFO:
- ret = get_info(user, len, 0);
+ ret = get_info(sk->sk_net, user, len, 0);
break;

case IPT_SO_GET_ENTRIES:
- ret = get_entries(user, len);
+ ret = get_entries(sk->sk_net, user, len);
break;

case IPT_SO_GET_REVISION_MATCH:
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:41 UTC
Permalink
[NETFILTER]: ipt_recent: fix sparse warnings

net/ipv4/netfilter/ipt_recent.c:215:17: warning: symbol 't' shadows an earlier one
net/ipv4/netfilter/ipt_recent.c:179:22: originally declared here
net/ipv4/netfilter/ipt_recent.c:322:13: warning: context imbalance in 'recent_seq_start' - wrong count at exit
net/ipv4/netfilter/ipt_recent.c:354:13: warning: context imbalance in 'recent_seq_stop' - unexpected unlock

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 15a3018c4c11086b7dc5310aae4d1f13640fe844
tree b053ffabbb0186460955dafe935653aaf2e83e4a
parent a0b8676ce8423a544c283c59ac3d0c97e2e64b21
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:08 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:19 +0100

net/ipv4/netfilter/ipt_recent.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index e3154a9..68cbe3c 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -212,11 +212,11 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in,
recent_entry_remove(t, e);
ret = !ret;
} else if (info->check_set & (IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) {
- unsigned long t = jiffies - info->seconds * HZ;
+ unsigned long time = jiffies - info->seconds * HZ;
unsigned int i, hits = 0;

for (i = 0; i < e->nstamps; i++) {
- if (info->seconds && time_after(t, e->stamps[i]))
+ if (info->seconds && time_after(time, e->stamps[i]))
continue;
if (++hits >= info->hit_count) {
ret = !ret;
@@ -320,6 +320,7 @@ struct recent_iter_state {
};

static void *recent_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(recent_lock)
{
struct recent_iter_state *st = seq->private;
const struct recent_table *t = st->table;
@@ -352,6 +353,7 @@ static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
}

static void recent_seq_stop(struct seq_file *s, void *v)
+ __releases(recent_lock)
{
spin_unlock_bh(&recent_lock);
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:44 UTC
Permalink
[NETFILTER]: nf_conntrack_ipv6: fix sparse warnings

CHECK net/ipv6/netfilter/nf_conntrack_reasm.c
net/ipv6/netfilter/nf_conntrack_reasm.c:77:18: warning: symbol 'nf_ct_ipv6_sysctl_table' was not declared. Should it be static?
net/ipv6/netfilter/nf_conntrack_reasm.c:586:16: warning: symbol 'nf_ct_frag6_gather' was not declared. Should it be static?
net/ipv6/netfilter/nf_conntrack_reasm.c:662:6: warning: symbol 'nf_ct_frag6_output' was not declared. Should it be static?
net/ipv6/netfilter/nf_conntrack_reasm.c:683:5: warning: symbol 'nf_ct_frag6_kfree_frags' was not declared. Should it be static?
net/ipv6/netfilter/nf_conntrack_reasm.c:698:5: warning: symbol 'nf_ct_frag6_init' was not declared. Should it be static?
net/ipv6/netfilter/nf_conntrack_reasm.c:717:6: warning: symbol 'nf_ct_frag6_cleanup' was not declared. Should it be static?

Based on patch by Stephen Hemminger with suggestions by Yasuyuki KOZAKAI.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit ec8971e984194b97af037d06dc40a23f9581276b
tree 12aa4bdb71e3226153aa2a47d90ae168757f4e8c
parent e31ab9c086cec05ec66429e4d60a12cb60615c0e
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:09 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:05 +0100

net/ipv6/netfilter/nf_conntrack_reasm.c | 16 +---------------
1 files changed, 1 insertions(+), 15 deletions(-)

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 022da6c..2a0d698 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -39,6 +39,7 @@
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
+#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
#include <linux/sysctl.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
@@ -680,21 +681,6 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
nf_conntrack_put_reasm(skb);
}

-int nf_ct_frag6_kfree_frags(struct sk_buff *skb)
-{
- struct sk_buff *s, *s2;
-
- for (s = NFCT_FRAG6_CB(skb)->orig; s; s = s2) {
-
- s2 = s->next;
- kfree_skb(s);
- }
-
- kfree_skb(skb);
-
- return 0;
-}
-
int nf_ct_frag6_init(void)
{
nf_frags.hashfn = nf_hashfn;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:30 UTC
Permalink
[NETFILTER]: xt_owner: allow matching UID/GID ranges

Add support for ranges to the new revision. This doesn't affect
compatibility since the new revision was not released yet.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>

---
commit c1e9e8f11d30d54eb79e53ca02f0fd17a60407ef
tree 8ad98d01d79a033fd2014a2de8fbc03a00a4f2cd
parent 09a855c601cbbf240e7f127705dea74317658c45
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:22:=
03 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 15:04:18 +=
0100

include/linux/netfilter/xt_owner.h | 4 ++--
net/netfilter/xt_owner.c | 14 ++++++++------
2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilt=
er/xt_owner.h
index eacd34e..c84e52c 100644
--- a/include/linux/netfilter/xt_owner.h
+++ b/include/linux/netfilter/xt_owner.h
@@ -8,8 +8,8 @@ enum {
};
=20
struct xt_owner_match_info {
- u_int32_t uid;
- u_int32_t gid;
+ u_int32_t uid_min, uid_max;
+ u_int32_t gid_min, gid_max;
u_int8_t match, invert;
};
=20
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index d382f9c..9059c16 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -4,8 +4,8 @@
*
* (C) 2000 Marc Boucher <***@mbsi.ca>
*
- * Copyright =C2=A9 CC Computer Consultants GmbH, 2007
- * Contact: <***@computergmbh.de>
+ * Copyright =C2=A9 CC Computer Consultants GmbH, 2007 - 2008
+ * <***@computergmbh.de>
*
* This program is free software; you can redistribute it and/or modif=
y
* it under the terms of the GNU General Public License version 2 as
@@ -102,13 +102,15 @@ owner_mt(const struct sk_buff *skb, const struct =
net_device *in,
(XT_OWNER_UID | XT_OWNER_GID)) =3D=3D 0;
=20
if (info->match & XT_OWNER_UID)
- if ((filp->f_uid !=3D info->uid) ^
- !!(info->invert & XT_OWNER_UID))
+ if ((filp->f_uid >=3D info->uid_min &&
+ filp->f_uid <=3D info->uid_max) ^
+ !(info->invert & XT_OWNER_UID))
return false;
=20
if (info->match & XT_OWNER_GID)
- if ((filp->f_gid !=3D info->gid) ^
- !!(info->invert & XT_OWNER_GID))
+ if ((filp->f_gid >=3D info->gid_min &&
+ filp->f_gid <=3D info->gid_max) ^
+ !(info->invert & XT_OWNER_GID))
return false;
=20
return true;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-dev=
el" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:42 UTC
Permalink
[NETFILTER]: {ip,arp,ip6}_tables: fix sparse warnings in compat code

CHECK net/ipv4/netfilter/ip_tables.c
net/ipv4/netfilter/ip_tables.c:1453:8: warning: incorrect type in argument 3 (different signedness)
net/ipv4/netfilter/ip_tables.c:1453:8: expected int *size
net/ipv4/netfilter/ip_tables.c:1453:8: got unsigned int [usertype] *size
net/ipv4/netfilter/ip_tables.c:1458:44: warning: incorrect type in argument 3 (different signedness)
net/ipv4/netfilter/ip_tables.c:1458:44: expected int *size
net/ipv4/netfilter/ip_tables.c:1458:44: got unsigned int [usertype] *size
net/ipv4/netfilter/ip_tables.c:1603:2: warning: incorrect type in argument 2 (different signedness)
net/ipv4/netfilter/ip_tables.c:1603:2: expected unsigned int *i
net/ipv4/netfilter/ip_tables.c:1603:2: got int *<noident>
net/ipv4/netfilter/ip_tables.c:1627:8: warning: incorrect type in argument 3 (different signedness)
net/ipv4/netfilter/ip_tables.c:1627:8: expected int *size
net/ipv4/netfilter/ip_tables.c:1627:8: got unsigned int *size
net/ipv4/netfilter/ip_tables.c:1634:40: warning: incorrect type in argument 3 (different signedness)
net/ipv4/netfilter/ip_tables.c:1634:40: expected int *size
net/ipv4/netfilter/ip_tables.c:1634:40: got unsigned int *size
net/ipv4/netfilter/ip_tables.c:1653:8: warning: incorrect type in argument 5 (different signedness)
net/ipv4/netfilter/ip_tables.c:1653:8: expected unsigned int *i
net/ipv4/netfilter/ip_tables.c:1653:8: got int *<noident>
net/ipv4/netfilter/ip_tables.c:1666:2: warning: incorrect type in argument 2 (different signedness)
net/ipv4/netfilter/ip_tables.c:1666:2: expected unsigned int *i
net/ipv4/netfilter/ip_tables.c:1666:2: got int *<noident>
CHECK net/ipv4/netfilter/arp_tables.c
net/ipv4/netfilter/arp_tables.c:1285:40: warning: incorrect type in argument 3 (different signedness)
net/ipv4/netfilter/arp_tables.c:1285:40: expected int *size
net/ipv4/netfilter/arp_tables.c:1285:40: got unsigned int *size
net/ipv4/netfilter/arp_tables.c:1543:44: warning: incorrect type in argument 3 (different signedness)
net/ipv4/netfilter/arp_tables.c:1543:44: expected int *size
net/ipv4/netfilter/arp_tables.c:1543:44: got unsigned int [usertype] *size
CHECK net/ipv6/netfilter/ip6_tables.c
net/ipv6/netfilter/ip6_tables.c:1481:8: warning: incorrect type in argument 3 (different signedness)
net/ipv6/netfilter/ip6_tables.c:1481:8: expected int *size
net/ipv6/netfilter/ip6_tables.c:1481:8: got unsigned int [usertype] *size
net/ipv6/netfilter/ip6_tables.c:1486:44: warning: incorrect type in argument 3 (different signedness)
net/ipv6/netfilter/ip6_tables.c:1486:44: expected int *size
net/ipv6/netfilter/ip6_tables.c:1486:44: got unsigned int [usertype] *size
net/ipv6/netfilter/ip6_tables.c:1631:2: warning: incorrect type in argument 2 (different signedness)
net/ipv6/netfilter/ip6_tables.c:1631:2: expected unsigned int *i
net/ipv6/netfilter/ip6_tables.c:1631:2: got int *<noident>
net/ipv6/netfilter/ip6_tables.c:1655:8: warning: incorrect type in argument 3 (different signedness)
net/ipv6/netfilter/ip6_tables.c:1655:8: expected int *size
net/ipv6/netfilter/ip6_tables.c:1655:8: got unsigned int *size
net/ipv6/netfilter/ip6_tables.c:1662:40: warning: incorrect type in argument 3 (different signedness)
net/ipv6/netfilter/ip6_tables.c:1662:40: expected int *size
net/ipv6/netfilter/ip6_tables.c:1662:40: got unsigned int *size
net/ipv6/netfilter/ip6_tables.c:1680:8: warning: incorrect type in argument 5 (different signedness)
net/ipv6/netfilter/ip6_tables.c:1680:8: expected unsigned int *i
net/ipv6/netfilter/ip6_tables.c:1680:8: got int *<noident>
net/ipv6/netfilter/ip6_tables.c:1693:2: warning: incorrect type in argument 2 (different signedness)
net/ipv6/netfilter/ip6_tables.c:1693:2: expected unsigned int *i
net/ipv6/netfilter/ip6_tables.c:1693:2: got int *<noident>

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit e31ab9c086cec05ec66429e4d60a12cb60615c0e
tree 7d55247673a73a6c25d1264ce4974a71012361af
parent 15a3018c4c11086b7dc5310aae4d1f13640fe844
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:08 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:02 +0100

include/linux/netfilter/x_tables.h | 8 ++++----
net/ipv4/netfilter/ip_tables.c | 10 ++++++----
net/ipv6/netfilter/ip6_tables.c | 10 ++++++----
net/netfilter/x_tables.c | 8 ++++----
4 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 91a1dd5..11eea39 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -432,15 +432,15 @@ extern short xt_compat_calc_jump(int af, unsigned int offset);

extern int xt_compat_match_offset(struct xt_match *match);
extern int xt_compat_match_from_user(struct xt_entry_match *m,
- void **dstptr, int *size);
+ void **dstptr, unsigned int *size);
extern int xt_compat_match_to_user(struct xt_entry_match *m,
- void __user **dstptr, int *size);
+ void __user **dstptr, unsigned int *size);

extern int xt_compat_target_offset(struct xt_target *target);
extern void xt_compat_target_from_user(struct xt_entry_target *t,
- void **dstptr, int *size);
+ void **dstptr, unsigned int *size);
extern int xt_compat_target_to_user(struct xt_entry_target *t,
- void __user **dstptr, int *size);
+ void __user **dstptr, unsigned int *size);

#endif /* CONFIG_COMPAT */
#endif /* __KERNEL__ */
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 427bc9b..a73afa1 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1429,7 +1429,7 @@ struct compat_ipt_replace {

static int
compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
- compat_uint_t *size, struct xt_counters *counters,
+ unsigned int *size, struct xt_counters *counters,
unsigned int *i)
{
struct ipt_entry_target *t;
@@ -1476,7 +1476,7 @@ compat_find_calc_match(struct ipt_entry_match *m,
const char *name,
const struct ipt_ip *ip,
unsigned int hookmask,
- int *size, int *i)
+ int *size, unsigned int *i)
{
struct xt_match *match;

@@ -1534,7 +1534,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
struct ipt_entry_target *t;
struct xt_target *target;
unsigned int entry_offset;
- int ret, off, h, j;
+ unsigned int j;
+ int ret, off, h;

duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
@@ -1647,7 +1648,8 @@ static int
compat_check_entry(struct ipt_entry *e, const char *name,
unsigned int *i)
{
- int j, ret;
+ unsigned int j;
+ int ret;

j = 0;
ret = IPT_MATCH_ITERATE(e, check_match, name, &e->ip,
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 6fabb73..b91738a 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1457,7 +1457,7 @@ struct compat_ip6t_replace {

static int
compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
- compat_uint_t *size, struct xt_counters *counters,
+ unsigned int *size, struct xt_counters *counters,
unsigned int *i)
{
struct ip6t_entry_target *t;
@@ -1504,7 +1504,7 @@ compat_find_calc_match(struct ip6t_entry_match *m,
const char *name,
const struct ip6t_ip6 *ipv6,
unsigned int hookmask,
- int *size, int *i)
+ int *size, unsigned int *i)
{
struct xt_match *match;

@@ -1562,7 +1562,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
struct ip6t_entry_target *t;
struct xt_target *target;
unsigned int entry_offset;
- int ret, off, h, j;
+ unsigned int j;
+ int ret, off, h;

duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0
@@ -1674,7 +1675,8 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
static int compat_check_entry(struct ip6t_entry *e, const char *name,
unsigned int *i)
{
- int j, ret;
+ unsigned int j;
+ int ret;

j = 0;
ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6,
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d7fbb1b..cd78fc8 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -399,7 +399,7 @@ int xt_compat_match_offset(struct xt_match *match)
EXPORT_SYMBOL_GPL(xt_compat_match_offset);

int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
- int *size)
+ unsigned int *size)
{
struct xt_match *match = m->u.kernel.match;
struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
@@ -426,7 +426,7 @@ int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
EXPORT_SYMBOL_GPL(xt_compat_match_from_user);

int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
- int *size)
+ unsigned int *size)
{
struct xt_match *match = m->u.kernel.match;
struct compat_xt_entry_match __user *cm = *dstptr;
@@ -493,7 +493,7 @@ int xt_compat_target_offset(struct xt_target *target)
EXPORT_SYMBOL_GPL(xt_compat_target_offset);

void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
- int *size)
+ unsigned int *size)
{
struct xt_target *target = t->u.kernel.target;
struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
@@ -519,7 +519,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
EXPORT_SYMBOL_GPL(xt_compat_target_from_user);

int xt_compat_target_to_user(struct xt_entry_target *t, void __user **dstptr,
- int *size)
+ unsigned int *size)
{
struct xt_target *target = t->u.kernel.target;
struct compat_xt_entry_target __user *ct = *dstptr;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:06 UTC
Permalink
[NETFILTER]: nf_nat: switch rwlock to spinlock

Since we're using RCU, all users of nf_nat_lock take a write_lock.
Switch it to a spinlock.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 5cf331a51d8fed16e2e12142d8dc66eef5cb7bca
tree bd9226e5403ac965a26f9aa792a5951126d4c197
parent 9a797e6248868e23d468f801ec67b98a44ef689b
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:10 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:10 +0100

net/ipv4/netfilter/nf_nat_core.c | 26 +++++++++++++-------------
1 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index c7a985f..dd07362 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -31,7 +31,7 @@
#include <net/netfilter/nf_conntrack_l3proto.h>
#include <net/netfilter/nf_conntrack_l4proto.h>

-static DEFINE_RWLOCK(nf_nat_lock);
+static DEFINE_SPINLOCK(nf_nat_lock);

static struct nf_conntrack_l3proto *l3proto __read_mostly;

@@ -330,12 +330,12 @@ nf_nat_setup_info(struct nf_conn *ct,
unsigned int srchash;

srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
- write_lock_bh(&nf_nat_lock);
+ spin_lock_bh(&nf_nat_lock);
/* nf_conntrack_alter_reply might re-allocate exntension aera */
nat = nfct_nat(ct);
nat->ct = ct;
hlist_add_head_rcu(&nat->bysource, &bysource[srchash]);
- write_unlock_bh(&nf_nat_lock);
+ spin_unlock_bh(&nf_nat_lock);
}

/* It's done. */
@@ -521,14 +521,14 @@ int nf_nat_protocol_register(const struct nf_nat_protocol *proto)
{
int ret = 0;

- write_lock_bh(&nf_nat_lock);
+ spin_lock_bh(&nf_nat_lock);
if (nf_nat_protos[proto->protonum] != &nf_nat_unknown_protocol) {
ret = -EBUSY;
goto out;
}
rcu_assign_pointer(nf_nat_protos[proto->protonum], proto);
out:
- write_unlock_bh(&nf_nat_lock);
+ spin_unlock_bh(&nf_nat_lock);
return ret;
}
EXPORT_SYMBOL(nf_nat_protocol_register);
@@ -536,10 +536,10 @@ EXPORT_SYMBOL(nf_nat_protocol_register);
/* Noone stores the protocol anywhere; simply delete it. */
void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto)
{
- write_lock_bh(&nf_nat_lock);
+ spin_lock_bh(&nf_nat_lock);
rcu_assign_pointer(nf_nat_protos[proto->protonum],
&nf_nat_unknown_protocol);
- write_unlock_bh(&nf_nat_lock);
+ spin_unlock_bh(&nf_nat_lock);
synchronize_rcu();
}
EXPORT_SYMBOL(nf_nat_protocol_unregister);
@@ -594,10 +594,10 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)

NF_CT_ASSERT(nat->ct->status & IPS_NAT_DONE_MASK);

- write_lock_bh(&nf_nat_lock);
+ spin_lock_bh(&nf_nat_lock);
hlist_del_rcu(&nat->bysource);
nat->ct = NULL;
- write_unlock_bh(&nf_nat_lock);
+ spin_unlock_bh(&nf_nat_lock);
}

static void nf_nat_move_storage(struct nf_conn *conntrack, void *old)
@@ -609,10 +609,10 @@ static void nf_nat_move_storage(struct nf_conn *conntrack, void *old)
if (!ct || !(ct->status & IPS_NAT_DONE_MASK))
return;

- write_lock_bh(&nf_nat_lock);
+ spin_lock_bh(&nf_nat_lock);
hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
new_nat->ct = ct;
- write_unlock_bh(&nf_nat_lock);
+ spin_unlock_bh(&nf_nat_lock);
}

static struct nf_ct_ext_type nat_extend __read_mostly = {
@@ -646,13 +646,13 @@ static int __init nf_nat_init(void)
}

/* Sew in builtin protocols. */
- write_lock_bh(&nf_nat_lock);
+ spin_lock_bh(&nf_nat_lock);
for (i = 0; i < MAX_IP_NAT_PROTO; i++)
rcu_assign_pointer(nf_nat_protos[i], &nf_nat_unknown_protocol);
rcu_assign_pointer(nf_nat_protos[IPPROTO_TCP], &nf_nat_protocol_tcp);
rcu_assign_pointer(nf_nat_protos[IPPROTO_UDP], &nf_nat_protocol_udp);
rcu_assign_pointer(nf_nat_protos[IPPROTO_ICMP], &nf_nat_protocol_icmp);
- write_unlock_bh(&nf_nat_lock);
+ spin_unlock_bh(&nf_nat_lock);

/* Initialize fake conntrack so that NAT will skip it */
nf_conntrack_untracked.status |= IPS_NAT_DONE_MASK;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:00 UTC
Permalink
[NETFILTER]: nf_conntrack: reorder struct nf_conntrack_l4proto

Reorder struct nf_conntrack_l4proto so all members used during packet
processing are in the same cacheline.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 7b2624034f45ce13ecfdf13847cbf7ad67bb7137
tree b723a4d976afb8853e3b619922b24004ab2bb6f7
parent 2f75544ea729329074f86020b4524179cc82c219
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:08 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:08 +0100

include/net/netfilter/nf_conntrack_l4proto.h | 19 +++++++++----------
1 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index fb50c21..84892cc 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -23,9 +23,6 @@ struct nf_conntrack_l4proto
/* L4 Protocol number. */
u_int8_t l4proto;

- /* Protocol name */
- const char *name;
-
/* Try to fill in the third arg: dataoff is offset past network protocol
hdr. Return true if possible. */
int (*pkt_to_tuple)(const struct sk_buff *skb,
@@ -38,13 +35,6 @@ struct nf_conntrack_l4proto
int (*invert_tuple)(struct nf_conntrack_tuple *inverse,
const struct nf_conntrack_tuple *orig);

- /* Print out the per-protocol part of the tuple. Return like seq_* */
- int (*print_tuple)(struct seq_file *s,
- const struct nf_conntrack_tuple *);
-
- /* Print out the private part of the conntrack. */
- int (*print_conntrack)(struct seq_file *s, const struct nf_conn *);
-
/* Returns verdict for packet, or -1 for invalid. */
int (*packet)(struct nf_conn *conntrack,
const struct sk_buff *skb,
@@ -65,6 +55,13 @@ struct nf_conntrack_l4proto
enum ip_conntrack_info *ctinfo,
int pf, unsigned int hooknum);

+ /* Print out the per-protocol part of the tuple. Return like seq_* */
+ int (*print_tuple)(struct seq_file *s,
+ const struct nf_conntrack_tuple *);
+
+ /* Print out the private part of the conntrack. */
+ int (*print_conntrack)(struct seq_file *s, const struct nf_conn *);
+
/* convert protoinfo to nfnetink attributes */
int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,
const struct nf_conn *ct);
@@ -87,6 +84,8 @@ struct nf_conntrack_l4proto
struct ctl_table *ctl_compat_table;
#endif
#endif
+ /* Protocol name */
+ const char *name;

/* Module (if any) which this is connected to. */
struct module *me;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:58 UTC
Permalink
[NETFILTER]: nf_conntrack: avoid duplicate protocol comparison in nf_ct_tuple_equal()

nf_ct_tuple_src_equal() and nf_ct_tuple_dst_equal() both compare the protocol
numbers. Unfortunately gcc doesn't optimize out the second comparison, so
remove it and prefix both functions with __ to indicate that they should not
be used directly.

Saves another 16 byte of text in __nf_conntrack_find() on x86_64:

nf_conntrack_tuple_taken | -20 # 320 -> 300, size inlines: 181 -> 161
__nf_conntrack_find | -16 # 267 -> 251, size inlines: 127 -> 115
__nf_conntrack_confirm | -40 # 875 -> 835, size inlines: 570 -> 537
3 functions changed, 76 bytes removed

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 18fd2bf273954b4fa527e5d630049f40acc29fca
tree f2b287d7b240777464be03524e99b18cd3e4e497
parent 419fd8e88eba9f4c35fd1bdc27aaa22578f202fb
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:14 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:08 +0100

include/net/netfilter/nf_conntrack_tuple.h | 17 ++++++++---------
1 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index 45cb17c..e69ab2e 100644
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -132,34 +132,33 @@ struct nf_conntrack_tuple_hash

#endif /* __KERNEL__ */

-static inline int nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1,
- const struct nf_conntrack_tuple *t2)
+static inline int __nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1,
+ const struct nf_conntrack_tuple *t2)
{
return (t1->src.u3.all[0] == t2->src.u3.all[0] &&
t1->src.u3.all[1] == t2->src.u3.all[1] &&
t1->src.u3.all[2] == t2->src.u3.all[2] &&
t1->src.u3.all[3] == t2->src.u3.all[3] &&
t1->src.u.all == t2->src.u.all &&
- t1->src.l3num == t2->src.l3num &&
- t1->dst.protonum == t2->dst.protonum);
+ t1->src.l3num == t2->src.l3num);
}

-static inline int nf_ct_tuple_dst_equal(const struct nf_conntrack_tuple *t1,
- const struct nf_conntrack_tuple *t2)
+static inline int __nf_ct_tuple_dst_equal(const struct nf_conntrack_tuple *t1,
+ const struct nf_conntrack_tuple *t2)
{
return (t1->dst.u3.all[0] == t2->dst.u3.all[0] &&
t1->dst.u3.all[1] == t2->dst.u3.all[1] &&
t1->dst.u3.all[2] == t2->dst.u3.all[2] &&
t1->dst.u3.all[3] == t2->dst.u3.all[3] &&
t1->dst.u.all == t2->dst.u.all &&
- t1->src.l3num == t2->src.l3num &&
t1->dst.protonum == t2->dst.protonum);
}

static inline int nf_ct_tuple_equal(const struct nf_conntrack_tuple *t1,
const struct nf_conntrack_tuple *t2)
{
- return nf_ct_tuple_src_equal(t1, t2) && nf_ct_tuple_dst_equal(t1, t2);
+ return __nf_ct_tuple_src_equal(t1, t2) &&
+ __nf_ct_tuple_dst_equal(t1, t2);
}

static inline int nf_ct_tuple_mask_equal(const struct nf_conntrack_tuple_mask *m1,
@@ -199,7 +198,7 @@ static inline int nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,
const struct nf_conntrack_tuple_mask *mask)
{
return nf_ct_tuple_src_mask_cmp(t, tuple, mask) &&
- nf_ct_tuple_dst_equal(t, tuple);
+ __nf_ct_tuple_dst_equal(t, tuple);
}

#endif /* _NF_CONNTRACK_TUPLE_H */
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:53 UTC
Permalink
[NETFILTER]: nf_conntrack: use RCU for conntrack hash

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit b3deb266341ef2957c9386657243bfdf3480cf84
tree a0f6f7efa7464a3fd81e5bbab659ee83b1362698
parent 504ca298fd3846f894b3979666df5bf5021707ff
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:12 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:07 +0100

include/net/netfilter/nf_conntrack.h | 2 +
.../netfilter/nf_conntrack_l3proto_ipv4_compat.c | 18 ++++---
net/netfilter/nf_conntrack_core.c | 63 +++++++++++++-------
net/netfilter/nf_conntrack_netlink.c | 11 ++-
net/netfilter/nf_conntrack_standalone.c | 18 +++---
net/netfilter/xt_connlimit.c | 4 +
6 files changed, 73 insertions(+), 43 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index dada041..561ae76 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -129,6 +129,8 @@ struct nf_conn

/* Extensions */
struct nf_ct_ext *ext;
+
+ struct rcu_head rcu;
};

static inline struct nf_conn *
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 2fdcd92..0ee87ed 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -39,12 +39,14 @@ struct ct_iter_state {
static struct hlist_node *ct_get_first(struct seq_file *seq)
{
struct ct_iter_state *st = seq->private;
+ struct hlist_node *n;

for (st->bucket = 0;
st->bucket < nf_conntrack_htable_size;
st->bucket++) {
- if (!hlist_empty(&nf_conntrack_hash[st->bucket]))
- return nf_conntrack_hash[st->bucket].first;
+ n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+ if (n)
+ return n;
}
return NULL;
}
@@ -54,11 +56,11 @@ static struct hlist_node *ct_get_next(struct seq_file *seq,
{
struct ct_iter_state *st = seq->private;

- head = head->next;
+ head = rcu_dereference(head->next);
while (head == NULL) {
if (++st->bucket >= nf_conntrack_htable_size)
return NULL;
- head = nf_conntrack_hash[st->bucket].first;
+ head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
}
return head;
}
@@ -74,8 +76,9 @@ static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
}

static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(RCU)
{
- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
return ct_get_idx(seq, *pos);
}

@@ -86,8 +89,9 @@ static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
}

static void ct_seq_stop(struct seq_file *s, void *v)
+ __releases(RCU)
{
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();
}

static int ct_seq_show(struct seq_file *s, void *v)
@@ -226,6 +230,7 @@ static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
}

static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(RCU)
{
rcu_read_lock();
return ct_expect_get_idx(seq, *pos);
@@ -238,6 +243,7 @@ static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
}

static void exp_seq_stop(struct seq_file *seq, void *v)
+ __releases(RCU)
{
rcu_read_unlock();
}
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 1025607..a54bfec 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -166,8 +166,8 @@ static void
clean_from_lists(struct nf_conn *ct)
{
pr_debug("clean_from_lists(%p)\n", ct);
- hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
- hlist_del(&ct->tuplehash[IP_CT_DIR_REPLY].hnode);
+ hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
+ hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode);

/* Destroy all pending expectations */
nf_ct_remove_expectations(ct);
@@ -253,7 +253,7 @@ __nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
struct hlist_node *n;
unsigned int hash = hash_conntrack(tuple);

- hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode) {
+ hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
nf_ct_tuple_equal(tuple, &h->tuple)) {
NF_CT_STAT_INC(found);
@@ -271,12 +271,16 @@ struct nf_conntrack_tuple_hash *
nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple)
{
struct nf_conntrack_tuple_hash *h;
+ struct nf_conn *ct;

- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
h = __nf_conntrack_find(tuple, NULL);
- if (h)
- atomic_inc(&nf_ct_tuplehash_to_ctrack(h)->ct_general.use);
- read_unlock_bh(&nf_conntrack_lock);
+ if (h) {
+ ct = nf_ct_tuplehash_to_ctrack(h);
+ if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
+ h = NULL;
+ }
+ rcu_read_unlock();

return h;
}
@@ -286,10 +290,10 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
unsigned int hash,
unsigned int repl_hash)
{
- hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
- &nf_conntrack_hash[hash]);
- hlist_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
- &nf_conntrack_hash[repl_hash]);
+ hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
+ &nf_conntrack_hash[hash]);
+ hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
+ &nf_conntrack_hash[repl_hash]);
}

void nf_conntrack_hash_insert(struct nf_conn *ct)
@@ -392,9 +396,9 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
{
struct nf_conntrack_tuple_hash *h;

- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
h = __nf_conntrack_find(tuple, ignored_conntrack);
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();

return h != NULL;
}
@@ -413,21 +417,23 @@ static int early_drop(unsigned int hash)
unsigned int i, cnt = 0;
int dropped = 0;

- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
for (i = 0; i < nf_conntrack_htable_size; i++) {
- hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode) {
+ hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash],
+ hnode) {
tmp = nf_ct_tuplehash_to_ctrack(h);
if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
ct = tmp;
cnt++;
}
+
+ if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
+ ct = NULL;
if (ct || cnt >= NF_CT_EVICTION_RANGE)
break;
hash = (hash + 1) % nf_conntrack_htable_size;
}
- if (ct)
- atomic_inc(&ct->ct_general.use);
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();

if (!ct)
return dropped;
@@ -480,17 +486,25 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
/* Don't set timer yet: wait for confirmation */
setup_timer(&conntrack->timeout, death_by_timeout,
(unsigned long)conntrack);
+ INIT_RCU_HEAD(&conntrack->rcu);

return conntrack;
}
EXPORT_SYMBOL_GPL(nf_conntrack_alloc);

-void nf_conntrack_free(struct nf_conn *conntrack)
+static void nf_conntrack_free_rcu(struct rcu_head *head)
{
- nf_ct_ext_free(conntrack);
- kmem_cache_free(nf_conntrack_cachep, conntrack);
+ struct nf_conn *ct = container_of(head, struct nf_conn, rcu);
+
+ nf_ct_ext_free(ct);
+ kmem_cache_free(nf_conntrack_cachep, ct);
atomic_dec(&nf_conntrack_count);
}
+
+void nf_conntrack_free(struct nf_conn *conntrack)
+{
+ call_rcu(&conntrack->rcu, nf_conntrack_free_rcu);
+}
EXPORT_SYMBOL_GPL(nf_conntrack_free);

/* Allocate a new conntrack: we return -ENOMEM if classification
@@ -1036,12 +1050,17 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
* use a newrandom seed */
get_random_bytes(&rnd, 4);

+ /* Lookups in the old hash might happen in parallel, which means we
+ * might get false negatives during connection lookup. New connections
+ * created because of a false negative won't make it into the hash
+ * though since that required taking the lock.
+ */
write_lock_bh(&nf_conntrack_lock);
for (i = 0; i < nf_conntrack_htable_size; i++) {
while (!hlist_empty(&nf_conntrack_hash[i])) {
h = hlist_entry(nf_conntrack_hash[i].first,
struct nf_conntrack_tuple_hash, hnode);
- hlist_del(&h->hnode);
+ hlist_del_rcu(&h->hnode);
bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
hlist_add_head(&h->hnode, &hash[bucket]);
}
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 557f471..b701dcc 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -545,12 +545,12 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
u_int8_t l3proto = nfmsg->nfgen_family;

- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
last = (struct nf_conn *)cb->args[1];
for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
restart:
- hlist_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]],
- hnode) {
+ hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[cb->args[0]],
+ hnode) {
if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
continue;
ct = nf_ct_tuplehash_to_ctrack(h);
@@ -568,7 +568,8 @@ restart:
cb->nlh->nlmsg_seq,
IPCTNL_MSG_CT_NEW,
1, ct) < 0) {
- nf_conntrack_get(&ct->ct_general);
+ if (!atomic_inc_not_zero(&ct->ct_general.use))
+ continue;
cb->args[1] = (unsigned long)ct;
goto out;
}
@@ -584,7 +585,7 @@ restart:
}
}
out:
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();
if (last)
nf_ct_put(last);

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 28c5ae8..98f0cd3 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -58,12 +58,14 @@ struct ct_iter_state {
static struct hlist_node *ct_get_first(struct seq_file *seq)
{
struct ct_iter_state *st = seq->private;
+ struct hlist_node *n;

for (st->bucket = 0;
st->bucket < nf_conntrack_htable_size;
st->bucket++) {
- if (!hlist_empty(&nf_conntrack_hash[st->bucket]))
- return nf_conntrack_hash[st->bucket].first;
+ n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+ if (n)
+ return n;
}
return NULL;
}
@@ -73,11 +75,11 @@ static struct hlist_node *ct_get_next(struct seq_file *seq,
{
struct ct_iter_state *st = seq->private;

- head = head->next;
+ head = rcu_dereference(head->next);
while (head == NULL) {
if (++st->bucket >= nf_conntrack_htable_size)
return NULL;
- head = nf_conntrack_hash[st->bucket].first;
+ head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
}
return head;
}
@@ -93,9 +95,9 @@ static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
}

static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
- __acquires(nf_conntrack_lock)
+ __acquires(RCU)
{
- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
return ct_get_idx(seq, *pos);
}

@@ -106,9 +108,9 @@ static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
}

static void ct_seq_stop(struct seq_file *s, void *v)
- __releases(nf_conntrack_lock)
+ __releases(RCU)
{
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();
}

/* return 0 on success, 1 in case of error */
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index e00ecd9..f9b59a6 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -120,7 +120,7 @@ static int count_them(struct xt_connlimit_data *data,
else
hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];

- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();

/* check the saved connections */
list_for_each_entry_safe(conn, tmp, hash, list) {
@@ -163,7 +163,7 @@ static int count_them(struct xt_connlimit_data *data,
++matches;
}

- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();

if (addit) {
/* save the new connection in our list */
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:56 UTC
Permalink
[NETFILTER]: nf_conntrack: optimize __nf_conntrack_find()

Ignoring specific entries in __nf_conntrack_find() is only needed by NAT
for nf_conntrack_tuple_taken(). Remove it from __nf_conntrack_find()
and make nf_conntrack_tuple_taken() search the hash itself.

Saves 54 bytes of text in the hotpath on x86_64:

__nf_conntrack_find | -54 # 321 -> 267, # inlines: 3 -> 2, size inlines: 181 -> 127
nf_conntrack_tuple_taken | +305 # 15 -> 320, lexblocks: 0 -> 3, # inlines: 0 -> 3, size inlines: 0 -> 181
nf_conntrack_find_get | -2 # 90 -> 88
3 functions changed, 305 bytes added, 56 bytes removed, diff: +249

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 419fd8e88eba9f4c35fd1bdc27aaa22578f202fb
tree a1a0c6ac4b3543a127ee27cad47d5b4aa77862ec
parent 0d9d7643b39dae81d0b16b54365d7985a278227f
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:13 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:07 +0100

include/net/netfilter/nf_conntrack.h | 3 +--
net/netfilter/nf_conntrack_core.c | 22 +++++++++++++++-------
net/netfilter/nf_conntrack_netlink.c | 6 +++---
net/netfilter/xt_connlimit.c | 2 +-
4 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 561ae76..14e0cc8 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -178,8 +178,7 @@ extern void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced,
unsigned int size);

extern struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
- const struct nf_conn *ignored_conntrack);
+__nf_conntrack_find(const struct nf_conntrack_tuple *tuple);

extern void nf_conntrack_hash_insert(struct nf_conn *ct);

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index f284ddd..ce4c4ba 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -246,16 +246,14 @@ static void death_by_timeout(unsigned long ul_conntrack)
}

struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
- const struct nf_conn *ignored_conntrack)
+__nf_conntrack_find(const struct nf_conntrack_tuple *tuple)
{
struct nf_conntrack_tuple_hash *h;
struct hlist_node *n;
unsigned int hash = hash_conntrack(tuple);

hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
- if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
- nf_ct_tuple_equal(tuple, &h->tuple)) {
+ if (nf_ct_tuple_equal(tuple, &h->tuple)) {
NF_CT_STAT_INC(found);
return h;
}
@@ -274,7 +272,7 @@ nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple)
struct nf_conn *ct;

rcu_read_lock();
- h = __nf_conntrack_find(tuple, NULL);
+ h = __nf_conntrack_find(tuple);
if (h) {
ct = nf_ct_tuplehash_to_ctrack(h);
if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
@@ -395,12 +393,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
const struct nf_conn *ignored_conntrack)
{
struct nf_conntrack_tuple_hash *h;
+ struct hlist_node *n;
+ unsigned int hash = hash_conntrack(tuple);

rcu_read_lock();
- h = __nf_conntrack_find(tuple, ignored_conntrack);
+ hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
+ if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
+ nf_ct_tuple_equal(tuple, &h->tuple)) {
+ NF_CT_STAT_INC(found);
+ rcu_read_unlock();
+ return 1;
+ }
+ NF_CT_STAT_INC(searched);
+ }
rcu_read_unlock();

- return h != NULL;
+ return 0;
}
EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b6a8c08..bf86fdd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1222,9 +1222,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,

spin_lock_bh(&nf_conntrack_lock);
if (cda[CTA_TUPLE_ORIG])
- h = __nf_conntrack_find(&otuple, NULL);
+ h = __nf_conntrack_find(&otuple);
else if (cda[CTA_TUPLE_REPLY])
- h = __nf_conntrack_find(&rtuple, NULL);
+ h = __nf_conntrack_find(&rtuple);

if (h == NULL) {
struct nf_conntrack_tuple master;
@@ -1239,7 +1239,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
if (err < 0)
goto out_unlock;

- master_h = __nf_conntrack_find(&master, NULL);
+ master_h = __nf_conntrack_find(&master);
if (master_h == NULL) {
err = -ENOENT;
goto out_unlock;
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index f9b59a6..3b01119 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -124,7 +124,7 @@ static int count_them(struct xt_connlimit_data *data,

/* check the saved connections */
list_for_each_entry_safe(conn, tmp, hash, list) {
- found = __nf_conntrack_find(&conn->tuple, NULL);
+ found = __nf_conntrack_find(&conn->tuple);
found_ct = NULL;

if (found != NULL)
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:09 UTC
Permalink
[NETFILTER]: nf_conntrack_netlink: transmit mark during all events

The following feature was submitted some months ago. It forces the dump
of mark during the connection destruction event. The induced load is
quiet small and the patch is usefull to provide an easy way to filter
event on user side without having to keep an hash in userspace.

Signed-off-by: Eric Leblond <***@inl.fr>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 8bf50a16334291fa18d090ad11221e802327b26f
tree 41e125cf8230f6ffd0cc8f94679247e82c2c57c4
parent bc81193022f55c5cc719728b1bdf67648054bce6
author Eric Leblond <***@inl.fr> Tue, 29 Jan 2008 16:22:16 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:11 +0100

net/netfilter/nf_conntrack_netlink.c | 11 ++++++-----
1 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bf86fdd..4a1b42b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -491,11 +491,6 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
&& ctnetlink_dump_helpinfo(skb, ct) < 0)
goto nla_put_failure;

-#ifdef CONFIG_NF_CONNTRACK_MARK
- if ((events & IPCT_MARK || ct->mark)
- && ctnetlink_dump_mark(skb, ct) < 0)
- goto nla_put_failure;
-#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
if ((events & IPCT_SECMARK || ct->secmark)
&& ctnetlink_dump_secmark(skb, ct) < 0)
@@ -516,6 +511,12 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
goto nla_put_failure;
}

+#ifdef CONFIG_NF_CONNTRACK_MARK
+ if ((events & IPCT_MARK || ct->mark)
+ && ctnetlink_dump_mark(skb, ct) < 0)
+ goto nla_put_failure;
+#endif
+
nlh->nlmsg_len = skb->tail - b;
nfnetlink_send(skb, 0, group, 0);
return NOTIFY_DONE;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:12 UTC
Permalink
[NETFILTER]: nf_conntrack: kill unused static inline (do_iter)

Signed-off-by: Ilpo J=E4rvinen <***@helsinki.fi>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 589cbc737eef0c619fc75c099063861ec7540ec7
tree aec04a71a3720e1c37f8620f07b12e9e33e77ffa
parent da5a0452866ad6f4a4967f31d5d5854d9f481e33
author Ilpo J=E4rvinen <***@helsinki.fi> Tue, 29 Jan 2008 16:=
22:17 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:12 +=
0100

net/netfilter/nf_conntrack_core.c | 8 --------
1 files changed, 0 insertions(+), 8 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_connt=
rack_core.c
index 0db7d1d..2392234 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -902,14 +902,6 @@ static void nf_conntrack_attach(struct sk_buff *ns=
kb, struct sk_buff *skb)
nf_conntrack_get(nskb->nfct);
}
=20
-static inline int
-do_iter(const struct nf_conntrack_tuple_hash *i,
- int (*iter)(struct nf_conn *i, void *data),
- void *data)
-{
- return iter(nf_ct_tuplehash_to_ctrack(i), data);
-}
-
/* Bring out ya dead! */
static struct nf_conn *
get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
-
To unsubscribe from this list: send the line "unsubscribe netfilter-dev=
el" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:17 UTC
Permalink
[NETFILTER]: x_tables: netns propagation for /proc/net/*_tables_names

Propagate netns together with AF down to ->start/->next/->stop
iterators. Choose table based on netns and AF for showing.

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 513f43dcb3326e0f5273191d368a17585e865afc
tree 33e9aa9f7a1a993512840fc84708167ac9d62cf6
parent 738a61f2bcd7ded174cdac25f330e7bb1e3fb2c5
author Alexey Dobriyan <***@sw.ru> Wed, 30 Jan 2008 21:03:13 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:13 +0100

net/netfilter/x_tables.c | 31 +++++++++++++++++++------------
1 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 89e322d..12ed64c 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -720,27 +720,33 @@ void *xt_unregister_table(struct xt_table *table)
EXPORT_SYMBOL_GPL(xt_unregister_table);

#ifdef CONFIG_PROC_FS
+struct xt_names_priv {
+ struct seq_net_private p;
+ int af;
+};
static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
{
- struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
- u_int16_t af = (unsigned long)pde->data;
+ struct xt_names_priv *priv = seq->private;
+ struct net *net = priv->p.net;
+ int af = priv->af;

mutex_lock(&xt[af].mutex);
- return seq_list_start(&init_net.xt.tables[af], *pos);
+ return seq_list_start(&net->xt.tables[af], *pos);
}

static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
- struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
- u_int16_t af = (unsigned long)pde->data;
+ struct xt_names_priv *priv = seq->private;
+ struct net *net = priv->p.net;
+ int af = priv->af;

- return seq_list_next(v, &init_net.xt.tables[af], pos);
+ return seq_list_next(v, &net->xt.tables[af], pos);
}

static void xt_table_seq_stop(struct seq_file *seq, void *v)
{
- struct proc_dir_entry *pde = seq->private;
- u_int16_t af = (unsigned long)pde->data;
+ struct xt_names_priv *priv = seq->private;
+ int af = priv->af;

mutex_unlock(&xt[af].mutex);
}
@@ -765,12 +771,13 @@ static const struct seq_operations xt_table_seq_ops = {
static int xt_table_open(struct inode *inode, struct file *file)
{
int ret;
+ struct xt_names_priv *priv;

- ret = seq_open(file, &xt_table_seq_ops);
+ ret = seq_open_net(inode, file, &xt_table_seq_ops,
+ sizeof(struct xt_names_priv));
if (!ret) {
- struct seq_file *seq = file->private_data;
-
- seq->private = PDE(inode);
+ priv = ((struct seq_file *)file->private_data)->private;
+ priv->af = (unsigned long)PDE(inode)->data;
}
return ret;
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:30 UTC
Permalink
[NETFILTER]: nf_{conntrack,nat}_proto_gre: annotate with const

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 0d18e97268fb631100b6b7689ac1b75426463d0c
tree ed5370f3ae3ceb58b0963ffc83f9b17f3fa8ff78
parent 605ba346a8a54fc3c2a6d846a345d4d6c3cd5642
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:17 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:17 +0100

net/ipv4/netfilter/nf_nat_proto_gre.c | 2 +-
net/netfilter/nf_conntrack_proto_gre.c | 6 ++++--
2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index b887ebb..a1e4da1 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -104,7 +104,7 @@ gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff,
{
struct gre_hdr *greh;
struct gre_hdr_pptp *pgreh;
- struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+ const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
unsigned int hdroff = iphdroff + iph->ihl * 4;

/* pgreh includes two optional 32bit fields which are not required
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 4a185f6..e10024a 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -161,9 +161,11 @@ static int gre_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conntrack_tuple *tuple)
{
- struct gre_hdr_pptp _pgrehdr, *pgrehdr;
+ const struct gre_hdr_pptp *pgrehdr;
+ struct gre_hdr_pptp _pgrehdr;
__be16 srckey;
- struct gre_hdr _grehdr, *grehdr;
+ const struct gre_hdr *grehdr;
+ struct gre_hdr _grehdr;

/* first only delinearize old RFC1701 GRE header */
grehdr = skb_header_pointer(skb, dataoff, sizeof(_grehdr), &_grehdr);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:59 UTC
Permalink
[NETFILTER]: nf_conntrack: optimize hash_conntrack()

Avoid calling jhash three times and hash the entire tuple in one go.

__hash_conntrack | -485 # 760 -> 275, # inlines: 3 -> 1, size inlines: 717 -> 252
1 function changed, 485 bytes removed

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 2f75544ea729329074f86020b4524179cc82c219
tree e4dc132f189625ad5bd28e043e348f0deb825c47
parent 18fd2bf273954b4fa527e5d630049f40acc29fca
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:15 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:08 +0100

net/netfilter/nf_conntrack_core.c | 18 +++++++++++-------
1 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index ce4c4ba..24a0863 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -73,15 +73,19 @@ static unsigned int nf_conntrack_hash_rnd;
static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
unsigned int size, unsigned int rnd)
{
- unsigned int a, b;
+ unsigned int n;
+ u_int32_t h;

- a = jhash2(tuple->src.u3.all, ARRAY_SIZE(tuple->src.u3.all),
- (tuple->src.l3num << 16) | tuple->dst.protonum);
- b = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
- ((__force __u16)tuple->src.u.all << 16) |
- (__force __u16)tuple->dst.u.all);
+ /* The direction must be ignored, so we hash everything up to the
+ * destination ports (which is a multiple of 4) and treat the last
+ * three bytes manually.
+ */
+ n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
+ h = jhash2((u32 *)tuple, n,
+ rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
+ tuple->dst.protonum));

- return ((u64)jhash_2words(a, b, rnd) * size) >> 32;
+ return ((u64)h * size) >> 32;
}

static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Philip Craig
2008-04-28 08:24:50 UTC
Permalink
Post by Patrick McHardy
[NETFILTER]: nf_conntrack: optimize hash_conntrack()
Avoid calling jhash three times and hash the entire tuple in one go.
This has broken conntrack on a big endian ARM platform. 'conntrack -L'
shows many unreplied connections all with the same addresses/ports,
instead of just one connection.

It seems the problem is that we are now hashing the padding in struct
nf_conntrack_tuple, which we previously didn't, and this padding isn't
always zeroed, so the hash gives garbage.

Changing NF_CT_TUPLE_U_BLANK() to memset the whole tuple fixes it.

Adding __attribute__ ((packed)) everywhere to remove the padding
didn't seem to fix it, but I don't understand why... maybe I did
something wrong still. This probably isn't a solution anyway since
these structs are used in userspace?

I'm not sure what's special about big-endian or ARM to only affect
this platform. Any ideas?

I can work on this more tomorrow.

Here's the pahole output:

struct nf_conntrack_man {
union nf_inet_addr u3; /* 0 16 */
union nf_conntrack_man_proto u; /* 16 4 */
u_int16_t l3num; /* 20 2 */

/* size: 24, cachelines: 1 */
/* padding: 2 */
/* last cacheline: 24 bytes */
}; /* definitions: 1 */

struct nf_conntrack_tuple {
struct nf_conntrack_man src; /* 0 24 */

/* XXX last struct has 2 bytes of padding */

struct {
union nf_inet_addr u3; /* 24 16 */
union {
__be16 all; /* 2 */
struct {
__be16 port; /* 40 2 */
} tcp; /* 4 */
struct {
__be16 port; /* 40 2 */
} udp; /* 4 */
struct {
u_int8_t type; /* 40 1 */
u_int8_t code; /* 41 1 */
} icmp; /* 4 */
struct {
__be16 port; /* 40 2 */
} sctp; /* 4 */
struct {
__be16 key; /* 40 2 */
} gre; /* 4 */
} u; /* 40 4 */
u_int8_t protonum; /* 44 1 */
u_int8_t dir; /* 45 1 */
} dst; /* 24 24 */

/* XXX last struct has 2 bytes of padding */

/* size: 48, cachelines: 1 */
/* paddings: 2, sum paddings: 4 */
/* last cacheline: 48 bytes */
}; /* definitions: 1 */
Post by Patrick McHardy
__hash_conntrack | -485 # 760 -> 275, # inlines: 3 -> 1, size inlines: 717 -> 252
1 function changed, 485 bytes removed
---
commit 2f75544ea729329074f86020b4524179cc82c219
tree e4dc132f189625ad5bd28e043e348f0deb825c47
parent 18fd2bf273954b4fa527e5d630049f40acc29fca
net/netfilter/nf_conntrack_core.c | 18 +++++++++++-------
1 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index ce4c4ba..24a0863 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -73,15 +73,19 @@ static unsigned int nf_conntrack_hash_rnd;
static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
unsigned int size, unsigned int rnd)
{
- unsigned int a, b;
+ unsigned int n;
+ u_int32_t h;
- a = jhash2(tuple->src.u3.all, ARRAY_SIZE(tuple->src.u3.all),
- (tuple->src.l3num << 16) | tuple->dst.protonum);
- b = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
- ((__force __u16)tuple->src.u.all << 16) |
- (__force __u16)tuple->dst.u.all);
+ /* The direction must be ignored, so we hash everything up to the
+ * destination ports (which is a multiple of 4) and treat the last
+ * three bytes manually.
+ */
+ n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
+ h = jhash2((u32 *)tuple, n,
+ rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
+ tuple->dst.protonum));
- return ((u64)jhash_2words(a, b, rnd) * size) >> 32;
+ return ((u64)h * size) >> 32;
}
static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-04-28 13:59:30 UTC
Permalink
Post by Philip Craig
Post by Patrick McHardy
[NETFILTER]: nf_conntrack: optimize hash_conntrack()
Avoid calling jhash three times and hash the entire tuple in one go.
This has broken conntrack on a big endian ARM platform. 'conntrack -L'
shows many unreplied connections all with the same addresses/ports,
instead of just one connection.
It seems the problem is that we are now hashing the padding in struct
nf_conntrack_tuple, which we previously didn't, and this padding isn't
always zeroed, so the hash gives garbage.
Changing NF_CT_TUPLE_U_BLANK() to memset the whole tuple fixes it.
Adding __attribute__ ((packed)) everywhere to remove the padding
didn't seem to fix it, but I don't understand why... maybe I did
something wrong still. This probably isn't a solution anyway since
these structs are used in userspace?
I'm not sure what's special about big-endian or ARM to only affect
this platform. Any ideas?
I can work on this more tomorrow.
Thanks for tracking this down, I didn't realize we had holes
in struct nf_conntrack_tuple on ARM. There are two ways to
fix this, one is two remove the padding, the other one is to
clear the padding as you did. We could join all the tuple
structs to avoid padding, but unfortunately that probably
won't help because the port structs are also padded. Maybe
attribute(packed) on the individual port structs within the
union will work, I'm not sure about that.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Philip Craig
2008-04-29 04:48:27 UTC
Permalink
Post by Patrick McHardy
Thanks for tracking this down, I didn't realize we had holes
in struct nf_conntrack_tuple on ARM. There are two ways to
fix this, one is two remove the padding, the other one is to
clear the padding as you did. We could join all the tuple
structs to avoid padding, but unfortunately that probably
won't help because the port structs are also padded. Maybe
attribute(packed) on the individual port structs within the
union will work, I'm not sure about that.
I prefer to remove the padding so that we don't change how other
architectures work. The attached patch does this. I'm not sure
if this has any performance penalties on ARM.

The attribute(packed) is required on both the port structs
and the unions.
David Miller
2008-04-29 05:44:00 UTC
Permalink
From: Philip Craig <***@snapgear.com>
Date: Tue, 29 Apr 2008 14:48:27 +1000
Post by Philip Craig
I prefer to remove the padding so that we don't change how other
architectures work. The attached patch does this. I'm not sure
if this has any performance penalties on ARM.
The attribute(packed) is required on both the port structs
and the unions.
It has performance penalties on most RISC architectures.

Now these elements cannot be assumed to have any particular
alignment, so gcc will emit byte-at-a-time accesses to these
elements.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Philip Craig
2008-04-29 06:00:35 UTC
Permalink
Post by David Miller
Now these elements cannot be assumed to have any particular
alignment, so gcc will emit byte-at-a-time accesses to these
elements.
Ah, so the problem is the __attribute__(packed) removes align
restrictions for the whole structure, in addition to removing
padding.

Is there any way to tell gcc to pack but still align the whole
thing?

eg what does it do for this:
struct t {
struct s {
u16 a;
u16 b;
} __attribute__(packed);
};

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
David Miller
2008-04-29 06:14:14 UTC
Permalink
From: Philip Craig <***@snapgear.com>
Date: Tue, 29 Apr 2008 16:00:35 +1000
Post by Philip Craig
Post by David Miller
Now these elements cannot be assumed to have any particular
alignment, so gcc will emit byte-at-a-time accesses to these
elements.
Ah, so the problem is the __attribute__(packed) removes align
restrictions for the whole structure, in addition to removing
padding.
Is there any way to tell gcc to pack but still align the whole
thing?
Is there any way to tell ARM not to layout structures in such a silly
way by default? :-)))
Post by Philip Craig
struct t {
struct s {
u16 a;
u16 b;
} __attribute__(packed);
};
'a' and 'b' cannot be assumed to be aligned in any particular way,
and thus byte-at-a-time accesses will be made to them.

This program:
--------------------
typedef unsigned short u16;
struct t {
struct s {
u16 a;
u16 b;
} __attribute__((packed)) x;
};
u16 a(struct t *p)
{
return p->x.a;
}
u16 b(struct t *p)
{
return p->x.b;
}
--------------------

results in the following on sparc64:

a:
ldub [%o0], %g1
ldub [%o0+1], %o0
sllx %g1, 8, %g1
jmp %o7+8
or %o0, %g1, %o0
.size a, .-a
.align 4
.align 32
.global b
.type b, #function
.proc 04
b:
ldub [%o0+2], %g1
ldub [%o0+3], %o0
sllx %g1, 8, %g1
jmp %o7+8
or %o0, %g1, %o0
.size b, .-b
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Philip Craig
2008-04-29 06:50:56 UTC
Permalink
Post by David Miller
Post by Philip Craig
struct t {
struct s {
u16 a;
u16 b;
} __attribute__(packed);
};
'a' and 'b' cannot be assumed to be aligned in any particular way,
and thus byte-at-a-time accesses will be made to them.
Does it ever do anything besides byte access for words on sparc?

Here's my results on ARM, which show that including the packed
struct in another struct allows gcc to assume alignment.
I'm not saying this results in pretty code though :-)


typedef unsigned short u16;
typedef unsigned long u32;

static struct a {
struct {
u32 w;
u16 x;
} m;
u16 y;
u32 z;
} a;

static struct b {
struct {
u32 w;
u16 x;
} __attribute__ ((packed)) m;
u16 y;
u32 z;
} b;

static struct c {
struct {
u32 w;
u16 x;
} __attribute__ ((packed)) m;
u16 y;
u32 z;
} __attribute__ ((packed)) c;

u32 aw(struct a *p)
{
return p->m.w;
}

u16 ax(struct a *p)
{
return p->m.x;
}

u16 ay(struct a *p)
{
return p->y;
}

u32 az(struct a *p)
{
return p->z;
}

u32 bw(struct b *p)
{
return p->m.w;
}

u16 bx(struct b *p)
{
return p->m.x;
}

u16 by(struct b *p)
{
return p->y;
}

u32 bz(struct b *p)
{
return p->z;
}

u32 cw(struct c *p)
{
return p->m.w;
}

u16 cx(struct c *p)
{
return p->m.x;
}

u16 cy(struct c *p)
{
return p->y;
}

u32 cz(struct c *p)
{
return p->z;
}



00000000 <aw>:
0: e5900000 ldr r0, [r0]
4: e1a0f00e mov pc, lr

00000008 <ax>:
8: e5d03005 ldrb r3, [r0, #5]
c: e5d00004 ldrb r0, [r0, #4]
10: e1800403 orr r0, r0, r3, lsl #8
14: e1a0f00e mov pc, lr

00000018 <ay>:
18: e5d03009 ldrb r3, [r0, #9]
1c: e5d00008 ldrb r0, [r0, #8]
20: e1800403 orr r0, r0, r3, lsl #8
24: e1a0f00e mov pc, lr

00000028 <az>:
28: e590000c ldr r0, [r0, #12]
2c: e1a0f00e mov pc, lr

00000030 <bw>:
30: e5900000 ldr r0, [r0]
34: e1a0f00e mov pc, lr

00000038 <bx>:
38: e5d03005 ldrb r3, [r0, #5]
3c: e5d00004 ldrb r0, [r0, #4]
40: e1800403 orr r0, r0, r3, lsl #8
44: e1a0f00e mov pc, lr

00000048 <by>:
48: e5d03007 ldrb r3, [r0, #7]
4c: e5d00006 ldrb r0, [r0, #6]
50: e1800403 orr r0, r0, r3, lsl #8
54: e1a0f00e mov pc, lr

00000058 <bz>:
58: e5900008 ldr r0, [r0, #8]
5c: e1a0f00e mov pc, lr

00000060 <cw>:
60: e5d03000 ldrb r3, [r0]
64: e5d02001 ldrb r2, [r0, #1]
68: e5d01002 ldrb r1, [r0, #2]
6c: e1833402 orr r3, r3, r2, lsl #8
70: e5d00003 ldrb r0, [r0, #3]
74: e1833801 orr r3, r3, r1, lsl #16
78: e1830c00 orr r0, r3, r0, lsl #24
7c: e1a0f00e mov pc, lr

00000080 <cx>:
80: e5d03005 ldrb r3, [r0, #5]
84: e5d00004 ldrb r0, [r0, #4]
88: e1800403 orr r0, r0, r3, lsl #8
8c: e1a0f00e mov pc, lr

00000090 <cy>:
90: e5d03007 ldrb r3, [r0, #7]
94: e5d00006 ldrb r0, [r0, #6]
98: e1800403 orr r0, r0, r3, lsl #8
9c: e1a0f00e mov pc, lr

000000a0 <cz>:
a0: e5d03008 ldrb r3, [r0, #8]
a4: e5d02009 ldrb r2, [r0, #9]
a8: e5d0100a ldrb r1, [r0, #10]
ac: e1833402 orr r3, r3, r2, lsl #8
b0: e5d0000b ldrb r0, [r0, #11]
b4: e1833801 orr r3, r3, r1, lsl #16
b8: e1830c00 orr r0, r3, r0, lsl #24
bc: e1a0f00e mov pc, lr
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
David Miller
2008-04-29 06:56:50 UTC
Permalink
From: Philip Craig <***@snapgear.com>
Date: Tue, 29 Apr 2008 16:50:56 +1000
Post by Philip Craig
Post by David Miller
Post by Philip Craig
struct t {
struct s {
u16 a;
u16 b;
} __attribute__(packed);
};
'a' and 'b' cannot be assumed to be aligned in any particular way,
and thus byte-at-a-time accesses will be made to them.
Does it ever do anything besides byte access for words on sparc?
Here's my results on ARM, which show that including the packed
struct in another struct allows gcc to assume alignment.
I'm not saying this results in pretty code though :-)
Sure, the packed doesn't get inherited by the struct the
sub-struct is in.

But it still means the bit marked packed is going to be
accessed using byte-at-a-time loads and stores.

I guess this is immaterial, as it seems the memset() is the
best solution anyways.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Philip Craig
2008-04-29 07:00:50 UTC
Permalink
Post by David Miller
But it still means the bit marked packed is going to be
accessed using byte-at-a-time loads and stores.
That's not what my results showed (the bw() case).
Post by David Miller
I guess this is immaterial, as it seems the memset() is the
best solution anyways.
Yep.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Philip Craig
2008-04-29 05:44:01 UTC
Permalink
Post by Philip Craig
Post by Patrick McHardy
Thanks for tracking this down, I didn't realize we had holes
in struct nf_conntrack_tuple on ARM. There are two ways to
fix this, one is two remove the padding, the other one is to
clear the padding as you did. We could join all the tuple
structs to avoid padding, but unfortunately that probably
won't help because the port structs are also padded. Maybe
attribute(packed) on the individual port structs within the
union will work, I'm not sure about that.
I prefer to remove the padding so that we don't change how other
architectures work. The attached patch does this. I'm not sure
if this has any performance penalties on ARM.
I just noticed that IP_CT_TUPLE_U_BLANK() memsets the addresses too
now (the comment before it is outdated). There are only two lots
of 2 bytes it doesn't memset, which hardly seems worth it, and it
may even be slower on some architectures. So the simpler fix is
to memset the whole structure.

It still might be nice to eliminate the padding on ARM to save
memory though: it adds 8 bytes per tuple.

Thoughts?

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-04-29 05:54:49 UTC
Permalink
Post by Philip Craig
Post by Philip Craig
Post by Patrick McHardy
Thanks for tracking this down, I didn't realize we had holes
in struct nf_conntrack_tuple on ARM. There are two ways to
fix this, one is two remove the padding, the other one is to
clear the padding as you did. We could join all the tuple
structs to avoid padding, but unfortunately that probably
won't help because the port structs are also padded. Maybe
attribute(packed) on the individual port structs within the
union will work, I'm not sure about that.
I prefer to remove the padding so that we don't change how other
architectures work. The attached patch does this. I'm not sure
if this has any performance penalties on ARM.
I just noticed that IP_CT_TUPLE_U_BLANK() memsets the addresses too
now (the comment before it is outdated). There are only two lots
of 2 bytes it doesn't memset, which hardly seems worth it, and it
may even be slower on some architectures. So the simpler fix is
to memset the whole structure.
It still might be nice to eliminate the padding on ARM to save
memory though: it adds 8 bytes per tuple.
Thoughts?
I think the memset-solution is preferrable, using byte-wise
accesses to the entire tuple would really suck.


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Philip Craig
2008-04-29 08:40:32 UTC
Permalink
Post by Patrick McHardy
I think the memset-solution is preferrable, using byte-wise
accesses to the entire tuple would really suck.
Here's the memset patch.
David Miller
2008-04-29 10:20:08 UTC
Permalink
From: Philip Craig <***@snapgear.com>
Date: Tue, 29 Apr 2008 18:40:32 +1000
Post by Philip Craig
Post by Patrick McHardy
I think the memset-solution is preferrable, using byte-wise
accesses to the entire tuple would really suck.
Here's the memset patch.
Looks good to me, Patrick?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-04-29 10:22:31 UTC
Permalink
Post by David Miller
Date: Tue, 29 Apr 2008 18:40:32 +1000
Post by Philip Craig
Post by Patrick McHardy
I think the memset-solution is preferrable, using byte-wise
accesses to the entire tuple would really suck.
Here's the memset patch.
Looks good to me, Patrick?
Yes, please apply. I'm travelling, so I can't test myself, but
I'll also have a closer look once I return home. Thanks.



--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
David Miller
2008-04-29 10:35:25 UTC
Permalink
From: Patrick McHardy <***@trash.net>
Date: Tue, 29 Apr 2008 12:22:31 +0200
Post by Patrick McHardy
Post by David Miller
Looks good to me, Patrick?
Yes, please apply. I'm travelling, so I can't test myself, but
I'll also have a closer look once I return home. Thanks.
Ok, I've applied it, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:23 UTC
Permalink
[NETFILTER]: nf_{conntrack,nat}_tftp: annotate TFTP helper with const

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit c53f4c232b76b97fcdffeef43aae14f3d698f974
tree 42661b45662aba0ace2790184efea9d0c0e52473
parent 82c74083c7bc88bc8bd52e6a150a0812ce97f258
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:15 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:15 +0100

net/ipv4/netfilter/nf_nat_tftp.c | 2 +-
net/netfilter/nf_conntrack_tftp.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/ipv4/netfilter/nf_nat_tftp.c
index 1360a94..b096e81 100644
--- a/net/ipv4/netfilter/nf_nat_tftp.c
+++ b/net/ipv4/netfilter/nf_nat_tftp.c
@@ -24,7 +24,7 @@ static unsigned int help(struct sk_buff *skb,
enum ip_conntrack_info ctinfo,
struct nf_conntrack_expect *exp)
{
- struct nf_conn *ct = exp->master;
+ const struct nf_conn *ct = exp->master;

exp->saved_proto.udp.port
= ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index 176f769..bd2e800 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -39,7 +39,8 @@ static int tftp_help(struct sk_buff *skb,
struct nf_conn *ct,
enum ip_conntrack_info ctinfo)
{
- struct tftphdr _tftph, *tfh;
+ const struct tftphdr *tfh;
+ struct tftphdr _tftph;
struct nf_conntrack_expect *exp;
struct nf_conntrack_tuple *tuple;
unsigned int ret = NF_ACCEPT;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:10 UTC
Permalink
[NETFILTER]: ipt_CLUSTERIP: kill clusterip_config_entry_get

It's unused static inline.

Signed-off-by: Ilpo J=E4rvinen <***@helsinki.fi>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit da5a0452866ad6f4a4967f31d5d5854d9f481e33
tree 98fb53d9fd7a6bfa1f854f52ecf699a83a5cbc91
parent 8bf50a16334291fa18d090ad11221e802327b26f
author Ilpo J=E4rvinen <***@helsinki.fi> Tue, 29 Jan 2008 16:=
22:16 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:11 +=
0100

net/ipv4/netfilter/ipt_CLUSTERIP.c | 7 -------
1 files changed, 0 insertions(+), 7 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ip=
t_CLUSTERIP.c
index 1b31f7d..c6cf84c 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -76,13 +76,6 @@ clusterip_config_put(struct clusterip_config *c)
kfree(c);
}
=20
-/* increase the count of entries(rules) using/referencing this config =
*/
-static inline void
-clusterip_config_entry_get(struct clusterip_config *c)
-{
- atomic_inc(&c->entries);
-}
-
/* decrease the count of entries using/referencing this config. If la=
st
* entry(rule) is removed, remove the config from lists, but don't fre=
e it
* yet, since proc-files could still be holding references */
-
To unsubscribe from this list: send the line "unsubscribe netfilter-dev=
el" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:31 UTC
Permalink
[NETFILTER]: nf_{conntrack,nat}_icmp: constify and annotate

Constify a few data tables use const qualifiers on variables where
possible in the nf_conntrack_icmp* sources.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 8846d43ac0b92e4d9df20675ea5c441b03e96d10
tree 1282d5b99f1f3bff7dc6a8bfd92bad8b48f3e54d
parent 0d18e97268fb631100b6b7689ac1b75426463d0c
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:17 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:17 +0100

net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 10 ++++++----
net/ipv4/netfilter/nf_nat_proto_icmp.c | 2 +-
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 14 ++++++++------
3 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 17217f4..6873fdd 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -26,7 +26,8 @@ static int icmp_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conntrack_tuple *tuple)
{
- struct icmphdr _hdr, *hp;
+ const struct icmphdr *hp;
+ struct icmphdr _hdr;

hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
if (hp == NULL)
@@ -129,8 +130,8 @@ icmp_error_message(struct sk_buff *skb,
unsigned int hooknum)
{
struct nf_conntrack_tuple innertuple, origtuple;
- struct nf_conntrack_l4proto *innerproto;
- struct nf_conntrack_tuple_hash *h;
+ const struct nf_conntrack_l4proto *innerproto;
+ const struct nf_conntrack_tuple_hash *h;

NF_CT_ASSERT(skb->nfct == NULL);

@@ -176,7 +177,8 @@ static int
icmp_error(struct sk_buff *skb, unsigned int dataoff,
enum ip_conntrack_info *ctinfo, int pf, unsigned int hooknum)
{
- struct icmphdr _ih, *icmph;
+ const struct icmphdr *icmph;
+ struct icmphdr _ih;

/* Not enough header? */
icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index a0e44c9..03a0296 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -57,7 +57,7 @@ icmp_manip_pkt(struct sk_buff *skb,
const struct nf_conntrack_tuple *tuple,
enum nf_nat_manip_type maniptype)
{
- struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+ const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
struct icmphdr *hdr;
unsigned int hdroff = iphdroff + iph->ihl*4;

diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 430db1d..0897d0f 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -32,7 +32,8 @@ static int icmpv6_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conntrack_tuple *tuple)
{
- struct icmp6hdr _hdr, *hp;
+ const struct icmp6hdr *hp;
+ struct icmp6hdr _hdr;

hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
if (hp == NULL)
@@ -45,7 +46,7 @@ static int icmpv6_pkt_to_tuple(const struct sk_buff *skb,
}

/* Add 1; spaces filled with 0. */
-static u_int8_t invmap[] = {
+static const u_int8_t invmap[] = {
[ICMPV6_ECHO_REQUEST - 128] = ICMPV6_ECHO_REPLY + 1,
[ICMPV6_ECHO_REPLY - 128] = ICMPV6_ECHO_REQUEST + 1,
[ICMPV6_NI_QUERY - 128] = ICMPV6_NI_QUERY + 1,
@@ -105,7 +106,7 @@ static int icmpv6_new(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff)
{
- static u_int8_t valid_new[] = {
+ static const u_int8_t valid_new[] = {
[ICMPV6_ECHO_REQUEST - 128] = 1,
[ICMPV6_NI_QUERY - 128] = 1
};
@@ -129,8 +130,8 @@ icmpv6_error_message(struct sk_buff *skb,
unsigned int hooknum)
{
struct nf_conntrack_tuple intuple, origtuple;
- struct nf_conntrack_tuple_hash *h;
- struct nf_conntrack_l4proto *inproto;
+ const struct nf_conntrack_tuple_hash *h;
+ const struct nf_conntrack_l4proto *inproto;

NF_CT_ASSERT(skb->nfct == NULL);

@@ -176,7 +177,8 @@ static int
icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
enum ip_conntrack_info *ctinfo, int pf, unsigned int hooknum)
{
- struct icmp6hdr _ih, *icmp6h;
+ const struct icmp6hdr *icmp6h;
+ struct icmp6hdr _ih;

icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
if (icmp6h == NULL) {
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:14 UTC
Permalink
[NETFILTER]: xt_hashlimit match, revision 1

Introduces the xt_hashlimit match revision 1. It adds support for
kernel-level inversion and grouping source and/or destination IP
addresses, allowing to limit on a per-subnet basis. While this would
technically obsolete xt_limit, xt_hashlimit is a more expensive due
to the hashbucketing.

Kernel-level inversion: Previously you had to do user-level inversion:

iptables -N foo
iptables -A foo -m hashlimit --hashlimit(-upto) 5/s -j RETURN
iptables -A foo -j DROP
iptables -A INPUT -j foo

now it is simpler:

iptables -A INPUT -m hashlimit --hashlimit-over 5/s -j DROP

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 778b1b410be9abb98c52ea4288c9708b2f01a626
tree c0eaf40a59ba93a507d93f3f0290ef887551b9b9
parent 589cbc737eef0c619fc75c099063861ec7540ec7
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:22:=
18 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:12 +=
0100

include/linux/netfilter/xt_hashlimit.h | 37 +++-
net/netfilter/xt_hashlimit.c | 322 ++++++++++++++++++++++++=
++++----
2 files changed, 318 insertions(+), 41 deletions(-)

diff --git a/include/linux/netfilter/xt_hashlimit.h b/include/linux/net=
filter/xt_hashlimit.h
index c19972e..58b818e 100644
--- a/include/linux/netfilter/xt_hashlimit.h
+++ b/include/linux/netfilter/xt_hashlimit.h
@@ -9,13 +9,16 @@
/* details of this structure hidden by the implementation */
struct xt_hashlimit_htable;
=20
-#define XT_HASHLIMIT_HASH_DIP 0x0001
-#define XT_HASHLIMIT_HASH_DPT 0x0002
-#define XT_HASHLIMIT_HASH_SIP 0x0004
-#define XT_HASHLIMIT_HASH_SPT 0x0008
+enum {
+ XT_HASHLIMIT_HASH_DIP =3D 1 << 0,
+ XT_HASHLIMIT_HASH_DPT =3D 1 << 1,
+ XT_HASHLIMIT_HASH_SIP =3D 1 << 2,
+ XT_HASHLIMIT_HASH_SPT =3D 1 << 3,
+ XT_HASHLIMIT_INVERT =3D 1 << 4,
+};
=20
struct hashlimit_cfg {
- u_int32_t mode; /* bitmask of IPT_HASHLIMIT_HASH_* */
+ u_int32_t mode; /* bitmask of XT_HASHLIMIT_HASH_* */
u_int32_t avg; /* Average secs between packets * scale */
u_int32_t burst; /* Period multiplier for upper limit. */
=20
@@ -37,4 +40,28 @@ struct xt_hashlimit_info {
struct xt_hashlimit_info *master;
} u;
};
+
+struct hashlimit_cfg1 {
+ u_int32_t mode; /* bitmask of XT_HASHLIMIT_HASH_* */
+ u_int32_t avg; /* Average secs between packets * scale */
+ u_int32_t burst; /* Period multiplier for upper limit. */
+
+ /* user specified */
+ u_int32_t size; /* how many buckets */
+ u_int32_t max; /* max number of entries */
+ u_int32_t gc_interval; /* gc interval */
+ u_int32_t expire; /* when do entries expire? */
+
+ u_int8_t srcmask, dstmask;
+};
+
+struct xt_hashlimit_mtinfo1 {
+ char name[IFNAMSIZ];
+ struct hashlimit_cfg1 cfg;
+
+ /* Used internally by the kernel */
+ struct xt_hashlimit_htable *hinfo __attribute__((aligned(8)));
+ struct xt_hashlimit_mtinfo1 *master __attribute__((aligned(8)));
+};
+
#endif /*_XT_HASHLIMIT_H*/
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.=
c
index b224b8f..54aaf5b 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -1,9 +1,9 @@
-/* iptables match extension to limit the number of packets per second
- * seperately for each hashbucket (sourceip/sourceport/dstip/dstport)
+/*
+ * xt_hashlimit - Netfilter module to limit the number of packets per =
time
+ * seperately for each hashbucket (sourceip/sourceport/dstip/dstport)
*
- * (C) 2003-2004 by Harald Welte <***@netfilter.org>
- *
- * $Id: ipt_hashlimit.c 3244 2004-10-20 16:24:29Z ***@netfilter.or=
g $
+ * (C) 2003-2004 by Harald Welte <***@netfilter.org>
+ * Copyright =C2=A9 CC Computer Consultants GmbH, 2007 - 2008
*
* Development of this code was funded by Astaro AG, http://www.astaro=
=2Ecom/
*/
@@ -35,6 +35,7 @@
=20
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <***@netfilter.org>");
+MODULE_AUTHOR("Jan Engelhardt <***@computergmbh.de>");
MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
MODULE_ALIAS("ipt_hashlimit");
MODULE_ALIAS("ip6t_hashlimit");
@@ -57,7 +58,7 @@ struct dsthash_dst {
__be32 dst[4];
} ip6;
#endif
- } addr;
+ };
__be16 src_port;
__be16 dst_port;
};
@@ -81,7 +82,7 @@ struct xt_hashlimit_htable {
atomic_t use;
int family;
=20
- struct hashlimit_cfg cfg; /* config */
+ struct hashlimit_cfg1 cfg; /* config */
=20
/* used internally */
spinlock_t lock; /* lock for list_head */
@@ -184,7 +185,7 @@ dsthash_free(struct xt_hashlimit_htable *ht, struct=
dsthash_ent *ent)
}
static void htable_gc(unsigned long htlong);
=20
-static int htable_create(struct xt_hashlimit_info *minfo, int family)
+static int htable_create_v0(struct xt_hashlimit_info *minfo, int famil=
y)
{
struct xt_hashlimit_htable *hinfo;
unsigned int size;
@@ -210,7 +211,18 @@ static int htable_create(struct xt_hashlimit_info =
*minfo, int family)
minfo->hinfo =3D hinfo;
=20
/* copy match config into hashtable config */
- memcpy(&hinfo->cfg, &minfo->cfg, sizeof(hinfo->cfg));
+ hinfo->cfg.mode =3D minfo->cfg.mode;
+ hinfo->cfg.avg =3D minfo->cfg.avg;
+ hinfo->cfg.burst =3D minfo->cfg.burst;
+ hinfo->cfg.max =3D minfo->cfg.max;
+ hinfo->cfg.gc_interval =3D minfo->cfg.gc_interval;
+ hinfo->cfg.expire =3D minfo->cfg.expire;
+
+ if (family =3D=3D AF_INET)
+ hinfo->cfg.srcmask =3D hinfo->cfg.dstmask =3D 32;
+ else
+ hinfo->cfg.srcmask =3D hinfo->cfg.dstmask =3D 128;
+
hinfo->cfg.size =3D size;
if (!hinfo->cfg.max)
hinfo->cfg.max =3D 8 * hinfo->cfg.size;
@@ -246,6 +258,70 @@ static int htable_create(struct xt_hashlimit_info =
*minfo, int family)
return 0;
}
=20
+static int htable_create(struct xt_hashlimit_mtinfo1 *minfo,
+ unsigned int family)
+{
+ struct xt_hashlimit_htable *hinfo;
+ unsigned int size;
+ unsigned int i;
+
+ if (minfo->cfg.size) {
+ size =3D minfo->cfg.size;
+ } else {
+ size =3D (num_physpages << PAGE_SHIFT) / 16384 /
+ sizeof(struct list_head);
+ if (num_physpages > 1024 * 1024 * 1024 / PAGE_SIZE)
+ size =3D 8192;
+ if (size < 16)
+ size =3D 16;
+ }
+ /* FIXME: don't use vmalloc() here or anywhere else -HW */
+ hinfo =3D vmalloc(sizeof(struct xt_hashlimit_htable) +
+ sizeof(struct list_head) * size);
+ if (hinfo =3D=3D NULL) {
+ printk(KERN_ERR "xt_hashlimit: unable to create hashtable\n");
+ return -1;
+ }
+ minfo->hinfo =3D hinfo;
+
+ /* copy match config into hashtable config */
+ memcpy(&hinfo->cfg, &minfo->cfg, sizeof(hinfo->cfg));
+ hinfo->cfg.size =3D size;
+ if (hinfo->cfg.max =3D=3D 0)
+ hinfo->cfg.max =3D 8 * hinfo->cfg.size;
+ else if (hinfo->cfg.max < hinfo->cfg.size)
+ hinfo->cfg.max =3D hinfo->cfg.size;
+
+ for (i =3D 0; i < hinfo->cfg.size; i++)
+ INIT_HLIST_HEAD(&hinfo->hash[i]);
+
+ atomic_set(&hinfo->use, 1);
+ hinfo->count =3D 0;
+ hinfo->family =3D family;
+ hinfo->rnd_initialized =3D 0;
+ spin_lock_init(&hinfo->lock);
+
+ hinfo->pde =3D create_proc_entry(minfo->name, 0,
+ family =3D=3D AF_INET ? hashlimit_procdir4 :
+ hashlimit_procdir6);
+ if (hinfo->pde =3D=3D NULL) {
+ vfree(hinfo);
+ return -1;
+ }
+ hinfo->pde->proc_fops =3D &dl_file_ops;
+ hinfo->pde->data =3D hinfo;
+
+ setup_timer(&hinfo->timer, htable_gc, (unsigned long)hinfo);
+ hinfo->timer.expires =3D jiffies + msecs_to_jiffies(hinfo->cfg.gc_int=
erval);
+ add_timer(&hinfo->timer);
+
+ spin_lock_bh(&hashlimit_lock);
+ hlist_add_head(&hinfo->node, &hashlimit_htables);
+ spin_unlock_bh(&hashlimit_lock);
+
+ return 0;
+}
+
static bool select_all(const struct xt_hashlimit_htable *ht,
const struct dsthash_ent *he)
{
@@ -388,6 +464,46 @@ static inline void rateinfo_recalc(struct dsthash_=
ent *dh, unsigned long now)
dh->rateinfo.prev =3D now;
}
=20
+static inline __be32 maskl(__be32 a, unsigned int l)
+{
+ return htonl(ntohl(a) & ~(~(u_int32_t)0 >> l));
+}
+
+static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
+{
+ switch (p) {
+ case 0:
+ i[0] =3D i[1] =3D 0;
+ i[2] =3D i[3] =3D 0;
+ break;
+ case 1 ... 31:
+ i[0] =3D maskl(i[0], p);
+ i[1] =3D i[2] =3D i[3] =3D 0;
+ break;
+ case 32:
+ i[1] =3D i[2] =3D i[3] =3D 0;
+ break;
+ case 33 ... 63:
+ i[1] =3D maskl(i[1], p - 32);
+ i[2] =3D i[3] =3D 0;
+ break;
+ case 64:
+ i[2] =3D i[3] =3D 0;
+ break;
+ case 65 ... 95:
+ i[2] =3D maskl(i[2], p - 64);
+ i[3] =3D 0;
+ case 96:
+ i[3] =3D 0;
+ break;
+ case 97 ... 127:
+ i[3] =3D maskl(i[3], p - 96);
+ break;
+ case 128:
+ break;
+ }
+}
+
static int
hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
struct dsthash_dst *dst,
@@ -401,9 +517,11 @@ hashlimit_init_dst(const struct xt_hashlimit_htabl=
e *hinfo,
switch (hinfo->family) {
case AF_INET:
if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP)
- dst->addr.ip.dst =3D ip_hdr(skb)->daddr;
+ dst->ip.dst =3D maskl(ip_hdr(skb)->daddr,
+ hinfo->cfg.dstmask);
if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP)
- dst->addr.ip.src =3D ip_hdr(skb)->saddr;
+ dst->ip.src =3D maskl(ip_hdr(skb)->saddr,
+ hinfo->cfg.srcmask);
=20
if (!(hinfo->cfg.mode &
(XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
@@ -412,12 +530,16 @@ hashlimit_init_dst(const struct xt_hashlimit_htab=
le *hinfo,
break;
#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_=
MODULE)
case AF_INET6:
- if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP)
- memcpy(&dst->addr.ip6.dst, &ipv6_hdr(skb)->daddr,
- sizeof(dst->addr.ip6.dst));
- if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP)
- memcpy(&dst->addr.ip6.src, &ipv6_hdr(skb)->saddr,
- sizeof(dst->addr.ip6.src));
+ if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
+ memcpy(&dst->ip6.dst, &ipv6_hdr(skb)->daddr,
+ sizeof(dst->ip6.dst));
+ hashlimit_ipv6_mask(dst->ip6.dst, hinfo->cfg.dstmask);
+ }
+ if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP) {
+ memcpy(&dst->ip6.src, &ipv6_hdr(skb)->saddr,
+ sizeof(dst->ip6.src));
+ hashlimit_ipv6_mask(dst->ip6.src, hinfo->cfg.srcmask);
+ }
=20
if (!(hinfo->cfg.mode &
(XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
@@ -457,10 +579,10 @@ hashlimit_init_dst(const struct xt_hashlimit_htab=
le *hinfo,
}
=20
static bool
-hashlimit_mt(const struct sk_buff *skb, const struct net_device *in,
- const struct net_device *out, const struct xt_match *matc=
h,
- const void *matchinfo, int offset, unsigned int protoff,
- bool *hotdrop)
+hashlimit_mt_v0(const struct sk_buff *skb, const struct net_device *in=
,
+ const struct net_device *out, const struct xt_match *m=
atch,
+ const void *matchinfo, int offset, unsigned int protof=
f,
+ bool *hotdrop)
{
const struct xt_hashlimit_info *r =3D
((const struct xt_hashlimit_info *)matchinfo)->u.master;
@@ -512,9 +634,62 @@ hotdrop:
}
=20
static bool
-hashlimit_mt_check(const char *tablename, const void *inf,
- const struct xt_match *match, void *matchinfo,
- unsigned int hook_mask)
+hashlimit_mt(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const struct xt_match *matc=
h,
+ const void *matchinfo, int offset, unsigned int protoff,
+ bool *hotdrop)
+{
+ const struct xt_hashlimit_mtinfo1 *info =3D matchinfo;
+ struct xt_hashlimit_htable *hinfo =3D info->hinfo;
+ unsigned long now =3D jiffies;
+ struct dsthash_ent *dh;
+ struct dsthash_dst dst;
+
+ if (hashlimit_init_dst(hinfo, &dst, skb, protoff) < 0)
+ goto hotdrop;
+
+ spin_lock_bh(&hinfo->lock);
+ dh =3D dsthash_find(hinfo, &dst);
+ if (dh =3D=3D NULL) {
+ dh =3D dsthash_alloc_init(hinfo, &dst);
+ if (dh =3D=3D NULL) {
+ spin_unlock_bh(&hinfo->lock);
+ goto hotdrop;
+ }
+
+ dh->expires =3D jiffies + msecs_to_jiffies(hinfo->cfg.expire);
+ dh->rateinfo.prev =3D jiffies;
+ dh->rateinfo.credit =3D user2credits(hinfo->cfg.avg *
+ hinfo->cfg.burst);
+ dh->rateinfo.credit_cap =3D user2credits(hinfo->cfg.avg *
+ hinfo->cfg.burst);
+ dh->rateinfo.cost =3D user2credits(hinfo->cfg.avg);
+ } else {
+ /* update expiration timeout */
+ dh->expires =3D now + msecs_to_jiffies(hinfo->cfg.expire);
+ rateinfo_recalc(dh, now);
+ }
+
+ if (dh->rateinfo.credit >=3D dh->rateinfo.cost) {
+ /* below the limit */
+ dh->rateinfo.credit -=3D dh->rateinfo.cost;
+ spin_unlock_bh(&hinfo->lock);
+ return !(info->cfg.mode & XT_HASHLIMIT_INVERT);
+ }
+
+ spin_unlock_bh(&hinfo->lock);
+ /* default match is underlimit - so over the limit, we need to invert=
*/
+ return info->cfg.mode & XT_HASHLIMIT_INVERT;
+
+ hotdrop:
+ *hotdrop =3D true;
+ return false;
+}
+
+static bool
+hashlimit_mt_check_v0(const char *tablename, const void *inf,
+ const struct xt_match *match, void *matchinfo,
+ unsigned int hook_mask)
{
struct xt_hashlimit_info *r =3D matchinfo;
=20
@@ -546,7 +721,7 @@ hashlimit_mt_check(const char *tablename, const voi=
d *inf,
* create duplicate proc files. -HW */
mutex_lock(&hlimit_mutex);
r->hinfo =3D htable_find_get(r->name, match->family);
- if (!r->hinfo && htable_create(r, match->family) !=3D 0) {
+ if (!r->hinfo && htable_create_v0(r, match->family) !=3D 0) {
mutex_unlock(&hlimit_mutex);
return false;
}
@@ -557,14 +732,68 @@ hashlimit_mt_check(const char *tablename, const v=
oid *inf,
return true;
}
=20
+static bool
+hashlimit_mt_check(const char *tablename, const void *inf,
+ const struct xt_match *match, void *matchinfo,
+ unsigned int hook_mask)
+{
+ struct xt_hashlimit_mtinfo1 *info =3D matchinfo;
+
+ /* Check for overflow. */
+ if (info->cfg.burst =3D=3D 0 ||
+ user2credits(info->cfg.avg * info->cfg.burst) <
+ user2credits(info->cfg.avg)) {
+ printk(KERN_ERR "xt_hashlimit: overflow, try lower: %u/%u\n",
+ info->cfg.avg, info->cfg.burst);
+ return false;
+ }
+ if (info->cfg.gc_interval =3D=3D 0 || info->cfg.expire =3D=3D 0)
+ return false;
+ if (info->name[sizeof(info->name)-1] !=3D '\0')
+ return false;
+ if (match->family =3D=3D AF_INET) {
+ if (info->cfg.srcmask > 32 || info->cfg.dstmask > 32)
+ return false;
+ } else {
+ if (info->cfg.srcmask > 128 || info->cfg.dstmask > 128)
+ return false;
+ }
+
+ /* This is the best we've got: We cannot release and re-grab lock,
+ * since checkentry() is called before x_tables.c grabs xt_mutex.
+ * We also cannot grab the hashtable spinlock, since htable_create wi=
ll
+ * call vmalloc, and that can sleep. And we cannot just re-search
+ * the list of htable's in htable_create(), since then we would
+ * create duplicate proc files. -HW */
+ mutex_lock(&hlimit_mutex);
+ info->hinfo =3D htable_find_get(info->name, match->family);
+ if (!info->hinfo && htable_create(info, match->family) !=3D 0) {
+ mutex_unlock(&hlimit_mutex);
+ return false;
+ }
+ mutex_unlock(&hlimit_mutex);
+
+ /* Ugly hack: For SMP, we only want to use one set */
+ info->master =3D info;
+ return true;
+}
+
static void
-hashlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
+hashlimit_mt_destroy_v0(const struct xt_match *match, void *matchinfo)
{
const struct xt_hashlimit_info *r =3D matchinfo;
=20
htable_put(r->hinfo);
}
=20
+static void
+hashlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
+{
+ const struct xt_hashlimit_mtinfo1 *info =3D matchinfo;
+
+ htable_put(info->hinfo);
+}
+
#ifdef CONFIG_COMPAT
struct compat_xt_hashlimit_info {
char name[IFNAMSIZ];
@@ -592,33 +821,54 @@ static int hashlimit_mt_compat_to_user(void __use=
r *dst, void *src)
static struct xt_match hashlimit_mt_reg[] __read_mostly =3D {
{
.name =3D "hashlimit",
+ .revision =3D 0,
.family =3D AF_INET,
- .match =3D hashlimit_mt,
+ .match =3D hashlimit_mt_v0,
.matchsize =3D sizeof(struct xt_hashlimit_info),
#ifdef CONFIG_COMPAT
.compatsize =3D sizeof(struct compat_xt_hashlimit_info),
.compat_from_user =3D hashlimit_mt_compat_from_user,
.compat_to_user =3D hashlimit_mt_compat_to_user,
#endif
- .checkentry =3D hashlimit_mt_check,
- .destroy =3D hashlimit_mt_destroy,
+ .checkentry =3D hashlimit_mt_check_v0,
+ .destroy =3D hashlimit_mt_destroy_v0,
.me =3D THIS_MODULE
},
+ {
+ .name =3D "hashlimit",
+ .revision =3D 1,
+ .family =3D AF_INET,
+ .match =3D hashlimit_mt,
+ .matchsize =3D sizeof(struct xt_hashlimit_mtinfo1),
+ .checkentry =3D hashlimit_mt_check,
+ .destroy =3D hashlimit_mt_destroy,
+ .me =3D THIS_MODULE,
+ },
#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_=
MODULE)
{
.name =3D "hashlimit",
.family =3D AF_INET6,
- .match =3D hashlimit_mt,
+ .match =3D hashlimit_mt_v0,
.matchsize =3D sizeof(struct xt_hashlimit_info),
#ifdef CONFIG_COMPAT
.compatsize =3D sizeof(struct compat_xt_hashlimit_info),
.compat_from_user =3D hashlimit_mt_compat_from_user,
.compat_to_user =3D hashlimit_mt_compat_to_user,
#endif
- .checkentry =3D hashlimit_mt_check,
- .destroy =3D hashlimit_mt_destroy,
+ .checkentry =3D hashlimit_mt_check_v0,
+ .destroy =3D hashlimit_mt_destroy_v0,
.me =3D THIS_MODULE
},
+ {
+ .name =3D "hashlimit",
+ .revision =3D 1,
+ .family =3D AF_INET6,
+ .match =3D hashlimit_mt,
+ .matchsize =3D sizeof(struct xt_hashlimit_mtinfo1),
+ .checkentry =3D hashlimit_mt_check,
+ .destroy =3D hashlimit_mt_destroy,
+ .me =3D THIS_MODULE,
+ },
#endif
};
=20
@@ -678,9 +928,9 @@ static int dl_seq_real_show(struct dsthash_ent *ent=
, int family,
return seq_printf(s, "%ld %u.%u.%u.%u:%u->"
"%u.%u.%u.%u:%u %u %u %u\n",
(long)(ent->expires - jiffies)/HZ,
- NIPQUAD(ent->dst.addr.ip.src),
+ NIPQUAD(ent->dst.ip.src),
ntohs(ent->dst.src_port),
- NIPQUAD(ent->dst.addr.ip.dst),
+ NIPQUAD(ent->dst.ip.dst),
ntohs(ent->dst.dst_port),
ent->rateinfo.credit, ent->rateinfo.credit_cap,
ent->rateinfo.cost);
@@ -689,9 +939,9 @@ static int dl_seq_real_show(struct dsthash_ent *ent=
, int family,
return seq_printf(s, "%ld " NIP6_FMT ":%u->"
NIP6_FMT ":%u %u %u %u\n",
(long)(ent->expires - jiffies)/HZ,
- NIP6(*(struct in6_addr *)&ent->dst.addr.ip6.src),
+ NIP6(*(struct in6_addr *)&ent->dst.ip6.src),
ntohs(ent->dst.src_port),
- NIP6(*(struct in6_addr *)&ent->dst.addr.ip6.dst),
+ NIP6(*(struct in6_addr *)&ent->dst.ip6.dst),
ntohs(ent->dst.dst_port),
ent->rateinfo.credit, ent->rateinfo.credit_cap,
ent->rateinfo.cost);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-dev=
el" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:27 UTC
Permalink
[NETFILTER]: nf_{conntrack,nat}_proto_tcp: constify and annotate TCP modules

Constify a few data tables use const qualifiers on variables where
possible in the nf_*_proto_tcp sources.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 86b8346c2ce0407e1712aefc6e4f9bb5c24fd238
tree a19302786670a00bea34bfa3180447bea60872c0
parent 5eb90087e67023fc3314f7a59702720e2ffe0fc4
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:16 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:16 +0100

include/net/netfilter/nf_conntrack.h | 2 +
net/ipv4/netfilter/nf_nat_proto_tcp.c | 2 +
net/netfilter/nf_conntrack_proto_tcp.c | 44 +++++++++++++++++---------------
3 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index bda78a2..90b3e7f 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -216,7 +216,7 @@ static inline void nf_ct_refresh(struct nf_conn *ct,

/* These are for NAT. Icky. */
/* Update TCP window tracking data when NAT mangles the packet */
-extern void nf_conntrack_tcp_update(struct sk_buff *skb,
+extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conn *ct,
int dir);
diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
index da23e9f..ffd5d15 100644
--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
@@ -93,7 +93,7 @@ tcp_manip_pkt(struct sk_buff *skb,
const struct nf_conntrack_tuple *tuple,
enum nf_nat_manip_type maniptype)
{
- struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+ const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
struct tcphdr *hdr;
unsigned int hdroff = iphdroff + iph->ihl*4;
__be32 oldip, newip;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 9807af6..3e0ccca 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -46,7 +46,7 @@ static int nf_ct_tcp_max_retrans __read_mostly = 3;
/* FIXME: Examine ipfilter's timeouts and conntrack transitions more
closely. They're more complex. --RR */

-static const char *tcp_conntrack_names[] = {
+static const char *const tcp_conntrack_names[] = {
"NONE",
"SYN_SENT",
"SYN_RECV",
@@ -261,7 +261,8 @@ static int tcp_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conntrack_tuple *tuple)
{
- struct tcphdr _hdr, *hp;
+ const struct tcphdr *hp;
+ struct tcphdr _hdr;

/* Actually only need first 8 bytes. */
hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
@@ -343,7 +344,7 @@ static unsigned int get_conntrack_index(const struct tcphdr *tcph)
static inline __u32 segment_seq_plus_len(__u32 seq,
size_t len,
unsigned int dataoff,
- struct tcphdr *tcph)
+ const struct tcphdr *tcph)
{
/* XXX Should I use payload length field in IP/IPv6 header ?
* - YK */
@@ -362,11 +363,11 @@ static inline __u32 segment_seq_plus_len(__u32 seq,
*/
static void tcp_options(const struct sk_buff *skb,
unsigned int dataoff,
- struct tcphdr *tcph,
+ const struct tcphdr *tcph,
struct ip_ct_tcp_state *state)
{
unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
- unsigned char *ptr;
+ const unsigned char *ptr;
int length = (tcph->doff*4) - sizeof(struct tcphdr);

if (!length)
@@ -417,10 +418,10 @@ static void tcp_options(const struct sk_buff *skb,
}

static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
- struct tcphdr *tcph, __u32 *sack)
+ const struct tcphdr *tcph, __u32 *sack)
{
unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
- unsigned char *ptr;
+ const unsigned char *ptr;
int length = (tcph->doff*4) - sizeof(struct tcphdr);
__u32 tmp;

@@ -477,18 +478,18 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
}
}

-static int tcp_in_window(struct nf_conn *ct,
+static int tcp_in_window(const struct nf_conn *ct,
struct ip_ct_tcp *state,
enum ip_conntrack_dir dir,
unsigned int index,
const struct sk_buff *skb,
unsigned int dataoff,
- struct tcphdr *tcph,
+ const struct tcphdr *tcph,
int pf)
{
struct ip_ct_tcp_state *sender = &state->seen[dir];
struct ip_ct_tcp_state *receiver = &state->seen[!dir];
- struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
+ const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
__u32 seq, ack, sack, end, win, swin;
int res;

@@ -686,14 +687,14 @@ static int tcp_in_window(struct nf_conn *ct,
#ifdef CONFIG_NF_NAT_NEEDED
/* Update sender->td_end after NAT successfully mangled the packet */
/* Caller must linearize skb at tcp header. */
-void nf_conntrack_tcp_update(struct sk_buff *skb,
+void nf_conntrack_tcp_update(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conn *ct,
int dir)
{
- struct tcphdr *tcph = (void *)skb->data + dataoff;
- struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
- struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
+ const struct tcphdr *tcph = (const void *)skb->data + dataoff;
+ const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
+ const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
__u32 end;

end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
@@ -726,7 +727,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
#define TH_CWR 0x80

/* table of valid flag combinations - PUSH, ECE and CWR are always valid */
-static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
+static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
{
[TH_SYN] = 1,
[TH_SYN|TH_URG] = 1,
@@ -746,7 +747,8 @@ static int tcp_error(struct sk_buff *skb,
int pf,
unsigned int hooknum)
{
- struct tcphdr _tcph, *th;
+ const struct tcphdr *th;
+ struct tcphdr _tcph;
unsigned int tcplen = skb->len - dataoff;
u_int8_t tcpflags;

@@ -803,7 +805,8 @@ static int tcp_packet(struct nf_conn *ct,
struct nf_conntrack_tuple *tuple;
enum tcp_conntrack new_state, old_state;
enum ip_conntrack_dir dir;
- struct tcphdr *th, _tcph;
+ const struct tcphdr *th;
+ struct tcphdr _tcph;
unsigned long timeout;
unsigned int index;

@@ -964,9 +967,10 @@ static int tcp_new(struct nf_conn *ct,
unsigned int dataoff)
{
enum tcp_conntrack new_state;
- struct tcphdr *th, _tcph;
- struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
- struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
+ const struct tcphdr *th;
+ struct tcphdr _tcph;
+ const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
+ const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];

th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
BUG_ON(th == NULL);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:20 UTC
Permalink
[NETFILTER]: nf_conntrack_h323: constify and annotate H.323 helper

Constify data tables (predominantly in nf_conntrack_h323_types.c, but
also a few in nf_conntrack_h323_asn1.c) and use const qualifiers on
variables where possible in the h323 sources.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit c26afec8b93bbda984a179775afcdcd5c48ee365
tree f7895e18edceda46eb109da98b2e94023109960e
parent 25de3b864f944b5adc2f0bf70fbb6b88efafabb1
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:14 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:14 +0100

net/ipv4/netfilter/nf_nat_h323.c | 5
net/netfilter/nf_conntrack_h323_asn1.c | 76 ++++---
net/netfilter/nf_conntrack_h323_main.c | 19 +-
net/netfilter/nf_conntrack_h323_types.c | 346 ++++++++++++++++---------------
4 files changed, 230 insertions(+), 216 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index a121989..ee47bf2 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -32,7 +32,8 @@ static int set_addr(struct sk_buff *skb,
__be32 ip;
__be16 port;
} __attribute__ ((__packed__)) buf;
- struct tcphdr _tcph, *th;
+ const struct tcphdr *th;
+ struct tcphdr _tcph;

buf.ip = ip;
buf.port = port;
@@ -99,7 +100,7 @@ static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
unsigned char **data,
TransportAddress *taddr, int count)
{
- struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+ const struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
int dir = CTINFO2DIR(ctinfo);
int i;
__be16 port;
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index ef02262..8678823 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -87,7 +87,7 @@ typedef struct field_t {
unsigned char ub;
unsigned short attr;
unsigned short offset;
- struct field_t *fields;
+ const struct field_t *fields;
} field_t;

/* Bit Stream */
@@ -111,21 +111,21 @@ static unsigned int get_bitmap(bitstr_t *bs, unsigned int b);
static unsigned int get_uint(bitstr_t *bs, int b);

/* Decoder Functions */
-static int decode_nul(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_bool(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_oid(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_int(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_enum(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_bitstr(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_numstr(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_octstr(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_bmpstr(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_seq(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_seqof(bitstr_t *bs, field_t *f, char *base, int level);
-static int decode_choice(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_nul(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_bool(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_oid(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_int(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_enum(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_bitstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_numstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_octstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_bmpstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_seq(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_seqof(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_choice(bitstr_t *bs, const struct field_t *f, char *base, int level);

/* Decoder Functions Vector */
-typedef int (*decoder_t)(bitstr_t *, field_t *, char *, int);
+typedef int (*decoder_t)(bitstr_t *, const struct field_t *, char *, int);
static const decoder_t Decoders[] = {
decode_nul,
decode_bool,
@@ -264,7 +264,8 @@ static unsigned int get_uint(bitstr_t *bs, int b)
}

/****************************************************************************/
-static int decode_nul(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_nul(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -272,7 +273,8 @@ static int decode_nul(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_bool(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_bool(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -283,7 +285,8 @@ static int decode_bool(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_oid(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_oid(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
int len;

@@ -299,7 +302,8 @@ static int decode_oid(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_int(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_int(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int len;

@@ -342,7 +346,8 @@ static int decode_int(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_enum(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_enum(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -357,7 +362,8 @@ static int decode_enum(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_bitstr(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_bitstr(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int len;

@@ -390,7 +396,8 @@ static int decode_bitstr(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_numstr(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_numstr(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int len;

@@ -407,7 +414,8 @@ static int decode_numstr(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_octstr(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_octstr(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int len;

@@ -455,7 +463,8 @@ static int decode_octstr(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_bmpstr(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_bmpstr(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int len;

@@ -480,11 +489,12 @@ static int decode_bmpstr(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_seq(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_seq(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int ext, bmp, i, opt, len = 0, bmp2, bmp2_len;
int err;
- field_t *son;
+ const struct field_t *son;
unsigned char *beg = NULL;

PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -596,11 +606,12 @@ static int decode_seq(bitstr_t *bs, field_t *f, char *base, int level)
}

/****************************************************************************/
-static int decode_seqof(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_seqof(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int count, effective_count = 0, i, len = 0;
int err;
- field_t *son;
+ const struct field_t *son;
unsigned char *beg = NULL;

PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -685,11 +696,12 @@ static int decode_seqof(bitstr_t *bs, field_t *f, char *base, int level)


/****************************************************************************/
-static int decode_choice(bitstr_t *bs, field_t *f, char *base, int level)
+static int decode_choice(bitstr_t *bs, const struct field_t *f,
+ char *base, int level)
{
unsigned int type, ext, len = 0;
int err;
- field_t *son;
+ const struct field_t *son;
unsigned char *beg = NULL;

PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -756,7 +768,7 @@ static int decode_choice(bitstr_t *bs, field_t *f, char *base, int level)
/****************************************************************************/
int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage *ras)
{
- static field_t ras_message = {
+ static const struct field_t ras_message = {
FNAME("RasMessage") CHOICE, 5, 24, 32, DECODE | EXT,
0, _RasMessage
};
@@ -773,7 +785,7 @@ int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage *ras)
static int DecodeH323_UserInformation(unsigned char *buf, unsigned char *beg,
size_t sz, H323_UserInformation *uuie)
{
- static field_t h323_userinformation = {
+ static const struct field_t h323_userinformation = {
FNAME("H323-UserInformation") SEQ, 1, 2, 2, DECODE | EXT,
0, _H323_UserInformation
};
@@ -792,7 +804,7 @@ int DecodeMultimediaSystemControlMessage(unsigned char *buf, size_t sz,
MultimediaSystemControlMessage *
mscm)
{
- static field_t multimediasystemcontrolmessage = {
+ static const struct field_t multimediasystemcontrolmessage = {
FNAME("MultimediaSystemControlMessage") CHOICE, 2, 4, 4,
DECODE | EXT, 0, _MultimediaSystemControlMessage
};
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 0256305..6213787 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -114,7 +114,8 @@ static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff,
{
struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
int dir = CTINFO2DIR(ctinfo);
- struct tcphdr _tcph, *th;
+ const struct tcphdr *th;
+ struct tcphdr _tcph;
int tcpdatalen;
int tcpdataoff;
unsigned char *tpkt;
@@ -212,11 +213,11 @@ static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff,
}

/****************************************************************************/
-static int get_h245_addr(struct nf_conn *ct, unsigned char *data,
+static int get_h245_addr(struct nf_conn *ct, const unsigned char *data,
H245_TransportAddress *taddr,
union nf_inet_addr *addr, __be16 *port)
{
- unsigned char *p;
+ const unsigned char *p;
int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
int len;

@@ -625,7 +626,7 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data,
TransportAddress *taddr,
union nf_inet_addr *addr, __be16 *port)
{
- unsigned char *p;
+ const unsigned char *p;
int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
int len;

@@ -704,9 +705,8 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,

/* If the calling party is on the same side of the forward-to party,
* we don't need to track the second call */
-static int callforward_do_filter(union nf_inet_addr *src,
- union nf_inet_addr *dst,
- int family)
+static int callforward_do_filter(const union nf_inet_addr *src,
+ const union nf_inet_addr *dst, int family)
{
const struct nf_afinfo *afinfo;
struct flowi fl1, fl2;
@@ -1185,7 +1185,8 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
static unsigned char *get_udp_data(struct sk_buff *skb, unsigned int protoff,
int *datalen)
{
- struct udphdr _uh, *uh;
+ const struct udphdr *uh;
+ struct udphdr _uh;
int dataoff;

uh = skb_header_pointer(skb, protoff, sizeof(_uh), &_uh);
@@ -1468,7 +1469,7 @@ static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
unsigned char **data, AdmissionRequest *arq)
{
- struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+ const struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
int dir = CTINFO2DIR(ctinfo);
__be16 port;
union nf_inet_addr addr;
diff --git a/net/netfilter/nf_conntrack_h323_types.c b/net/netfilter/nf_conntrack_h323_types.c
index 3a21fdf..d880f35 100644
--- a/net/netfilter/nf_conntrack_h323_types.c
+++ b/net/netfilter/nf_conntrack_h323_types.c
@@ -5,22 +5,22 @@
* This source code is licensed under General Public License version 2.
*/

-static field_t _TransportAddress_ipAddress[] = { /* SEQUENCE */
+static const struct field_t _TransportAddress_ipAddress[] = { /* SEQUENCE */
{FNAME("ip") OCTSTR, FIXD, 4, 0, DECODE,
offsetof(TransportAddress_ipAddress, ip), NULL},
{FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _TransportAddress_ipSourceRoute_route[] = { /* SEQUENCE OF */
+static const struct field_t _TransportAddress_ipSourceRoute_route[] = { /* SEQUENCE OF */
{FNAME("item") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
};

-static field_t _TransportAddress_ipSourceRoute_routing[] = { /* CHOICE */
+static const struct field_t _TransportAddress_ipSourceRoute_routing[] = { /* CHOICE */
{FNAME("strict") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("loose") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _TransportAddress_ipSourceRoute[] = { /* SEQUENCE */
+static const struct field_t _TransportAddress_ipSourceRoute[] = { /* SEQUENCE */
{FNAME("ip") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
{FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
{FNAME("route") SEQOF, SEMI, 0, 0, SKIP, 0,
@@ -29,37 +29,37 @@ static field_t _TransportAddress_ipSourceRoute[] = { /* SEQUENCE */
_TransportAddress_ipSourceRoute_routing},
};

-static field_t _TransportAddress_ipxAddress[] = { /* SEQUENCE */
+static const struct field_t _TransportAddress_ipxAddress[] = { /* SEQUENCE */
{FNAME("node") OCTSTR, FIXD, 6, 0, SKIP, 0, NULL},
{FNAME("netnum") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
{FNAME("port") OCTSTR, FIXD, 2, 0, SKIP, 0, NULL},
};

-static field_t _TransportAddress_ip6Address[] = { /* SEQUENCE */
+static const struct field_t _TransportAddress_ip6Address[] = { /* SEQUENCE */
{FNAME("ip") OCTSTR, FIXD, 16, 0, DECODE,
offsetof(TransportAddress_ip6Address, ip), NULL},
{FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _H221NonStandard[] = { /* SEQUENCE */
+static const struct field_t _H221NonStandard[] = { /* SEQUENCE */
{FNAME("t35CountryCode") INT, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("t35Extension") INT, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("manufacturerCode") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _NonStandardIdentifier[] = { /* CHOICE */
+static const struct field_t _NonStandardIdentifier[] = { /* CHOICE */
{FNAME("object") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("h221NonStandard") SEQ, 0, 3, 3, SKIP | EXT, 0,
_H221NonStandard},
};

-static field_t _NonStandardParameter[] = { /* SEQUENCE */
+static const struct field_t _NonStandardParameter[] = { /* SEQUENCE */
{FNAME("nonStandardIdentifier") CHOICE, 1, 2, 2, SKIP | EXT, 0,
_NonStandardIdentifier},
{FNAME("data") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _TransportAddress[] = { /* CHOICE */
+static const struct field_t _TransportAddress[] = { /* CHOICE */
{FNAME("ipAddress") SEQ, 0, 2, 2, DECODE,
offsetof(TransportAddress, ipAddress), _TransportAddress_ipAddress},
{FNAME("ipSourceRoute") SEQ, 0, 4, 4, SKIP | EXT, 0,
@@ -75,7 +75,7 @@ static field_t _TransportAddress[] = { /* CHOICE */
_NonStandardParameter},
};

-static field_t _AliasAddress[] = { /* CHOICE */
+static const struct field_t _AliasAddress[] = { /* CHOICE */
{FNAME("dialedDigits") NUMDGT, 7, 1, 0, SKIP, 0, NULL},
{FNAME("h323-ID") BMPSTR, BYTE, 1, 0, SKIP, 0, NULL},
{FNAME("url-ID") IA5STR, WORD, 1, 0, SKIP, 0, NULL},
@@ -85,78 +85,78 @@ static field_t _AliasAddress[] = { /* CHOICE */
{FNAME("mobileUIM") CHOICE, 1, 2, 2, SKIP | EXT, 0, NULL},
};

-static field_t _Setup_UUIE_sourceAddress[] = { /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_sourceAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _VendorIdentifier[] = { /* SEQUENCE */
+static const struct field_t _VendorIdentifier[] = { /* SEQUENCE */
{FNAME("vendor") SEQ, 0, 3, 3, SKIP | EXT, 0, _H221NonStandard},
{FNAME("productId") OCTSTR, BYTE, 1, 0, SKIP | OPT, 0, NULL},
{FNAME("versionId") OCTSTR, BYTE, 1, 0, SKIP | OPT, 0, NULL},
};

-static field_t _GatekeeperInfo[] = { /* SEQUENCE */
+static const struct field_t _GatekeeperInfo[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
};

-static field_t _H310Caps[] = { /* SEQUENCE */
+static const struct field_t _H310Caps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _H320Caps[] = { /* SEQUENCE */
+static const struct field_t _H320Caps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _H321Caps[] = { /* SEQUENCE */
+static const struct field_t _H321Caps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _H322Caps[] = { /* SEQUENCE */
+static const struct field_t _H322Caps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _H323Caps[] = { /* SEQUENCE */
+static const struct field_t _H323Caps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _H324Caps[] = { /* SEQUENCE */
+static const struct field_t _H324Caps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _VoiceCaps[] = { /* SEQUENCE */
+static const struct field_t _VoiceCaps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _T120OnlyCaps[] = { /* SEQUENCE */
+static const struct field_t _T120OnlyCaps[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _SupportedProtocols[] = { /* CHOICE */
+static const struct field_t _SupportedProtocols[] = { /* CHOICE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP, 0,
_NonStandardParameter},
{FNAME("h310") SEQ, 1, 1, 3, SKIP | EXT, 0, _H310Caps},
@@ -171,29 +171,29 @@ static field_t _SupportedProtocols[] = { /* CHOICE */
{FNAME("t38FaxAnnexbOnly") SEQ, 2, 5, 5, SKIP | EXT, 0, NULL},
};

-static field_t _GatewayInfo_protocol[] = { /* SEQUENCE OF */
+static const struct field_t _GatewayInfo_protocol[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 4, 9, 11, SKIP | EXT, 0, _SupportedProtocols},
};

-static field_t _GatewayInfo[] = { /* SEQUENCE */
+static const struct field_t _GatewayInfo[] = { /* SEQUENCE */
{FNAME("protocol") SEQOF, SEMI, 0, 0, SKIP | OPT, 0,
_GatewayInfo_protocol},
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
};

-static field_t _McuInfo[] = { /* SEQUENCE */
+static const struct field_t _McuInfo[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("protocol") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
};

-static field_t _TerminalInfo[] = { /* SEQUENCE */
+static const struct field_t _TerminalInfo[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
};

-static field_t _EndpointType[] = { /* SEQUENCE */
+static const struct field_t _EndpointType[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("vendor") SEQ, 2, 3, 3, SKIP | EXT | OPT, 0,
@@ -210,19 +210,19 @@ static field_t _EndpointType[] = { /* SEQUENCE */
0, NULL},
};

-static field_t _Setup_UUIE_destinationAddress[] = { /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_destinationAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _Setup_UUIE_destExtraCallInfo[] = { /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_destExtraCallInfo[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _Setup_UUIE_destExtraCRV[] = { /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_destExtraCRV[] = { /* SEQUENCE OF */
{FNAME("item") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _Setup_UUIE_conferenceGoal[] = { /* CHOICE */
+static const struct field_t _Setup_UUIE_conferenceGoal[] = { /* CHOICE */
{FNAME("create") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("join") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("invite") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -231,12 +231,12 @@ static field_t _Setup_UUIE_conferenceGoal[] = { /* CHOICE */
0, NULL},
};

-static field_t _Q954Details[] = { /* SEQUENCE */
+static const struct field_t _Q954Details[] = { /* SEQUENCE */
{FNAME("conferenceCalling") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("threePartyService") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _QseriesOptions[] = { /* SEQUENCE */
+static const struct field_t _QseriesOptions[] = { /* SEQUENCE */
{FNAME("q932Full") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("q951Full") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("q952Full") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -247,32 +247,32 @@ static field_t _QseriesOptions[] = { /* SEQUENCE */
{FNAME("q954Info") SEQ, 0, 2, 2, SKIP | EXT, 0, _Q954Details},
};

-static field_t _CallType[] = { /* CHOICE */
+static const struct field_t _CallType[] = { /* CHOICE */
{FNAME("pointToPoint") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("oneToN") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("nToOne") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("nToN") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _H245_NonStandardIdentifier_h221NonStandard[] = { /* SEQUENCE */
+static const struct field_t _H245_NonStandardIdentifier_h221NonStandard[] = { /* SEQUENCE */
{FNAME("t35CountryCode") INT, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("t35Extension") INT, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("manufacturerCode") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _H245_NonStandardIdentifier[] = { /* CHOICE */
+static const struct field_t _H245_NonStandardIdentifier[] = { /* CHOICE */
{FNAME("object") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("h221NonStandard") SEQ, 0, 3, 3, SKIP, 0,
_H245_NonStandardIdentifier_h221NonStandard},
};

-static field_t _H245_NonStandardParameter[] = { /* SEQUENCE */
+static const struct field_t _H245_NonStandardParameter[] = { /* SEQUENCE */
{FNAME("nonStandardIdentifier") CHOICE, 1, 2, 2, SKIP, 0,
_H245_NonStandardIdentifier},
{FNAME("data") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _H261VideoCapability[] = { /* SEQUENCE */
+static const struct field_t _H261VideoCapability[] = { /* SEQUENCE */
{FNAME("qcifMPI") INT, 2, 1, 0, SKIP | OPT, 0, NULL},
{FNAME("cifMPI") INT, 2, 1, 0, SKIP | OPT, 0, NULL},
{FNAME("temporalSpatialTradeOffCapability") BOOL, FIXD, 0, 0, SKIP, 0,
@@ -282,7 +282,7 @@ static field_t _H261VideoCapability[] = { /* SEQUENCE */
{FNAME("videoBadMBsCap") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _H262VideoCapability[] = { /* SEQUENCE */
+static const struct field_t _H262VideoCapability[] = { /* SEQUENCE */
{FNAME("profileAndLevel-SPatML") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("profileAndLevel-MPatLL") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("profileAndLevel-MPatML") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -304,7 +304,7 @@ static field_t _H262VideoCapability[] = { /* SEQUENCE */
{FNAME("videoBadMBsCap") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _H263VideoCapability[] = { /* SEQUENCE */
+static const struct field_t _H263VideoCapability[] = { /* SEQUENCE */
{FNAME("sqcifMPI") INT, 5, 1, 0, SKIP | OPT, 0, NULL},
{FNAME("qcifMPI") INT, 5, 1, 0, SKIP | OPT, 0, NULL},
{FNAME("cifMPI") INT, 5, 1, 0, SKIP | OPT, 0, NULL},
@@ -330,7 +330,7 @@ static field_t _H263VideoCapability[] = { /* SEQUENCE */
{FNAME("h263Options") SEQ, 5, 29, 31, SKIP | EXT | OPT, 0, NULL},
};

-static field_t _IS11172VideoCapability[] = { /* SEQUENCE */
+static const struct field_t _IS11172VideoCapability[] = { /* SEQUENCE */
{FNAME("constrainedBitstream") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("videoBitRate") INT, CONS, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("vbvBufferSize") INT, CONS, 0, 0, SKIP | OPT, 0, NULL},
@@ -341,7 +341,7 @@ static field_t _IS11172VideoCapability[] = { /* SEQUENCE */
{FNAME("videoBadMBsCap") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _VideoCapability[] = { /* CHOICE */
+static const struct field_t _VideoCapability[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
_H245_NonStandardParameter},
{FNAME("h261VideoCapability") SEQ, 2, 5, 6, SKIP | EXT, 0,
@@ -355,12 +355,12 @@ static field_t _VideoCapability[] = { /* CHOICE */
{FNAME("genericVideoCapability") SEQ, 5, 6, 6, SKIP | EXT, 0, NULL},
};

-static field_t _AudioCapability_g7231[] = { /* SEQUENCE */
+static const struct field_t _AudioCapability_g7231[] = { /* SEQUENCE */
{FNAME("maxAl-sduAudioFrames") INT, BYTE, 1, 0, SKIP, 0, NULL},
{FNAME("silenceSuppression") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _IS11172AudioCapability[] = { /* SEQUENCE */
+static const struct field_t _IS11172AudioCapability[] = { /* SEQUENCE */
{FNAME("audioLayer1") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("audioLayer2") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("audioLayer3") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -372,7 +372,7 @@ static field_t _IS11172AudioCapability[] = { /* SEQUENCE */
{FNAME("bitRate") INT, WORD, 1, 0, SKIP, 0, NULL},
};

-static field_t _IS13818AudioCapability[] = { /* SEQUENCE */
+static const struct field_t _IS13818AudioCapability[] = { /* SEQUENCE */
{FNAME("audioLayer1") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("audioLayer2") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("audioLayer3") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -396,7 +396,7 @@ static field_t _IS13818AudioCapability[] = { /* SEQUENCE */
{FNAME("bitRate") INT, WORD, 1, 0, SKIP, 0, NULL},
};

-static field_t _AudioCapability[] = { /* CHOICE */
+static const struct field_t _AudioCapability[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
_H245_NonStandardParameter},
{FNAME("g711Alaw64k") INT, BYTE, 1, 0, SKIP, 0, NULL},
@@ -424,7 +424,7 @@ static field_t _AudioCapability[] = { /* CHOICE */
{FNAME("g729Extensions") SEQ, 1, 8, 8, SKIP | EXT, 0, NULL},
};

-static field_t _DataProtocolCapability[] = { /* CHOICE */
+static const struct field_t _DataProtocolCapability[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
_H245_NonStandardParameter},
{FNAME("v14buffered") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -442,7 +442,7 @@ static field_t _DataProtocolCapability[] = { /* CHOICE */
{FNAME("udp") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _T84Profile_t84Restricted[] = { /* SEQUENCE */
+static const struct field_t _T84Profile_t84Restricted[] = { /* SEQUENCE */
{FNAME("qcif") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("cif") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("ccir601Seq") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -464,25 +464,25 @@ static field_t _T84Profile_t84Restricted[] = { /* SEQUENCE */
{FNAME("digPhotoHighProg") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _T84Profile[] = { /* CHOICE */
+static const struct field_t _T84Profile[] = { /* CHOICE */
{FNAME("t84Unrestricted") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("t84Restricted") SEQ, 0, 19, 19, SKIP | EXT, 0,
_T84Profile_t84Restricted},
};

-static field_t _DataApplicationCapability_application_t84[] = { /* SEQUENCE */
+static const struct field_t _DataApplicationCapability_application_t84[] = { /* SEQUENCE */
{FNAME("t84Protocol") CHOICE, 3, 7, 14, SKIP | EXT, 0,
_DataProtocolCapability},
{FNAME("t84Profile") CHOICE, 1, 2, 2, SKIP, 0, _T84Profile},
};

-static field_t _DataApplicationCapability_application_nlpid[] = { /* SEQUENCE */
+static const struct field_t _DataApplicationCapability_application_nlpid[] = { /* SEQUENCE */
{FNAME("nlpidProtocol") CHOICE, 3, 7, 14, SKIP | EXT, 0,
_DataProtocolCapability},
{FNAME("nlpidData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _DataApplicationCapability_application[] = { /* CHOICE */
+static const struct field_t _DataApplicationCapability_application[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
_H245_NonStandardParameter},
{FNAME("t120") CHOICE, 3, 7, 14, DECODE | EXT,
@@ -509,20 +509,20 @@ static field_t _DataApplicationCapability_application[] = { /* CHOICE */
{FNAME("genericDataCapability") SEQ, 5, 6, 6, SKIP | EXT, 0, NULL},
};

-static field_t _DataApplicationCapability[] = { /* SEQUENCE */
+static const struct field_t _DataApplicationCapability[] = { /* SEQUENCE */
{FNAME("application") CHOICE, 4, 10, 14, DECODE | EXT,
offsetof(DataApplicationCapability, application),
_DataApplicationCapability_application},
{FNAME("maxBitRate") INT, CONS, 0, 0, SKIP, 0, NULL},
};

-static field_t _EncryptionMode[] = { /* CHOICE */
+static const struct field_t _EncryptionMode[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
_H245_NonStandardParameter},
{FNAME("h233Encryption") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _DataType[] = { /* CHOICE */
+static const struct field_t _DataType[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
_H245_NonStandardParameter},
{FNAME("nullData") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -538,7 +538,7 @@ static field_t _DataType[] = { /* CHOICE */
{FNAME("multiplexedStream") SEQ, 0, 2, 2, SKIP | EXT, 0, NULL},
};

-static field_t _H222LogicalChannelParameters[] = { /* SEQUENCE */
+static const struct field_t _H222LogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("resourceID") INT, WORD, 0, 0, SKIP, 0, NULL},
{FNAME("subChannelID") INT, WORD, 0, 0, SKIP, 0, NULL},
{FNAME("pcr-pid") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
@@ -546,12 +546,12 @@ static field_t _H222LogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("streamDescriptors") OCTSTR, SEMI, 0, 0, SKIP | OPT, 0, NULL},
};

-static field_t _H223LogicalChannelParameters_adaptationLayerType_al3[] = { /* SEQUENCE */
+static const struct field_t _H223LogicalChannelParameters_adaptationLayerType_al3[] = { /* SEQUENCE */
{FNAME("controlFieldOctets") INT, 2, 0, 0, SKIP, 0, NULL},
{FNAME("sendBufferSize") INT, CONS, 0, 0, SKIP, 0, NULL},
};

-static field_t _H223LogicalChannelParameters_adaptationLayerType[] = { /* CHOICE */
+static const struct field_t _H223LogicalChannelParameters_adaptationLayerType[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
_H245_NonStandardParameter},
{FNAME("al1Framed") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -565,53 +565,53 @@ static field_t _H223LogicalChannelParameters_adaptationLayerType[] = { /* CHOICE
{FNAME("al3M") SEQ, 0, 5, 6, SKIP | EXT, 0, NULL},
};

-static field_t _H223LogicalChannelParameters[] = { /* SEQUENCE */
+static const struct field_t _H223LogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("adaptationLayerType") CHOICE, 3, 6, 9, SKIP | EXT, 0,
_H223LogicalChannelParameters_adaptationLayerType},
{FNAME("segmentableFlag") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _CRCLength[] = { /* CHOICE */
+static const struct field_t _CRCLength[] = { /* CHOICE */
{FNAME("crc8bit") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("crc16bit") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("crc32bit") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _V76HDLCParameters[] = { /* SEQUENCE */
+static const struct field_t _V76HDLCParameters[] = { /* SEQUENCE */
{FNAME("crcLength") CHOICE, 2, 3, 3, SKIP | EXT, 0, _CRCLength},
{FNAME("n401") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("loopbackTestProcedure") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _V76LogicalChannelParameters_suspendResume[] = { /* CHOICE */
+static const struct field_t _V76LogicalChannelParameters_suspendResume[] = { /* CHOICE */
{FNAME("noSuspendResume") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("suspendResumewAddress") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("suspendResumewoAddress") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _V76LogicalChannelParameters_mode_eRM_recovery[] = { /* CHOICE */
+static const struct field_t _V76LogicalChannelParameters_mode_eRM_recovery[] = { /* CHOICE */
{FNAME("rej") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("sREJ") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("mSREJ") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _V76LogicalChannelParameters_mode_eRM[] = { /* SEQUENCE */
+static const struct field_t _V76LogicalChannelParameters_mode_eRM[] = { /* SEQUENCE */
{FNAME("windowSize") INT, 7, 1, 0, SKIP, 0, NULL},
{FNAME("recovery") CHOICE, 2, 3, 3, SKIP | EXT, 0,
_V76LogicalChannelParameters_mode_eRM_recovery},
};

-static field_t _V76LogicalChannelParameters_mode[] = { /* CHOICE */
+static const struct field_t _V76LogicalChannelParameters_mode[] = { /* CHOICE */
{FNAME("eRM") SEQ, 0, 2, 2, SKIP | EXT, 0,
_V76LogicalChannelParameters_mode_eRM},
{FNAME("uNERM") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _V75Parameters[] = { /* SEQUENCE */
+static const struct field_t _V75Parameters[] = { /* SEQUENCE */
{FNAME("audioHeaderPresent") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _V76LogicalChannelParameters[] = { /* SEQUENCE */
+static const struct field_t _V76LogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("hdlcParameters") SEQ, 0, 3, 3, SKIP | EXT, 0,
_V76HDLCParameters},
{FNAME("suspendResume") CHOICE, 2, 3, 3, SKIP | EXT, 0,
@@ -622,38 +622,38 @@ static field_t _V76LogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("v75Parameters") SEQ, 0, 1, 1, SKIP | EXT, 0, _V75Parameters},
};

-static field_t _H2250LogicalChannelParameters_nonStandard[] = { /* SEQUENCE OF */
+static const struct field_t _H2250LogicalChannelParameters_nonStandard[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 0, 2, 2, SKIP, 0, _H245_NonStandardParameter},
};

-static field_t _UnicastAddress_iPAddress[] = { /* SEQUENCE */
+static const struct field_t _UnicastAddress_iPAddress[] = { /* SEQUENCE */
{FNAME("network") OCTSTR, FIXD, 4, 0, DECODE,
offsetof(UnicastAddress_iPAddress, network), NULL},
{FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _UnicastAddress_iPXAddress[] = { /* SEQUENCE */
+static const struct field_t _UnicastAddress_iPXAddress[] = { /* SEQUENCE */
{FNAME("node") OCTSTR, FIXD, 6, 0, SKIP, 0, NULL},
{FNAME("netnum") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
{FNAME("tsapIdentifier") OCTSTR, FIXD, 2, 0, SKIP, 0, NULL},
};

-static field_t _UnicastAddress_iP6Address[] = { /* SEQUENCE */
+static const struct field_t _UnicastAddress_iP6Address[] = { /* SEQUENCE */
{FNAME("network") OCTSTR, FIXD, 16, 0, DECODE,
offsetof(UnicastAddress_iP6Address, network), NULL},
{FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _UnicastAddress_iPSourceRouteAddress_routing[] = { /* CHOICE */
+static const struct field_t _UnicastAddress_iPSourceRouteAddress_routing[] = { /* CHOICE */
{FNAME("strict") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("loose") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _UnicastAddress_iPSourceRouteAddress_route[] = { /* SEQUENCE OF */
+static const struct field_t _UnicastAddress_iPSourceRouteAddress_route[] = { /* SEQUENCE OF */
{FNAME("item") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
};

-static field_t _UnicastAddress_iPSourceRouteAddress[] = { /* SEQUENCE */
+static const struct field_t _UnicastAddress_iPSourceRouteAddress[] = { /* SEQUENCE */
{FNAME("routing") CHOICE, 1, 2, 2, SKIP, 0,
_UnicastAddress_iPSourceRouteAddress_routing},
{FNAME("network") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
@@ -662,7 +662,7 @@ static field_t _UnicastAddress_iPSourceRouteAddress[] = { /* SEQUENCE */
_UnicastAddress_iPSourceRouteAddress_route},
};

-static field_t _UnicastAddress[] = { /* CHOICE */
+static const struct field_t _UnicastAddress[] = { /* CHOICE */
{FNAME("iPAddress") SEQ, 0, 2, 2, DECODE | EXT,
offsetof(UnicastAddress, iPAddress), _UnicastAddress_iPAddress},
{FNAME("iPXAddress") SEQ, 0, 3, 3, SKIP | EXT, 0,
@@ -676,17 +676,17 @@ static field_t _UnicastAddress[] = { /* CHOICE */
{FNAME("nonStandardAddress") SEQ, 0, 2, 2, SKIP, 0, NULL},
};

-static field_t _MulticastAddress_iPAddress[] = { /* SEQUENCE */
+static const struct field_t _MulticastAddress_iPAddress[] = { /* SEQUENCE */
{FNAME("network") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
{FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _MulticastAddress_iP6Address[] = { /* SEQUENCE */
+static const struct field_t _MulticastAddress_iP6Address[] = { /* SEQUENCE */
{FNAME("network") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
{FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _MulticastAddress[] = { /* CHOICE */
+static const struct field_t _MulticastAddress[] = { /* CHOICE */
{FNAME("iPAddress") SEQ, 0, 2, 2, SKIP | EXT, 0,
_MulticastAddress_iPAddress},
{FNAME("iP6Address") SEQ, 0, 2, 2, SKIP | EXT, 0,
@@ -695,14 +695,14 @@ static field_t _MulticastAddress[] = { /* CHOICE */
{FNAME("nonStandardAddress") SEQ, 0, 2, 2, SKIP, 0, NULL},
};

-static field_t _H245_TransportAddress[] = { /* CHOICE */
+static const struct field_t _H245_TransportAddress[] = { /* CHOICE */
{FNAME("unicastAddress") CHOICE, 3, 5, 7, DECODE | EXT,
offsetof(H245_TransportAddress, unicastAddress), _UnicastAddress},
{FNAME("multicastAddress") CHOICE, 1, 2, 4, SKIP | EXT, 0,
_MulticastAddress},
};

-static field_t _H2250LogicalChannelParameters[] = { /* SEQUENCE */
+static const struct field_t _H2250LogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("nonStandard") SEQOF, SEMI, 0, 0, SKIP | OPT, 0,
_H2250LogicalChannelParameters_nonStandard},
{FNAME("sessionID") INT, BYTE, 0, 0, SKIP, 0, NULL},
@@ -728,7 +728,7 @@ static field_t _H2250LogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("source") SEQ, 0, 2, 2, SKIP | EXT | OPT, 0, NULL},
};

-static field_t _OpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters[] = { /* CHOICE */
+static const struct field_t _OpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters[] = { /* CHOICE */
{FNAME("h222LogicalChannelParameters") SEQ, 3, 5, 5, SKIP | EXT, 0,
_H222LogicalChannelParameters},
{FNAME("h223LogicalChannelParameters") SEQ, 0, 2, 2, SKIP | EXT, 0,
@@ -742,7 +742,7 @@ static field_t _OpenLogicalChannel_forwardLogicalChannelParameters_multiplexPara
{FNAME("none") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _OpenLogicalChannel_forwardLogicalChannelParameters[] = { /* SEQUENCE */
+static const struct field_t _OpenLogicalChannel_forwardLogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("portNumber") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("dataType") CHOICE, 3, 6, 9, DECODE | EXT,
offsetof(OpenLogicalChannel_forwardLogicalChannelParameters,
@@ -756,7 +756,7 @@ static field_t _OpenLogicalChannel_forwardLogicalChannelParameters[] = { /* SEQU
{FNAME("replacementFor") INT, WORD, 1, 0, SKIP | OPT, 0, NULL},
};

-static field_t _OpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters[] = { /* CHOICE */
+static const struct field_t _OpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters[] = { /* CHOICE */
{FNAME("h223LogicalChannelParameters") SEQ, 0, 2, 2, SKIP | EXT, 0,
_H223LogicalChannelParameters},
{FNAME("v76LogicalChannelParameters") SEQ, 0, 5, 5, SKIP | EXT, 0,
@@ -767,7 +767,7 @@ static field_t _OpenLogicalChannel_reverseLogicalChannelParameters_multiplexPara
h2250LogicalChannelParameters), _H2250LogicalChannelParameters},
};

-static field_t _OpenLogicalChannel_reverseLogicalChannelParameters[] = { /* SEQUENCE */
+static const struct field_t _OpenLogicalChannel_reverseLogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("dataType") CHOICE, 3, 6, 9, SKIP | EXT, 0, _DataType},
{FNAME("multiplexParameters") CHOICE, 1, 2, 3, DECODE | EXT | OPT,
offsetof(OpenLogicalChannel_reverseLogicalChannelParameters,
@@ -778,23 +778,23 @@ static field_t _OpenLogicalChannel_reverseLogicalChannelParameters[] = { /* SEQU
{FNAME("replacementFor") INT, WORD, 1, 0, SKIP | OPT, 0, NULL},
};

-static field_t _NetworkAccessParameters_distribution[] = { /* CHOICE */
+static const struct field_t _NetworkAccessParameters_distribution[] = { /* CHOICE */
{FNAME("unicast") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("multicast") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _Q2931Address_address[] = { /* CHOICE */
+static const struct field_t _Q2931Address_address[] = { /* CHOICE */
{FNAME("internationalNumber") NUMSTR, 4, 1, 0, SKIP, 0, NULL},
{FNAME("nsapAddress") OCTSTR, 5, 1, 0, SKIP, 0, NULL},
};

-static field_t _Q2931Address[] = { /* SEQUENCE */
+static const struct field_t _Q2931Address[] = { /* SEQUENCE */
{FNAME("address") CHOICE, 1, 2, 2, SKIP | EXT, 0,
_Q2931Address_address},
{FNAME("subaddress") OCTSTR, 5, 1, 0, SKIP | OPT, 0, NULL},
};

-static field_t _NetworkAccessParameters_networkAddress[] = { /* CHOICE */
+static const struct field_t _NetworkAccessParameters_networkAddress[] = { /* CHOICE */
{FNAME("q2931Address") SEQ, 1, 2, 2, SKIP | EXT, 0, _Q2931Address},
{FNAME("e164Address") NUMDGT, 7, 1, 0, SKIP, 0, NULL},
{FNAME("localAreaAddress") CHOICE, 1, 2, 2, DECODE | EXT,
@@ -802,7 +802,7 @@ static field_t _NetworkAccessParameters_networkAddress[] = { /* CHOICE */
_H245_TransportAddress},
};

-static field_t _NetworkAccessParameters[] = { /* SEQUENCE */
+static const struct field_t _NetworkAccessParameters[] = { /* SEQUENCE */
{FNAME("distribution") CHOICE, 1, 2, 2, SKIP | EXT | OPT, 0,
_NetworkAccessParameters_distribution},
{FNAME("networkAddress") CHOICE, 2, 3, 3, DECODE | EXT,
@@ -814,7 +814,7 @@ static field_t _NetworkAccessParameters[] = { /* SEQUENCE */
NULL},
};

-static field_t _OpenLogicalChannel[] = { /* SEQUENCE */
+static const struct field_t _OpenLogicalChannel[] = { /* SEQUENCE */
{FNAME("forwardLogicalChannelNumber") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("forwardLogicalChannelParameters") SEQ, 1, 3, 5, DECODE | EXT,
offsetof(OpenLogicalChannel, forwardLogicalChannelParameters),
@@ -829,13 +829,13 @@ static field_t _OpenLogicalChannel[] = { /* SEQUENCE */
{FNAME("encryptionSync") SEQ, 2, 4, 4, STOP | EXT | OPT, 0, NULL},
};

-static field_t _Setup_UUIE_fastStart[] = { /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_fastStart[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
sizeof(OpenLogicalChannel), _OpenLogicalChannel}
,
};

-static field_t _Setup_UUIE[] = { /* SEQUENCE */
+static const struct field_t _Setup_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("h245Address") CHOICE, 3, 7, 7, DECODE | EXT | OPT,
offsetof(Setup_UUIE, h245Address), _TransportAddress},
@@ -894,13 +894,13 @@ static field_t _Setup_UUIE[] = { /* SEQUENCE */
NULL},
};

-static field_t _CallProceeding_UUIE_fastStart[] = { /* SEQUENCE OF */
+static const struct field_t _CallProceeding_UUIE_fastStart[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
sizeof(OpenLogicalChannel), _OpenLogicalChannel}
,
};

-static field_t _CallProceeding_UUIE[] = { /* SEQUENCE */
+static const struct field_t _CallProceeding_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("destinationInfo") SEQ, 6, 8, 10, SKIP | EXT, 0,
_EndpointType},
@@ -920,13 +920,13 @@ static field_t _CallProceeding_UUIE[] = { /* SEQUENCE */
{FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
};

-static field_t _Connect_UUIE_fastStart[] = { /* SEQUENCE OF */
+static const struct field_t _Connect_UUIE_fastStart[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
sizeof(OpenLogicalChannel), _OpenLogicalChannel}
,
};

-static field_t _Connect_UUIE[] = { /* SEQUENCE */
+static const struct field_t _Connect_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("h245Address") CHOICE, 3, 7, 7, DECODE | EXT | OPT,
offsetof(Connect_UUIE, h245Address), _TransportAddress},
@@ -954,13 +954,13 @@ static field_t _Connect_UUIE[] = { /* SEQUENCE */
{FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
};

-static field_t _Alerting_UUIE_fastStart[] = { /* SEQUENCE OF */
+static const struct field_t _Alerting_UUIE_fastStart[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
sizeof(OpenLogicalChannel), _OpenLogicalChannel}
,
};

-static field_t _Alerting_UUIE[] = { /* SEQUENCE */
+static const struct field_t _Alerting_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("destinationInfo") SEQ, 6, 8, 10, SKIP | EXT, 0,
_EndpointType},
@@ -986,7 +986,7 @@ static field_t _Alerting_UUIE[] = { /* SEQUENCE */
{FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
};

-static field_t _Information_UUIE[] = { /* SEQUENCE */
+static const struct field_t _Information_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("callIdentifier") SEQ, 0, 1, 1, SKIP | EXT, 0, NULL},
{FNAME("tokens") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
@@ -996,7 +996,7 @@ static field_t _Information_UUIE[] = { /* SEQUENCE */
{FNAME("circuitInfo") SEQ, 3, 3, 3, SKIP | EXT | OPT, 0, NULL},
};

-static field_t _ReleaseCompleteReason[] = { /* CHOICE */
+static const struct field_t _ReleaseCompleteReason[] = { /* CHOICE */
{FNAME("noBandwidth") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("gatekeeperResources") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("unreachableDestination") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -1022,7 +1022,7 @@ static field_t _ReleaseCompleteReason[] = { /* CHOICE */
{FNAME("tunnelledSignallingRejected") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _ReleaseComplete_UUIE[] = { /* SEQUENCE */
+static const struct field_t _ReleaseComplete_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("reason") CHOICE, 4, 12, 22, SKIP | EXT | OPT, 0,
_ReleaseCompleteReason},
@@ -1039,11 +1039,11 @@ static field_t _ReleaseComplete_UUIE[] = { /* SEQUENCE */
{FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
};

-static field_t _Facility_UUIE_alternativeAliasAddress[] = { /* SEQUENCE OF */
+static const struct field_t _Facility_UUIE_alternativeAliasAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _FacilityReason[] = { /* CHOICE */
+static const struct field_t _FacilityReason[] = { /* CHOICE */
{FNAME("routeCallToGatekeeper") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("callForwarded") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("routeCallToMC") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -1057,13 +1057,13 @@ static field_t _FacilityReason[] = { /* CHOICE */
{FNAME("transportedInformation") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _Facility_UUIE_fastStart[] = { /* SEQUENCE OF */
+static const struct field_t _Facility_UUIE_fastStart[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
sizeof(OpenLogicalChannel), _OpenLogicalChannel}
,
};

-static field_t _Facility_UUIE[] = { /* SEQUENCE */
+static const struct field_t _Facility_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("alternativeAddress") CHOICE, 3, 7, 7, DECODE | EXT | OPT,
offsetof(Facility_UUIE, alternativeAddress), _TransportAddress},
@@ -1094,17 +1094,17 @@ static field_t _Facility_UUIE[] = { /* SEQUENCE */
NULL},
};

-static field_t _CallIdentifier[] = { /* SEQUENCE */
+static const struct field_t _CallIdentifier[] = { /* SEQUENCE */
{FNAME("guid") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
};

-static field_t _SecurityServiceMode[] = { /* CHOICE */
+static const struct field_t _SecurityServiceMode[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0, _NonStandardParameter},
{FNAME("none") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("default") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _SecurityCapabilities[] = { /* SEQUENCE */
+static const struct field_t _SecurityCapabilities[] = { /* SEQUENCE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("encryption") CHOICE, 2, 3, 3, SKIP | EXT, 0,
@@ -1115,30 +1115,30 @@ static field_t _SecurityCapabilities[] = { /* SEQUENCE */
_SecurityServiceMode},
};

-static field_t _H245Security[] = { /* CHOICE */
+static const struct field_t _H245Security[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0, _NonStandardParameter},
{FNAME("noSecurity") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("tls") SEQ, 1, 4, 4, SKIP | EXT, 0, _SecurityCapabilities},
{FNAME("ipsec") SEQ, 1, 4, 4, SKIP | EXT, 0, _SecurityCapabilities},
};

-static field_t _DHset[] = { /* SEQUENCE */
+static const struct field_t _DHset[] = { /* SEQUENCE */
{FNAME("halfkey") BITSTR, WORD, 0, 0, SKIP, 0, NULL},
{FNAME("modSize") BITSTR, WORD, 0, 0, SKIP, 0, NULL},
{FNAME("generator") BITSTR, WORD, 0, 0, SKIP, 0, NULL},
};

-static field_t _TypedCertificate[] = { /* SEQUENCE */
+static const struct field_t _TypedCertificate[] = { /* SEQUENCE */
{FNAME("type") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("certificate") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _H235_NonStandardParameter[] = { /* SEQUENCE */
+static const struct field_t _H235_NonStandardParameter[] = { /* SEQUENCE */
{FNAME("nonStandardIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("data") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _ClearToken[] = { /* SEQUENCE */
+static const struct field_t _ClearToken[] = { /* SEQUENCE */
{FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("timeStamp") INT, CONS, 1, 0, SKIP | OPT, 0, NULL},
{FNAME("password") BMPSTR, 7, 1, 0, SKIP | OPT, 0, NULL},
@@ -1154,120 +1154,120 @@ static field_t _ClearToken[] = { /* SEQUENCE */
{FNAME("sendersID") BMPSTR, 7, 1, 0, SKIP | OPT, 0, NULL},
};

-static field_t _Progress_UUIE_tokens[] = { /* SEQUENCE OF */
+static const struct field_t _Progress_UUIE_tokens[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 8, 9, 11, SKIP | EXT, 0, _ClearToken},
};

-static field_t _Params[] = { /* SEQUENCE */
+static const struct field_t _Params[] = { /* SEQUENCE */
{FNAME("ranInt") INT, UNCO, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("iv8") OCTSTR, FIXD, 8, 0, SKIP | OPT, 0, NULL},
{FNAME("iv16") OCTSTR, FIXD, 16, 0, SKIP | OPT, 0, NULL},
};

-static field_t _CryptoH323Token_cryptoEPPwdHash_token[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPPwdHash_token[] = { /* SEQUENCE */
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("hash") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoH323Token_cryptoEPPwdHash[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPPwdHash[] = { /* SEQUENCE */
{FNAME("alias") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
{FNAME("timeStamp") INT, CONS, 1, 0, SKIP, 0, NULL},
{FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
_CryptoH323Token_cryptoEPPwdHash_token},
};

-static field_t _CryptoH323Token_cryptoGKPwdHash_token[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKPwdHash_token[] = { /* SEQUENCE */
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("hash") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoH323Token_cryptoGKPwdHash[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKPwdHash[] = { /* SEQUENCE */
{FNAME("gatekeeperId") BMPSTR, 7, 1, 0, SKIP, 0, NULL},
{FNAME("timeStamp") INT, CONS, 1, 0, SKIP, 0, NULL},
{FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
_CryptoH323Token_cryptoGKPwdHash_token},
};

-static field_t _CryptoH323Token_cryptoEPPwdEncr[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPPwdEncr[] = { /* SEQUENCE */
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoH323Token_cryptoGKPwdEncr[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKPwdEncr[] = { /* SEQUENCE */
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoH323Token_cryptoEPCert[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPCert[] = { /* SEQUENCE */
{FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoH323Token_cryptoGKCert[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKCert[] = { /* SEQUENCE */
{FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoH323Token_cryptoFastStart[] = { /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoFastStart[] = { /* SEQUENCE */
{FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoToken_cryptoEncryptedToken_token[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoEncryptedToken_token[] = { /* SEQUENCE */
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoToken_cryptoEncryptedToken[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoEncryptedToken[] = { /* SEQUENCE */
{FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
_CryptoToken_cryptoEncryptedToken_token},
};

-static field_t _CryptoToken_cryptoSignedToken_token[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoSignedToken_token[] = { /* SEQUENCE */
{FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoToken_cryptoSignedToken[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoSignedToken[] = { /* SEQUENCE */
{FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("token") SEQ, 0, 4, 4, SKIP, 0,
_CryptoToken_cryptoSignedToken_token},
};

-static field_t _CryptoToken_cryptoHashedToken_token[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoHashedToken_token[] = { /* SEQUENCE */
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("hash") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoToken_cryptoHashedToken[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoHashedToken[] = { /* SEQUENCE */
{FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("hashedVals") SEQ, 8, 9, 11, SKIP | EXT, 0, _ClearToken},
{FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
_CryptoToken_cryptoHashedToken_token},
};

-static field_t _CryptoToken_cryptoPwdEncr[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoPwdEncr[] = { /* SEQUENCE */
{FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
{FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
};

-static field_t _CryptoToken[] = { /* CHOICE */
+static const struct field_t _CryptoToken[] = { /* CHOICE */
{FNAME("cryptoEncryptedToken") SEQ, 0, 2, 2, SKIP, 0,
_CryptoToken_cryptoEncryptedToken},
{FNAME("cryptoSignedToken") SEQ, 0, 2, 2, SKIP, 0,
@@ -1278,7 +1278,7 @@ static field_t _CryptoToken[] = { /* CHOICE */
_CryptoToken_cryptoPwdEncr},
};

-static field_t _CryptoH323Token[] = { /* CHOICE */
+static const struct field_t _CryptoH323Token[] = { /* CHOICE */
{FNAME("cryptoEPPwdHash") SEQ, 0, 3, 3, SKIP, 0,
_CryptoH323Token_cryptoEPPwdHash},
{FNAME("cryptoGKPwdHash") SEQ, 0, 3, 3, SKIP, 0,
@@ -1297,17 +1297,17 @@ static field_t _CryptoH323Token[] = { /* CHOICE */
_CryptoToken},
};

-static field_t _Progress_UUIE_cryptoTokens[] = { /* SEQUENCE OF */
+static const struct field_t _Progress_UUIE_cryptoTokens[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 3, 8, 8, SKIP | EXT, 0, _CryptoH323Token},
};

-static field_t _Progress_UUIE_fastStart[] = { /* SEQUENCE OF */
+static const struct field_t _Progress_UUIE_fastStart[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
sizeof(OpenLogicalChannel), _OpenLogicalChannel}
,
};

-static field_t _Progress_UUIE[] = { /* SEQUENCE */
+static const struct field_t _Progress_UUIE[] = { /* SEQUENCE */
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("destinationInfo") SEQ, 6, 8, 10, SKIP | EXT, 0,
_EndpointType},
@@ -1328,7 +1328,7 @@ static field_t _Progress_UUIE[] = { /* SEQUENCE */
{FNAME("fastConnectRefused") NUL, FIXD, 0, 0, SKIP | OPT, 0, NULL},
};

-static field_t _H323_UU_PDU_h323_message_body[] = { /* CHOICE */
+static const struct field_t _H323_UU_PDU_h323_message_body[] = { /* CHOICE */
{FNAME("setup") SEQ, 7, 13, 39, DECODE | EXT,
offsetof(H323_UU_PDU_h323_message_body, setup), _Setup_UUIE},
{FNAME("callProceeding") SEQ, 1, 3, 12, DECODE | EXT,
@@ -1352,7 +1352,7 @@ static field_t _H323_UU_PDU_h323_message_body[] = { /* CHOICE */
{FNAME("notify") SEQ, 2, 4, 4, SKIP | EXT, 0, NULL},
};

-static field_t _RequestMessage[] = { /* CHOICE */
+static const struct field_t _RequestMessage[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 1, 1, STOP | EXT, 0, NULL},
{FNAME("masterSlaveDetermination") SEQ, 0, 2, 2, STOP | EXT, 0, NULL},
{FNAME("terminalCapabilitySet") SEQ, 3, 5, 5, STOP | EXT, 0, NULL},
@@ -1372,7 +1372,7 @@ static field_t _RequestMessage[] = { /* CHOICE */
NULL},
};

-static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters[] = { /* CHOICE */
+static const struct field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters[] = { /* CHOICE */
{FNAME("h222LogicalChannelParameters") SEQ, 3, 5, 5, SKIP | EXT, 0,
_H222LogicalChannelParameters},
{FNAME("h2250LogicalChannelParameters") SEQ, 10, 11, 14, DECODE | EXT,
@@ -1381,7 +1381,7 @@ static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexP
h2250LogicalChannelParameters), _H2250LogicalChannelParameters},
};

-static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters[] = { /* SEQUENCE */
+static const struct field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters[] = { /* SEQUENCE */
{FNAME("reverseLogicalChannelNumber") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("portNumber") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
{FNAME("multiplexParameters") CHOICE, 0, 1, 2, DECODE | EXT | OPT,
@@ -1391,11 +1391,11 @@ static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters[] = { /* S
{FNAME("replacementFor") INT, WORD, 1, 0, SKIP | OPT, 0, NULL},
};

-static field_t _H2250LogicalChannelAckParameters_nonStandard[] = { /* SEQUENCE OF */
+static const struct field_t _H2250LogicalChannelAckParameters_nonStandard[] = { /* SEQUENCE OF */
{FNAME("item") SEQ, 0, 2, 2, SKIP, 0, _H245_NonStandardParameter},
};

-static field_t _H2250LogicalChannelAckParameters[] = { /* SEQUENCE */
+static const struct field_t _H2250LogicalChannelAckParameters[] = { /* SEQUENCE */
{FNAME("nonStandard") SEQOF, SEMI, 0, 0, SKIP | OPT, 0,
_H2250LogicalChannelAckParameters_nonStandard},
{FNAME("sessionID") INT, 8, 1, 0, SKIP | OPT, 0, NULL},
@@ -1410,14 +1410,14 @@ static field_t _H2250LogicalChannelAckParameters[] = { /* SEQUENCE */
{FNAME("portNumber") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
};

-static field_t _OpenLogicalChannelAck_forwardMultiplexAckParameters[] = { /* CHOICE */
+static const struct field_t _OpenLogicalChannelAck_forwardMultiplexAckParameters[] = { /* CHOICE */
{FNAME("h2250LogicalChannelAckParameters") SEQ, 5, 5, 7, DECODE | EXT,
offsetof(OpenLogicalChannelAck_forwardMultiplexAckParameters,
h2250LogicalChannelAckParameters),
_H2250LogicalChannelAckParameters},
};

-static field_t _OpenLogicalChannelAck[] = { /* SEQUENCE */
+static const struct field_t _OpenLogicalChannelAck[] = { /* SEQUENCE */
{FNAME("forwardLogicalChannelNumber") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("reverseLogicalChannelParameters") SEQ, 2, 3, 4,
DECODE | EXT | OPT, offsetof(OpenLogicalChannelAck,
@@ -1433,7 +1433,7 @@ static field_t _OpenLogicalChannelAck[] = { /* SEQUENCE */
{FNAME("encryptionSync") SEQ, 2, 4, 4, STOP | EXT | OPT, 0, NULL},
};

-static field_t _ResponseMessage[] = { /* CHOICE */
+static const struct field_t _ResponseMessage[] = { /* CHOICE */
{FNAME("nonStandard") SEQ, 0, 1, 1, STOP | EXT, 0, NULL},
{FNAME("masterSlaveDeterminationAck") SEQ, 0, 1, 1, STOP | EXT, 0,
NULL},
@@ -1469,7 +1469,7 @@ static field_t _ResponseMessage[] = { /* CHOICE */
{FNAME("logicalChannelRateReject") SEQ, 1, 4, 4, STOP | EXT, 0, NULL},
};

-static field_t _MultimediaSystemControlMessage[] = { /* CHOICE */
+static const struct field_t _MultimediaSystemControlMessage[] = { /* CHOICE */
{FNAME("request") CHOICE, 4, 11, 15, DECODE | EXT,
offsetof(MultimediaSystemControlMessage, request), _RequestMessage},
{FNAME("response") CHOICE, 5, 19, 24, DECODE | EXT,
@@ -1479,14 +1479,14 @@ static field_t _MultimediaSystemControlMessage[] = { /* CHOICE */
{FNAME("indication") CHOICE, 4, 14, 23, STOP | EXT, 0, NULL},
};

-static field_t _H323_UU_PDU_h245Control[] = { /* SEQUENCE OF */
+static const struct field_t _H323_UU_PDU_h245Control[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 2, 4, 4, DECODE | OPEN | EXT,
sizeof(MultimediaSystemControlMessage),
_MultimediaSystemControlMessage}
,
};

-static field_t _H323_UU_PDU[] = { /* SEQUENCE */
+static const struct field_t _H323_UU_PDU[] = { /* SEQUENCE */
{FNAME("h323-message-body") CHOICE, 3, 7, 13, DECODE | EXT,
offsetof(H323_UU_PDU, h323_message_body),
_H323_UU_PDU_h323_message_body},
@@ -1507,13 +1507,13 @@ static field_t _H323_UU_PDU[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _H323_UserInformation[] = { /* SEQUENCE */
+static const struct field_t _H323_UserInformation[] = { /* SEQUENCE */
{FNAME("h323-uu-pdu") SEQ, 1, 2, 11, DECODE | EXT,
offsetof(H323_UserInformation, h323_uu_pdu), _H323_UU_PDU},
{FNAME("user-data") SEQ, 0, 2, 2, STOP | EXT | OPT, 0, NULL},
};

-static field_t _GatekeeperRequest[] = { /* SEQUENCE */
+static const struct field_t _GatekeeperRequest[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1537,7 +1537,7 @@ static field_t _GatekeeperRequest[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _GatekeeperConfirm[] = { /* SEQUENCE */
+static const struct field_t _GatekeeperConfirm[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1557,23 +1557,23 @@ static field_t _GatekeeperConfirm[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _RegistrationRequest_callSignalAddress[] = { /* SEQUENCE OF */
+static const struct field_t _RegistrationRequest_callSignalAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
sizeof(TransportAddress), _TransportAddress}
,
};

-static field_t _RegistrationRequest_rasAddress[] = { /* SEQUENCE OF */
+static const struct field_t _RegistrationRequest_rasAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
sizeof(TransportAddress), _TransportAddress}
,
};

-static field_t _RegistrationRequest_terminalAlias[] = { /* SEQUENCE OF */
+static const struct field_t _RegistrationRequest_terminalAlias[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _RegistrationRequest[] = { /* SEQUENCE */
+static const struct field_t _RegistrationRequest[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1621,17 +1621,17 @@ static field_t _RegistrationRequest[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _RegistrationConfirm_callSignalAddress[] = { /* SEQUENCE OF */
+static const struct field_t _RegistrationConfirm_callSignalAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
sizeof(TransportAddress), _TransportAddress}
,
};

-static field_t _RegistrationConfirm_terminalAlias[] = { /* SEQUENCE OF */
+static const struct field_t _RegistrationConfirm_terminalAlias[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _RegistrationConfirm[] = { /* SEQUENCE */
+static const struct field_t _RegistrationConfirm[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1667,13 +1667,13 @@ static field_t _RegistrationConfirm[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _UnregistrationRequest_callSignalAddress[] = { /* SEQUENCE OF */
+static const struct field_t _UnregistrationRequest_callSignalAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
sizeof(TransportAddress), _TransportAddress}
,
};

-static field_t _UnregistrationRequest[] = { /* SEQUENCE */
+static const struct field_t _UnregistrationRequest[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("callSignalAddress") SEQOF, SEMI, 0, 10, DECODE,
offsetof(UnregistrationRequest, callSignalAddress),
@@ -1694,24 +1694,24 @@ static field_t _UnregistrationRequest[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _CallModel[] = { /* CHOICE */
+static const struct field_t _CallModel[] = { /* CHOICE */
{FNAME("direct") NUL, FIXD, 0, 0, SKIP, 0, NULL},
{FNAME("gatekeeperRouted") NUL, FIXD, 0, 0, SKIP, 0, NULL},
};

-static field_t _AdmissionRequest_destinationInfo[] = { /* SEQUENCE OF */
+static const struct field_t _AdmissionRequest_destinationInfo[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _AdmissionRequest_destExtraCallInfo[] = { /* SEQUENCE OF */
+static const struct field_t _AdmissionRequest_destExtraCallInfo[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _AdmissionRequest_srcInfo[] = { /* SEQUENCE OF */
+static const struct field_t _AdmissionRequest_srcInfo[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _AdmissionRequest[] = { /* SEQUENCE */
+static const struct field_t _AdmissionRequest[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("callType") CHOICE, 2, 4, 4, SKIP | EXT, 0, _CallType},
{FNAME("callModel") CHOICE, 1, 2, 2, SKIP | EXT | OPT, 0, _CallModel},
@@ -1755,7 +1755,7 @@ static field_t _AdmissionRequest[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _AdmissionConfirm[] = { /* SEQUENCE */
+static const struct field_t _AdmissionConfirm[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("bandWidth") INT, CONS, 0, 0, SKIP, 0, NULL},
{FNAME("callModel") CHOICE, 1, 2, 2, SKIP | EXT, 0, _CallModel},
@@ -1790,11 +1790,11 @@ static field_t _AdmissionConfirm[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _LocationRequest_destinationInfo[] = { /* SEQUENCE OF */
+static const struct field_t _LocationRequest_destinationInfo[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
};

-static field_t _LocationRequest[] = { /* SEQUENCE */
+static const struct field_t _LocationRequest[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("endpointIdentifier") BMPSTR, 7, 1, 0, SKIP | OPT, 0, NULL},
{FNAME("destinationInfo") SEQOF, SEMI, 0, 0, SKIP, 0,
@@ -1818,7 +1818,7 @@ static field_t _LocationRequest[] = { /* SEQUENCE */
{FNAME("circuitInfo") SEQ, 3, 3, 3, STOP | EXT | OPT, 0, NULL},
};

-static field_t _LocationConfirm[] = { /* SEQUENCE */
+static const struct field_t _LocationConfirm[] = { /* SEQUENCE */
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
{FNAME("callSignalAddress") CHOICE, 3, 7, 7, DECODE | EXT,
offsetof(LocationConfirm, callSignalAddress), _TransportAddress},
@@ -1844,13 +1844,13 @@ static field_t _LocationConfirm[] = { /* SEQUENCE */
{FNAME("serviceControl") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _InfoRequestResponse_callSignalAddress[] = { /* SEQUENCE OF */
+static const struct field_t _InfoRequestResponse_callSignalAddress[] = { /* SEQUENCE OF */
{FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
sizeof(TransportAddress), _TransportAddress}
,
};

-static field_t _InfoRequestResponse[] = { /* SEQUENCE */
+static const struct field_t _InfoRequestResponse[] = { /* SEQUENCE */
{FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
_NonStandardParameter},
{FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
@@ -1873,7 +1873,7 @@ static field_t _InfoRequestResponse[] = { /* SEQUENCE */
{FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
};

-static field_t _RasMessage[] = { /* CHOICE */
+static const struct field_t _RasMessage[] = { /* CHOICE */
{FNAME("gatekeeperRequest") SEQ, 4, 8, 18, DECODE | EXT,
offsetof(RasMessage, gatekeeperRequest), _GatekeeperRequest},
{FNAME("gatekeeperConfirm") SEQ, 2, 5, 14, DECODE | EXT,
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:36 UTC
Permalink
[NETFILTER]: nf_conntrack: fix sparse warning

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit f4b1df40b6a6978e862bffcaa8d36aecf1220978
tree 52fa9c7e72ecbc5d8263489f99aa83b45784257c
parent 810b07fadc47c72a1372724d150abe96b15fc1ad
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100

net/netfilter/nf_conntrack_standalone.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index ea34090..e88e96a 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -384,7 +384,7 @@ static ctl_table nf_ct_netfilter_table[] = {
{ .ctl_name = 0 }
};

-struct ctl_path nf_ct_path[] = {
+static struct ctl_path nf_ct_path[] = {
{ .procname = "net", .ctl_name = CTL_NET, },
{ }
};
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:34 UTC
Permalink
[NETFILTER]: {ip,ip6}_queue: fix build error

Reported by Ingo Molnar:

net/built-in.o: In function `ip_queue_init':
ip_queue.c:(.init.text+0x322c): undefined reference to `net_ipv4_ctl_path'

Fix the build error and also handle CONFIG_PROC_FS=n properly.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 810b07fadc47c72a1372724d150abe96b15fc1ad
tree a69eb656934288404f89980fdfaad877eaee9256
parent aa77412a579726b762d394ca3b3f0306a02e6f98
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100

net/ipv4/netfilter/ip_queue.c | 18 ++++++++++++++----
net/ipv6/netfilter/ip6_queue.c | 18 ++++++++++++++----
2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 5109839..6bda110 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -512,6 +512,7 @@ static struct notifier_block ipq_nl_notifier = {
.notifier_call = ipq_rcv_nl_event,
};

+#ifdef CONFIG_SYSCTL
static struct ctl_table_header *ipq_sysctl_header;

static ctl_table ipq_table[] = {
@@ -525,7 +526,9 @@ static ctl_table ipq_table[] = {
},
{ .ctl_name = 0 }
};
+#endif

+#ifdef CONFIG_PROC_FS
static int ip_queue_show(struct seq_file *m, void *v)
{
read_lock_bh(&queue_lock);
@@ -562,6 +565,7 @@ static const struct file_operations ip_queue_proc_fops = {
.release = single_release,
.owner = THIS_MODULE,
};
+#endif

static const struct nf_queue_handler nfqh = {
.name = "ip_queue",
@@ -571,7 +575,7 @@ static const struct nf_queue_handler nfqh = {
static int __init ip_queue_init(void)
{
int status = -ENOMEM;
- struct proc_dir_entry *proc;
+ struct proc_dir_entry *proc __maybe_unused;

netlink_register_notifier(&ipq_nl_notifier);
ipqnl = netlink_kernel_create(&init_net, NETLINK_FIREWALL, 0,
@@ -581,6 +585,7 @@ static int __init ip_queue_init(void)
goto cleanup_netlink_notifier;
}

+#ifdef CONFIG_PROC_FS
proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
if (proc) {
proc->owner = THIS_MODULE;
@@ -589,10 +594,11 @@ static int __init ip_queue_init(void)
printk(KERN_ERR "ip_queue: failed to create proc entry\n");
goto cleanup_ipqnl;
}
-
+#endif
register_netdevice_notifier(&ipq_dev_notifier);
+#ifdef CONFIG_SYSCTL
ipq_sysctl_header = register_sysctl_paths(net_ipv4_ctl_path, ipq_table);
-
+#endif
status = nf_register_queue_handler(PF_INET, &nfqh);
if (status < 0) {
printk(KERN_ERR "ip_queue: failed to register queue handler\n");
@@ -601,10 +607,12 @@ static int __init ip_queue_init(void)
return status;

cleanup_sysctl:
+#ifdef CONFIG_SYSCTL
unregister_sysctl_table(ipq_sysctl_header);
+#endif
unregister_netdevice_notifier(&ipq_dev_notifier);
proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
-cleanup_ipqnl:
+cleanup_ipqnl: __maybe_unused
netlink_kernel_release(ipqnl);
mutex_lock(&ipqnl_mutex);
mutex_unlock(&ipqnl_mutex);
@@ -620,7 +628,9 @@ static void __exit ip_queue_fini(void)
synchronize_net();
ipq_flush(NULL, 0);

+#ifdef CONFIG_SYSCTL
unregister_sysctl_table(ipq_sysctl_header);
+#endif
unregister_netdevice_notifier(&ipq_dev_notifier);
proc_net_remove(&init_net, IPQ_PROC_FS_NAME);

diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 56b4ea6..e869916 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -515,6 +515,7 @@ static struct notifier_block ipq_nl_notifier = {
.notifier_call = ipq_rcv_nl_event,
};

+#ifdef CONFIG_SYSCTL
static struct ctl_table_header *ipq_sysctl_header;

static ctl_table ipq_table[] = {
@@ -528,7 +529,9 @@ static ctl_table ipq_table[] = {
},
{ .ctl_name = 0 }
};
+#endif

+#ifdef CONFIG_PROC_FS
static int ip6_queue_show(struct seq_file *m, void *v)
{
read_lock_bh(&queue_lock);
@@ -565,6 +568,7 @@ static const struct file_operations ip6_queue_proc_fops = {
.release = single_release,
.owner = THIS_MODULE,
};
+#endif

static const struct nf_queue_handler nfqh = {
.name = "ip6_queue",
@@ -574,7 +578,7 @@ static const struct nf_queue_handler nfqh = {
static int __init ip6_queue_init(void)
{
int status = -ENOMEM;
- struct proc_dir_entry *proc;
+ struct proc_dir_entry *proc __maybe_unused;

netlink_register_notifier(&ipq_nl_notifier);
ipqnl = netlink_kernel_create(&init_net, NETLINK_IP6_FW, 0,
@@ -584,6 +588,7 @@ static int __init ip6_queue_init(void)
goto cleanup_netlink_notifier;
}

+#ifdef CONFIG_PROC_FS
proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
if (proc) {
proc->owner = THIS_MODULE;
@@ -592,10 +597,11 @@ static int __init ip6_queue_init(void)
printk(KERN_ERR "ip6_queue: failed to create proc entry\n");
goto cleanup_ipqnl;
}
-
+#endif
register_netdevice_notifier(&ipq_dev_notifier);
+#ifdef CONFIG_SYSCTL
ipq_sysctl_header = register_sysctl_paths(net_ipv6_ctl_path, ipq_table);
-
+#endif
status = nf_register_queue_handler(PF_INET6, &nfqh);
if (status < 0) {
printk(KERN_ERR "ip6_queue: failed to register queue handler\n");
@@ -604,11 +610,13 @@ static int __init ip6_queue_init(void)
return status;

cleanup_sysctl:
+#ifdef CONFIG_SYSCTL
unregister_sysctl_table(ipq_sysctl_header);
+#endif
unregister_netdevice_notifier(&ipq_dev_notifier);
proc_net_remove(&init_net, IPQ_PROC_FS_NAME);

-cleanup_ipqnl:
+cleanup_ipqnl: __maybe_unused
netlink_kernel_release(ipqnl);
mutex_lock(&ipqnl_mutex);
mutex_unlock(&ipqnl_mutex);
@@ -624,7 +632,9 @@ static void __exit ip6_queue_fini(void)
synchronize_net();
ipq_flush(NULL, 0);

+#ifdef CONFIG_SYSCTL
unregister_sysctl_table(ipq_sysctl_header);
+#endif
unregister_netdevice_notifier(&ipq_dev_notifier);
proc_net_remove(&init_net, IPQ_PROC_FS_NAME);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:39 UTC
Permalink
[NETFILTER]: xt_iprange: fix sparse warnings

CHECK net/netfilter/xt_iprange.c
net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer
net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer
net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer
net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer
net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer
net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer
net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer
net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 59e1300f5bffbe2943e2c851be2bb803435420e1
tree 0a178e9489b665c73a078cbd9ef6c3ecafe23101
parent 5da2b9bf6eb8611637344f4da586d000c862e364
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100

net/netfilter/xt_iprange.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index dbea0e0..01035fc 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -101,7 +101,7 @@ iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
int r;

for (i = 0; i < 4; ++i) {
- r = a->s6_addr32[i] - b->s6_addr32[i];
+ r = (__force u32)a->s6_addr32[i] - (__force u32)b->s6_addr32[i];
if (r != 0)
return r;
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:02 UTC
Permalink
[NETFILTER]: nf_conntrack: don't inline early_drop()

early_drop() is only called *very* rarely, unfortunately gcc inlines it
into the hotpath because there is only a single caller. Explicitly mark
it noinline.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 9dcd796f052a9383e55d81e7da5912e0a6cd4b19
tree 6ad978cd8fb12dd20a265eec3a42d75d874a5aff
parent 7b2624034f45ce13ecfdf13847cbf7ad67bb7137
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:08 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:08 +0100

net/netfilter/nf_conntrack_core.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 24a0863..fabc9eb 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -420,7 +420,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);

/* There's a small race here where we may free a just-assured
connection. Too bad: we're in trouble anyway. */
-static int early_drop(unsigned int hash)
+static noinline int early_drop(unsigned int hash)
{
/* Use oldest entry, which is roughly LRU */
struct nf_conntrack_tuple_hash *h;
@@ -472,8 +472,8 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
/* We don't want any race condition at early drop stage */
atomic_inc(&nf_conntrack_count);

- if (nf_conntrack_max
- && atomic_read(&nf_conntrack_count) > nf_conntrack_max) {
+ if (nf_conntrack_max &&
+ unlikely(atomic_read(&nf_conntrack_count) > nf_conntrack_max)) {
unsigned int hash = hash_conntrack(orig);
if (!early_drop(hash)) {
atomic_dec(&nf_conntrack_count);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:38 UTC
Permalink
[NETFILTER]: nf_nat: fix sparse warning

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 5da2b9bf6eb8611637344f4da586d000c862e364
tree a895465adef1c57a6220f36ab1f3c83b8b0dcbaf
parent f4b1df40b6a6978e862bffcaa8d36aecf1220978
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:18 +0100

net/ipv4/netfilter/nf_nat_helper.c | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 4c02328..ca57f47 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -44,8 +44,7 @@ adjust_tcp_sequence(u32 seq,
struct nf_nat_seq *this_way, *other_way;
struct nf_conn_nat *nat = nfct_nat(ct);

- pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n",
- ntohl(seq), seq);
+ pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n", seq, seq);

dir = CTINFO2DIR(ctinfo);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:29 UTC
Permalink
[NETFILTER]: nf_{conntrack,nat}_proto_udp{,lite}: annotate with const

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 605ba346a8a54fc3c2a6d846a345d4d6c3cd5642
tree 5009903decf0c6ad4c33f80beec18160e29d9282
parent 86b8346c2ce0407e1712aefc6e4f9bb5c24fd238
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:17 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:17 +0100

net/ipv4/netfilter/nf_nat_proto_udp.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 6 ++++--
net/netfilter/nf_conntrack_proto_udplite.c | 6 ++++--
3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
index 10df4db..4b8f499 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
@@ -91,7 +91,7 @@ udp_manip_pkt(struct sk_buff *skb,
const struct nf_conntrack_tuple *tuple,
enum nf_nat_manip_type maniptype)
{
- struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+ const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
struct udphdr *hdr;
unsigned int hdroff = iphdroff + iph->ihl*4;
__be32 oldip, newip;
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 4c1e67e..b8a35cc 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -30,7 +30,8 @@ static int udp_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conntrack_tuple *tuple)
{
- struct udphdr _hdr, *hp;
+ const struct udphdr *hp;
+ struct udphdr _hdr;

/* Actually only need first 8 bytes. */
hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
@@ -94,7 +95,8 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
unsigned int hooknum)
{
unsigned int udplen = skb->len - dataoff;
- struct udphdr _hdr, *hdr;
+ const struct udphdr *hdr;
+ struct udphdr _hdr;

/* Header is too small? */
hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index d9e1532..9dd03c7 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -31,7 +31,8 @@ static int udplite_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
struct nf_conntrack_tuple *tuple)
{
- struct udphdr _hdr, *hp;
+ const struct udphdr *hp;
+ struct udphdr _hdr;

hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
if (hp == NULL)
@@ -94,7 +95,8 @@ static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
unsigned int hooknum)
{
unsigned int udplen = skb->len - dataoff;
- struct udphdr _hdr, *hdr;
+ const struct udphdr *hdr;
+ struct udphdr _hdr;
unsigned int cscov;

/* Header is too small? */
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:47 UTC
Permalink
[NETFILTER]: nf_conntrack: fix accounting with fixed timeouts

Don't skip accounting for conntracks with the FIXED_TIMEOUT bit.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 717ef6587331d45fecc0d1fa2a9f473f9d9ae1c9
tree adc3dd8a5ce9f4bd9f2ffa06a4cc2caffb5a13b3
parent 9813002a577062723e68ac1da712de25f7998f1e
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:05 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:05 +0100

net/netfilter/nf_conntrack_core.c | 7 +++----
1 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7b1f7e8..aa042c4 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -776,10 +776,8 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
write_lock_bh(&nf_conntrack_lock);

/* Only update if this is not a fixed timeout */
- if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
- write_unlock_bh(&nf_conntrack_lock);
- return;
- }
+ if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
+ goto acct;

/* If not in hash table, timer will not be active yet */
if (!nf_ct_is_confirmed(ct)) {
@@ -799,6 +797,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
}
}

+acct:
#ifdef CONFIG_NF_CT_ACCT
if (do_acct) {
ct->counters[CTINFO2DIR(ctinfo)].packets++;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:15 UTC
Permalink
[NETFILTER]: x_tables: semi-rewrite of /proc/net/foo_tables_*

There are many small but still wrong things with /proc/net/*_tables_*
so I decided to do overhaul simultaneously making it more suitable for
per-netns /proc/net/*_tables_* implementation.

Fix
a) xt_get_idx() duplicating now standard seq_list_start/seq_list_next
iterators
b) tables/matches/targets list was chosen again and again on every ->next
c) multiple useless "af >= NPROTO" checks -- we simple don't supply invalid
AFs there and registration function should BUG_ON instead.

Regardless, the one in ->next() is the most useless -- ->next doesn't
run at all if ->start fails.
d) Don't use mutex_lock_interruptible() -- it can fail and ->stop is
executed even if ->start failed, so unlock without lock is possible.

As side effect, streamline code by splitting xt_tgt_ops into xt_target_ops,
xt_matches_ops, xt_tables_ops.

xt_tables_ops hooks will be changed by per-netns code. Code of
xt_matches_ops, xt_target_ops is identical except the list chosen for
iterating, but I think consolidating code for two files not worth it
given "<< 16" hacks needed for it.

[Patrick: removed unused enum in x_tables.c]

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 738a61f2bcd7ded174cdac25f330e7bb1e3fb2c5
tree afbd0e64c8372192088dd364f1381659dd4d1cf4
parent 778b1b410be9abb98c52ea4288c9708b2f01a626
author Alexey Dobriyan <***@sw.ru> Wed, 30 Jan 2008 21:03:13 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:13 +0100

net/netfilter/x_tables.c | 230 +++++++++++++++++++++++++++++-----------------
1 files changed, 145 insertions(+), 85 deletions(-)

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index cd78fc8..89e322d 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -58,12 +58,6 @@ static struct xt_af *xt;
#define duprintf(format, args...)
#endif

-enum {
- TABLE,
- TARGET,
- MATCH,
-};
-
static const char *xt_prefix[NPROTO] = {
[AF_INET] = "ip",
[AF_INET6] = "ip6",
@@ -726,124 +720,190 @@ void *xt_unregister_table(struct xt_table *table)
EXPORT_SYMBOL_GPL(xt_unregister_table);

#ifdef CONFIG_PROC_FS
-static struct list_head *xt_get_idx(struct list_head *list, struct seq_file *seq, loff_t pos)
+static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
{
- struct list_head *head = list->next;
+ struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+ u_int16_t af = (unsigned long)pde->data;

- if (!head || list_empty(list))
- return NULL;
+ mutex_lock(&xt[af].mutex);
+ return seq_list_start(&init_net.xt.tables[af], *pos);
+}

- while (pos && (head = head->next)) {
- if (head == list)
- return NULL;
- pos--;
- }
- return pos ? NULL : head;
-}
-
-static struct list_head *type2list(u_int16_t af, u_int16_t type)
-{
- struct list_head *list;
-
- switch (type) {
- case TARGET:
- list = &xt[af].target;
- break;
- case MATCH:
- list = &xt[af].match;
- break;
- case TABLE:
- list = &init_net.xt.tables[af];
- break;
- default:
- list = NULL;
- break;
- }
+static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+ struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+ u_int16_t af = (unsigned long)pde->data;

- return list;
+ return seq_list_next(v, &init_net.xt.tables[af], pos);
}

-static void *xt_tgt_seq_start(struct seq_file *seq, loff_t *pos)
+static void xt_table_seq_stop(struct seq_file *seq, void *v)
{
- struct proc_dir_entry *pde = (struct proc_dir_entry *) seq->private;
- u_int16_t af = (unsigned long)pde->data & 0xffff;
- u_int16_t type = (unsigned long)pde->data >> 16;
- struct list_head *list;
+ struct proc_dir_entry *pde = seq->private;
+ u_int16_t af = (unsigned long)pde->data;

- if (af >= NPROTO)
- return NULL;
+ mutex_unlock(&xt[af].mutex);
+}

- list = type2list(af, type);
- if (!list)
- return NULL;
+static int xt_table_seq_show(struct seq_file *seq, void *v)
+{
+ struct xt_table *table = list_entry(v, struct xt_table, list);

- if (mutex_lock_interruptible(&xt[af].mutex) != 0)
- return NULL;
+ if (strlen(table->name))
+ return seq_printf(seq, "%s\n", table->name);
+ else
+ return 0;
+}

- return xt_get_idx(list, seq, *pos);
+static const struct seq_operations xt_table_seq_ops = {
+ .start = xt_table_seq_start,
+ .next = xt_table_seq_next,
+ .stop = xt_table_seq_stop,
+ .show = xt_table_seq_show,
+};
+
+static int xt_table_open(struct inode *inode, struct file *file)
+{
+ int ret;
+
+ ret = seq_open(file, &xt_table_seq_ops);
+ if (!ret) {
+ struct seq_file *seq = file->private_data;
+
+ seq->private = PDE(inode);
+ }
+ return ret;
}

-static void *xt_tgt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static const struct file_operations xt_table_ops = {
+ .owner = THIS_MODULE,
+ .open = xt_table_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+ .release = seq_release,
+};
+
+static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
{
- struct proc_dir_entry *pde = seq->private;
- u_int16_t af = (unsigned long)pde->data & 0xffff;
- u_int16_t type = (unsigned long)pde->data >> 16;
- struct list_head *list;
+ struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+ u_int16_t af = (unsigned long)pde->data;

- if (af >= NPROTO)
- return NULL;
+ mutex_lock(&xt[af].mutex);
+ return seq_list_start(&xt[af].match, *pos);
+}

- list = type2list(af, type);
- if (!list)
- return NULL;
+static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+ struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+ u_int16_t af = (unsigned long)pde->data;

- (*pos)++;
- return xt_get_idx(list, seq, *pos);
+ return seq_list_next(v, &xt[af].match, pos);
}

-static void xt_tgt_seq_stop(struct seq_file *seq, void *v)
+static void xt_match_seq_stop(struct seq_file *seq, void *v)
{
struct proc_dir_entry *pde = seq->private;
- u_int16_t af = (unsigned long)pde->data & 0xffff;
+ u_int16_t af = (unsigned long)pde->data;

mutex_unlock(&xt[af].mutex);
}

-static int xt_name_seq_show(struct seq_file *seq, void *v)
+static int xt_match_seq_show(struct seq_file *seq, void *v)
{
- char *name = (char *)v + sizeof(struct list_head);
+ struct xt_match *match = list_entry(v, struct xt_match, list);

- if (strlen(name))
- return seq_printf(seq, "%s\n", name);
+ if (strlen(match->name))
+ return seq_printf(seq, "%s\n", match->name);
else
return 0;
}

-static const struct seq_operations xt_tgt_seq_ops = {
- .start = xt_tgt_seq_start,
- .next = xt_tgt_seq_next,
- .stop = xt_tgt_seq_stop,
- .show = xt_name_seq_show,
+static const struct seq_operations xt_match_seq_ops = {
+ .start = xt_match_seq_start,
+ .next = xt_match_seq_next,
+ .stop = xt_match_seq_stop,
+ .show = xt_match_seq_show,
};

-static int xt_tgt_open(struct inode *inode, struct file *file)
+static int xt_match_open(struct inode *inode, struct file *file)
{
int ret;

- ret = seq_open(file, &xt_tgt_seq_ops);
+ ret = seq_open(file, &xt_match_seq_ops);
if (!ret) {
struct seq_file *seq = file->private_data;
- struct proc_dir_entry *pde = PDE(inode);

- seq->private = pde;
+ seq->private = PDE(inode);
}
+ return ret;
+}
+
+static const struct file_operations xt_match_ops = {
+ .owner = THIS_MODULE,
+ .open = xt_match_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+ .release = seq_release,
+};

+static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
+{
+ struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+ u_int16_t af = (unsigned long)pde->data;
+
+ mutex_lock(&xt[af].mutex);
+ return seq_list_start(&xt[af].target, *pos);
+}
+
+static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+ struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+ u_int16_t af = (unsigned long)pde->data;
+
+ return seq_list_next(v, &xt[af].target, pos);
+}
+
+static void xt_target_seq_stop(struct seq_file *seq, void *v)
+{
+ struct proc_dir_entry *pde = seq->private;
+ u_int16_t af = (unsigned long)pde->data;
+
+ mutex_unlock(&xt[af].mutex);
+}
+
+static int xt_target_seq_show(struct seq_file *seq, void *v)
+{
+ struct xt_target *target = list_entry(v, struct xt_target, list);
+
+ if (strlen(target->name))
+ return seq_printf(seq, "%s\n", target->name);
+ else
+ return 0;
+}
+
+static const struct seq_operations xt_target_seq_ops = {
+ .start = xt_target_seq_start,
+ .next = xt_target_seq_next,
+ .stop = xt_target_seq_stop,
+ .show = xt_target_seq_show,
+};
+
+static int xt_target_open(struct inode *inode, struct file *file)
+{
+ int ret;
+
+ ret = seq_open(file, &xt_target_seq_ops);
+ if (!ret) {
+ struct seq_file *seq = file->private_data;
+
+ seq->private = PDE(inode);
+ }
return ret;
}

-static const struct file_operations xt_file_ops = {
+static const struct file_operations xt_target_ops = {
.owner = THIS_MODULE,
- .open = xt_tgt_open,
+ .open = xt_target_open,
.read = seq_read,
.llseek = seq_lseek,
.release = seq_release,
@@ -869,25 +929,25 @@ int xt_proto_init(int af)
#ifdef CONFIG_PROC_FS
strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_TABLES, sizeof(buf));
- proc = proc_net_fops_create(&init_net, buf, 0440, &xt_file_ops);
+ proc = proc_net_fops_create(&init_net, buf, 0440, &xt_table_ops);
if (!proc)
goto out;
- proc->data = (void *) ((unsigned long) af | (TABLE << 16));
+ proc->data = (void *)(unsigned long)af;


strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_MATCHES, sizeof(buf));
- proc = proc_net_fops_create(&init_net, buf, 0440, &xt_file_ops);
+ proc = proc_net_fops_create(&init_net, buf, 0440, &xt_match_ops);
if (!proc)
goto out_remove_tables;
- proc->data = (void *) ((unsigned long) af | (MATCH << 16));
+ proc->data = (void *)(unsigned long)af;

strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_TARGETS, sizeof(buf));
- proc = proc_net_fops_create(&init_net, buf, 0440, &xt_file_ops);
+ proc = proc_net_fops_create(&init_net, buf, 0440, &xt_target_ops);
if (!proc)
goto out_remove_matches;
- proc->data = (void *) ((unsigned long) af | (TARGET << 16));
+ proc->data = (void *)(unsigned long)af;
#endif

return 0;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:26 UTC
Permalink
[NETFILTER]: nf_conntrack_sane: annotate SANE helper with const

Annotate nf_conntrack_sane variables with const qualifier and remove
a few casts.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 5eb90087e67023fc3314f7a59702720e2ffe0fc4
tree d0172cc159828b536ef1aa5f41781f494f1dfa24
parent 2f3c5e5beb62ae34c4edbb59dd62c9e6c0580c8c
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:16 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:16 +0100

net/netfilter/nf_conntrack_sane.c | 9 +++++----
1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index b5a16c6..a70051d 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -62,8 +62,9 @@ static int help(struct sk_buff *skb,
enum ip_conntrack_info ctinfo)
{
unsigned int dataoff, datalen;
- struct tcphdr _tcph, *th;
- char *sb_ptr;
+ const struct tcphdr *th;
+ struct tcphdr _tcph;
+ void *sb_ptr;
int ret = NF_ACCEPT;
int dir = CTINFO2DIR(ctinfo);
struct nf_ct_sane_master *ct_sane_info;
@@ -99,7 +100,7 @@ static int help(struct sk_buff *skb,
if (datalen != sizeof(struct sane_request))
goto out;

- req = (struct sane_request *)sb_ptr;
+ req = sb_ptr;
if (req->RPC_code != htonl(SANE_NET_START)) {
/* Not an interesting command */
ct_sane_info->state = SANE_STATE_NORMAL;
@@ -123,7 +124,7 @@ static int help(struct sk_buff *skb,
goto out;
}

- reply = (struct sane_reply_net_start *)sb_ptr;
+ reply = sb_ptr;
if (reply->status != htonl(SANE_STATUS_SUCCESS)) {
/* saned refused the command */
pr_debug("nf_ct_sane: unsuccessful SANE_STATUS = %u\n",
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:33 UTC
Permalink
[NETFILTER]: nf_conntrack: annotate l3protos with const

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit aa77412a579726b762d394ca3b3f0306a02e6f98
tree 118ea3991cdfa1edcb4d2cdfdea166ca944c3e6d
parent 8846d43ac0b92e4d9df20675ea5c441b03e96d10
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:17 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:17 +0100

include/net/netfilter/nf_conntrack_core.h | 4 ++--
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 14 ++++++++------
.../netfilter/nf_conntrack_l3proto_ipv4_compat.c | 8 ++++----
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 7 ++++---
net/netfilter/nf_conntrack_standalone.c | 10 +++++-----
5 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 2b9e571..9ee2646 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -68,8 +68,8 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)

int
print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
- struct nf_conntrack_l3proto *l3proto,
- struct nf_conntrack_l4proto *proto);
+ const struct nf_conntrack_l3proto *l3proto,
+ const struct nf_conntrack_l4proto *proto);

extern struct hlist_head *nf_conntrack_hash;
extern spinlock_t nf_conntrack_lock ;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index ac3d61d..a65b845 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -27,7 +27,8 @@
static int ipv4_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
struct nf_conntrack_tuple *tuple)
{
- __be32 _addrs[2], *ap;
+ const __be32 *ap;
+ __be32 _addrs[2];
ap = skb_header_pointer(skb, nhoff + offsetof(struct iphdr, saddr),
sizeof(u_int32_t) * 2, _addrs);
if (ap == NULL)
@@ -76,7 +77,8 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
unsigned int *dataoff, u_int8_t *protonum)
{
- struct iphdr _iph, *iph;
+ const struct iphdr *iph;
+ struct iphdr _iph;

iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
if (iph == NULL)
@@ -111,8 +113,8 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
{
struct nf_conn *ct;
enum ip_conntrack_info ctinfo;
- struct nf_conn_help *help;
- struct nf_conntrack_helper *helper;
+ const struct nf_conn_help *help;
+ const struct nf_conntrack_helper *helper;

/* This is where we call the helper: as the packet goes out. */
ct = nf_ct_get(skb, &ctinfo);
@@ -299,8 +301,8 @@ static ctl_table ip_ct_sysctl_table[] = {
static int
getorigdst(struct sock *sk, int optval, void __user *user, int *len)
{
- struct inet_sock *inet = inet_sk(sk);
- struct nf_conntrack_tuple_hash *h;
+ const struct inet_sock *inet = inet_sk(sk);
+ const struct nf_conntrack_tuple_hash *h;
struct nf_conntrack_tuple tuple;

NF_CT_TUPLE_U_BLANK(&tuple);
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 0ee87ed..089252e 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -98,8 +98,8 @@ static int ct_seq_show(struct seq_file *s, void *v)
{
const struct nf_conntrack_tuple_hash *hash = v;
const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
- struct nf_conntrack_l3proto *l3proto;
- struct nf_conntrack_l4proto *l4proto;
+ const struct nf_conntrack_l3proto *l3proto;
+ const struct nf_conntrack_l4proto *l4proto;

NF_CT_ASSERT(ct);

@@ -251,7 +251,7 @@ static void exp_seq_stop(struct seq_file *seq, void *v)
static int exp_seq_show(struct seq_file *s, void *v)
{
struct nf_conntrack_expect *exp;
- struct hlist_node *n = v;
+ const struct hlist_node *n = v;

exp = hlist_entry(n, struct nf_conntrack_expect, hnode);

@@ -332,7 +332,7 @@ static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
static int ct_cpu_seq_show(struct seq_file *seq, void *v)
{
unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
- struct ip_conntrack_stat *st = v;
+ const struct ip_conntrack_stat *st = v;

if (v == SEQ_START_TOKEN) {
seq_printf(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete\n");
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 2d7b024..3717bdf 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -30,7 +30,8 @@
static int ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
struct nf_conntrack_tuple *tuple)
{
- u_int32_t _addrs[8], *ap;
+ const u_int32_t *ap;
+ u_int32_t _addrs[8];

ap = skb_header_pointer(skb, nhoff + offsetof(struct ipv6hdr, saddr),
sizeof(_addrs), _addrs);
@@ -146,8 +147,8 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
int (*okfn)(struct sk_buff *))
{
struct nf_conn *ct;
- struct nf_conn_help *help;
- struct nf_conntrack_helper *helper;
+ const struct nf_conn_help *help;
+ const struct nf_conntrack_helper *helper;
enum ip_conntrack_info ctinfo;
unsigned int ret, protoff;
unsigned int extoff = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 278b35e..ea34090 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -31,8 +31,8 @@ MODULE_LICENSE("GPL");
#ifdef CONFIG_PROC_FS
int
print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
- struct nf_conntrack_l3proto *l3proto,
- struct nf_conntrack_l4proto *l4proto)
+ const struct nf_conntrack_l3proto *l3proto,
+ const struct nf_conntrack_l4proto *l4proto)
{
return l3proto->print_tuple(s, tuple) || l4proto->print_tuple(s, tuple);
}
@@ -118,8 +118,8 @@ static int ct_seq_show(struct seq_file *s, void *v)
{
const struct nf_conntrack_tuple_hash *hash = v;
const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
- struct nf_conntrack_l3proto *l3proto;
- struct nf_conntrack_l4proto *l4proto;
+ const struct nf_conntrack_l3proto *l3proto;
+ const struct nf_conntrack_l4proto *l4proto;

NF_CT_ASSERT(ct);

@@ -246,7 +246,7 @@ static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
static int ct_cpu_seq_show(struct seq_file *seq, void *v)
{
unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
- struct ip_conntrack_stat *st = v;
+ const struct ip_conntrack_stat *st = v;

if (v == SEQ_START_TOKEN) {
seq_printf(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete\n");
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:24 UTC
Permalink
[NETFILTER]: nf_{conntrack,nat}_pptp: annotate PPtP helper with const

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 2f3c5e5beb62ae34c4edbb59dd62c9e6c0580c8c
tree e7cc57d12720d1d9966d61231f04fa2069bd4b3a
parent c53f4c232b76b97fcdffeef43aae14f3d698f974
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:16 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:16 +0100

include/linux/netfilter/nf_conntrack_pptp.h | 2 +-
net/ipv4/netfilter/nf_nat_pptp.c | 10 +++++-----
net/netfilter/nf_conntrack_pptp.c | 14 ++++++++------
3 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_pptp.h b/include/linux/netfilter/nf_conntrack_pptp.h
index 2343549..3bbde0c 100644
--- a/include/linux/netfilter/nf_conntrack_pptp.h
+++ b/include/linux/netfilter/nf_conntrack_pptp.h
@@ -4,7 +4,7 @@

#include <linux/netfilter/nf_conntrack_common.h>

-extern const char *pptp_msg_name[];
+extern const char *const pptp_msg_name[];

/* state of the control session */
enum pptp_ctrlsess_state {
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index e63b944..3a1e6d6 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -40,11 +40,11 @@ MODULE_ALIAS("ip_nat_pptp");
static void pptp_nat_expected(struct nf_conn *ct,
struct nf_conntrack_expect *exp)
{
- struct nf_conn *master = ct->master;
+ const struct nf_conn *master = ct->master;
struct nf_conntrack_expect *other_exp;
struct nf_conntrack_tuple t;
- struct nf_ct_pptp_master *ct_pptp_info;
- struct nf_nat_pptp *nat_pptp_info;
+ const struct nf_ct_pptp_master *ct_pptp_info;
+ const struct nf_nat_pptp *nat_pptp_info;
struct nf_nat_range range;

ct_pptp_info = &nfct_help(master)->help.ct_pptp_info;
@@ -186,7 +186,7 @@ static void
pptp_exp_gre(struct nf_conntrack_expect *expect_orig,
struct nf_conntrack_expect *expect_reply)
{
- struct nf_conn *ct = expect_orig->master;
+ const struct nf_conn *ct = expect_orig->master;
struct nf_ct_pptp_master *ct_pptp_info;
struct nf_nat_pptp *nat_pptp_info;

@@ -217,7 +217,7 @@ pptp_inbound_pkt(struct sk_buff *skb,
struct PptpControlHeader *ctlh,
union pptp_ctrl_union *pptpReq)
{
- struct nf_nat_pptp *nat_pptp_info;
+ const struct nf_nat_pptp *nat_pptp_info;
u_int16_t msg;
__be16 new_pcid;
unsigned int pcid_off;
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 099b6df..b5cb8e8 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -67,7 +67,7 @@ EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_expectfn);

#ifdef DEBUG
/* PptpControlMessageType names */
-const char *pptp_msg_name[] = {
+const char *const pptp_msg_name[] = {
"UNKNOWN_MESSAGE",
"START_SESSION_REQUEST",
"START_SESSION_REPLY",
@@ -136,7 +136,7 @@ static void pptp_expectfn(struct nf_conn *ct,

static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
{
- struct nf_conntrack_tuple_hash *h;
+ const struct nf_conntrack_tuple_hash *h;
struct nf_conntrack_expect *exp;
struct nf_conn *sibling;

@@ -168,7 +168,7 @@ static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
/* timeout GRE data connections */
static void pptp_destroy_siblings(struct nf_conn *ct)
{
- struct nf_conn_help *help = nfct_help(ct);
+ const struct nf_conn_help *help = nfct_help(ct);
struct nf_conntrack_tuple t;

nf_ct_gre_keymap_destroy(ct);
@@ -497,9 +497,11 @@ conntrack_pptp_help(struct sk_buff *skb, unsigned int protoff,

{
int dir = CTINFO2DIR(ctinfo);
- struct nf_ct_pptp_master *info = &nfct_help(ct)->help.ct_pptp_info;
- struct tcphdr _tcph, *tcph;
- struct pptp_pkt_hdr _pptph, *pptph;
+ const struct nf_ct_pptp_master *info = &nfct_help(ct)->help.ct_pptp_info;
+ const struct tcphdr *tcph;
+ struct tcphdr _tcph;
+ const struct pptp_pkt_hdr *pptph;
+ struct pptp_pkt_hdr _pptph;
struct PptpControlHeader _ctlh, *ctlh;
union pptp_ctrl_union _pptpReq, *pptpReq;
unsigned int tcplen = skb->len - protoff;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:55 UTC
Permalink
[NETFILTER]: nf_conntrack: switch rwlock to spinlock

With the RCU conversion only write_lock usages of nf_conntrack_lock are
left (except one read_lock that should actually use write_lock in the
H.323 helper). Switch to a spinlock.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 0d9d7643b39dae81d0b16b54365d7985a278227f
tree 47e3dd620e54d57464c87140391c9a2a4805443b
parent b3deb266341ef2957c9386657243bfdf3480cf84
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:13 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:07 +0100

include/net/netfilter/nf_conntrack_core.h | 2 +-
net/netfilter/nf_conntrack_core.c | 38 +++++++++++++++--------------
net/netfilter/nf_conntrack_expect.c | 12 +++++----
net/netfilter/nf_conntrack_h323_main.c | 4 ++-
net/netfilter/nf_conntrack_helper.c | 4 ++-
net/netfilter/nf_conntrack_netlink.c | 22 ++++++++---------
6 files changed, 41 insertions(+), 41 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 7ad0828..2b9e571 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -72,7 +72,7 @@ print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
struct nf_conntrack_l4proto *proto);

extern struct hlist_head *nf_conntrack_hash;
-extern rwlock_t nf_conntrack_lock ;
+extern spinlock_t nf_conntrack_lock ;
extern struct hlist_head unconfirmed;

#endif /* _NF_CONNTRACK_CORE_H */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a54bfec..f284ddd 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -40,7 +40,7 @@

#define NF_CONNTRACK_VERSION "0.5.0"

-DEFINE_RWLOCK(nf_conntrack_lock);
+DEFINE_SPINLOCK(nf_conntrack_lock);
EXPORT_SYMBOL_GPL(nf_conntrack_lock);

/* nf_conntrack_standalone needs this */
@@ -199,7 +199,7 @@ destroy_conntrack(struct nf_conntrack *nfct)

rcu_read_unlock();

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
/* Expectations will have been removed in clean_from_lists,
* except TFTP can create an expectation on the first packet,
* before connection is in the list, so we need to clean here,
@@ -213,7 +213,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
}

NF_CT_STAT_INC(delete);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);

if (ct->master)
nf_ct_put(ct->master);
@@ -236,12 +236,12 @@ static void death_by_timeout(unsigned long ul_conntrack)
rcu_read_unlock();
}

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
/* Inside lock so preempt is disabled on module removal path.
* Otherwise we can get spurious warnings. */
NF_CT_STAT_INC(delete_list);
clean_from_lists(ct);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
nf_ct_put(ct);
}

@@ -303,9 +303,9 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
__nf_conntrack_hash_insert(ct, hash, repl_hash);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
}
EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);

@@ -342,7 +342,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
pr_debug("Confirming conntrack %p\n", ct);

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);

/* See if there's one in the list already, including reverse:
NAT could have grabbed it without realizing, since we're
@@ -368,7 +368,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
atomic_inc(&ct->ct_general.use);
set_bit(IPS_CONFIRMED_BIT, &ct->status);
NF_CT_STAT_INC(insert);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
help = nfct_help(ct);
if (help && help->helper)
nf_conntrack_event_cache(IPCT_HELPER, skb);
@@ -383,7 +383,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)

out:
NF_CT_STAT_INC(insert_failed);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
return NF_DROP;
}
EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
@@ -538,7 +538,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
return NULL;
}

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
exp = nf_ct_find_expectation(tuple);
if (exp) {
pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
@@ -576,7 +576,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
hlist_add_head(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
&unconfirmed);

- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);

if (exp) {
if (exp->expectfn)
@@ -787,7 +787,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
NF_CT_ASSERT(skb);

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);

/* Only update if this is not a fixed timeout */
if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
@@ -824,7 +824,7 @@ acct:
}
#endif

- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);

/* must be unlocked when calling event cache */
if (event)
@@ -909,7 +909,7 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
struct nf_conn *ct;
struct hlist_node *n;

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
hlist_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnode) {
ct = nf_ct_tuplehash_to_ctrack(h);
@@ -922,11 +922,11 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
if (iter(ct, data))
set_bit(IPS_DYING_BIT, &ct->status);
}
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
return NULL;
found:
atomic_inc(&ct->ct_general.use);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
return ct;
}

@@ -1055,7 +1055,7 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
* created because of a false negative won't make it into the hash
* though since that required taking the lock.
*/
- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
for (i = 0; i < nf_conntrack_htable_size; i++) {
while (!hlist_empty(&nf_conntrack_hash[i])) {
h = hlist_entry(nf_conntrack_hash[i].first,
@@ -1073,7 +1073,7 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
nf_conntrack_vmalloc = vmalloced;
nf_conntrack_hash = hash;
nf_conntrack_hash_rnd = rnd;
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);

nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
return 0;
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index a5c8ef0..e06bf00 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -65,9 +65,9 @@ static void nf_ct_expectation_timed_out(unsigned long ul_expect)
{
struct nf_conntrack_expect *exp = (void *)ul_expect;

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
nf_ct_unlink_expect(exp);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
nf_ct_expect_put(exp);
}

@@ -201,12 +201,12 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
/* Generally a bad idea to call this: could have matched already. */
void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
{
- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
if (del_timer(&exp->timeout)) {
nf_ct_unlink_expect(exp);
nf_ct_expect_put(exp);
}
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
}
EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);

@@ -355,7 +355,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)

NF_CT_ASSERT(master_help);

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
if (!master_help->helper) {
ret = -ESHUTDOWN;
goto out;
@@ -390,7 +390,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
nf_ct_expect_event(IPEXP_NEW, expect);
ret = 0;
out:
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
return ret;
}
EXPORT_SYMBOL_GPL(nf_ct_expect_related);
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 872c1aa..0256305 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1415,7 +1415,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
nf_ct_refresh(ct, skb, info->timeout * HZ);

/* Set expect timeout */
- read_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
exp = find_expect(ct, &ct->tuplehash[dir].tuple.dst.u3,
info->sig_port[!dir]);
if (exp) {
@@ -1425,7 +1425,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
NF_CT_DUMP_TUPLE(&exp->tuple);
set_expect_timeout(exp, info->timeout);
}
- read_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
}

return 0;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 42f781f..b1fd21c 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -138,7 +138,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
*/
synchronize_rcu();

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);

/* Get rid of expectations */
for (i = 0; i < nf_ct_expect_hsize; i++) {
@@ -160,7 +160,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
hlist_for_each_entry(h, n, &nf_conntrack_hash[i], hnode)
unhelp(h, me);
}
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
}
EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b701dcc..b6a8c08 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1220,7 +1220,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
return err;
}

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
if (cda[CTA_TUPLE_ORIG])
h = __nf_conntrack_find(&otuple, NULL);
else if (cda[CTA_TUPLE_REPLY])
@@ -1248,7 +1248,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
atomic_inc(&master_ct->ct_general.use);
}

- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
err = -ENOENT;
if (nlh->nlmsg_flags & NLM_F_CREATE)
err = ctnetlink_create_conntrack(cda,
@@ -1281,7 +1281,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
}

out_unlock:
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
return err;
}

@@ -1614,10 +1614,10 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
struct nf_conn_help *m_help;

/* delete all expectations for this helper */
- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
h = __nf_conntrack_helper_find_byname(name);
if (!h) {
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
return -EINVAL;
}
for (i = 0; i < nf_ct_expect_hsize; i++) {
@@ -1632,10 +1632,10 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
}
}
}
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
} else {
/* This basically means we have to flush everything*/
- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
for (i = 0; i < nf_ct_expect_hsize; i++) {
hlist_for_each_entry_safe(exp, n, next,
&nf_ct_expect_hash[i],
@@ -1646,7 +1646,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
}
}
}
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
}

return 0;
@@ -1732,11 +1732,11 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
if (err < 0)
return err;

- write_lock_bh(&nf_conntrack_lock);
+ spin_lock_bh(&nf_conntrack_lock);
exp = __nf_ct_expect_find(&tuple);

if (!exp) {
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);
err = -ENOENT;
if (nlh->nlmsg_flags & NLM_F_CREATE)
err = ctnetlink_create_expect(cda, u3);
@@ -1746,7 +1746,7 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
err = -EEXIST;
if (!(nlh->nlmsg_flags & NLM_F_EXCL))
err = ctnetlink_change_expect(exp, cda);
- write_unlock_bh(&nf_conntrack_lock);
+ spin_unlock_bh(&nf_conntrack_lock);

return err;
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:21 UTC
Permalink
[NETFILTER]: nf_{conntrack,nat}_sip: annotate SIP helper with const

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 82c74083c7bc88bc8bd52e6a150a0812ce97f258
tree b5be7021d07c1b2910f50abaf8906d19ffc061fc
parent c26afec8b93bbda984a179775afcdcd5c48ee365
author Jan Engelhardt <***@computergmbh.de> Wed, 30 Jan 2008 21:03:15 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:15 +0100

include/linux/netfilter/nf_conntrack_sip.h | 6 +++---
net/ipv4/netfilter/nf_nat_sip.c | 4 ++--
net/netfilter/nf_conntrack_sip.c | 25 +++++++++++++------------
3 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index 9fff197..8e5ce1c 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -30,9 +30,9 @@ extern unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
struct nf_conntrack_expect *exp,
const char *dptr);

-extern int ct_sip_get_info(struct nf_conn *ct, const char *dptr, size_t dlen,
- unsigned int *matchoff, unsigned int *matchlen,
- enum sip_header_pos pos);
+extern int ct_sip_get_info(const struct nf_conn *ct, const char *dptr,
+ size_t dlen, unsigned int *matchoff,
+ unsigned int *matchlen, enum sip_header_pos pos);
extern int ct_sip_lnlen(const char *line, const char *limit);
extern const char *ct_sip_search(const char *needle, const char *haystack,
size_t needle_len, size_t haystack_len,
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 606a170..b4c8d49 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -35,9 +35,9 @@ struct addr_map {
} addr[IP_CT_DIR_MAX];
};

-static void addr_map_init(struct nf_conn *ct, struct addr_map *map)
+static void addr_map_init(const struct nf_conn *ct, struct addr_map *map)
{
- struct nf_conntrack_tuple *t;
+ const struct nf_conntrack_tuple *t;
enum ip_conntrack_dir dir;
unsigned int n;

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 775f7d4..c521c89 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -48,10 +48,10 @@ unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
const char *dptr) __read_mostly;
EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);

-static int digits_len(struct nf_conn *, const char *, const char *, int *);
-static int epaddr_len(struct nf_conn *, const char *, const char *, int *);
-static int skp_digits_len(struct nf_conn *, const char *, const char *, int *);
-static int skp_epaddr_len(struct nf_conn *, const char *, const char *, int *);
+static int digits_len(const struct nf_conn *, const char *, const char *, int *);
+static int epaddr_len(const struct nf_conn *, const char *, const char *, int *);
+static int skp_digits_len(const struct nf_conn *, const char *, const char *, int *);
+static int skp_epaddr_len(const struct nf_conn *, const char *, const char *, int *);

struct sip_header_nfo {
const char *lname;
@@ -61,7 +61,7 @@ struct sip_header_nfo {
size_t snlen;
size_t ln_strlen;
int case_sensitive;
- int (*match_len)(struct nf_conn *, const char *,
+ int (*match_len)(const struct nf_conn *, const char *,
const char *, int *);
};

@@ -225,7 +225,7 @@ const char *ct_sip_search(const char *needle, const char *haystack,
}
EXPORT_SYMBOL_GPL(ct_sip_search);

-static int digits_len(struct nf_conn *ct, const char *dptr,
+static int digits_len(const struct nf_conn *ct, const char *dptr,
const char *limit, int *shift)
{
int len = 0;
@@ -237,7 +237,7 @@ static int digits_len(struct nf_conn *ct, const char *dptr,
}

/* get digits length, skipping blank spaces. */
-static int skp_digits_len(struct nf_conn *ct, const char *dptr,
+static int skp_digits_len(const struct nf_conn *ct, const char *dptr,
const char *limit, int *shift)
{
for (; dptr <= limit && *dptr == ' '; dptr++)
@@ -246,8 +246,9 @@ static int skp_digits_len(struct nf_conn *ct, const char *dptr,
return digits_len(ct, dptr, limit, shift);
}

-static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
- union nf_inet_addr *addr, const char *limit)
+static int parse_addr(const struct nf_conn *ct, const char *cp,
+ const char **endp, union nf_inet_addr *addr,
+ const char *limit)
{
const char *end;
int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
@@ -272,7 +273,7 @@ static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
}

/* skip ip address. returns its length. */
-static int epaddr_len(struct nf_conn *ct, const char *dptr,
+static int epaddr_len(const struct nf_conn *ct, const char *dptr,
const char *limit, int *shift)
{
union nf_inet_addr addr;
@@ -292,7 +293,7 @@ static int epaddr_len(struct nf_conn *ct, const char *dptr,
}

/* get address length, skiping user info. */
-static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
+static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
const char *limit, int *shift)
{
const char *start = dptr;
@@ -319,7 +320,7 @@ static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
}

/* Returns 0 if not found, -1 error parsing. */
-int ct_sip_get_info(struct nf_conn *ct,
+int ct_sip_get_info(const struct nf_conn *ct,
const char *dptr, size_t dlen,
unsigned int *matchoff,
unsigned int *matchlen,
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:18 UTC
Permalink
[NETFILTER]: x_tables: create per-netns /proc/net/*_tables_*

Signed-off-by: Alexey Dobriyan <***@sw.ru>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 25de3b864f944b5adc2f0bf70fbb6b88efafabb1
tree b3cdc7e18a67f280eeaa9ca59f29d15f69b536d3
parent 513f43dcb3326e0f5273191d368a17585e865afc
author Alexey Dobriyan <***@sw.ru> Wed, 30 Jan 2008 21:03:14 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:14 +0100

include/linux/netfilter/x_tables.h | 4 ++--
net/ipv4/netfilter/arp_tables.c | 21 ++++++++++++++++++---
net/ipv4/netfilter/ip_tables.c | 21 ++++++++++++++++++---
net/ipv6/netfilter/ip6_tables.c | 22 +++++++++++++++++++---
net/netfilter/x_tables.c | 20 ++++++++++----------
5 files changed, 67 insertions(+), 21 deletions(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 11eea39..b2c62cc 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -357,8 +357,8 @@ extern struct xt_table *xt_find_table_lock(struct net *net, int af,
const char *name);
extern void xt_table_unlock(struct xt_table *t);

-extern int xt_proto_init(int af);
-extern void xt_proto_fini(int af);
+extern int xt_proto_init(struct net *net, int af);
+extern void xt_proto_fini(struct net *net, int af);

extern struct xt_table_info *xt_alloc_table_info(unsigned int size);
extern void xt_free_table_info(struct xt_table_info *info);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 3608675..a7591ce 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1822,11 +1822,26 @@ static struct nf_sockopt_ops arpt_sockopts = {
.owner = THIS_MODULE,
};

+static int __net_init arp_tables_net_init(struct net *net)
+{
+ return xt_proto_init(net, NF_ARP);
+}
+
+static void __net_exit arp_tables_net_exit(struct net *net)
+{
+ xt_proto_fini(net, NF_ARP);
+}
+
+static struct pernet_operations arp_tables_net_ops = {
+ .init = arp_tables_net_init,
+ .exit = arp_tables_net_exit,
+};
+
static int __init arp_tables_init(void)
{
int ret;

- ret = xt_proto_init(NF_ARP);
+ ret = register_pernet_subsys(&arp_tables_net_ops);
if (ret < 0)
goto err1;

@@ -1851,7 +1866,7 @@ err4:
err3:
xt_unregister_target(&arpt_standard_target);
err2:
- xt_proto_fini(NF_ARP);
+ unregister_pernet_subsys(&arp_tables_net_ops);
err1:
return ret;
}
@@ -1861,7 +1876,7 @@ static void __exit arp_tables_fini(void)
nf_unregister_sockopt(&arpt_sockopts);
xt_unregister_target(&arpt_error_target);
xt_unregister_target(&arpt_standard_target);
- xt_proto_fini(NF_ARP);
+ unregister_pernet_subsys(&arp_tables_net_ops);
}

EXPORT_SYMBOL(arpt_register_table);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index a73afa1..600737f 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2213,11 +2213,26 @@ static struct xt_match icmp_matchstruct __read_mostly = {
.family = AF_INET,
};

+static int __net_init ip_tables_net_init(struct net *net)
+{
+ return xt_proto_init(net, AF_INET);
+}
+
+static void __net_exit ip_tables_net_exit(struct net *net)
+{
+ xt_proto_fini(net, AF_INET);
+}
+
+static struct pernet_operations ip_tables_net_ops = {
+ .init = ip_tables_net_init,
+ .exit = ip_tables_net_exit,
+};
+
static int __init ip_tables_init(void)
{
int ret;

- ret = xt_proto_init(AF_INET);
+ ret = register_pernet_subsys(&ip_tables_net_ops);
if (ret < 0)
goto err1;

@@ -2247,7 +2262,7 @@ err4:
err3:
xt_unregister_target(&ipt_standard_target);
err2:
- xt_proto_fini(AF_INET);
+ unregister_pernet_subsys(&ip_tables_net_ops);
err1:
return ret;
}
@@ -2260,7 +2275,7 @@ static void __exit ip_tables_fini(void)
xt_unregister_target(&ipt_error_target);
xt_unregister_target(&ipt_standard_target);

- xt_proto_fini(AF_INET);
+ unregister_pernet_subsys(&ip_tables_net_ops);
}

EXPORT_SYMBOL(ipt_register_table);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index b91738a..bf9bb6e 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -2238,11 +2238,26 @@ static struct xt_match icmp6_matchstruct __read_mostly = {
.family = AF_INET6,
};

+static int __net_init ip6_tables_net_init(struct net *net)
+{
+ return xt_proto_init(net, AF_INET6);
+}
+
+static void __net_exit ip6_tables_net_exit(struct net *net)
+{
+ xt_proto_fini(net, AF_INET6);
+}
+
+static struct pernet_operations ip6_tables_net_ops = {
+ .init = ip6_tables_net_init,
+ .exit = ip6_tables_net_exit,
+};
+
static int __init ip6_tables_init(void)
{
int ret;

- ret = xt_proto_init(AF_INET6);
+ ret = register_pernet_subsys(&ip6_tables_net_ops);
if (ret < 0)
goto err1;

@@ -2272,7 +2287,7 @@ err4:
err3:
xt_unregister_target(&ip6t_standard_target);
err2:
- xt_proto_fini(AF_INET6);
+ unregister_pernet_subsys(&ip6_tables_net_ops);
err1:
return ret;
}
@@ -2284,7 +2299,8 @@ static void __exit ip6_tables_fini(void)
xt_unregister_match(&icmp6_matchstruct);
xt_unregister_target(&ip6t_error_target);
xt_unregister_target(&ip6t_standard_target);
- xt_proto_fini(AF_INET6);
+
+ unregister_pernet_subsys(&ip6_tables_net_ops);
}

/*
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 12ed64c..a679208 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -922,7 +922,7 @@ static const struct file_operations xt_target_ops = {

#endif /* CONFIG_PROC_FS */

-int xt_proto_init(int af)
+int xt_proto_init(struct net *net, int af)
{
#ifdef CONFIG_PROC_FS
char buf[XT_FUNCTION_MAXNAMELEN];
@@ -936,7 +936,7 @@ int xt_proto_init(int af)
#ifdef CONFIG_PROC_FS
strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_TABLES, sizeof(buf));
- proc = proc_net_fops_create(&init_net, buf, 0440, &xt_table_ops);
+ proc = proc_net_fops_create(net, buf, 0440, &xt_table_ops);
if (!proc)
goto out;
proc->data = (void *)(unsigned long)af;
@@ -944,14 +944,14 @@ int xt_proto_init(int af)

strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_MATCHES, sizeof(buf));
- proc = proc_net_fops_create(&init_net, buf, 0440, &xt_match_ops);
+ proc = proc_net_fops_create(net, buf, 0440, &xt_match_ops);
if (!proc)
goto out_remove_tables;
proc->data = (void *)(unsigned long)af;

strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_TARGETS, sizeof(buf));
- proc = proc_net_fops_create(&init_net, buf, 0440, &xt_target_ops);
+ proc = proc_net_fops_create(net, buf, 0440, &xt_target_ops);
if (!proc)
goto out_remove_matches;
proc->data = (void *)(unsigned long)af;
@@ -963,34 +963,34 @@ int xt_proto_init(int af)
out_remove_matches:
strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_MATCHES, sizeof(buf));
- proc_net_remove(&init_net, buf);
+ proc_net_remove(net, buf);

out_remove_tables:
strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_TABLES, sizeof(buf));
- proc_net_remove(&init_net, buf);
+ proc_net_remove(net, buf);
out:
return -1;
#endif
}
EXPORT_SYMBOL_GPL(xt_proto_init);

-void xt_proto_fini(int af)
+void xt_proto_fini(struct net *net, int af)
{
#ifdef CONFIG_PROC_FS
char buf[XT_FUNCTION_MAXNAMELEN];

strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_TABLES, sizeof(buf));
- proc_net_remove(&init_net, buf);
+ proc_net_remove(net, buf);

strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_TARGETS, sizeof(buf));
- proc_net_remove(&init_net, buf);
+ proc_net_remove(net, buf);

strlcpy(buf, xt_prefix[af], sizeof(buf));
strlcat(buf, FORMAT_MATCHES, sizeof(buf));
- proc_net_remove(&init_net, buf);
+ proc_net_remove(net, buf);
#endif /*CONFIG_PROC_FS*/
}
EXPORT_SYMBOL_GPL(xt_proto_fini);
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:05 UTC
Permalink
[NETFILTER]: nf_nat: use RCU for bysource hash

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 9a797e6248868e23d468f801ec67b98a44ef689b
tree 5d08e94eede5551cc1f0188da7074d9b285b41be
parent cd3672c2df98db3eb29b793ec537f8382e268dc8
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:09 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:09 +0100

net/ipv4/netfilter/nf_nat_core.c | 12 ++++++------
1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index c07575d..c7a985f 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -154,8 +154,8 @@ find_appropriate_src(const struct nf_conntrack_tuple *tuple,
struct nf_conn *ct;
struct hlist_node *n;

- read_lock_bh(&nf_nat_lock);
- hlist_for_each_entry(nat, n, &bysource[h], bysource) {
+ rcu_read_lock();
+ hlist_for_each_entry_rcu(nat, n, &bysource[h], bysource) {
ct = nat->ct;
if (same_src(ct, tuple)) {
/* Copy source part from reply tuple. */
@@ -164,12 +164,12 @@ find_appropriate_src(const struct nf_conntrack_tuple *tuple,
result->dst = tuple->dst;

if (in_range(result, range)) {
- read_unlock_bh(&nf_nat_lock);
+ rcu_read_unlock();
return 1;
}
}
}
- read_unlock_bh(&nf_nat_lock);
+ rcu_read_unlock();
return 0;
}

@@ -334,7 +334,7 @@ nf_nat_setup_info(struct nf_conn *ct,
/* nf_conntrack_alter_reply might re-allocate exntension aera */
nat = nfct_nat(ct);
nat->ct = ct;
- hlist_add_head(&nat->bysource, &bysource[srchash]);
+ hlist_add_head_rcu(&nat->bysource, &bysource[srchash]);
write_unlock_bh(&nf_nat_lock);
}

@@ -595,7 +595,7 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
NF_CT_ASSERT(nat->ct->status & IPS_NAT_DONE_MASK);

write_lock_bh(&nf_nat_lock);
- hlist_del(&nat->bysource);
+ hlist_del_rcu(&nat->bysource);
nat->ct = NULL;
write_unlock_bh(&nf_nat_lock);
}
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:45 UTC
Permalink
[NETFILTER]: nf_conntrack_netlink: fix unbalanced locking

Properly drop nf_conntrack_lock on tuple parsing error.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 9813002a577062723e68ac1da712de25f7998f1e
tree 3e9798a85beddb21ab8410d63050fa0567dfd6f4
parent ec8971e984194b97af037d06dc40a23f9581276b
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:10 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:05 +0100

net/netfilter/nf_conntrack_netlink.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 38141f1..bdae292 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1237,7 +1237,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
CTA_TUPLE_MASTER,
u3);
if (err < 0)
- return err;
+ goto out_unlock;

master_h = __nf_conntrack_find(&master, NULL);
if (master_h == NULL) {
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:08 UTC
Permalink
[NETFILTER]: nf_conntrack_h323: clean up code a bit

-total: 81 errors, 3 warnings, 876 lines checked
+total: 44 errors, 3 warnings, 876 lines checked

There is still work to be done, but that's for another patch.

Signed-off-by: Jan Engelhardt <***@computergmbh.de>
Signed-off-by: Patrick McHardy <***@trash.net>

---
commit bc81193022f55c5cc719728b1bdf67648054bce6
tree 3fe9a6ef417db3eacdcb20c160f57b38c80feade
parent 5cf331a51d8fed16e2e12142d8dc66eef5cb7bca
author Jan Engelhardt <***@computergmbh.de> Tue, 29 Jan 2008 16:22:15 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:10 +0100

net/netfilter/nf_conntrack_h323_asn1.c | 128 ++++++++++++++++----------------
1 files changed, 64 insertions(+), 64 deletions(-)

diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index f73e130..ef02262 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -96,7 +96,7 @@ typedef struct {
unsigned char *beg;
unsigned char *end;
unsigned char *cur;
- unsigned bit;
+ unsigned int bit;
} bitstr_t;

/* Tool Functions */
@@ -104,28 +104,28 @@ typedef struct {
#define INC_BITS(bs,b) if(((bs)->bit+=(b))>7){(bs)->cur+=(bs)->bit>>3;(bs)->bit&=7;}
#define BYTE_ALIGN(bs) if((bs)->bit){(bs)->cur++;(bs)->bit=0;}
#define CHECK_BOUND(bs,n) if((bs)->cur+(n)>(bs)->end)return(H323_ERROR_BOUND)
-static unsigned get_len(bitstr_t * bs);
-static unsigned get_bit(bitstr_t * bs);
-static unsigned get_bits(bitstr_t * bs, unsigned b);
-static unsigned get_bitmap(bitstr_t * bs, unsigned b);
-static unsigned get_uint(bitstr_t * bs, int b);
+static unsigned int get_len(bitstr_t *bs);
+static unsigned int get_bit(bitstr_t *bs);
+static unsigned int get_bits(bitstr_t *bs, unsigned int b);
+static unsigned int get_bitmap(bitstr_t *bs, unsigned int b);
+static unsigned int get_uint(bitstr_t *bs, int b);

/* Decoder Functions */
-static int decode_nul(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_bool(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_oid(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_int(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_enum(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_seq(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_choice(bitstr_t * bs, field_t * f, char *base, int level);
+static int decode_nul(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_bool(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_oid(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_int(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_enum(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_bitstr(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_numstr(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_octstr(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_bmpstr(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_seq(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_seqof(bitstr_t *bs, field_t *f, char *base, int level);
+static int decode_choice(bitstr_t *bs, field_t *f, char *base, int level);

/* Decoder Functions Vector */
-typedef int (*decoder_t) (bitstr_t *, field_t *, char *, int);
+typedef int (*decoder_t)(bitstr_t *, field_t *, char *, int);
static const decoder_t Decoders[] = {
decode_nul,
decode_bool,
@@ -150,9 +150,9 @@ static const decoder_t Decoders[] = {
* Functions
****************************************************************************/
/* Assume bs is aligned && v < 16384 */
-static unsigned get_len(bitstr_t * bs)
+static unsigned int get_len(bitstr_t *bs)
{
- unsigned v;
+ unsigned int v;

v = *bs->cur++;

@@ -166,9 +166,9 @@ static unsigned get_len(bitstr_t * bs)
}

/****************************************************************************/
-static unsigned get_bit(bitstr_t * bs)
+static unsigned int get_bit(bitstr_t *bs)
{
- unsigned b = (*bs->cur) & (0x80 >> bs->bit);
+ unsigned int b = (*bs->cur) & (0x80 >> bs->bit);

INC_BIT(bs);

@@ -177,9 +177,9 @@ static unsigned get_bit(bitstr_t * bs)

/****************************************************************************/
/* Assume b <= 8 */
-static unsigned get_bits(bitstr_t * bs, unsigned b)
+static unsigned int get_bits(bitstr_t *bs, unsigned int b)
{
- unsigned v, l;
+ unsigned int v, l;

v = (*bs->cur) & (0xffU >> bs->bit);
l = b + bs->bit;
@@ -203,9 +203,9 @@ static unsigned get_bits(bitstr_t * bs, unsigned b)

/****************************************************************************/
/* Assume b <= 32 */
-static unsigned get_bitmap(bitstr_t * bs, unsigned b)
+static unsigned int get_bitmap(bitstr_t *bs, unsigned int b)
{
- unsigned v, l, shift, bytes;
+ unsigned int v, l, shift, bytes;

if (!b)
return 0;
@@ -213,18 +213,18 @@ static unsigned get_bitmap(bitstr_t * bs, unsigned b)
l = bs->bit + b;

if (l < 8) {
- v = (unsigned) (*bs->cur) << (bs->bit + 24);
+ v = (unsigned int)(*bs->cur) << (bs->bit + 24);
bs->bit = l;
} else if (l == 8) {
- v = (unsigned) (*bs->cur++) << (bs->bit + 24);
+ v = (unsigned int)(*bs->cur++) << (bs->bit + 24);
bs->bit = 0;
} else {
for (bytes = l >> 3, shift = 24, v = 0; bytes;
bytes--, shift -= 8)
- v |= (unsigned) (*bs->cur++) << shift;
+ v |= (unsigned int)(*bs->cur++) << shift;

if (l < 32) {
- v |= (unsigned) (*bs->cur) << shift;
+ v |= (unsigned int)(*bs->cur) << shift;
v <<= bs->bit;
} else if (l > 32) {
v <<= bs->bit;
@@ -242,9 +242,9 @@ static unsigned get_bitmap(bitstr_t * bs, unsigned b)
/****************************************************************************
* Assume bs is aligned and sizeof(unsigned int) == 4
****************************************************************************/
-static unsigned get_uint(bitstr_t * bs, int b)
+static unsigned int get_uint(bitstr_t *bs, int b)
{
- unsigned v = 0;
+ unsigned int v = 0;

switch (b) {
case 4:
@@ -264,7 +264,7 @@ static unsigned get_uint(bitstr_t * bs, int b)
}

/****************************************************************************/
-static int decode_nul(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_nul(bitstr_t *bs, field_t *f, char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -272,7 +272,7 @@ static int decode_nul(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_bool(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bool(bitstr_t *bs, field_t *f, char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -283,7 +283,7 @@ static int decode_bool(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_oid(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_oid(bitstr_t *bs, field_t *f, char *base, int level)
{
int len;

@@ -299,9 +299,9 @@ static int decode_oid(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_int(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned len;
+ unsigned int len;

PRINT("%*.s%s", level * TAB_SIZE, " ", f->name);

@@ -318,9 +318,9 @@ static int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
len = get_bits(bs, 2) + 1;
BYTE_ALIGN(bs);
if (base && (f->attr & DECODE)) { /* timeToLive */
- unsigned v = get_uint(bs, len) + f->lb;
+ unsigned int v = get_uint(bs, len) + f->lb;
PRINT(" = %u", v);
- *((unsigned *) (base + f->offset)) = v;
+ *((unsigned int *)(base + f->offset)) = v;
}
bs->cur += len;
break;
@@ -342,7 +342,7 @@ static int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_enum(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_enum(bitstr_t *bs, field_t *f, char *base, int level)
{
PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -357,9 +357,9 @@ static int decode_enum(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bitstr(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned len;
+ unsigned int len;

PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -390,9 +390,9 @@ static int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_numstr(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned len;
+ unsigned int len;

PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -407,9 +407,9 @@ static int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_octstr(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned len;
+ unsigned int len;

PRINT("%*.s%s", level * TAB_SIZE, " ", f->name);

@@ -424,7 +424,7 @@ static int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
bs->cur[0], bs->cur[1],
bs->cur[2], bs->cur[3],
bs->cur[4] * 256 + bs->cur[5]));
- *((unsigned *) (base + f->offset)) =
+ *((unsigned int *)(base + f->offset)) =
bs->cur - bs->buf;
}
}
@@ -455,9 +455,9 @@ static int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bmpstr(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned len;
+ unsigned int len;

PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);

@@ -480,9 +480,9 @@ static int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_seq(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned ext, bmp, i, opt, len = 0, bmp2, bmp2_len;
+ unsigned int ext, bmp, i, opt, len = 0, bmp2, bmp2_len;
int err;
field_t *son;
unsigned char *beg = NULL;
@@ -498,7 +498,7 @@ static int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
/* Get fields bitmap */
bmp = get_bitmap(bs, f->sz);
if (base)
- *(unsigned *) base = bmp;
+ *(unsigned int *)base = bmp;

/* Decode the root components */
for (i = opt = 0, son = f->fields; i < f->lb; i++, son++) {
@@ -550,7 +550,7 @@ static int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
bmp2 = get_bitmap(bs, bmp2_len);
bmp |= bmp2 >> f->sz;
if (base)
- *(unsigned *) base = bmp;
+ *(unsigned int *)base = bmp;
BYTE_ALIGN(bs);

/* Decode the extension components */
@@ -596,9 +596,9 @@ static int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-static int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_seqof(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned count, effective_count = 0, i, len = 0;
+ unsigned int count, effective_count = 0, i, len = 0;
int err;
field_t *son;
unsigned char *beg = NULL;
@@ -636,8 +636,8 @@ static int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
/* Write Count */
if (base) {
effective_count = count > f->ub ? f->ub : count;
- *(unsigned *) base = effective_count;
- base += sizeof(unsigned);
+ *(unsigned int *)base = effective_count;
+ base += sizeof(unsigned int);
}

/* Decode nested field */
@@ -685,9 +685,9 @@ static int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)


/****************************************************************************/
-static int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_choice(bitstr_t *bs, field_t *f, char *base, int level)
{
- unsigned type, ext, len = 0;
+ unsigned int type, ext, len = 0;
int err;
field_t *son;
unsigned char *beg = NULL;
@@ -710,7 +710,7 @@ static int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)

/* Write Type */
if (base)
- *(unsigned *) base = type;
+ *(unsigned int *)base = type;

/* Check Range */
if (type >= f->ub) { /* Newer version? */
@@ -754,7 +754,7 @@ static int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
}

/****************************************************************************/
-int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage * ras)
+int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage *ras)
{
static field_t ras_message = {
FNAME("RasMessage") CHOICE, 5, 24, 32, DECODE | EXT,
@@ -771,7 +771,7 @@ int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage * ras)

/****************************************************************************/
static int DecodeH323_UserInformation(unsigned char *buf, unsigned char *beg,
- size_t sz, H323_UserInformation * uuie)
+ size_t sz, H323_UserInformation *uuie)
{
static field_t h323_userinformation = {
FNAME("H323-UserInformation") SEQ, 1, 2, 2, DECODE | EXT,
@@ -807,7 +807,7 @@ int DecodeMultimediaSystemControlMessage(unsigned char *buf, size_t sz,
}

/****************************************************************************/
-int DecodeQ931(unsigned char *buf, size_t sz, Q931 * q931)
+int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931)
{
unsigned char *p = buf;
int len;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:18:03 UTC
Permalink
[NETFILTER]: nf_conntrack: naming unification

Rename all "conntrack" variables to "ct" for more consistency and avoiding
some overly long lines.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit cd3672c2df98db3eb29b793ec537f8382e268dc8
tree f59812b460484dd55188e97ad22e9e0e48328d3f
parent 9dcd796f052a9383e55d81e7da5912e0a6cd4b19
author Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:09 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:09 +0100

include/net/netfilter/nf_conntrack.h | 4 -
include/net/netfilter/nf_conntrack_l3proto.h | 4 -
include/net/netfilter/nf_conntrack_l4proto.h | 6 -
net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 12 +-
net/ipv4/netfilter/nf_nat_proto_gre.c | 10 +-
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 8 +
net/netfilter/nf_conntrack_core.c | 58 ++++-----
net/netfilter/nf_conntrack_proto_generic.c | 6 -
net/netfilter/nf_conntrack_proto_sctp.c | 2
net/netfilter/nf_conntrack_proto_tcp.c | 150 ++++++++++++------------
net/netfilter/nf_conntrack_proto_udp.c | 13 +-
net/netfilter/nf_conntrack_proto_udplite.c | 13 +-
net/netfilter/nf_conntrack_standalone.c | 38 +++---
13 files changed, 157 insertions(+), 167 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 14e0cc8..bda78a2 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -145,7 +145,7 @@ nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)

/* Alter reply tuple (maybe alter helper). */
extern void
-nf_conntrack_alter_reply(struct nf_conn *conntrack,
+nf_conntrack_alter_reply(struct nf_conn *ct,
const struct nf_conntrack_tuple *newreply);

/* Is this tuple taken? (ignoring any belonging to the given
@@ -218,7 +218,7 @@ static inline void nf_ct_refresh(struct nf_conn *ct,
/* Update TCP window tracking data when NAT mangles the packet */
extern void nf_conntrack_tcp_update(struct sk_buff *skb,
unsigned int dataoff,
- struct nf_conn *conntrack,
+ struct nf_conn *ct,
int dir);

/* Fake conntrack entry for untracked connections */
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index d5526bc..b886e3a 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -43,7 +43,7 @@ struct nf_conntrack_l3proto
const struct nf_conntrack_tuple *);

/* Returns verdict for packet, or -1 for invalid. */
- int (*packet)(struct nf_conn *conntrack,
+ int (*packet)(struct nf_conn *ct,
const struct sk_buff *skb,
enum ip_conntrack_info ctinfo);

@@ -51,7 +51,7 @@ struct nf_conntrack_l3proto
* Called when a new connection for this protocol found;
* returns TRUE if it's OK. If so, packet() called next.
*/
- int (*new)(struct nf_conn *conntrack, const struct sk_buff *skb);
+ int (*new)(struct nf_conn *ct, const struct sk_buff *skb);

/*
* Called before tracking.
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 84892cc..efc16ec 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -36,7 +36,7 @@ struct nf_conntrack_l4proto
const struct nf_conntrack_tuple *orig);

/* Returns verdict for packet, or -1 for invalid. */
- int (*packet)(struct nf_conn *conntrack,
+ int (*packet)(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff,
enum ip_conntrack_info ctinfo,
@@ -45,11 +45,11 @@ struct nf_conntrack_l4proto

/* Called when a new connection for this protocol found;
* returns TRUE if it's OK. If so, packet() called next. */
- int (*new)(struct nf_conn *conntrack, const struct sk_buff *skb,
+ int (*new)(struct nf_conn *ct, const struct sk_buff *skb,
unsigned int dataoff);

/* Called when a conntrack entry is destroyed */
- void (*destroy)(struct nf_conn *conntrack);
+ void (*destroy)(struct nf_conn *ct);

int (*error)(struct sk_buff *skb, unsigned int dataoff,
enum ip_conntrack_info *ctinfo,
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 4004a04..17217f4 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -100,7 +100,7 @@ static int icmp_packet(struct nf_conn *ct,
}

/* Called when a new connection for this protocol found. */
-static int icmp_new(struct nf_conn *conntrack,
+static int icmp_new(struct nf_conn *ct,
const struct sk_buff *skb, unsigned int dataoff)
{
static const u_int8_t valid_new[] = {
@@ -110,15 +110,15 @@ static int icmp_new(struct nf_conn *conntrack,
[ICMP_ADDRESS] = 1
};

- if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
- || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type]) {
+ if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
+ || !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
/* Can't create a new ICMP `conn' with this. */
pr_debug("icmp: can't create new conn with type %u\n",
- conntrack->tuplehash[0].tuple.dst.u.icmp.type);
- NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
+ ct->tuplehash[0].tuple.dst.u.icmp.type);
+ NF_CT_DUMP_TUPLE(&ct->tuplehash[0].tuple);
return 0;
}
- atomic_set(&conntrack->proto.icmp.count, 0);
+ atomic_set(&ct->proto.icmp.count, 0);
return 1;
}

diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index c9dbd55..b887ebb 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -59,7 +59,7 @@ static int
gre_unique_tuple(struct nf_conntrack_tuple *tuple,
const struct nf_nat_range *range,
enum nf_nat_manip_type maniptype,
- const struct nf_conn *conntrack)
+ const struct nf_conn *ct)
{
static u_int16_t key;
__be16 *keyptr;
@@ -67,7 +67,7 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,

/* If there is no master conntrack we are not PPTP,
do not change tuples */
- if (!conntrack->master)
+ if (!ct->master)
return 0;

if (maniptype == IP_NAT_MANIP_SRC)
@@ -76,7 +76,7 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
keyptr = &tuple->dst.u.gre.key;

if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
- pr_debug("%p: NATing GRE PPTP\n", conntrack);
+ pr_debug("%p: NATing GRE PPTP\n", ct);
min = 1;
range_size = 0xffff;
} else {
@@ -88,11 +88,11 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,

for (i = 0; i < range_size; i++, key++) {
*keyptr = htons(min + key % range_size);
- if (!nf_nat_used_tuple(tuple, conntrack))
+ if (!nf_nat_used_tuple(tuple, ct))
return 1;
}

- pr_debug("%p: no NAT mapping\n", conntrack);
+ pr_debug("%p: no NAT mapping\n", ct);
return 0;
}

diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index da924c6..430db1d 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -101,7 +101,7 @@ static int icmpv6_packet(struct nf_conn *ct,
}

/* Called when a new connection for this protocol found. */
-static int icmpv6_new(struct nf_conn *conntrack,
+static int icmpv6_new(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff)
{
@@ -109,16 +109,16 @@ static int icmpv6_new(struct nf_conn *conntrack,
[ICMPV6_ECHO_REQUEST - 128] = 1,
[ICMPV6_NI_QUERY - 128] = 1
};
- int type = conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128;
+ int type = ct->tuplehash[0].tuple.dst.u.icmp.type - 128;

if (type < 0 || type >= sizeof(valid_new) || !valid_new[type]) {
/* Can't create a new ICMPv6 `conn' with this. */
pr_debug("icmpv6: can't create new conn with type %u\n",
type + 128);
- NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
+ NF_CT_DUMP_TUPLE(&ct->tuplehash[0].tuple);
return 0;
}
- atomic_set(&conntrack->proto.icmp.count, 0);
+ atomic_set(&ct->proto.icmp.count, 0);
return 1;
}

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index fabc9eb..0db7d1d 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -462,7 +462,7 @@ static noinline int early_drop(unsigned int hash)
struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
const struct nf_conntrack_tuple *repl)
{
- struct nf_conn *conntrack = NULL;
+ struct nf_conn *ct = NULL;

if (unlikely(!nf_conntrack_hash_rnd_initted)) {
get_random_bytes(&nf_conntrack_hash_rnd, 4);
@@ -485,22 +485,21 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
}
}

- conntrack = kmem_cache_zalloc(nf_conntrack_cachep, GFP_ATOMIC);
- if (conntrack == NULL) {
+ ct = kmem_cache_zalloc(nf_conntrack_cachep, GFP_ATOMIC);
+ if (ct == NULL) {
pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
atomic_dec(&nf_conntrack_count);
return ERR_PTR(-ENOMEM);
}

- atomic_set(&conntrack->ct_general.use, 1);
- conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
- conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
+ atomic_set(&ct->ct_general.use, 1);
+ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
+ ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
/* Don't set timer yet: wait for confirmation */
- setup_timer(&conntrack->timeout, death_by_timeout,
- (unsigned long)conntrack);
- INIT_RCU_HEAD(&conntrack->rcu);
+ setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
+ INIT_RCU_HEAD(&ct->rcu);

- return conntrack;
+ return ct;
}
EXPORT_SYMBOL_GPL(nf_conntrack_alloc);

@@ -513,9 +512,9 @@ static void nf_conntrack_free_rcu(struct rcu_head *head)
atomic_dec(&nf_conntrack_count);
}

-void nf_conntrack_free(struct nf_conn *conntrack)
+void nf_conntrack_free(struct nf_conn *ct)
{
- call_rcu(&conntrack->rcu, nf_conntrack_free_rcu);
+ call_rcu(&ct->rcu, nf_conntrack_free_rcu);
}
EXPORT_SYMBOL_GPL(nf_conntrack_free);

@@ -528,7 +527,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
struct sk_buff *skb,
unsigned int dataoff)
{
- struct nf_conn *conntrack;
+ struct nf_conn *ct;
struct nf_conn_help *help;
struct nf_conntrack_tuple repl_tuple;
struct nf_conntrack_expect *exp;
@@ -538,14 +537,14 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
return NULL;
}

- conntrack = nf_conntrack_alloc(tuple, &repl_tuple);
- if (conntrack == NULL || IS_ERR(conntrack)) {
+ ct = nf_conntrack_alloc(tuple, &repl_tuple);
+ if (ct == NULL || IS_ERR(ct)) {
pr_debug("Can't allocate conntrack.\n");
- return (struct nf_conntrack_tuple_hash *)conntrack;
+ return (struct nf_conntrack_tuple_hash *)ct;
}

- if (!l4proto->new(conntrack, skb, dataoff)) {
- nf_conntrack_free(conntrack);
+ if (!l4proto->new(ct, skb, dataoff)) {
+ nf_conntrack_free(ct);
pr_debug("init conntrack: can't track with proto module\n");
return NULL;
}
@@ -554,30 +553,30 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
exp = nf_ct_find_expectation(tuple);
if (exp) {
pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
- conntrack, exp);
+ ct, exp);
/* Welcome, Mr. Bond. We've been expecting you... */
- __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
- conntrack->master = exp->master;
+ __set_bit(IPS_EXPECTED_BIT, &ct->status);
+ ct->master = exp->master;
if (exp->helper) {
- help = nf_ct_helper_ext_add(conntrack, GFP_ATOMIC);
+ help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
if (help)
rcu_assign_pointer(help->helper, exp->helper);
}

#ifdef CONFIG_NF_CONNTRACK_MARK
- conntrack->mark = exp->master->mark;
+ ct->mark = exp->master->mark;
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
- conntrack->secmark = exp->master->secmark;
+ ct->secmark = exp->master->secmark;
#endif
- nf_conntrack_get(&conntrack->master->ct_general);
+ nf_conntrack_get(&ct->master->ct_general);
NF_CT_STAT_INC(expect_new);
} else {
struct nf_conntrack_helper *helper;

helper = __nf_ct_helper_find(&repl_tuple);
if (helper) {
- help = nf_ct_helper_ext_add(conntrack, GFP_ATOMIC);
+ help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
if (help)
rcu_assign_pointer(help->helper, helper);
}
@@ -585,18 +584,17 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
}

/* Overload tuple linked list to put us in unconfirmed list. */
- hlist_add_head(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
- &unconfirmed);
+ hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode, &unconfirmed);

spin_unlock_bh(&nf_conntrack_lock);

if (exp) {
if (exp->expectfn)
- exp->expectfn(conntrack, exp);
+ exp->expectfn(ct, exp);
nf_ct_expect_put(exp);
}

- return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
+ return &ct->tuplehash[IP_CT_DIR_ORIGINAL];
}

/* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index 22c5dcb..5545891 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -41,19 +41,19 @@ static int generic_print_tuple(struct seq_file *s,
}

/* Returns verdict for packet, or -1 for invalid. */
-static int packet(struct nf_conn *conntrack,
+static int packet(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff,
enum ip_conntrack_info ctinfo,
int pf,
unsigned int hooknum)
{
- nf_ct_refresh_acct(conntrack, ctinfo, skb, nf_ct_generic_timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_generic_timeout);
return NF_ACCEPT;
}

/* Called when a new connection for this protocol found. */
-static int new(struct nf_conn *conntrack, const struct sk_buff *skb,
+static int new(struct nf_conn *ct, const struct sk_buff *skb,
unsigned int dataoff)
{
return 1;
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 7017b16..f9a0837 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -25,7 +25,7 @@
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_ecache.h>

-/* Protects conntrack->proto.sctp */
+/* Protects ct->proto.sctp */
static DEFINE_RWLOCK(sctp_lock);

/* FIXME: Examine ipfilter's timeouts and conntrack transitions more
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 8e22075..9807af6 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -26,7 +26,7 @@
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_log.h>

-/* Protects conntrack->proto.tcp */
+/* Protects ct->proto.tcp */
static DEFINE_RWLOCK(tcp_lock);

/* "Be conservative in what you do,
@@ -292,13 +292,12 @@ static int tcp_print_tuple(struct seq_file *s,
}

/* Print out the private part of the conntrack. */
-static int tcp_print_conntrack(struct seq_file *s,
- const struct nf_conn *conntrack)
+static int tcp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
{
enum tcp_conntrack state;

read_lock_bh(&tcp_lock);
- state = conntrack->proto.tcp.state;
+ state = ct->proto.tcp.state;
read_unlock_bh(&tcp_lock);

return seq_printf(s, "%s ", tcp_conntrack_names[state]);
@@ -689,12 +688,12 @@ static int tcp_in_window(struct nf_conn *ct,
/* Caller must linearize skb at tcp header. */
void nf_conntrack_tcp_update(struct sk_buff *skb,
unsigned int dataoff,
- struct nf_conn *conntrack,
+ struct nf_conn *ct,
int dir)
{
struct tcphdr *tcph = (void *)skb->data + dataoff;
- struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[dir];
- struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[!dir];
+ struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
+ struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
__u32 end;

end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
@@ -703,9 +702,9 @@ void nf_conntrack_tcp_update(struct sk_buff *skb,
/*
* We have to worry for the ack in the reply packet only...
*/
- if (after(end, conntrack->proto.tcp.seen[dir].td_end))
- conntrack->proto.tcp.seen[dir].td_end = end;
- conntrack->proto.tcp.last_end = end;
+ if (after(end, ct->proto.tcp.seen[dir].td_end))
+ ct->proto.tcp.seen[dir].td_end = end;
+ ct->proto.tcp.last_end = end;
write_unlock_bh(&tcp_lock);
pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
"receiver end=%u maxend=%u maxwin=%u scale=%i\n",
@@ -794,7 +793,7 @@ static int tcp_error(struct sk_buff *skb,
}

/* Returns verdict for packet, or -1 for invalid. */
-static int tcp_packet(struct nf_conn *conntrack,
+static int tcp_packet(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff,
enum ip_conntrack_info ctinfo,
@@ -812,26 +811,24 @@ static int tcp_packet(struct nf_conn *conntrack,
BUG_ON(th == NULL);

write_lock_bh(&tcp_lock);
- old_state = conntrack->proto.tcp.state;
+ old_state = ct->proto.tcp.state;
dir = CTINFO2DIR(ctinfo);
index = get_conntrack_index(th);
new_state = tcp_conntracks[dir][index][old_state];
- tuple = &conntrack->tuplehash[dir].tuple;
+ tuple = &ct->tuplehash[dir].tuple;

switch (new_state) {
case TCP_CONNTRACK_SYN_SENT:
if (old_state < TCP_CONNTRACK_TIME_WAIT)
break;
- if ((conntrack->proto.tcp.seen[!dir].flags &
- IP_CT_TCP_FLAG_CLOSE_INIT)
- || (conntrack->proto.tcp.last_dir == dir
- && conntrack->proto.tcp.last_index == TCP_RST_SET)) {
+ if ((ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_CLOSE_INIT)
+ || (ct->proto.tcp.last_dir == dir
+ && ct->proto.tcp.last_index == TCP_RST_SET)) {
/* Attempt to reopen a closed/aborted connection.
* Delete this connection and look up again. */
write_unlock_bh(&tcp_lock);
- if (del_timer(&conntrack->timeout))
- conntrack->timeout.function((unsigned long)
- conntrack);
+ if (del_timer(&ct->timeout))
+ ct->timeout.function((unsigned long)ct);
return -NF_REPEAT;
}
/* Fall through */
@@ -843,10 +840,9 @@ static int tcp_packet(struct nf_conn *conntrack,
* c) ACK in reply direction after initial SYN in original.
*/
if (index == TCP_SYNACK_SET
- && conntrack->proto.tcp.last_index == TCP_SYN_SET
- && conntrack->proto.tcp.last_dir != dir
- && ntohl(th->ack_seq) ==
- conntrack->proto.tcp.last_end) {
+ && ct->proto.tcp.last_index == TCP_SYN_SET
+ && ct->proto.tcp.last_dir != dir
+ && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
/* This SYN/ACK acknowledges a SYN that we earlier
* ignored as invalid. This means that the client and
* the server are both in sync, while the firewall is
@@ -858,15 +854,14 @@ static int tcp_packet(struct nf_conn *conntrack,
if (LOG_INVALID(IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: killing out of sync session ");
- if (del_timer(&conntrack->timeout))
- conntrack->timeout.function((unsigned long)
- conntrack);
+ if (del_timer(&ct->timeout))
+ ct->timeout.function((unsigned long)ct);
return -NF_DROP;
}
- conntrack->proto.tcp.last_index = index;
- conntrack->proto.tcp.last_dir = dir;
- conntrack->proto.tcp.last_seq = ntohl(th->seq);
- conntrack->proto.tcp.last_end =
+ ct->proto.tcp.last_index = index;
+ ct->proto.tcp.last_dir = dir;
+ ct->proto.tcp.last_seq = ntohl(th->seq);
+ ct->proto.tcp.last_end =
segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);

write_unlock_bh(&tcp_lock);
@@ -885,11 +880,11 @@ static int tcp_packet(struct nf_conn *conntrack,
return -NF_ACCEPT;
case TCP_CONNTRACK_CLOSE:
if (index == TCP_RST_SET
- && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
- && conntrack->proto.tcp.last_index == TCP_SYN_SET)
- || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
- && conntrack->proto.tcp.last_index == TCP_ACK_SET))
- && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
+ && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
+ && ct->proto.tcp.last_index == TCP_SYN_SET)
+ || (!test_bit(IPS_ASSURED_BIT, &ct->status)
+ && ct->proto.tcp.last_index == TCP_ACK_SET))
+ && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
/* RST sent to invalid SYN or ACK we had let through
* at a) and c) above:
*
@@ -907,15 +902,15 @@ static int tcp_packet(struct nf_conn *conntrack,
break;
}

- if (!tcp_in_window(conntrack, &conntrack->proto.tcp, dir, index,
+ if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
skb, dataoff, th, pf)) {
write_unlock_bh(&tcp_lock);
return -NF_ACCEPT;
}
in_window:
/* From now on we have got in-window packets */
- conntrack->proto.tcp.last_index = index;
- conntrack->proto.tcp.last_dir = dir;
+ ct->proto.tcp.last_index = index;
+ ct->proto.tcp.last_dir = dir;

pr_debug("tcp_conntracks: ");
NF_CT_DUMP_TUPLE(tuple);
@@ -924,12 +919,12 @@ static int tcp_packet(struct nf_conn *conntrack,
(th->fin ? 1 : 0), (th->rst ? 1 : 0),
old_state, new_state);

- conntrack->proto.tcp.state = new_state;
+ ct->proto.tcp.state = new_state;
if (old_state != new_state
&& (new_state == TCP_CONNTRACK_FIN_WAIT
|| new_state == TCP_CONNTRACK_CLOSE))
- conntrack->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
- timeout = conntrack->proto.tcp.retrans >= nf_ct_tcp_max_retrans
+ ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
+ timeout = ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans
&& tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
? nf_ct_tcp_timeout_max_retrans : tcp_timeouts[new_state];
write_unlock_bh(&tcp_lock);
@@ -938,41 +933,40 @@ static int tcp_packet(struct nf_conn *conntrack,
if (new_state != old_state)
nf_conntrack_event_cache(IPCT_PROTOINFO, skb);

- if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
+ if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
/* If only reply is a RST, we can consider ourselves not to
have an established connection: this is a fairly common
problem case, so we can delete the conntrack
immediately. --RR */
if (th->rst) {
- if (del_timer(&conntrack->timeout))
- conntrack->timeout.function((unsigned long)
- conntrack);
+ if (del_timer(&ct->timeout))
+ ct->timeout.function((unsigned long)ct);
return NF_ACCEPT;
}
- } else if (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
+ } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
&& (old_state == TCP_CONNTRACK_SYN_RECV
|| old_state == TCP_CONNTRACK_ESTABLISHED)
&& new_state == TCP_CONNTRACK_ESTABLISHED) {
/* Set ASSURED if we see see valid ack in ESTABLISHED
after SYN_RECV or a valid answer for a picked up
connection. */
- set_bit(IPS_ASSURED_BIT, &conntrack->status);
+ set_bit(IPS_ASSURED_BIT, &ct->status);
nf_conntrack_event_cache(IPCT_STATUS, skb);
}
- nf_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, timeout);

return NF_ACCEPT;
}

/* Called when a new connection for this protocol found. */
-static int tcp_new(struct nf_conn *conntrack,
+static int tcp_new(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff)
{
enum tcp_conntrack new_state;
struct tcphdr *th, _tcph;
- struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[0];
- struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[1];
+ struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
+ struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];

th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
BUG_ON(th == NULL);
@@ -990,17 +984,17 @@ static int tcp_new(struct nf_conn *conntrack,

if (new_state == TCP_CONNTRACK_SYN_SENT) {
/* SYN packet */
- conntrack->proto.tcp.seen[0].td_end =
+ ct->proto.tcp.seen[0].td_end =
segment_seq_plus_len(ntohl(th->seq), skb->len,
dataoff, th);
- conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
- if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
- conntrack->proto.tcp.seen[0].td_maxwin = 1;
- conntrack->proto.tcp.seen[0].td_maxend =
- conntrack->proto.tcp.seen[0].td_end;
-
- tcp_options(skb, dataoff, th, &conntrack->proto.tcp.seen[0]);
- conntrack->proto.tcp.seen[1].flags = 0;
+ ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
+ if (ct->proto.tcp.seen[0].td_maxwin == 0)
+ ct->proto.tcp.seen[0].td_maxwin = 1;
+ ct->proto.tcp.seen[0].td_maxend =
+ ct->proto.tcp.seen[0].td_end;
+
+ tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
+ ct->proto.tcp.seen[1].flags = 0;
} else if (nf_ct_tcp_loose == 0) {
/* Don't try to pick up connections. */
return 0;
@@ -1010,32 +1004,32 @@ static int tcp_new(struct nf_conn *conntrack,
* its history is lost for us.
* Let's try to use the data from the packet.
*/
- conntrack->proto.tcp.seen[0].td_end =
+ ct->proto.tcp.seen[0].td_end =
segment_seq_plus_len(ntohl(th->seq), skb->len,
dataoff, th);
- conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
- if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
- conntrack->proto.tcp.seen[0].td_maxwin = 1;
- conntrack->proto.tcp.seen[0].td_maxend =
- conntrack->proto.tcp.seen[0].td_end +
- conntrack->proto.tcp.seen[0].td_maxwin;
- conntrack->proto.tcp.seen[0].td_scale = 0;
+ ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
+ if (ct->proto.tcp.seen[0].td_maxwin == 0)
+ ct->proto.tcp.seen[0].td_maxwin = 1;
+ ct->proto.tcp.seen[0].td_maxend =
+ ct->proto.tcp.seen[0].td_end +
+ ct->proto.tcp.seen[0].td_maxwin;
+ ct->proto.tcp.seen[0].td_scale = 0;

/* We assume SACK and liberal window checking to handle
* window scaling */
- conntrack->proto.tcp.seen[0].flags =
- conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
- IP_CT_TCP_FLAG_BE_LIBERAL;
+ ct->proto.tcp.seen[0].flags =
+ ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
+ IP_CT_TCP_FLAG_BE_LIBERAL;
}

- conntrack->proto.tcp.seen[1].td_end = 0;
- conntrack->proto.tcp.seen[1].td_maxend = 0;
- conntrack->proto.tcp.seen[1].td_maxwin = 1;
- conntrack->proto.tcp.seen[1].td_scale = 0;
+ ct->proto.tcp.seen[1].td_end = 0;
+ ct->proto.tcp.seen[1].td_maxend = 0;
+ ct->proto.tcp.seen[1].td_maxwin = 1;
+ ct->proto.tcp.seen[1].td_scale = 0;

/* tcp_packet will set them */
- conntrack->proto.tcp.state = TCP_CONNTRACK_NONE;
- conntrack->proto.tcp.last_index = TCP_NONE_SET;
+ ct->proto.tcp.state = TCP_CONNTRACK_NONE;
+ ct->proto.tcp.last_index = TCP_NONE_SET;

pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
"receiver end=%u maxend=%u maxwin=%u scale=%i\n",
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 3848754..4c1e67e 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -61,7 +61,7 @@ static int udp_print_tuple(struct seq_file *s,
}

/* Returns verdict for packet, and may modify conntracktype */
-static int udp_packet(struct nf_conn *conntrack,
+static int udp_packet(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff,
enum ip_conntrack_info ctinfo,
@@ -70,20 +70,19 @@ static int udp_packet(struct nf_conn *conntrack,
{
/* If we've seen traffic both ways, this is some kind of UDP
stream. Extend timeout. */
- if (test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
- nf_ct_refresh_acct(conntrack, ctinfo, skb,
- nf_ct_udp_timeout_stream);
+ if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
+ nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream);
/* Also, more likely to be important, and not a probe */
- if (!test_and_set_bit(IPS_ASSURED_BIT, &conntrack->status))
+ if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
nf_conntrack_event_cache(IPCT_STATUS, skb);
} else
- nf_ct_refresh_acct(conntrack, ctinfo, skb, nf_ct_udp_timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout);

return NF_ACCEPT;
}

/* Called when a new connection for this protocol found. */
-static int udp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
+static int udp_new(struct nf_conn *ct, const struct sk_buff *skb,
unsigned int dataoff)
{
return 1;
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index 070056d..d9e1532 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -60,7 +60,7 @@ static int udplite_print_tuple(struct seq_file *s,
}

/* Returns verdict for packet, and may modify conntracktype */
-static int udplite_packet(struct nf_conn *conntrack,
+static int udplite_packet(struct nf_conn *ct,
const struct sk_buff *skb,
unsigned int dataoff,
enum ip_conntrack_info ctinfo,
@@ -69,21 +69,20 @@ static int udplite_packet(struct nf_conn *conntrack,
{
/* If we've seen traffic both ways, this is some kind of UDP
stream. Extend timeout. */
- if (test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
- nf_ct_refresh_acct(conntrack, ctinfo, skb,
+ if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
+ nf_ct_refresh_acct(ct, ctinfo, skb,
nf_ct_udplite_timeout_stream);
/* Also, more likely to be important, and not a probe */
- if (!test_and_set_bit(IPS_ASSURED_BIT, &conntrack->status))
+ if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
nf_conntrack_event_cache(IPCT_STATUS, skb);
} else
- nf_ct_refresh_acct(conntrack, ctinfo, skb,
- nf_ct_udplite_timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);

return NF_ACCEPT;
}

/* Called when a new connection for this protocol found. */
-static int udplite_new(struct nf_conn *conntrack, const struct sk_buff *skb,
+static int udplite_new(struct nf_conn *ct, const struct sk_buff *skb,
unsigned int dataoff)
{
return 1;
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 98f0cd3..278b35e 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -117,71 +117,71 @@ static void ct_seq_stop(struct seq_file *s, void *v)
static int ct_seq_show(struct seq_file *s, void *v)
{
const struct nf_conntrack_tuple_hash *hash = v;
- const struct nf_conn *conntrack = nf_ct_tuplehash_to_ctrack(hash);
+ const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
struct nf_conntrack_l3proto *l3proto;
struct nf_conntrack_l4proto *l4proto;

- NF_CT_ASSERT(conntrack);
+ NF_CT_ASSERT(ct);

/* we only want to print DIR_ORIGINAL */
if (NF_CT_DIRECTION(hash))
return 0;

- l3proto = __nf_ct_l3proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
+ l3proto = __nf_ct_l3proto_find(ct->tuplehash[IP_CT_DIR_ORIGINAL]
.tuple.src.l3num);

NF_CT_ASSERT(l3proto);
- l4proto = __nf_ct_l4proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
+ l4proto = __nf_ct_l4proto_find(ct->tuplehash[IP_CT_DIR_ORIGINAL]
.tuple.src.l3num,
- conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
+ ct->tuplehash[IP_CT_DIR_ORIGINAL]
.tuple.dst.protonum);
NF_CT_ASSERT(l4proto);

if (seq_printf(s, "%-8s %u %-8s %u %ld ",
l3proto->name,
- conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num,
+ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num,
l4proto->name,
- conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum,
- timer_pending(&conntrack->timeout)
- ? (long)(conntrack->timeout.expires - jiffies)/HZ : 0) != 0)
+ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum,
+ timer_pending(&ct->timeout)
+ ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0)
return -ENOSPC;

- if (l4proto->print_conntrack && l4proto->print_conntrack(s, conntrack))
+ if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct))
return -ENOSPC;

- if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+ if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
l3proto, l4proto))
return -ENOSPC;

- if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_ORIGINAL]))
+ if (seq_print_counters(s, &ct->counters[IP_CT_DIR_ORIGINAL]))
return -ENOSPC;

- if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
+ if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
if (seq_printf(s, "[UNREPLIED] "))
return -ENOSPC;

- if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
+ if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
l3proto, l4proto))
return -ENOSPC;

- if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_REPLY]))
+ if (seq_print_counters(s, &ct->counters[IP_CT_DIR_REPLY]))
return -ENOSPC;

- if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
+ if (test_bit(IPS_ASSURED_BIT, &ct->status))
if (seq_printf(s, "[ASSURED] "))
return -ENOSPC;

#if defined(CONFIG_NF_CONNTRACK_MARK)
- if (seq_printf(s, "mark=%u ", conntrack->mark))
+ if (seq_printf(s, "mark=%u ", ct->mark))
return -ENOSPC;
#endif

#ifdef CONFIG_NF_CONNTRACK_SECMARK
- if (seq_printf(s, "secmark=%u ", conntrack->secmark))
+ if (seq_printf(s, "secmark=%u ", ct->secmark))
return -ENOSPC;
#endif

- if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
+ if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
return -ENOSPC;

return 0;
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:48 UTC
Permalink
[NETFILTER]: nf_conntrack: use RCU for conntrack helpers

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 4e4ce3f8b47acaf70dc99ce8c50fe64e4f1a098f
tree f39893b7e3ff63a4aa51dd5f15f3887a3831bf61
parent 717ef6587331d45fecc0d1fa2a9f473f9d9ae1c9
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:10 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:06 +0100

include/net/netfilter/nf_conntrack_helper.h | 4 --
net/netfilter/nf_conntrack_helper.c | 58 ++++++++-------------------
net/netfilter/nf_conntrack_netlink.c | 9 ++--
3 files changed, 21 insertions(+), 50 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 2f3af00..4ca125e 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -43,12 +43,8 @@ extern struct nf_conntrack_helper *
__nf_ct_helper_find(const struct nf_conntrack_tuple *tuple);

extern struct nf_conntrack_helper *
-nf_ct_helper_find_get( const struct nf_conntrack_tuple *tuple);
-
-extern struct nf_conntrack_helper *
__nf_conntrack_helper_find_byname(const char *name);

-extern void nf_ct_helper_put(struct nf_conntrack_helper *helper);
extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);
extern void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 96aa637..42f781f 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -28,6 +28,7 @@
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_extend.h>

+static DEFINE_MUTEX(nf_ct_helper_mutex);
static struct hlist_head *nf_ct_helper_hash __read_mostly;
static unsigned int nf_ct_helper_hsize __read_mostly;
static unsigned int nf_ct_helper_count __read_mostly;
@@ -54,42 +55,13 @@ __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
return NULL;

h = helper_hash(tuple);
- hlist_for_each_entry(helper, n, &nf_ct_helper_hash[h], hnode) {
+ hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) {
if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask))
return helper;
}
return NULL;
}
-
-struct nf_conntrack_helper *
-nf_ct_helper_find_get(const struct nf_conntrack_tuple *tuple)
-{
- struct nf_conntrack_helper *helper;
-
- /* need nf_conntrack_lock to assure that helper exists until
- * try_module_get() is called */
- read_lock_bh(&nf_conntrack_lock);
-
- helper = __nf_ct_helper_find(tuple);
- if (helper) {
- /* need to increase module usage count to assure helper will
- * not go away while the caller is e.g. busy putting a
- * conntrack in the hash that uses the helper */
- if (!try_module_get(helper->me))
- helper = NULL;
- }
-
- read_unlock_bh(&nf_conntrack_lock);
-
- return helper;
-}
-EXPORT_SYMBOL_GPL(nf_ct_helper_find_get);
-
-void nf_ct_helper_put(struct nf_conntrack_helper *helper)
-{
- module_put(helper->me);
-}
-EXPORT_SYMBOL_GPL(nf_ct_helper_put);
+EXPORT_SYMBOL_GPL(__nf_ct_helper_find);

struct nf_conntrack_helper *
__nf_conntrack_helper_find_byname(const char *name)
@@ -99,7 +71,7 @@ __nf_conntrack_helper_find_byname(const char *name)
unsigned int i;

for (i = 0; i < nf_ct_helper_hsize; i++) {
- hlist_for_each_entry(h, n, &nf_ct_helper_hash[i], hnode) {
+ hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) {
if (!strcmp(h->name, name))
return h;
}
@@ -140,10 +112,10 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)

BUG_ON(me->timeout == 0);

- write_lock_bh(&nf_conntrack_lock);
- hlist_add_head(&me->hnode, &nf_ct_helper_hash[h]);
+ mutex_lock(&nf_ct_helper_mutex);
+ hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]);
nf_ct_helper_count++;
- write_unlock_bh(&nf_conntrack_lock);
+ mutex_unlock(&nf_ct_helper_mutex);

return 0;
}
@@ -156,10 +128,17 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
struct hlist_node *n, *next;
unsigned int i;

- /* Need write lock here, to delete helper. */
- write_lock_bh(&nf_conntrack_lock);
- hlist_del(&me->hnode);
+ mutex_lock(&nf_ct_helper_mutex);
+ hlist_del_rcu(&me->hnode);
nf_ct_helper_count--;
+ mutex_unlock(&nf_ct_helper_mutex);
+
+ /* Make sure every nothing is still using the helper unless its a
+ * connection in the hash.
+ */
+ synchronize_rcu();
+
+ write_lock_bh(&nf_conntrack_lock);

/* Get rid of expectations */
for (i = 0; i < nf_ct_expect_hsize; i++) {
@@ -182,9 +161,6 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
unhelp(h, me);
}
write_unlock_bh(&nf_conntrack_lock);
-
- /* Someone could be still looking at the helper in a bh. */
- synchronize_net();
}
EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bdae292..b6c0935 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1167,11 +1167,12 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
#endif

- helper = nf_ct_helper_find_get(rtuple);
+ rcu_read_lock();
+ helper = __nf_ct_helper_find(rtuple);
if (helper) {
help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
if (help == NULL) {
- nf_ct_helper_put(helper);
+ rcu_read_unlock();
err = -ENOMEM;
goto err;
}
@@ -1187,9 +1188,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],

add_timer(&ct->timeout);
nf_conntrack_hash_insert(ct);
-
- if (helper)
- nf_ct_helper_put(helper);
+ rcu_read_unlock();

return 0;

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:52 UTC
Permalink
[NETFILTER]: nf_conntrack_expect: use RCU for expectation hash

Use RCU for expectation hash. This doesn't buy much for conntrack runtime
performance, but allows to reduce the use of nf_conntrack_lock for /proc
and nf_netlink_conntrack.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 504ca298fd3846f894b3979666df5bf5021707ff
tree 2b94fd833ebb414fd8305ada3295a3fd5fb5e516
parent 23cf79fc3f39291ad9e98a00584d1f0c0b8c5d25
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:11 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:06 +0100

include/net/netfilter/nf_conntrack_expect.h | 2 +
.../netfilter/nf_conntrack_l3proto_ipv4_compat.c | 14 ++++---
net/netfilter/nf_conntrack_expect.c | 43 +++++++++++++-------
net/netfilter/nf_conntrack_netlink.c | 7 ++-
4 files changed, 41 insertions(+), 25 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 6c3fd25..cb608a1 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -49,6 +49,8 @@ struct nf_conntrack_expect
/* Direction relative to the master connection. */
enum ip_conntrack_dir dir;
#endif
+
+ struct rcu_head rcu;
};

#define NF_CT_EXPECT_PERMANENT 0x1
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 543c02b..2fdcd92 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -191,10 +191,12 @@ struct ct_expect_iter_state {
static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
{
struct ct_expect_iter_state *st = seq->private;
+ struct hlist_node *n;

for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
- if (!hlist_empty(&nf_ct_expect_hash[st->bucket]))
- return nf_ct_expect_hash[st->bucket].first;
+ n = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+ if (n)
+ return n;
}
return NULL;
}
@@ -204,11 +206,11 @@ static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
{
struct ct_expect_iter_state *st = seq->private;

- head = head->next;
+ head = rcu_dereference(head->next);
while (head == NULL) {
if (++st->bucket >= nf_ct_expect_hsize)
return NULL;
- head = nf_ct_expect_hash[st->bucket].first;
+ head = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
}
return head;
}
@@ -225,7 +227,7 @@ static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)

static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
{
- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
return ct_expect_get_idx(seq, *pos);
}

@@ -237,7 +239,7 @@ static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)

static void exp_seq_stop(struct seq_file *seq, void *v)
{
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();
}

static int exp_seq_show(struct seq_file *s, void *v)
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e405079..a5c8ef0 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -50,7 +50,7 @@ void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
NF_CT_ASSERT(master_help);
NF_CT_ASSERT(!timer_pending(&exp->timeout));

- hlist_del(&exp->hnode);
+ hlist_del_rcu(&exp->hnode);
nf_ct_expect_count--;

hlist_del(&exp->lnode);
@@ -97,7 +97,7 @@ __nf_ct_expect_find(const struct nf_conntrack_tuple *tuple)
return NULL;

h = nf_ct_expect_dst_hash(tuple);
- hlist_for_each_entry(i, n, &nf_ct_expect_hash[h], hnode) {
+ hlist_for_each_entry_rcu(i, n, &nf_ct_expect_hash[h], hnode) {
if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
return i;
}
@@ -111,11 +111,11 @@ nf_ct_expect_find_get(const struct nf_conntrack_tuple *tuple)
{
struct nf_conntrack_expect *i;

- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
i = __nf_ct_expect_find(tuple);
- if (i)
- atomic_inc(&i->use);
- read_unlock_bh(&nf_conntrack_lock);
+ if (i && !atomic_inc_not_zero(&i->use))
+ i = NULL;
+ rcu_read_unlock();

return i;
}
@@ -223,6 +223,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)

new->master = me;
atomic_set(&new->use, 1);
+ INIT_RCU_HEAD(&new->rcu);
return new;
}
EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);
@@ -278,10 +279,18 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
}
EXPORT_SYMBOL_GPL(nf_ct_expect_init);

+static void nf_ct_expect_free_rcu(struct rcu_head *head)
+{
+ struct nf_conntrack_expect *exp;
+
+ exp = container_of(head, struct nf_conntrack_expect, rcu);
+ kmem_cache_free(nf_ct_expect_cachep, exp);
+}
+
void nf_ct_expect_put(struct nf_conntrack_expect *exp)
{
if (atomic_dec_and_test(&exp->use))
- kmem_cache_free(nf_ct_expect_cachep, exp);
+ call_rcu(&exp->rcu, nf_ct_expect_free_rcu);
}
EXPORT_SYMBOL_GPL(nf_ct_expect_put);

@@ -295,7 +304,7 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
hlist_add_head(&exp->lnode, &master_help->expectations);
master_help->expecting++;

- hlist_add_head(&exp->hnode, &nf_ct_expect_hash[h]);
+ hlist_add_head_rcu(&exp->hnode, &nf_ct_expect_hash[h]);
nf_ct_expect_count++;

setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
@@ -394,10 +403,12 @@ struct ct_expect_iter_state {
static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
{
struct ct_expect_iter_state *st = seq->private;
+ struct hlist_node *n;

for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
- if (!hlist_empty(&nf_ct_expect_hash[st->bucket]))
- return nf_ct_expect_hash[st->bucket].first;
+ n = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+ if (n)
+ return n;
}
return NULL;
}
@@ -407,11 +418,11 @@ static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
{
struct ct_expect_iter_state *st = seq->private;

- head = head->next;
+ head = rcu_dereference(head->next);
while (head == NULL) {
if (++st->bucket >= nf_ct_expect_hsize)
return NULL;
- head = nf_ct_expect_hash[st->bucket].first;
+ head = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
}
return head;
}
@@ -427,9 +438,9 @@ static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
}

static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
- __acquires(nf_conntrack_lock)
+ __acquires(RCU)
{
- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
return ct_expect_get_idx(seq, *pos);
}

@@ -440,9 +451,9 @@ static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
}

static void exp_seq_stop(struct seq_file *seq, void *v)
- __releases(nf_conntrack_lock)
+ __releases(RCU)
{
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();
}

static int exp_seq_show(struct seq_file *s, void *v)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b6c0935..557f471 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1471,7 +1471,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
struct hlist_node *n;
u_int8_t l3proto = nfmsg->nfgen_family;

- read_lock_bh(&nf_conntrack_lock);
+ rcu_read_lock();
last = (struct nf_conntrack_expect *)cb->args[1];
for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
restart:
@@ -1488,7 +1488,8 @@ restart:
cb->nlh->nlmsg_seq,
IPCTNL_MSG_EXP_NEW,
1, exp) < 0) {
- atomic_inc(&exp->use);
+ if (!atomic_inc_not_zero(&exp->use))
+ continue;
cb->args[1] = (unsigned long)exp;
goto out;
}
@@ -1499,7 +1500,7 @@ restart:
}
}
out:
- read_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();
if (last)
nf_ct_expect_put(last);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Jan Engelhardt
2008-01-30 20:20:36 UTC
Permalink
Post by Patrick McHardy
Hi Dave,
following is the final netfilter update for 2.6.25.
I miss at least 7 posted patches from me here. Lost in the backlog?
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:22:17 UTC
Permalink
Post by Jan Engelhardt
Post by Patrick McHardy
Hi Dave,
following is the final netfilter update for 2.6.25.
I miss at least 7 posted patches from me here. Lost in the backlog?
OK, lets make that "the last big netfilter update for 2.6.25" :)
I'll pick up your patches once these are in net-2.6.git.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Jan Engelhardt
2008-01-30 20:26:05 UTC
Permalink
Post by Patrick McHardy
Post by Jan Engelhardt
Post by Patrick McHardy
Hi Dave,
following is the final netfilter update for 2.6.25.
I miss at least 7 posted patches from me here. Lost in the backlog?
OK, lets make that "the last big netfilter update for 2.6.25" :)
I'll pick up your patches once these are in net-2.6.git.
K, I'll rediff now.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 20:17:50 UTC
Permalink
[NETFILTER]: nf_conntrack_core: avoid taking nf_conntrack_lock in nf_conntrack_alter_reply

The conntrack is unconfirmed, so we have an exclusive reference, which means
that the write_lock is definitely unneeded. A read_lock used to be needed
for the helper lookup, but since we're using RCU for helpers now rcu_read_lock
is enough.

Signed-off-by: Patrick McHardy <***@trash.net>

---
commit 23cf79fc3f39291ad9e98a00584d1f0c0b8c5d25
tree 6b4f9cb8b2e0cb7dff253b256ee392e018add46a
parent 4e4ce3f8b47acaf70dc99ce8c50fe64e4f1a098f
author Patrick McHardy <***@trash.net> Tue, 29 Jan 2008 16:22:11 +0100
committer Patrick McHardy <***@trash.net> Wed, 30 Jan 2008 21:03:06 +0100

net/netfilter/nf_conntrack_core.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index aa042c4..1025607 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -729,7 +729,6 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
struct nf_conn_help *help = nfct_help(ct);
struct nf_conntrack_helper *helper;

- write_lock_bh(&nf_conntrack_lock);
/* Should be unconfirmed, so not in hash table yet */
NF_CT_ASSERT(!nf_ct_is_confirmed(ct));

@@ -738,8 +737,9 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,

ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
if (ct->master || (help && help->expecting != 0))
- goto out;
+ return;

+ rcu_read_lock();
helper = __nf_ct_helper_find(newreply);
if (helper == NULL) {
if (help)
@@ -757,7 +757,7 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,

rcu_assign_pointer(help->helper, helper);
out:
- write_unlock_bh(&nf_conntrack_lock);
+ rcu_read_unlock();
}
EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Jan Engelhardt
2008-01-30 20:55:25 UTC
Permalink
following is the final netfilter update for 2.6.25. containing the iptables
netns work by Alexey Dobriyan, lots of sparse warning fixes by Stephen, Eric
and myself, const annotations throughout netfilter by Jan Engelhardt,
a set of patches to finally use RCU for the conntrack and NAT hashes, some
conntrack optimizations and some minor misc cleanups.
What do people use to apply this batch? I exported them into an MBOX
and tried git-am, but that always uses the mail's From: and Subject:
rather than the --raw patch after the three-dashes.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 21:27:31 UTC
Permalink
Post by Jan Engelhardt
following is the final netfilter update for 2.6.25. containing the iptables
netns work by Alexey Dobriyan, lots of sparse warning fixes by Stephen, Eric
and myself, const annotations throughout netfilter by Jan Engelhardt,
a set of patches to finally use RCU for the conntrack and NAT hashes, some
conntrack optimizations and some minor misc cleanups.
What do people use to apply this batch? I exported them into an MBOX
rather than the --raw patch after the three-dashes.
I'll push my tree to netfilter.org, things are going pretty slow,
but it should appear at http://people.netfilter.org/~kaber/nf-2.6.git
within the next 30 minutes or so.


-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Jan Engelhardt
2008-01-30 21:30:02 UTC
Permalink
Post by Patrick McHardy
Post by Jan Engelhardt
following is the final netfilter update for 2.6.25. containing the iptables
netns work by Alexey Dobriyan, lots of sparse warning fixes by Stephen, Eric
and myself, const annotations throughout netfilter by Jan Engelhardt,
a set of patches to finally use RCU for the conntrack and NAT hashes, some
conntrack optimizations and some minor misc cleanups.
What do people use to apply this batch? I exported them into an MBOX
rather than the --raw patch after the three-dashes.
I'll push my tree to netfilter.org, things are going pretty slow,
but it should appear at http://people.netfilter.org/~kaber/nf-2.6.git
within the next 30 minutes or so.
Do you have git://?

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 21:31:17 UTC
Permalink
[dave taken out of CC since I don't think he cares]
Post by Jan Engelhardt
Post by Patrick McHardy
Post by Jan Engelhardt
following is the final netfilter update for 2.6.25. containing the iptables
netns work by Alexey Dobriyan, lots of sparse warning fixes by Stephen, Eric
and myself, const annotations throughout netfilter by Jan Engelhardt,
a set of patches to finally use RCU for the conntrack and NAT hashes, some
conntrack optimizations and some minor misc cleanups.
What do people use to apply this batch? I exported them into an MBOX
rather than the --raw patch after the three-dashes.
I'll push my tree to netfilter.org, things are going pretty slow,
but it should appear at http://people.netfilter.org/~kaber/nf-2.6.git
within the next 30 minutes or so.
Do you have git://?
No.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Patrick McHardy
2008-01-30 21:34:38 UTC
Permalink
Post by Patrick McHardy
Post by Jan Engelhardt
following is the final netfilter update for 2.6.25. containing the iptables
netns work by Alexey Dobriyan, lots of sparse warning fixes by Stephen, Eric
and myself, const annotations throughout netfilter by Jan Engelhardt,
a set of patches to finally use RCU for the conntrack and NAT hashes, some
conntrack optimizations and some minor misc cleanups.
What do people use to apply this batch? I exported them into an MBOX
rather than the --raw patch after the three-dashes.
I'll push my tree to netfilter.org, things are going pretty slow,
but it should appear at http://people.netfilter.org/~kaber/nf-2.6.git
within the next 30 minutes or so.
Its there now.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
David Miller
2008-01-31 00:54:03 UTC
Permalink
From: Jan Engelhardt <***@computergmbh.de>
Date: Wed, 30 Jan 2008 21:55:25 +0100 (CET)
Post by Jan Engelhardt
What do people use to apply this batch? I exported them into an MBOX
rather than the --raw patch after the three-dashes.
I do it by hand in emacs, one email at a time :-)
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
David Miller
2008-01-31 12:56:00 UTC
Permalink
From: Patrick McHardy <***@trash.net>
Date: Wed, 30 Jan 2008 21:16:52 +0100 (MET)
following is the final netfilter update for 2.6.25. containing the iptables
netns work by Alexey Dobriyan, lots of sparse warning fixes by Stephen, Eric
and myself, const annotations throughout netfilter by Jan Engelhardt,
a set of patches to finally use RCU for the conntrack and NAT hashes, some
conntrack optimizations and some minor misc cleanups.
All applied, thanks Patrick.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Loading...