[NETFILTER]: nf_conntrack: reduce masks to a subset of tuples

[powerpc.git] / net / netfilter / nf_conntrack_netlink.c

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 0627559..2064914 100644 (file)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -689,7 +689,7 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
        if (err < 0)
                return err;
 
-       h = nf_conntrack_find_get(&tuple, NULL);
+       h = nf_conntrack_find_get(&tuple);
        if (!h)
                return -ENOENT;
 
@@ -744,7 +744,7 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
        if (err < 0)
                return err;
 
-       h = nf_conntrack_find_get(&tuple, NULL);
+       h = nf_conntrack_find_get(&tuple);
        if (!h)
                return -ENOENT;
 
@@ -1094,22 +1094,29 @@ nfattr_failure:
 static inline int
 ctnetlink_exp_dump_mask(struct sk_buff *skb,
                        const struct nf_conntrack_tuple *tuple,
-                       const struct nf_conntrack_tuple *mask)
+                       const struct nf_conntrack_tuple_mask *mask)
 {
        int ret;
        struct nf_conntrack_l3proto *l3proto;
        struct nf_conntrack_l4proto *l4proto;
-       struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
+       struct nf_conntrack_tuple m;
+       struct nfattr *nest_parms;
+
+       memset(&m, 0xFF, sizeof(m));
+       m.src.u.all = mask->src.u.all;
+       memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+
+       nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
 
        l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
-       ret = ctnetlink_dump_tuples_ip(skb, mask, l3proto);
+       ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
        nf_ct_l3proto_put(l3proto);
 
        if (unlikely(ret < 0))
                goto nfattr_failure;
 
        l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
-       ret = ctnetlink_dump_tuples_proto(skb, mask, l4proto);
+       ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
        nf_ct_l4proto_put(l4proto);
        if (unlikely(ret < 0))
                goto nfattr_failure;
@@ -1239,7 +1246,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
        u_int8_t l3proto = nfmsg->nfgen_family;
 
        read_lock_bh(&nf_conntrack_lock);
-       list_for_each_prev(i, &nf_conntrack_expect_list) {
+       list_for_each_prev(i, &nf_ct_expect_list) {
                exp = (struct nf_conntrack_expect *) i;
                if (l3proto && exp->tuple.src.l3num != l3proto)
                        continue;
@@ -1291,14 +1298,14 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
        if (err < 0)
                return err;
 
-       exp = nf_conntrack_expect_find_get(&tuple);
+       exp = nf_ct_expect_find_get(&tuple);
        if (!exp)
                return -ENOENT;
 
        if (cda[CTA_EXPECT_ID-1]) {
                __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
                if (exp->id != ntohl(id)) {
-                       nf_conntrack_expect_put(exp);
+                       nf_ct_expect_put(exp);
                        return -ENOENT;
                }
        }
@@ -1314,14 +1321,14 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
        if (err <= 0)
                goto free;
 
-       nf_conntrack_expect_put(exp);
+       nf_ct_expect_put(exp);
 
        return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
 
 free:
        kfree_skb(skb2);
 out:
-       nf_conntrack_expect_put(exp);
+       nf_ct_expect_put(exp);
        return err;
 }
 
@@ -1346,23 +1353,23 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                        return err;
 
                /* bump usage count to 2 */
-               exp = nf_conntrack_expect_find_get(&tuple);
+               exp = nf_ct_expect_find_get(&tuple);
                if (!exp)
                        return -ENOENT;
 
                if (cda[CTA_EXPECT_ID-1]) {
                        __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
                        if (exp->id != ntohl(id)) {
-                               nf_conntrack_expect_put(exp);
+                               nf_ct_expect_put(exp);
                                return -ENOENT;
                        }
                }
 
                /* after list removal, usage count == 1 */
-               nf_conntrack_unexpect_related(exp);
+               nf_ct_unexpect_related(exp);
                /* have to put what we 'get' above.
                 * after this line usage count == 0 */
-               nf_conntrack_expect_put(exp);
+               nf_ct_expect_put(exp);
        } else if (cda[CTA_EXPECT_HELP_NAME-1]) {
                char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
 
@@ -1373,24 +1380,22 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                        write_unlock_bh(&nf_conntrack_lock);
                        return -EINVAL;
                }
-               list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
-                                        list) {
+               list_for_each_entry_safe(exp, tmp, &nf_ct_expect_list, list) {
                        struct nf_conn_help *m_help = nfct_help(exp->master);
                        if (m_help->helper == h
                            && del_timer(&exp->timeout)) {
                                nf_ct_unlink_expect(exp);
-                               nf_conntrack_expect_put(exp);
+                               nf_ct_expect_put(exp);
                        }
                }
                write_unlock_bh(&nf_conntrack_lock);
        } else {
                /* This basically means we have to flush everything*/
                write_lock_bh(&nf_conntrack_lock);
-               list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
-                                        list) {
+               list_for_each_entry_safe(exp, tmp, &nf_ct_expect_list, list) {
                        if (del_timer(&exp->timeout)) {
                                nf_ct_unlink_expect(exp);
-                               nf_conntrack_expect_put(exp);
+                               nf_ct_expect_put(exp);
                        }
                }
                write_unlock_bh(&nf_conntrack_lock);
@@ -1426,7 +1431,7 @@ ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
                return err;
 
        /* Look for master conntrack of this expectation */
-       h = nf_conntrack_find_get(&master_tuple, NULL);
+       h = nf_conntrack_find_get(&master_tuple);
        if (!h)
                return -ENOENT;
        ct = nf_ct_tuplehash_to_ctrack(h);
@@ -1438,7 +1443,7 @@ ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
                goto out;
        }
 
-       exp = nf_conntrack_expect_alloc(ct);
+       exp = nf_ct_expect_alloc(ct);
        if (!exp) {
                err = -ENOMEM;
                goto out;
@@ -1449,10 +1454,11 @@ ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
        exp->master = ct;
        exp->helper = NULL;
        memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
-       memcpy(&exp->mask, &mask, sizeof(struct nf_conntrack_tuple));
+       memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
+       exp->mask.src.u.all = mask.src.u.all;
 
-       err = nf_conntrack_expect_related(exp);
-       nf_conntrack_expect_put(exp);
+       err = nf_ct_expect_related(exp);
+       nf_ct_expect_put(exp);
 
 out:
        nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
@@ -1482,7 +1488,7 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                return err;
 
        write_lock_bh(&nf_conntrack_lock);
-       exp = __nf_conntrack_expect_find(&tuple);
+       exp = __nf_ct_expect_find(&tuple);
 
        if (!exp) {
                write_unlock_bh(&nf_conntrack_lock);
@@ -1572,7 +1578,7 @@ static int __init ctnetlink_init(void)
                goto err_unreg_exp_subsys;
        }
 
-       ret = nf_conntrack_expect_register_notifier(&ctnl_notifier_exp);
+       ret = nf_ct_expect_register_notifier(&ctnl_notifier_exp);
        if (ret < 0) {
                printk("ctnetlink_init: cannot expect register notifier.\n");
                goto err_unreg_notifier;
@@ -1598,7 +1604,7 @@ static void __exit ctnetlink_exit(void)
        printk("ctnetlink: unregistering from nfnetlink.\n");
 
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
-       nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
+       nf_ct_expect_unregister_notifier(&ctnl_notifier_exp);
        nf_conntrack_unregister_notifier(&ctnl_notifier);
 #endif