Commit cdcb71bf authored by Al Viro's avatar Al Viro Committed by David S. Miller
Browse files

[NETFILTER]: conntrack annotations 



Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 59b8bfd8

include/linux/netfilter_ipv4/ip_conntrack.h

+1 −1
Original line number Diff line number Diff line
@@ -157,7 +157,7 @@ struct ip_conntrack_expect 
	unsigned int flags;



#ifdef CONFIG_IP_NF_NAT_NEEDED

	u_int32_t saved_ip;

	__be32 saved_ip;

	/* This is the original per-proto part, used to map the

	 * expected connection the way the recipient expects. */

	union ip_conntrack_manip_proto saved_proto;

include/linux/netfilter_ipv4/ip_conntrack_tuple.h

+8 −8
Original line number Diff line number Diff line
@@ -23,13 +23,13 @@ union ip_conntrack_manip_proto 
		__be16 port;

	} tcp;

	struct {

		u_int16_t port;

		__be16 port;

	} udp;

	struct {

		u_int16_t id;

		__be16 id;

	} icmp;

	struct {

		u_int16_t port;

		__be16 port;

	} sctp;

	struct {

		__be16 key;	/* key is 32bit, pptp only uses 16 */
@@ -39,7 +39,7 @@ union ip_conntrack_manip_proto 
/* The manipulable part of the tuple. */

struct ip_conntrack_manip

{

	u_int32_t ip;

	__be32 ip;

	union ip_conntrack_manip_proto u;

};
@@ -50,22 +50,22 @@ struct ip_conntrack_tuple 


	/* These are the parts of the tuple which are fixed. */

	struct {

		u_int32_t ip;

		__be32 ip;

		union {

			/* Add other protocols here. */

			u_int16_t all;



			struct {

				u_int16_t port;

				__be16 port;

			} tcp;

			struct {

				u_int16_t port;

				__be16 port;

			} udp;

			struct {

				u_int8_t type, code;

			} icmp;

			struct {

				u_int16_t port;

				__be16 port;

			} sctp;

			struct {

				__be16 key;	/* key is 32bit,

net/ipv4/netfilter/ip_conntrack_amanda.c

+3 −3
Original line number Diff line number Diff line
@@ -155,11 +155,11 @@ static int help(struct sk_buff **pskb, 
		exp->tuple.dst.protonum = IPPROTO_TCP;

		exp->tuple.dst.u.tcp.port = htons(port);



		exp->mask.src.ip = 0xFFFFFFFF;

		exp->mask.src.ip = htonl(0xFFFFFFFF);

		exp->mask.src.u.tcp.port = 0;

		exp->mask.dst.ip = 0xFFFFFFFF;

		exp->mask.dst.ip = htonl(0xFFFFFFFF);

		exp->mask.dst.protonum = 0xFF;

		exp->mask.dst.u.tcp.port = 0xFFFF;

		exp->mask.dst.u.tcp.port = htons(0xFFFF);



		if (ip_nat_amanda_hook)

			ret = ip_nat_amanda_hook(pskb, ctinfo, off - dataoff,

net/ipv4/netfilter/ip_conntrack_core.c

+6 −6
Original line number Diff line number Diff line
@@ -149,8 +149,8 @@ static unsigned int ip_conntrack_hash_rnd; 
static u_int32_t __hash_conntrack(const struct ip_conntrack_tuple *tuple,

			    unsigned int size, unsigned int rnd)

{

	return (jhash_3words(tuple->src.ip,

	                     (tuple->dst.ip ^ tuple->dst.protonum),

	return (jhash_3words((__force u32)tuple->src.ip,

	                     ((__force u32)tuple->dst.ip ^ tuple->dst.protonum),

	                     (tuple->src.u.all | (tuple->dst.u.all << 16)),

	                     rnd) % size);

}
@@ -1169,9 +1169,9 @@ void __ip_ct_refresh_acct(struct ip_conntrack *ct, 
int ip_ct_port_tuple_to_nfattr(struct sk_buff *skb,

			       const struct ip_conntrack_tuple *tuple)

{

	NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),

	NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(__be16),

		&tuple->src.u.tcp.port);

	NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),

	NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(__be16),

		&tuple->dst.u.tcp.port);

	return 0;
@@ -1186,9 +1186,9 @@ int ip_ct_port_nfattr_to_tuple(struct nfattr *tb[], 
		return -EINVAL;



	t->src.u.tcp.port =

		*(u_int16_t *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);

		*(__be16 *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);

	t->dst.u.tcp.port =

		*(u_int16_t *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);

		*(__be16 *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);



	return 0;

}

net/ipv4/netfilter/ip_conntrack_ftp.c

+3 −3
Original line number Diff line number Diff line
@@ -425,8 +425,8 @@ static int help(struct sk_buff **pskb, 
	exp->tuple.src.u.tcp.port = 0; /* Don't care. */

	exp->tuple.dst.protonum = IPPROTO_TCP;

	exp->mask = ((struct ip_conntrack_tuple)

		{ { 0xFFFFFFFF, { 0 } },

		  { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});

		{ { htonl(0xFFFFFFFF), { 0 } },

		  { htonl(0xFFFFFFFF), { .tcp = { htons(0xFFFF) } }, 0xFF }});



	exp->expectfn = NULL;

	exp->flags = 0;
@@ -488,7 +488,7 @@ static int __init ip_conntrack_ftp_init(void) 
	for (i = 0; i < ports_c; i++) {

		ftp[i].tuple.src.u.tcp.port = htons(ports[i]);

		ftp[i].tuple.dst.protonum = IPPROTO_TCP;

		ftp[i].mask.src.u.tcp.port = 0xFFFF;

		ftp[i].mask.src.u.tcp.port = htons(0xFFFF);

		ftp[i].mask.dst.protonum = 0xFF;

		ftp[i].max_expected = 1;

		ftp[i].timeout = 5 * 60; /* 5 minutes */