Commit 0b60afba authored by Linus Torvalds's avatar Linus Torvalds

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

parents 61be6d66 7c6de058
...@@ -184,8 +184,11 @@ static inline int nf_hook_thresh(int pf, unsigned int hook, ...@@ -184,8 +184,11 @@ static inline int nf_hook_thresh(int pf, unsigned int hook,
struct sk_buff **pskb, struct sk_buff **pskb,
struct net_device *indev, struct net_device *indev,
struct net_device *outdev, struct net_device *outdev,
int (*okfn)(struct sk_buff *), int thresh) int (*okfn)(struct sk_buff *), int thresh,
int cond)
{ {
if (!cond)
return 1;
#ifndef CONFIG_NETFILTER_DEBUG #ifndef CONFIG_NETFILTER_DEBUG
if (list_empty(&nf_hooks[pf][hook])) if (list_empty(&nf_hooks[pf][hook]))
return 1; return 1;
...@@ -197,7 +200,7 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb, ...@@ -197,7 +200,7 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
struct net_device *indev, struct net_device *outdev, struct net_device *indev, struct net_device *outdev,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN); return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN, 1);
} }
/* Activate hook; either okfn or kfree_skb called, unless a hook /* Activate hook; either okfn or kfree_skb called, unless a hook
...@@ -224,7 +227,13 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb, ...@@ -224,7 +227,13 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \ #define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
({int __ret; \ ({int __ret; \
if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1)\ if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh, 1)) == 1)\
__ret = (okfn)(skb); \
__ret;})
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) \
({int __ret; \
if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
__ret = (okfn)(skb); \ __ret = (okfn)(skb); \
__ret;}) __ret;})
...@@ -295,11 +304,13 @@ extern struct proc_dir_entry *proc_net_netfilter; ...@@ -295,11 +304,13 @@ extern struct proc_dir_entry *proc_net_netfilter;
#else /* !CONFIG_NETFILTER */ #else /* !CONFIG_NETFILTER */
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb) #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
static inline int nf_hook_thresh(int pf, unsigned int hook, static inline int nf_hook_thresh(int pf, unsigned int hook,
struct sk_buff **pskb, struct sk_buff **pskb,
struct net_device *indev, struct net_device *indev,
struct net_device *outdev, struct net_device *outdev,
int (*okfn)(struct sk_buff *), int thresh) int (*okfn)(struct sk_buff *), int thresh,
int cond)
{ {
return okfn(*pskb); return okfn(*pskb);
} }
...@@ -307,7 +318,7 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb, ...@@ -307,7 +318,7 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
struct net_device *indev, struct net_device *outdev, struct net_device *indev, struct net_device *outdev,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
return okfn(*pskb); return 1;
} }
static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {} static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
struct flowi; struct flowi;
......
...@@ -41,6 +41,7 @@ struct inet_skb_parm ...@@ -41,6 +41,7 @@ struct inet_skb_parm
#define IPSKB_XFRM_TUNNEL_SIZE 2 #define IPSKB_XFRM_TUNNEL_SIZE 2
#define IPSKB_XFRM_TRANSFORMED 4 #define IPSKB_XFRM_TRANSFORMED 4
#define IPSKB_FRAG_COMPLETE 8 #define IPSKB_FRAG_COMPLETE 8
#define IPSKB_REROUTED 16
}; };
struct ipcm_cookie struct ipcm_cookie
......
...@@ -866,7 +866,6 @@ extern int xfrm_state_mtu(struct xfrm_state *x, int mtu); ...@@ -866,7 +866,6 @@ extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
extern int xfrm_init_state(struct xfrm_state *x); extern int xfrm_init_state(struct xfrm_state *x);
extern int xfrm4_rcv(struct sk_buff *skb); extern int xfrm4_rcv(struct sk_buff *skb);
extern int xfrm4_output(struct sk_buff *skb); extern int xfrm4_output(struct sk_buff *skb);
extern int xfrm4_output_finish(struct sk_buff *skb);
extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler); extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler); extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
extern int xfrm6_rcv_spi(struct sk_buff **pskb, u32 spi); extern int xfrm6_rcv_spi(struct sk_buff **pskb, u32 spi);
......
...@@ -830,7 +830,8 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -830,7 +830,8 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
skb->h.raw = skb->nh.raw; skb->h.raw = skb->nh.raw;
skb->nh.raw = skb_push(skb, gre_hlen); skb->nh.raw = skb_push(skb, gre_hlen);
memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE|IPSKB_XFRM_TRANSFORMED); IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
IPSKB_REROUTED);
dst_release(skb->dst); dst_release(skb->dst);
skb->dst = &rt->u.dst; skb->dst = &rt->u.dst;
......
...@@ -207,8 +207,10 @@ static inline int ip_finish_output(struct sk_buff *skb) ...@@ -207,8 +207,10 @@ static inline int ip_finish_output(struct sk_buff *skb)
{ {
#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
/* Policy lookup after SNAT yielded a new policy */ /* Policy lookup after SNAT yielded a new policy */
if (skb->dst->xfrm != NULL) if (skb->dst->xfrm != NULL) {
return xfrm4_output_finish(skb); IPCB(skb)->flags |= IPSKB_REROUTED;
return dst_output(skb);
}
#endif #endif
if (skb->len > dst_mtu(skb->dst) && if (skb->len > dst_mtu(skb->dst) &&
!(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size)) !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
...@@ -271,8 +273,9 @@ int ip_mc_output(struct sk_buff *skb) ...@@ -271,8 +273,9 @@ int ip_mc_output(struct sk_buff *skb)
newskb->dev, ip_dev_loopback_xmit); newskb->dev, ip_dev_loopback_xmit);
} }
return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dev, return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dev,
ip_finish_output); ip_finish_output,
!(IPCB(skb)->flags & IPSKB_REROUTED));
} }
int ip_output(struct sk_buff *skb) int ip_output(struct sk_buff *skb)
...@@ -284,8 +287,9 @@ int ip_output(struct sk_buff *skb) ...@@ -284,8 +287,9 @@ int ip_output(struct sk_buff *skb)
skb->dev = dev; skb->dev = dev;
skb->protocol = htons(ETH_P_IP); skb->protocol = htons(ETH_P_IP);
return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev, return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev,
ip_finish_output); ip_finish_output,
!(IPCB(skb)->flags & IPSKB_REROUTED));
} }
int ip_queue_xmit(struct sk_buff *skb, int ipfragok) int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
......
...@@ -622,7 +622,8 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -622,7 +622,8 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
skb->h.raw = skb->nh.raw; skb->h.raw = skb->nh.raw;
skb->nh.raw = skb_push(skb, sizeof(struct iphdr)); skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE|IPSKB_XFRM_TRANSFORMED); IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
IPSKB_REROUTED);
dst_release(skb->dst); dst_release(skb->dst);
skb->dst = &rt->u.dst; skb->dst = &rt->u.dst;
......
...@@ -529,15 +529,10 @@ static int init_or_cleanup(int init) ...@@ -529,15 +529,10 @@ static int init_or_cleanup(int init)
goto cleanup_localinops; goto cleanup_localinops;
} }
#endif #endif
/* For use by REJECT target */
ip_ct_attach = __nf_conntrack_attach;
return ret; return ret;
cleanup: cleanup:
synchronize_net(); synchronize_net();
ip_ct_attach = NULL;
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
unregister_sysctl_table(nf_ct_ipv4_sysctl_header); unregister_sysctl_table(nf_ct_ipv4_sysctl_header);
cleanup_localinops: cleanup_localinops:
......
...@@ -152,10 +152,16 @@ error_nolock: ...@@ -152,10 +152,16 @@ error_nolock:
goto out_exit; goto out_exit;
} }
int xfrm4_output_finish(struct sk_buff *skb) static int xfrm4_output_finish(struct sk_buff *skb)
{ {
int err; int err;
#ifdef CONFIG_NETFILTER
if (!skb->dst->xfrm) {
IPCB(skb)->flags |= IPSKB_REROUTED;
return dst_output(skb);
}
#endif
while (likely((err = xfrm4_output_one(skb)) == 0)) { while (likely((err = xfrm4_output_one(skb)) == 0)) {
nf_reset(skb); nf_reset(skb);
...@@ -178,6 +184,7 @@ int xfrm4_output_finish(struct sk_buff *skb) ...@@ -178,6 +184,7 @@ int xfrm4_output_finish(struct sk_buff *skb)
int xfrm4_output(struct sk_buff *skb) int xfrm4_output(struct sk_buff *skb)
{ {
return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev, return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
xfrm4_output_finish); xfrm4_output_finish,
!(IPCB(skb)->flags & IPSKB_REROUTED));
} }
...@@ -42,6 +42,7 @@ ...@@ -42,6 +42,7 @@
#include <linux/net.h> #include <linux/net.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
#include <linux/init.h> #include <linux/init.h>
#include <linux/netfilter.h>
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
#include <linux/sysctl.h> #include <linux/sysctl.h>
...@@ -255,6 +256,7 @@ out: ...@@ -255,6 +256,7 @@ out:
struct icmpv6_msg { struct icmpv6_msg {
struct sk_buff *skb; struct sk_buff *skb;
int offset; int offset;
uint8_t type;
}; };
static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb) static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
...@@ -266,6 +268,8 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st ...@@ -266,6 +268,8 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st
csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset, csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
to, len, csum); to, len, csum);
skb->csum = csum_block_add(skb->csum, csum, odd); skb->csum = csum_block_add(skb->csum, csum, odd);
if (!(msg->type & ICMPV6_INFOMSG_MASK))
nf_ct_attach(skb, org_skb);
return 0; return 0;
} }
...@@ -403,6 +407,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info, ...@@ -403,6 +407,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
msg.skb = skb; msg.skb = skb;
msg.offset = skb->nh.raw - skb->data; msg.offset = skb->nh.raw - skb->data;
msg.type = type;
len = skb->len - msg.offset; len = skb->len - msg.offset;
len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) -sizeof(struct icmp6hdr)); len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) -sizeof(struct icmp6hdr));
...@@ -500,6 +505,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb) ...@@ -500,6 +505,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
msg.skb = skb; msg.skb = skb;
msg.offset = 0; msg.offset = 0;
msg.type = ICMPV6_ECHO_REPLY;
err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr), err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl, sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl,
......
...@@ -160,6 +160,8 @@ static void send_reset(struct sk_buff *oldskb) ...@@ -160,6 +160,8 @@ static void send_reset(struct sk_buff *oldskb)
csum_partial((char *)tcph, csum_partial((char *)tcph,
sizeof(struct tcphdr), 0)); sizeof(struct tcphdr), 0));
nf_ct_attach(nskb, oldskb);
NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, nskb, NULL, nskb->dst->dev, NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, nskb, NULL, nskb->dst->dev,
dst_output); dst_output);
} }
......
...@@ -126,7 +126,7 @@ config NETFILTER_XT_TARGET_CONNMARK ...@@ -126,7 +126,7 @@ config NETFILTER_XT_TARGET_CONNMARK
tristate '"CONNMARK" target support' tristate '"CONNMARK" target support'
depends on NETFILTER_XTABLES depends on NETFILTER_XTABLES
depends on IP_NF_MANGLE || IP6_NF_MANGLE depends on IP_NF_MANGLE || IP6_NF_MANGLE
depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK_IPV4) depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
help help
This option adds a `CONNMARK' target, which allows one to manipulate This option adds a `CONNMARK' target, which allows one to manipulate
the connection mark value. Similar to the MARK target, but the connection mark value. Similar to the MARK target, but
...@@ -187,7 +187,7 @@ config NETFILTER_XT_MATCH_COMMENT ...@@ -187,7 +187,7 @@ config NETFILTER_XT_MATCH_COMMENT
config NETFILTER_XT_MATCH_CONNBYTES config NETFILTER_XT_MATCH_CONNBYTES
tristate '"connbytes" per-connection counter match support' tristate '"connbytes" per-connection counter match support'
depends on NETFILTER_XTABLES depends on NETFILTER_XTABLES
depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || NF_CT_ACCT depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
help help
This option adds a `connbytes' match, which allows you to match the This option adds a `connbytes' match, which allows you to match the
number of bytes and/or packets for each direction within a connection. number of bytes and/or packets for each direction within a connection.
...@@ -198,7 +198,7 @@ config NETFILTER_XT_MATCH_CONNBYTES ...@@ -198,7 +198,7 @@ config NETFILTER_XT_MATCH_CONNBYTES
config NETFILTER_XT_MATCH_CONNMARK config NETFILTER_XT_MATCH_CONNMARK
tristate '"connmark" connection mark match support' tristate '"connmark" connection mark match support'
depends on NETFILTER_XTABLES depends on NETFILTER_XTABLES
depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || NF_CONNTRACK_MARK depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
help help
This option adds a `connmark' match, which allows you to match the This option adds a `connmark' match, which allows you to match the
connection mark value previously set for the session by `CONNMARK'. connection mark value previously set for the session by `CONNMARK'.
......
...@@ -1556,6 +1556,8 @@ void nf_conntrack_cleanup(void) ...@@ -1556,6 +1556,8 @@ void nf_conntrack_cleanup(void)
{ {
int i; int i;
ip_ct_attach = NULL;
/* This makes sure all current packets have passed through /* This makes sure all current packets have passed through
netfilter framework. Roll on, two-stage module netfilter framework. Roll on, two-stage module
delete... */ delete... */
...@@ -1715,6 +1717,9 @@ int __init nf_conntrack_init(void) ...@@ -1715,6 +1717,9 @@ int __init nf_conntrack_init(void)
nf_ct_l3protos[i] = &nf_conntrack_generic_l3proto; nf_ct_l3protos[i] = &nf_conntrack_generic_l3proto;
write_unlock_bh(&nf_conntrack_lock); write_unlock_bh(&nf_conntrack_lock);
/* For use by REJECT target */
ip_ct_attach = __nf_conntrack_attach;
/* Set up fake conntrack: /* Set up fake conntrack:
- to never be deleted, not in any hashes */ - to never be deleted, not in any hashes */
atomic_set(&nf_conntrack_untracked.ct_general.use, 1); atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
......
...@@ -864,7 +864,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff) ...@@ -864,7 +864,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff)
{ {
return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr, return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
skb->len - dataoff, IPPROTO_TCP, skb->len - dataoff, IPPROTO_TCP,
skb->ip_summed == CHECKSUM_HW ? skb->csum skb->ip_summed == CHECKSUM_HW
? csum_sub(skb->csum,
skb_checksum(skb, 0, dataoff, 0))
: skb_checksum(skb, dataoff, skb->len - dataoff, : skb_checksum(skb, dataoff, skb->len - dataoff,
0)); 0));
} }
......
...@@ -161,7 +161,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff) ...@@ -161,7 +161,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff)
{ {
return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr, return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
skb->len - dataoff, IPPROTO_UDP, skb->len - dataoff, IPPROTO_UDP,
skb->ip_summed == CHECKSUM_HW ? skb->csum skb->ip_summed == CHECKSUM_HW
? csum_sub(skb->csum,
skb_checksum(skb, 0, dataoff, 0))
: skb_checksum(skb, dataoff, skb->len - dataoff, : skb_checksum(skb, dataoff, skb->len - dataoff,
0)); 0));
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment