7,13c7,8
< /* (C) 1999-2001 Paul `Rusty' Russell
<  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
<  *
<  * This program is free software; you can redistribute it and/or modify
<  * it under the terms of the GNU General Public License version 2 as
<  * published by the Free Software Foundation.
<  */
---
> /* (c) 1999 Paul `Rusty' Russell.  Licenced under the GNU General
>    Public Licence. */
15d9
< #include <linux/config.h>
23,25c17
< #ifdef CONFIG_SYSCTL
< #include <linux/sysctl.h>
< #endif
---
> #include <linux/version.h>
27d18
< #include <net/ip.h>
43a35
> struct module *ip_conntrack_module = THIS_MODULE;
46,50d37
< static int kill_proto(const struct ip_conntrack *i, void *data)
< {
< 	return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum == 
< 			*((u_int8_t *) data));
< }
72,79c59,60
< 	if (expect->expectant->helper->timeout)
< 		len = sprintf(buffer, "EXPECTING: %lu ",
< 			      timer_pending(&expect->timeout)
< 			      ? (expect->timeout.expires - jiffies)/HZ : 0);
< 	else
< 		len = sprintf(buffer, "EXPECTING: - ");
< 	len += sprintf(buffer + len, "use=%u proto=%u ",
< 		      atomic_read(&expect->use), expect->tuple.dst.protonum);
---
> 	len = sprintf(buffer, "EXPECTING: proto=%u ",
> 		      expect->tuple.dst.protonum);
81c62
< 			   __ip_ct_find_proto(expect->tuple.dst.protonum));
---
> 			   __find_proto(expect->tuple.dst.protonum));
87c68
< print_conntrack(char *buffer, struct ip_conntrack *conntrack)
---
> print_conntrack(char *buffer, const struct ip_conntrack *conntrack)
91c72
< 		= __ip_ct_find_proto(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
---
> 		= __find_proto(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
105c86
< 	if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
---
> 	if (!(conntrack->status & IPS_SEEN_REPLY))
110c91
< 	if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
---
> 	if (conntrack->status & IPS_ASSURED)
163,164c144
< 	READ_LOCK(&ip_conntrack_expect_tuple_lock);
< 	list_for_each(e, &ip_conntrack_expect_list) {
---
> 	for (e = expect_list.next; e != &expect_list; e = e->next) {
174c154
< 			goto finished_expects;
---
> 			goto finished;
178,179d157
<  finished_expects:
< 	READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
198,217d175
< static unsigned int ip_conntrack_defrag(unsigned int hooknum,
< 				        struct sk_buff **pskb,
< 				        const struct net_device *in,
< 				        const struct net_device *out,
< 				        int (*okfn)(struct sk_buff *))
< {
< 	/* Previously seen (loopback)?  Ignore.  Do this before
<            fragment check. */
< 	if ((*pskb)->nfct)
< 		return NF_ACCEPT;
< 
< 	/* Gather fragments. */
< 	if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
< 		*pskb = ip_ct_gather_frags(*pskb);
< 		if (!*pskb)
< 			return NF_STOLEN;
< 	}
< 	return NF_ACCEPT;
< }
< 
233,234c191
< 	if ((*pskb)->len > dst_pmtu(&rt->u.dst) &&
< 	    !skb_shinfo(*pskb)->tso_size) {
---
> 	if ((*pskb)->len > rt->u.dst.pmtu) {
260,291c217,222
< static struct nf_hook_ops ip_conntrack_defrag_ops = {
< 	.hook		= ip_conntrack_defrag,
< 	.owner		= THIS_MODULE,
< 	.pf		= PF_INET,
< 	.hooknum	= NF_IP_PRE_ROUTING,
< 	.priority	= NF_IP_PRI_CONNTRACK_DEFRAG,
< };
< 
< static struct nf_hook_ops ip_conntrack_in_ops = {
< 	.hook		= ip_conntrack_in,
< 	.owner		= THIS_MODULE,
< 	.pf		= PF_INET,
< 	.hooknum	= NF_IP_PRE_ROUTING,
< 	.priority	= NF_IP_PRI_CONNTRACK,
< };
< 
< static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
< 	.hook		= ip_conntrack_defrag,
< 	.owner		= THIS_MODULE,
< 	.pf		= PF_INET,
< 	.hooknum	= NF_IP_LOCAL_OUT,
< 	.priority	= NF_IP_PRI_CONNTRACK_DEFRAG,
< };
< 
< static struct nf_hook_ops ip_conntrack_local_out_ops = {
< 	.hook		= ip_conntrack_local,
< 	.owner		= THIS_MODULE,
< 	.pf		= PF_INET,
< 	.hooknum	= NF_IP_LOCAL_OUT,
< 	.priority	= NF_IP_PRI_CONNTRACK,
< };
< 
---
> static struct nf_hook_ops ip_conntrack_in_ops
> = { { NULL, NULL }, ip_conntrack_in, PF_INET, NF_IP_PRE_ROUTING,
> 	NF_IP_PRI_CONNTRACK };
> static struct nf_hook_ops ip_conntrack_local_out_ops
> = { { NULL, NULL }, ip_conntrack_local, PF_INET, NF_IP_LOCAL_OUT,
> 	NF_IP_PRI_CONNTRACK };
293,494c224,228
< static struct nf_hook_ops ip_conntrack_out_ops = {
< 	.hook		= ip_refrag,
< 	.owner		= THIS_MODULE,
< 	.pf		= PF_INET,
< 	.hooknum	= NF_IP_POST_ROUTING,
< 	.priority	= NF_IP_PRI_LAST,
< };
< 
< static struct nf_hook_ops ip_conntrack_local_in_ops = {
< 	.hook		= ip_confirm,
< 	.owner		= THIS_MODULE,
< 	.pf		= PF_INET,
< 	.hooknum	= NF_IP_LOCAL_IN,
< 	.priority	= NF_IP_PRI_LAST-1,
< };
< 
< /* Sysctl support */
< 
< #ifdef CONFIG_SYSCTL
< 
< /* From ip_conntrack_core.c */
< extern int ip_conntrack_max;
< extern unsigned int ip_conntrack_htable_size;
< 
< /* From ip_conntrack_proto_tcp.c */
< extern unsigned long ip_ct_tcp_timeout_syn_sent;
< extern unsigned long ip_ct_tcp_timeout_syn_recv;
< extern unsigned long ip_ct_tcp_timeout_established;
< extern unsigned long ip_ct_tcp_timeout_fin_wait;
< extern unsigned long ip_ct_tcp_timeout_close_wait;
< extern unsigned long ip_ct_tcp_timeout_last_ack;
< extern unsigned long ip_ct_tcp_timeout_time_wait;
< extern unsigned long ip_ct_tcp_timeout_close;
< 
< /* From ip_conntrack_proto_udp.c */
< extern unsigned long ip_ct_udp_timeout;
< extern unsigned long ip_ct_udp_timeout_stream;
< 
< /* From ip_conntrack_proto_icmp.c */
< extern unsigned long ip_ct_icmp_timeout;
< 
< /* From ip_conntrack_proto_icmp.c */
< extern unsigned long ip_ct_generic_timeout;
< 
< static struct ctl_table_header *ip_ct_sysctl_header;
< 
< static ctl_table ip_ct_sysctl_table[] = {
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_MAX,
< 		.procname	= "ip_conntrack_max",
< 		.data		= &ip_conntrack_max,
< 		.maxlen		= sizeof(int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_BUCKETS,
< 		.procname	= "ip_conntrack_buckets",
< 		.data		= &ip_conntrack_htable_size,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0444,
< 		.proc_handler	= &proc_dointvec,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
< 		.procname	= "ip_conntrack_tcp_timeout_syn_sent",
< 		.data		= &ip_ct_tcp_timeout_syn_sent,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
< 		.procname	= "ip_conntrack_tcp_timeout_syn_recv",
< 		.data		= &ip_ct_tcp_timeout_syn_recv,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
< 		.procname	= "ip_conntrack_tcp_timeout_established",
< 		.data		= &ip_ct_tcp_timeout_established,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
< 		.procname	= "ip_conntrack_tcp_timeout_fin_wait",
< 		.data		= &ip_ct_tcp_timeout_fin_wait,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
< 		.procname	= "ip_conntrack_tcp_timeout_close_wait",
< 		.data		= &ip_ct_tcp_timeout_close_wait,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
< 		.procname	= "ip_conntrack_tcp_timeout_last_ack",
< 		.data		= &ip_ct_tcp_timeout_last_ack,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
< 		.procname	= "ip_conntrack_tcp_timeout_time_wait",
< 		.data		= &ip_ct_tcp_timeout_time_wait,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
< 		.procname	= "ip_conntrack_tcp_timeout_close",
< 		.data		= &ip_ct_tcp_timeout_close,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT,
< 		.procname	= "ip_conntrack_udp_timeout",
< 		.data		= &ip_ct_udp_timeout,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT_STREAM,
< 		.procname	= "ip_conntrack_udp_timeout_stream",
< 		.data		= &ip_ct_udp_timeout_stream,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT,
< 		.procname	= "ip_conntrack_icmp_timeout",
< 		.data		= &ip_ct_icmp_timeout,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{
< 		.ctl_name	= NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT,
< 		.procname	= "ip_conntrack_generic_timeout",
< 		.data		= &ip_ct_generic_timeout,
< 		.maxlen		= sizeof(unsigned int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec_jiffies,
< 	},
< 	{ .ctl_name = 0 }
< };
< 
< #define NET_IP_CONNTRACK_MAX 2089
< 
< static ctl_table ip_ct_netfilter_table[] = {
< 	{
< 		.ctl_name	= NET_IPV4_NETFILTER,
< 		.procname	= "netfilter",
< 		.mode		= 0555,
< 		.child		= ip_ct_sysctl_table,
< 	},
< 	{
< 		.ctl_name	= NET_IP_CONNTRACK_MAX,
< 		.procname	= "ip_conntrack_max",
< 		.data		= &ip_conntrack_max,
< 		.maxlen		= sizeof(int),
< 		.mode		= 0644,
< 		.proc_handler	= &proc_dointvec
< 	},
< 	{ .ctl_name = 0 }
< };
< 
< static ctl_table ip_ct_ipv4_table[] = {
< 	{
< 		.ctl_name	= NET_IPV4,
< 		.procname	= "ipv4",
< 		.mode		= 0555,
< 		.child		= ip_ct_netfilter_table,
< 	},
< 	{ .ctl_name = 0 }
< };
< 
< static ctl_table ip_ct_net_table[] = {
< 	{
< 		.ctl_name	= CTL_NET,
< 		.procname	= "net",
< 		.mode		= 0555, 
< 		.child		= ip_ct_ipv4_table,
< 	},
< 	{ .ctl_name = 0 }
< };
< #endif
---
> static struct nf_hook_ops ip_conntrack_out_ops
> = { { NULL, NULL }, ip_refrag, PF_INET, NF_IP_POST_ROUTING, NF_IP_PRI_LAST };
> static struct nf_hook_ops ip_conntrack_local_in_ops
> = { { NULL, NULL }, ip_confirm, PF_INET, NF_IP_LOCAL_IN, NF_IP_PRI_LAST-1 };
> 
506c240
< 	proc = proc_net_create("ip_conntrack", 0440, list_conntracks);
---
> 	proc = proc_net_create("ip_conntrack",0,list_conntracks);
510,519d243
< 	ret = nf_register_hook(&ip_conntrack_defrag_ops);
< 	if (ret < 0) {
< 		printk("ip_conntrack: can't register pre-routing defrag hook.\n");
< 		goto cleanup_proc;
< 	}
< 	ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
< 	if (ret < 0) {
< 		printk("ip_conntrack: can't register local_out defrag hook.\n");
< 		goto cleanup_defragops;
< 	}
522,523c246,247
< 		printk("ip_conntrack: can't register pre-routing hook.\n");
< 		goto cleanup_defraglocalops;
---
> 		printk("ip_conntrack: can't register in hook.\n");
> 		goto cleanup_proc;
540,546d263
< #ifdef CONFIG_SYSCTL
< 	ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
< 	if (ip_ct_sysctl_header == NULL) {
< 		printk("ip_conntrack: can't register to sysctl.\n");
< 		goto cleanup;
< 	}
< #endif
551,553d267
< #ifdef CONFIG_SYSCTL
<  	unregister_sysctl_table(ip_ct_sysctl_header);
< #endif
561,564d274
<  cleanup_defraglocalops:
< 	nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
<  cleanup_defragops:
< 	nf_unregister_hook(&ip_conntrack_defrag_ops);
581c291
< 	list_for_each(i, &protocol_list) {
---
> 	for (i = protocol_list.next; i != &protocol_list; i = i->next) {
589a300
> 	MOD_INC_USE_COUNT;
595a307,308
> /* FIXME: Implement this --RR */
> #if 0
598,609d310
< 	WRITE_LOCK(&ip_conntrack_lock);
< 
< 	/* ip_ct_find_proto() returns proto_generic in case there is no protocol 
< 	 * helper. So this should be enough - HW */
< 	LIST_DELETE(&protocol_list, proto);
< 	WRITE_UNLOCK(&ip_conntrack_lock);
< 	
< 	/* Somebody could be still looking at the proto in bh. */
< 	synchronize_net();
< 
< 	/* Remove all contrack entries for this protocol */
< 	ip_ct_selective_cleanup(kill_proto, &proto->proto);
610a312
> #endif
625,630d326
< /* Some modules need us, but don't depend directly on any symbol.
<    They should call this. */
< void need_ip_conntrack(void)
< {
< }
< 
632d327
< EXPORT_SYMBOL(ip_conntrack_protocol_unregister);
637c332
< EXPORT_SYMBOL(need_ip_conntrack);
---
> EXPORT_SYMBOL(ip_conntrack_module);
642,645d336
< EXPORT_SYMBOL(ip_ct_find_proto);
< EXPORT_SYMBOL(__ip_ct_find_proto);
< EXPORT_SYMBOL(ip_ct_find_helper);
< EXPORT_SYMBOL(ip_conntrack_expect_alloc);
649,650d339
< EXPORT_SYMBOL_GPL(ip_conntrack_expect_find_get);
< EXPORT_SYMBOL_GPL(ip_conntrack_expect_put);
654d342
< EXPORT_SYMBOL(ip_conntrack_expect_list);
656,659d343
< EXPORT_SYMBOL(ip_conntrack_hash);
< EXPORT_SYMBOL(ip_conntrack_untracked);
< EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
< EXPORT_SYMBOL_GPL(ip_conntrack_put);
