Commit 2ab3b6f8 authored by David S. Miller's avatar David S. Miller

Merge davem@nuts.ninka.net:/home/davem/src/BK/net-2.5

into kernel.bkbits.net:/home/davem/net-2.5
parents 5f2d71d6 e2ee1b88
...@@ -35,16 +35,15 @@ ...@@ -35,16 +35,15 @@
unsigned int unsigned int
do_masquerade(struct sk_buff **pskb, const struct net_device *dev) do_masquerade(struct sk_buff **pskb, const struct net_device *dev)
{ {
struct iphdr *iph = (*pskb)->nh.iph;
struct ip_nat_info *info; struct ip_nat_info *info;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
struct ip_conntrack *ct; struct ip_conntrack *ct;
unsigned int ret; unsigned int ret;
/* Sorry, only ICMP, TCP and UDP. */ /* Sorry, only ICMP, TCP and UDP. */
if (iph->protocol != IPPROTO_ICMP if ((*pskb)->nh.iph->protocol != IPPROTO_ICMP
&& iph->protocol != IPPROTO_TCP && (*pskb)->nh.iph->protocol != IPPROTO_TCP
&& iph->protocol != IPPROTO_UDP) && (*pskb)->nh.iph->protocol != IPPROTO_UDP)
return NF_DROP; return NF_DROP;
/* Feed it to connection tracking; in fact we're in NF_IP_FORWARD, /* Feed it to connection tracking; in fact we're in NF_IP_FORWARD,
...@@ -68,7 +67,7 @@ do_masquerade(struct sk_buff **pskb, const struct net_device *dev) ...@@ -68,7 +67,7 @@ do_masquerade(struct sk_buff **pskb, const struct net_device *dev)
/* Setup the masquerade, if not already */ /* Setup the masquerade, if not already */
if (!info->initialized) { if (!info->initialized) {
u_int32_t newsrc; u_int32_t newsrc;
struct flowi fl = { .nl_u = { .ip4_u = { .daddr = iph->daddr } } }; struct flowi fl = { .nl_u = { .ip4_u = { .daddr = (*pskb)->nh.iph->daddr } } };
struct rtable *rt; struct rtable *rt;
struct ip_nat_multi_range range; struct ip_nat_multi_range range;
...@@ -124,19 +123,18 @@ unsigned int ...@@ -124,19 +123,18 @@ unsigned int
check_for_demasq(struct sk_buff **pskb) check_for_demasq(struct sk_buff **pskb)
{ {
struct ip_conntrack_tuple tuple; struct ip_conntrack_tuple tuple;
struct iphdr *iph = (*pskb)->nh.iph;
struct ip_conntrack_protocol *protocol; struct ip_conntrack_protocol *protocol;
struct ip_conntrack_tuple_hash *h; struct ip_conntrack_tuple_hash *h;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
struct ip_conntrack *ct; struct ip_conntrack *ct;
int ret; int ret;
protocol = ip_ct_find_proto(iph->protocol); protocol = ip_ct_find_proto((*pskb)->nh.iph->protocol);
/* We don't feed packets to conntrack system unless we know /* We don't feed packets to conntrack system unless we know
they're part of an connection already established by an they're part of an connection already established by an
explicit masq command. */ explicit masq command. */
switch (iph->protocol) { switch ((*pskb)->nh.iph->protocol) {
case IPPROTO_ICMP: case IPPROTO_ICMP:
/* ICMP errors. */ /* ICMP errors. */
ct = icmp_error_track(*pskb, &ctinfo, NF_IP_PRE_ROUTING); ct = icmp_error_track(*pskb, &ctinfo, NF_IP_PRE_ROUTING);
...@@ -146,12 +144,6 @@ check_for_demasq(struct sk_buff **pskb) ...@@ -146,12 +144,6 @@ check_for_demasq(struct sk_buff **pskb)
server here (== DNAT). Do SNAT icmp manips server here (== DNAT). Do SNAT icmp manips
in POST_ROUTING handling. */ in POST_ROUTING handling. */
if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) { if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
/* FIXME: Remove once NAT handled non-linear.
*/
if (skb_is_nonlinear(*pskb)
&& skb_linearize(*pskb, GFP_ATOMIC) != 0)
return NF_DROP;
icmp_reply_translation(pskb, ct, icmp_reply_translation(pskb, ct,
NF_IP_PRE_ROUTING, NF_IP_PRE_ROUTING,
CTINFO2DIR(ctinfo)); CTINFO2DIR(ctinfo));
...@@ -166,7 +158,7 @@ check_for_demasq(struct sk_buff **pskb) ...@@ -166,7 +158,7 @@ check_for_demasq(struct sk_buff **pskb)
case IPPROTO_UDP: case IPPROTO_UDP:
IP_NF_ASSERT(((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) == 0); IP_NF_ASSERT(((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) == 0);
if (!get_tuple(iph, *pskb, iph->ihl*4, &tuple, protocol)) { if (!get_tuple((*pskb)->nh.iph, *pskb, (*pskb)->nh.iph->ihl*4, &tuple, protocol)) {
if (net_ratelimit()) if (net_ratelimit())
printk("ip_fw_compat_masq: Can't get tuple\n"); printk("ip_fw_compat_masq: Can't get tuple\n");
return NF_ACCEPT; return NF_ACCEPT;
......
...@@ -717,10 +717,13 @@ manip_pkt(u_int16_t proto, ...@@ -717,10 +717,13 @@ manip_pkt(u_int16_t proto,
iph = (void *)(*pskb)->data + iphdroff; iph = (void *)(*pskb)->data + iphdroff;
/* Manipulate protcol part. */ /* Manipulate protcol part. */
if (!find_nat_proto(proto)->manip_pkt(pskb, iphdroff + iph->ihl*4, if (!find_nat_proto(proto)->manip_pkt(pskb,
iphdroff + iph->ihl*4,
manip, maniptype)) manip, maniptype))
return 0; return 0;
iph = (void *)(*pskb)->data + iphdroff;
if (maniptype == IP_NAT_MANIP_SRC) { if (maniptype == IP_NAT_MANIP_SRC) {
iph->check = ip_nat_cheat_check(~iph->saddr, manip->ip, iph->check = ip_nat_cheat_check(~iph->saddr, manip->ip,
iph->check); iph->check);
...@@ -953,6 +956,8 @@ icmp_reply_translation(struct sk_buff **pskb, ...@@ -953,6 +956,8 @@ icmp_reply_translation(struct sk_buff **pskb,
hdrlen = (*pskb)->nh.iph->ihl * 4; hdrlen = (*pskb)->nh.iph->ihl * 4;
inside = (void *)(*pskb)->data + (*pskb)->nh.iph->ihl*4;
inside->icmp.checksum = 0; inside->icmp.checksum = 0;
inside->icmp.checksum = csum_fold(skb_checksum(*pskb, hdrlen, inside->icmp.checksum = csum_fold(skb_checksum(*pskb, hdrlen,
(*pskb)->len - hdrlen, (*pskb)->len - hdrlen,
......
...@@ -91,6 +91,7 @@ int inet_del_protocol(struct inet_protocol *prot, unsigned char protocol) ...@@ -91,6 +91,7 @@ int inet_del_protocol(struct inet_protocol *prot, unsigned char protocol)
} }
spin_unlock_bh(&inet_proto_lock); spin_unlock_bh(&inet_proto_lock);
synchronize_net();
return ret; return ret;
} }
...@@ -80,5 +80,7 @@ int inet6_del_protocol(struct inet6_protocol *prot, unsigned char protocol) ...@@ -80,5 +80,7 @@ int inet6_del_protocol(struct inet6_protocol *prot, unsigned char protocol)
spin_unlock_bh(&inet6_proto_lock); spin_unlock_bh(&inet6_proto_lock);
synchronize_net();
return ret; return ret;
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment