Commit 6e699867 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: nat: avoid use of nf_conn_nat extension

successful insert into the bysource hash sets IPS_SRC_NAT_DONE status bit
so we can check that instead of presence of nat extension which requires
extra deref.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cba81cc4
...@@ -706,7 +706,7 @@ static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb, ...@@ -706,7 +706,7 @@ static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb,
l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
if (l4proto->allow_clash && if (l4proto->allow_clash &&
!nfct_nat(ct) && ((ct->status & IPS_NAT_DONE_MASK) == 0) &&
!nf_ct_is_dying(ct) && !nf_ct_is_dying(ct) &&
atomic_inc_not_zero(&ct->ct_general.use)) { atomic_inc_not_zero(&ct->ct_general.use)) {
enum ip_conntrack_info oldinfo; enum ip_conntrack_info oldinfo;
......
...@@ -549,10 +549,6 @@ struct nf_nat_proto_clean { ...@@ -549,10 +549,6 @@ struct nf_nat_proto_clean {
static int nf_nat_proto_remove(struct nf_conn *i, void *data) static int nf_nat_proto_remove(struct nf_conn *i, void *data)
{ {
const struct nf_nat_proto_clean *clean = data; const struct nf_nat_proto_clean *clean = data;
struct nf_conn_nat *nat = nfct_nat(i);
if (!nat)
return 0;
if ((clean->l3proto && nf_ct_l3num(i) != clean->l3proto) || if ((clean->l3proto && nf_ct_l3num(i) != clean->l3proto) ||
(clean->l4proto && nf_ct_protonum(i) != clean->l4proto)) (clean->l4proto && nf_ct_protonum(i) != clean->l4proto))
...@@ -563,12 +559,10 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data) ...@@ -563,12 +559,10 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data)
static int nf_nat_proto_clean(struct nf_conn *ct, void *data) static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
{ {
struct nf_conn_nat *nat = nfct_nat(ct);
if (nf_nat_proto_remove(ct, data)) if (nf_nat_proto_remove(ct, data))
return 1; return 1;
if (!nat) if ((ct->status & IPS_SRC_NAT_DONE) == 0)
return 0; return 0;
/* This netns is being destroyed, and conntrack has nat null binding. /* This netns is being destroyed, and conntrack has nat null binding.
...@@ -716,13 +710,9 @@ EXPORT_SYMBOL_GPL(nf_nat_l3proto_unregister); ...@@ -716,13 +710,9 @@ EXPORT_SYMBOL_GPL(nf_nat_l3proto_unregister);
/* No one using conntrack by the time this called. */ /* No one using conntrack by the time this called. */
static void nf_nat_cleanup_conntrack(struct nf_conn *ct) static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
{ {
struct nf_conn_nat *nat = nf_ct_ext_find(ct, NF_CT_EXT_NAT); if (ct->status & IPS_SRC_NAT_DONE)
rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
if (!nat) nf_nat_bysource_params);
return;
rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
nf_nat_bysource_params);
} }
static struct nf_ct_ext_type nat_extend __read_mostly = { static struct nf_ct_ext_type nat_extend __read_mostly = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment