← Back to branch summary

~ubuntu-branches/debian/wheezy/linux-2.6/wheezy

« back to all changes in this revision

Viewing changes to net/ipv4/netfilter/nf_nat_core.c

  • Committer: Bazaar Package Importer
  • Author(s): Ben Hutchings, Ben Hutchings, Aurelien Jarno
  • Date: 2011-06-07 12:14:05 UTC
  • mfrom: (43.1.9 sid)
  • Revision ID: james.westby@ubuntu.com-20110607121405-i3h1rd7nrnd2b73h
Tags: 2.6.39-2
http://bugs.debian.org/627492
http://bugs.debian.org/596626
http://bugs.debian.org/628932
http://bugs.debian.org/628191
http://bugs.debian.org/627837
http://bugs.debian.org/622997
http://bugs.debian.org/622745
http://bugs.debian.org/619827
http://bugs.debian.org/629401
[ Ben Hutchings ]
* [x86] Enable BACKLIGHT_APPLE, replacing BACKLIGHT_MBP_NVIDIA
  (Closes: #627492)
* cgroups: Disable memory resource controller by default. Allow it
  to be enabled using kernel parameter 'cgroup_enable=memory'.
* rt2800usb: Enable support for more USB devices including
  Linksys WUSB600N (Closes: #596626) (this change was accidentally
  omitted from 2.6.39-1)
* [x86] Remove Celeron from list of processors supporting PAE. Most
  'Celeron M' models do not.
* Update debconf template translations:
  - Swedish (Martin Bagge) (Closes: #628932)
  - French (David Prévot) (Closes: #628191)
* aufs: Update for 2.6.39 (Closes: #627837)
* Add stable 2.6.39.1, including:
  - ext4: dont set PageUptodate in ext4_end_bio()
  - pata_cmd64x: fix boot crash on parisc (Closes: #622997, #622745)
  - ext3: Fix fs corruption when make_indexed_dir() fails
  - netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages
  - sctp: fix race between sctp_bind_addr_free() and
    sctp_bind_addr_conflict()
  - sctp: fix memory leak of the ASCONF queue when free asoc
  - md/bitmap: fix saving of events_cleared and other state
  - cdc_acm: Fix oops when Droids MuIn LCD is connected
  - cx88: Fix conversion from BKL to fine-grained locks (Closes: #619827)
  - keys: Set cred->user_ns in key_replace_session_keyring (CVE-2011-2184)
  - tmpfs: fix race between truncate and writepage
  - nfs41: Correct offset for LAYOUTCOMMIT
  - xen/mmu: fix a race window causing leave_mm BUG()
  - ext4: fix possible use-after-free in ext4_remove_li_request()
  For the complete list of changes, see:
   http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.1
* Bump ABI to 2
* netfilter: Enable IP_SET, IP_SET_BITMAP_IP, IP_SET_BITMAP_IPMAC,
  IP_SET_BITMAP_PORT, IP_SET_HASH_IP, IP_SET_HASH_IPPORT,
  IP_SET_HASH_IPPORTIP, IP_SET_HASH_IPPORTNET, IP_SET_HASH_NET,
  IP_SET_HASH_NETPORT, IP_SET_LIST_SET, NETFILTER_XT_SET as modules
  (Closes: #629401)

[ Aurelien Jarno ]
* [mipsel/loongson-2f] Disable_SCSI_LPFC to workaround GCC ICE.

Show diffs side-by-side

added added

removed removed

Lines of Context:
net/ipv4/netfilter/nf_nat_core.c
221
221
           manips not an issue.  */
222
222
        if (maniptype == IP_NAT_MANIP_SRC &&
223
223
            !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
224
 
                if (find_appropriate_src(net, zone, orig_tuple, tuple, range)) {
 
224
                /* try the original tuple first */
 
225
                if (in_range(orig_tuple, range)) {
 
226
                        if (!nf_nat_used_tuple(orig_tuple, ct)) {
 
227
                                *tuple = *orig_tuple;
 
228
                                return;
 
229
                        }
 
230
                } else if (find_appropriate_src(net, zone, orig_tuple, tuple,
 
231
                           range)) {
225
232
                        pr_debug("get_unique_tuple: Found current src map\n");
226
233
                        if (!nf_nat_used_tuple(tuple, ct))
227
234
                                return;
266
273
        struct net *net = nf_ct_net(ct);
267
274
        struct nf_conntrack_tuple curr_tuple, new_tuple;
268
275
        struct nf_conn_nat *nat;
269
 
        int have_to_hash = !(ct->status & IPS_NAT_DONE_MASK);
270
276
 
271
277
        /* nat helper or nfctnetlink also setup binding */
272
278
        nat = nfct_nat(ct);
306
312
                        ct->status |= IPS_DST_NAT;
307
313
        }
308
314
 
309
 
        /* Place in source hash if this is the first time. */
310
 
        if (have_to_hash) {
 
315
        if (maniptype == IP_NAT_MANIP_SRC) {
311
316
                unsigned int srchash;
312
317
 
313
318
                srchash = hash_by_src(net, nf_ct_zone(ct),
323
328
 
324
329
        /* It's done. */
325
330
        if (maniptype == IP_NAT_MANIP_DST)
326
 
                set_bit(IPS_DST_NAT_DONE_BIT, &ct->status);
 
331
                ct->status |= IPS_DST_NAT_DONE;
327
332
        else
328
 
                set_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
 
333
                ct->status |= IPS_SRC_NAT_DONE;
329
334
 
330
335
        return NF_ACCEPT;
331
336
}
502
507
        int ret = 0;
503
508
 
504
509
        spin_lock_bh(&nf_nat_lock);
505
 
        if (nf_nat_protos[proto->protonum] != &nf_nat_unknown_protocol) {
 
510
        if (rcu_dereference_protected(
 
511
                        nf_nat_protos[proto->protonum],
 
512
                        lockdep_is_held(&nf_nat_lock)
 
513
                        ) != &nf_nat_unknown_protocol) {
506
514
                ret = -EBUSY;
507
515
                goto out;
508
516
        }
513
521
}
514
522
EXPORT_SYMBOL(nf_nat_protocol_register);
515
523
 
516
 
/* Noone stores the protocol anywhere; simply delete it. */
 
524
/* No one stores the protocol anywhere; simply delete it. */
517
525
void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto)
518
526
{
519
527
        spin_lock_bh(&nf_nat_lock);
524
532
}
525
533
EXPORT_SYMBOL(nf_nat_protocol_unregister);
526
534
 
527
 
/* Noone using conntrack by the time this called. */
 
535
/* No one using conntrack by the time this called. */
528
536
static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
529
537
{
530
538
        struct nf_conn_nat *nat = nf_ct_ext_find(ct, NF_CT_EXT_NAT);
532
540
        if (nat == NULL || nat->ct == NULL)
533
541
                return;
534
542
 
535
 
        NF_CT_ASSERT(nat->ct->status & IPS_NAT_DONE_MASK);
 
543
        NF_CT_ASSERT(nat->ct->status & IPS_SRC_NAT_DONE);
536
544
 
537
545
        spin_lock_bh(&nf_nat_lock);
538
546
        hlist_del_rcu(&nat->bysource);
545
553
        struct nf_conn_nat *old_nat = old;
546
554
        struct nf_conn *ct = old_nat->ct;
547
555
 
548
 
        if (!ct || !(ct->status & IPS_NAT_DONE_MASK))
 
556
        if (!ct || !(ct->status & IPS_SRC_NAT_DONE))
549
557
                return;
550
558
 
551
559
        spin_lock_bh(&nf_nat_lock);
552
 
        new_nat->ct = ct;
553
560
        hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
554
561
        spin_unlock_bh(&nf_nat_lock);
555
562
}
679
686
{
680
687
        /* Leave them the same for the moment. */
681
688
        net->ipv4.nat_htable_size = net->ct.htable_size;
682
 
        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size,
683
 
                                                       &net->ipv4.nat_vmalloced, 0);
 
689
        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size, 0);
684
690
        if (!net->ipv4.nat_bysource)
685
691
                return -ENOMEM;
686
692
        return 0;
702
708
{
703
709
        nf_ct_iterate_cleanup(net, &clean_nat, NULL);
704
710
        synchronize_rcu();
705
 
        nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_vmalloced,
706
 
                             net->ipv4.nat_htable_size);
 
711
        nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_htable_size);
707
712
}
708
713
 
709
714
static struct pernet_operations nf_nat_net_ops = {