Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

[pandora-kernel.git] / net / ipv4 / netfilter / ip_conntrack_proto_icmp.c

diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 98f0015..3021af0 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -13,15 +13,15 @@
 #include <linux/in.h>
 #include <linux/icmp.h>
 #include <linux/seq_file.h>
+#include <linux/skbuff.h>
 #include <net/ip.h>
 #include <net/checksum.h>
-#include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
 
-unsigned long ip_ct_icmp_timeout = 30*HZ;
+unsigned int ip_ct_icmp_timeout = 30*HZ;
 
 #if 0
 #define DEBUGP printk
@@ -46,20 +46,21 @@ static int icmp_pkt_to_tuple(const struct sk_buff *skb,
        return 1;
 }
 
+/* Add 1; spaces filled with 0. */
+static const u_int8_t invmap[] = {
+       [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
+       [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
+       [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
+       [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
+       [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
+       [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
+       [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
+       [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
+};
+
 static int icmp_invert_tuple(struct ip_conntrack_tuple *tuple,
                             const struct ip_conntrack_tuple *orig)
 {
-       /* Add 1; spaces filled with 0. */
-       static u_int8_t invmap[]
-               = { [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
-                   [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
-                   [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
-                   [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
-                   [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
-                   [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
-                   [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
-                   [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1};
-
        if (orig->dst.u.icmp.type >= sizeof(invmap)
            || !invmap[orig->dst.u.icmp.type])
                return 0;
@@ -109,17 +110,17 @@ static int icmp_packet(struct ip_conntrack *ct,
        return NF_ACCEPT;
 }
 
-static u_int8_t valid_new[] = { 
-       [ICMP_ECHO] = 1,
-       [ICMP_TIMESTAMP] = 1,
-       [ICMP_INFO_REQUEST] = 1,
-       [ICMP_ADDRESS] = 1 
-};
-
 /* Called when a new connection for this protocol found. */
 static int icmp_new(struct ip_conntrack *conntrack,
                    const struct sk_buff *skb)
 {
+       static const u_int8_t valid_new[] = { 
+               [ICMP_ECHO] = 1,
+               [ICMP_TIMESTAMP] = 1,
+               [ICMP_INFO_REQUEST] = 1,
+               [ICMP_ADDRESS] = 1 
+       };
+
        if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
            || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type]) {
                /* Can't create a new ICMP `conn' with this. */
@@ -151,13 +152,13 @@ icmp_error_message(struct sk_buff *skb,
        /* Not enough header? */
        inside = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_in), &_in);
        if (inside == NULL)
-               return NF_ACCEPT;
+               return -NF_ACCEPT;
 
        /* Ignore ICMP's containing fragments (shouldn't happen) */
        if (inside->ip.frag_off & htons(IP_OFFSET)) {
                DEBUGP("icmp_error_track: fragment of proto %u\n",
                       inside->ip.protocol);
-               return NF_ACCEPT;
+               return -NF_ACCEPT;
        }
 
        innerproto = ip_conntrack_proto_find_get(inside->ip.protocol);
@@ -166,7 +167,7 @@ icmp_error_message(struct sk_buff *skb,
        if (!ip_ct_get_tuple(&inside->ip, skb, dataoff, &origtuple, innerproto)) {
                DEBUGP("icmp_error: ! get_tuple p=%u", inside->ip.protocol);
                ip_conntrack_proto_put(innerproto);
-               return NF_ACCEPT;
+               return -NF_ACCEPT;
        }
 
        /* Ordinarily, we'd expect the inverted tupleproto, but it's
@@ -174,7 +175,7 @@ icmp_error_message(struct sk_buff *skb,
        if (!ip_ct_invert_tuple(&innertuple, &origtuple, innerproto)) {
                DEBUGP("icmp_error_track: Can't invert tuple\n");
                ip_conntrack_proto_put(innerproto);
-               return NF_ACCEPT;
+               return -NF_ACCEPT;
        }
        ip_conntrack_proto_put(innerproto);
 
@@ -190,7 +191,7 @@ icmp_error_message(struct sk_buff *skb,
 
                if (!h) {
                        DEBUGP("icmp_error_track: no match\n");
-                       return NF_ACCEPT;
+                       return -NF_ACCEPT;
                }
                /* Reverse direction from that found */
                if (DIRECTION(h) != IP_CT_DIR_REPLY)
@@ -230,19 +231,15 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
        case CHECKSUM_HW:
                if (!(u16)csum_fold(skb->csum)) 
                        break;
-               if (LOG_INVALID(IPPROTO_ICMP))
-                       nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
-                                     "ip_ct_icmp: bad HW ICMP checksum ");
-               return -NF_ACCEPT;
+               /* fall through */
        case CHECKSUM_NONE:
-               if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0))) {
+               skb->csum = 0;
+               if (__skb_checksum_complete(skb)) {
                        if (LOG_INVALID(IPPROTO_ICMP))
                                nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                              "ip_ct_icmp: bad ICMP checksum ");
                        return -NF_ACCEPT;
                }
-       default:
-               break;
        }
 
 checksum_skipped:
@@ -282,10 +279,6 @@ static int icmp_tuple_to_nfattr(struct sk_buff *skb,
        NFA_PUT(skb, CTA_PROTO_ICMP_CODE, sizeof(u_int8_t),
                &t->dst.u.icmp.code);
 
-       if (t->dst.u.icmp.type >= sizeof(valid_new) 
-           || !valid_new[t->dst.u.icmp.type])
-               return -EINVAL;
-
        return 0;
 
 nfattr_failure:
@@ -296,15 +289,20 @@ static int icmp_nfattr_to_tuple(struct nfattr *tb[],
                                struct ip_conntrack_tuple *tuple)
 {
        if (!tb[CTA_PROTO_ICMP_TYPE-1]
-           || !tb[CTA_PROTO_ICMP_CODE-1])
-               return -1;
+           || !tb[CTA_PROTO_ICMP_CODE-1]
+           || !tb[CTA_PROTO_ICMP_ID-1])
+               return -EINVAL;
 
        tuple->dst.u.icmp.type = 
                        *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_TYPE-1]);
        tuple->dst.u.icmp.code =
                        *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_CODE-1]);
        tuple->src.u.icmp.id =
-                       *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
+                       *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
+
+       if (tuple->dst.u.icmp.type >= sizeof(invmap)
+           || !invmap[tuple->dst.u.icmp.type])
+               return -EINVAL;
 
        return 0;
 }