ia64/linux-2.6.18-xen.hg

view net/netfilter/xt_helper.c @ 871:9cbcc9008446

xen/x86: don't initialize cpu_data[]'s apicid field on generic code

Afaict, this is not only redundant with the intialization done in
drivers/xen/core/smpboot.c, but actually results - at least for
secondary CPUs - in the Xen-specific value written to be later
overwritten with whatever the generic code determines (with no
guarantee that the two values are identical).

Signed-off-by: Jan Beulich <jbeulich@novell.com>
author Keir Fraser <keir.fraser@citrix.com>
date Thu May 14 10:09:15 2009 +0100 (2009-05-14)
parents 831230e53067
children
line source
1 /* iptables module to match on related connections */
2 /*
3 * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * 19 Mar 2002 Harald Welte <laforge@gnumonks.org>:
10 * - Port to newnat infrastructure
11 */
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/netfilter.h>
16 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
17 #include <linux/netfilter_ipv4/ip_conntrack.h>
18 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
19 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
20 #else
21 #include <net/netfilter/nf_conntrack.h>
22 #include <net/netfilter/nf_conntrack_core.h>
23 #include <net/netfilter/nf_conntrack_helper.h>
24 #endif
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter/xt_helper.h>
28 MODULE_LICENSE("GPL");
29 MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
30 MODULE_DESCRIPTION("iptables helper match module");
31 MODULE_ALIAS("ipt_helper");
32 MODULE_ALIAS("ip6t_helper");
34 #if 0
35 #define DEBUGP printk
36 #else
37 #define DEBUGP(format, args...)
38 #endif
40 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
41 static int
42 match(const struct sk_buff *skb,
43 const struct net_device *in,
44 const struct net_device *out,
45 const struct xt_match *match,
46 const void *matchinfo,
47 int offset,
48 unsigned int protoff,
49 int *hotdrop)
50 {
51 const struct xt_helper_info *info = matchinfo;
52 struct ip_conntrack *ct;
53 enum ip_conntrack_info ctinfo;
54 int ret = info->invert;
56 ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
57 if (!ct) {
58 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
59 return ret;
60 }
62 if (!ct->master) {
63 DEBUGP("xt_helper: conntrack %p has no master\n", ct);
64 return ret;
65 }
67 read_lock_bh(&ip_conntrack_lock);
68 if (!ct->master->helper) {
69 DEBUGP("xt_helper: master ct %p has no helper\n",
70 exp->expectant);
71 goto out_unlock;
72 }
74 DEBUGP("master's name = %s , info->name = %s\n",
75 ct->master->helper->name, info->name);
77 if (info->name[0] == '\0')
78 ret ^= 1;
79 else
80 ret ^= !strncmp(ct->master->helper->name, info->name,
81 strlen(ct->master->helper->name));
82 out_unlock:
83 read_unlock_bh(&ip_conntrack_lock);
84 return ret;
85 }
87 #else /* CONFIG_IP_NF_CONNTRACK */
89 static int
90 match(const struct sk_buff *skb,
91 const struct net_device *in,
92 const struct net_device *out,
93 const struct xt_match *match,
94 const void *matchinfo,
95 int offset,
96 unsigned int protoff,
97 int *hotdrop)
98 {
99 const struct xt_helper_info *info = matchinfo;
100 struct nf_conn *ct;
101 struct nf_conn_help *master_help;
102 enum ip_conntrack_info ctinfo;
103 int ret = info->invert;
105 ct = nf_ct_get((struct sk_buff *)skb, &ctinfo);
106 if (!ct) {
107 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
108 return ret;
109 }
111 if (!ct->master) {
112 DEBUGP("xt_helper: conntrack %p has no master\n", ct);
113 return ret;
114 }
116 read_lock_bh(&nf_conntrack_lock);
117 master_help = nfct_help(ct->master);
118 if (!master_help || !master_help->helper) {
119 DEBUGP("xt_helper: master ct %p has no helper\n",
120 exp->expectant);
121 goto out_unlock;
122 }
124 DEBUGP("master's name = %s , info->name = %s\n",
125 ct->master->helper->name, info->name);
127 if (info->name[0] == '\0')
128 ret ^= 1;
129 else
130 ret ^= !strncmp(master_help->helper->name, info->name,
131 strlen(master_help->helper->name));
132 out_unlock:
133 read_unlock_bh(&nf_conntrack_lock);
134 return ret;
135 }
136 #endif
138 static int check(const char *tablename,
139 const void *inf,
140 const struct xt_match *match,
141 void *matchinfo,
142 unsigned int matchsize,
143 unsigned int hook_mask)
144 {
145 struct xt_helper_info *info = matchinfo;
147 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
148 if (nf_ct_l3proto_try_module_get(match->family) < 0) {
149 printk(KERN_WARNING "can't load nf_conntrack support for "
150 "proto=%d\n", match->family);
151 return 0;
152 }
153 #endif
154 info->name[29] = '\0';
155 return 1;
156 }
158 static void
159 destroy(const struct xt_match *match, void *matchinfo, unsigned int matchsize)
160 {
161 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
162 nf_ct_l3proto_module_put(match->family);
163 #endif
164 }
166 static struct xt_match helper_match = {
167 .name = "helper",
168 .match = match,
169 .matchsize = sizeof(struct xt_helper_info),
170 .checkentry = check,
171 .destroy = destroy,
172 .family = AF_INET,
173 .me = THIS_MODULE,
174 };
175 static struct xt_match helper6_match = {
176 .name = "helper",
177 .match = match,
178 .matchsize = sizeof(struct xt_helper_info),
179 .checkentry = check,
180 .destroy = destroy,
181 .family = AF_INET6,
182 .me = THIS_MODULE,
183 };
185 static int __init xt_helper_init(void)
186 {
187 int ret;
188 need_conntrack();
190 ret = xt_register_match(&helper_match);
191 if (ret < 0)
192 return ret;
194 ret = xt_register_match(&helper6_match);
195 if (ret < 0)
196 xt_unregister_match(&helper_match);
198 return ret;
199 }
201 static void __exit xt_helper_fini(void)
202 {
203 xt_unregister_match(&helper_match);
204 xt_unregister_match(&helper6_match);
205 }
207 module_init(xt_helper_init);
208 module_exit(xt_helper_fini);