-diff -Nurb linux-2.6.22-521/include/linux/netfilter/xt_MARK.h linux-2.6.22-522/include/linux/netfilter/xt_MARK.h
---- linux-2.6.22-521/include/linux/netfilter/xt_MARK.h 2007-07-08 19:32:17.000000000 -0400
-+++ linux-2.6.22-522/include/linux/netfilter/xt_MARK.h 2008-09-17 17:59:53.000000000 -0400
-@@ -11,6 +11,7 @@
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter/xt_MARK.h linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter/xt_MARK.h
+--- linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter/xt_MARK.h 2008-07-13 23:51:29.000000000 +0200
++++ linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter/xt_MARK.h 2009-01-12 01:18:23.000000000 +0100
+@@ -11,6 +11,7 @@ enum {
XT_MARK_SET=0,
XT_MARK_AND,
XT_MARK_OR,
};
struct xt_mark_target_info_v1 {
-diff -Nurb linux-2.6.22-521/include/linux/netfilter/xt_SETXID.h linux-2.6.22-522/include/linux/netfilter/xt_SETXID.h
---- linux-2.6.22-521/include/linux/netfilter/xt_SETXID.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.22-522/include/linux/netfilter/xt_SETXID.h 2008-09-17 17:59:53.000000000 -0400
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter/xt_SETXID.h linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter/xt_SETXID.h
+--- linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter/xt_SETXID.h 1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter/xt_SETXID.h 2009-01-12 01:18:23.000000000 +0100
@@ -0,0 +1,14 @@
+#ifndef _XT_SETXID_H_target
+#define _XT_SETXID_H_target
+};
+
+#endif /*_XT_SETXID_H_target*/
-diff -Nurb linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_MARK.h linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_MARK.h
---- linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_MARK.h 2007-07-08 19:32:17.000000000 -0400
-+++ linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_MARK.h 2008-09-17 17:59:53.000000000 -0400
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter_ipv4/ipt_MARK.h linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter_ipv4/ipt_MARK.h
+--- linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter_ipv4/ipt_MARK.h 2008-07-13 23:51:29.000000000 +0200
++++ linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter_ipv4/ipt_MARK.h 2009-01-12 01:18:23.000000000 +0100
@@ -12,6 +12,7 @@
#define IPT_MARK_SET XT_MARK_SET
#define IPT_MARK_AND XT_MARK_AND
#define ipt_mark_target_info_v1 xt_mark_target_info_v1
-diff -Nurb linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_SETXID.h linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_SETXID.h
---- linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_SETXID.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_SETXID.h 2008-09-17 17:59:53.000000000 -0400
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter_ipv4/ipt_SETXID.h linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter_ipv4/ipt_SETXID.h
+--- linux-2.6.27.10-vs2.3.x-P/include/linux/netfilter_ipv4/ipt_SETXID.h 1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.27.10-vs2.3.x-P522/include/linux/netfilter_ipv4/ipt_SETXID.h 2009-01-12 01:18:23.000000000 +0100
@@ -0,0 +1,13 @@
+#ifndef _IPT_SETXID_H_target
+#define _IPT_SETXID_H_target
+#define ipt_setxid_target_info_v1 xt_setxid_target_info_v1
+
+#endif /*_IPT_SETXID_H_target*/
-diff -Nurb linux-2.6.22-521/include/net/netfilter/nf_conntrack.h linux-2.6.22-522/include/net/netfilter/nf_conntrack.h
---- linux-2.6.22-521/include/net/netfilter/nf_conntrack.h 2007-07-08 19:32:17.000000000 -0400
-+++ linux-2.6.22-522/include/net/netfilter/nf_conntrack.h 2008-09-17 17:59:53.000000000 -0400
-@@ -131,6 +131,9 @@
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/include/net/netfilter/nf_conntrack.h linux-2.6.27.10-vs2.3.x-P522/include/net/netfilter/nf_conntrack.h
+--- linux-2.6.27.10-vs2.3.x-P/include/net/netfilter/nf_conntrack.h 2008-10-13 14:52:09.000000000 +0200
++++ linux-2.6.27.10-vs2.3.x-P522/include/net/netfilter/nf_conntrack.h 2009-01-12 01:59:20.000000000 +0100
+@@ -121,6 +121,9 @@ struct nf_conn
/* Storage reserved for other modules: */
union nf_conntrack_proto proto;
+ /* PLANETLAB. VNET-specific */
+ int xid[IP_CT_DIR_MAX];
+
- /* features dynamically at the end: helper, nat (both optional) */
- char data[0];
- };
-diff -Nurb linux-2.6.22-521/net/netfilter/Kconfig linux-2.6.22-522/net/netfilter/Kconfig
---- linux-2.6.22-521/net/netfilter/Kconfig 2007-07-08 19:32:17.000000000 -0400
-+++ linux-2.6.22-522/net/netfilter/Kconfig 2008-09-17 17:59:53.000000000 -0400
-@@ -389,6 +389,13 @@
+ /* Extensions */
+ struct nf_ct_ext *ext;
- To compile it as a module, choose M here. If unsure, say N.
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/net/netfilter/Kconfig linux-2.6.27.10-vs2.3.x-P522/net/netfilter/Kconfig
+--- linux-2.6.27.10-vs2.3.x-P/net/netfilter/Kconfig 2008-10-13 14:52:09.000000000 +0200
++++ linux-2.6.27.10-vs2.3.x-P522/net/netfilter/Kconfig 2009-01-12 01:18:23.000000000 +0100
+@@ -477,6 +477,13 @@ config NETFILTER_XT_TARGET_TCPOPTSTRIP
+ This option adds a "TCPOPTSTRIP" target, which allows you to strip
+ TCP options from TCP packets.
+config NETFILTER_XT_TARGET_SETXID
+ tristate '"SETXID" target support'
config NETFILTER_XT_MATCH_COMMENT
tristate '"comment" match support'
depends on NETFILTER_XTABLES
-diff -Nurb linux-2.6.22-521/net/netfilter/Makefile linux-2.6.22-522/net/netfilter/Makefile
---- linux-2.6.22-521/net/netfilter/Makefile 2007-07-08 19:32:17.000000000 -0400
-+++ linux-2.6.22-522/net/netfilter/Makefile 2008-09-17 17:59:53.000000000 -0400
-@@ -37,6 +37,7 @@
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/net/netfilter/Makefile linux-2.6.27.10-vs2.3.x-P522/net/netfilter/Makefile
+--- linux-2.6.27.10-vs2.3.x-P/net/netfilter/Makefile 2008-10-13 14:52:09.000000000 +0200
++++ linux-2.6.27.10-vs2.3.x-P522/net/netfilter/Makefile 2009-01-12 01:18:23.000000000 +0100
+@@ -38,6 +38,7 @@ obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_co
obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
# targets
+obj-$(CONFIG_NETFILTER_XT_TARGET_SETXID) += xt_SETXID.o
obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o
obj-$(CONFIG_NETFILTER_XT_TARGET_CONNMARK) += xt_CONNMARK.o
- obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
-diff -Nurb linux-2.6.22-521/net/netfilter/nf_conntrack_core.c linux-2.6.22-522/net/netfilter/nf_conntrack_core.c
---- linux-2.6.22-521/net/netfilter/nf_conntrack_core.c 2007-07-08 19:32:17.000000000 -0400
-+++ linux-2.6.22-522/net/netfilter/nf_conntrack_core.c 2008-09-17 17:59:53.000000000 -0400
-@@ -726,6 +726,8 @@
-
+ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/net/netfilter/nf_conntrack_core.c linux-2.6.27.10-vs2.3.x-P522/net/netfilter/nf_conntrack_core.c
+--- linux-2.6.27.10-vs2.3.x-P/net/netfilter/nf_conntrack_core.c 2008-10-13 14:52:09.000000000 +0200
++++ linux-2.6.27.10-vs2.3.x-P522/net/netfilter/nf_conntrack_core.c 2009-01-12 02:01:55.000000000 +0100
+@@ -595,6 +595,9 @@ init_conntrack(const struct nf_conntrack
/* Overload tuple linked list to put us in unconfirmed list. */
- list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);
+ hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode, &unconfirmed);
+
+ conntrack->xid[IP_CT_DIR_ORIGINAL] = -1;
+ conntrack->xid[IP_CT_DIR_REPLY] = -1;
++
+ spin_unlock_bh(&nf_conntrack_lock);
- write_unlock_bh(&nf_conntrack_lock);
-
-diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilter/xt_MARK.c
---- linux-2.6.22-521/net/netfilter/xt_MARK.c 2007-07-08 19:32:17.000000000 -0400
-+++ linux-2.6.22-522/net/netfilter/xt_MARK.c 2008-09-17 18:29:52.000000000 -0400
-@@ -5,13 +5,19 @@
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
+ if (exp) {
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/net/netfilter/xt_MARK.c linux-2.6.27.10-vs2.3.x-P522/net/netfilter/xt_MARK.c
+--- linux-2.6.27.10-vs2.3.x-P/net/netfilter/xt_MARK.c 2008-07-13 23:51:29.000000000 +0200
++++ linux-2.6.27.10-vs2.3.x-P522/net/netfilter/xt_MARK.c 2009-01-12 02:20:38.000000000 +0100
+@@ -8,13 +8,19 @@
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
*/
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_MARK.h>
-@@ -21,6 +27,50 @@
+@@ -24,6 +30,50 @@ MODULE_DESCRIPTION("Xtables: packet mark
MODULE_ALIAS("ipt_MARK");
MODULE_ALIAS("ip6t_MARK");
+}
+
static unsigned int
- target_v0(struct sk_buff **pskb,
- const struct net_device *in,
-@@ -35,6 +85,68 @@
+ mark_tg_v0(struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+@@ -35,13 +85,88 @@ mark_tg_v0(struct sk_buff *skb, const st
return XT_CONTINUE;
}
+#define related(ct) (ct==(IP_CT_IS_REPLY + IP_CT_RELATED))
+
static unsigned int
- target_v1(struct sk_buff **pskb,
- const struct net_device *in,
-@@ -44,7 +156,20 @@
- const void *targinfo)
+ mark_tg_v1(struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+ const struct xt_target *target, const void *targinfo)
{
const struct xt_mark_target_info_v1 *markinfo = targinfo;
- int mark = 0;
switch (markinfo->mode) {
case XT_MARK_SET:
-@@ -58,13 +183,126 @@
+@@ -55,9 +180,119 @@ mark_tg_v1(struct sk_buff *skb, const st
case XT_MARK_OR:
- mark = (*pskb)->mark | markinfo->mark;
+ mark = skb->mark | markinfo->mark;
break;
+
-+ case XT_MARK_COPYXID:
-+ dif = ((struct rtable *)(*pskb)->dst)->rt_iif;
-+
-+ ct = nf_ct_get((*pskb), &ctinfo);
-+ if (!ct)
-+ break;
-+
-+ dir = CTINFO2DIR(ctinfo);
-+ src_ip = ct->tuplehash[dir].tuple.src.u3.ip;
-+ dst_ip = ct->tuplehash[dir].tuple.dst.u3.ip;
-+ src_port = get_src_port(&ct->tuplehash[dir].tuple);
-+ proto = ct->tuplehash[dir].tuple.dst.protonum;
-+
-+ ip = ct->tuplehash[dir].tuple.dst.u3.ip;
-+ port = get_dst_port(&ct->tuplehash[dir].tuple);
-+
-+ if (proto == 1) {
-+ if ((*pskb)->mark>0) /* The packet is marked, it's going out */
-+ {
-+ ct->xid[0]=(*pskb)->mark;
-+ }
-+
-+ if (ct->xid[0] > 0) {
-+ mark = ct->xid[0];
-+ }
-+ }
-+ else if (proto == 17) {
-+ struct sock *sk;
-+ if (!(*pskb)->mark) {
-+ sk = __udp4_lib_lookup(src_ip, src_port, ip, port,
-+ dif, udp_hash);
-+
-+ if (sk && hooknum==NF_IP_LOCAL_IN) {
-+ mark=sk->sk_nid;
-+ }
-+
-+ if (sk) {
-+ sock_put(sk);
-+ }
-+ }
-+ else
-+ if ((*pskb)->mark>0) /* The packet is marked, it's going out */
-+ {
-+ ct->xid[0]=(*pskb)->mark;
-+ }
-+ }
-+ else if (proto == 6) /* TCP */{
-+ int sockettype=0; /* Established socket */
-+ /* Looks for an established socket or a listening socket corresponding to the 4-tuple, in
-+ * that order. The order is important for Codemux connections to be handled properly */
-+
-+ connection_sk = inet_lookup_established(&tcp_hashinfo, src_ip, src_port, ip, port, dif);
-+
-+ if (!connection_sk) {
-+ connection_sk = inet_lookup_listener(&tcp_hashinfo, ip, port, dif);
-+ sockettype=1; /* Listening socket */
-+ }
-+
-+ if (connection_sk) {
-+ /* The peercred is not set. We set it if the other side has an xid. */
-+ if (!PEERCRED_SET(connection_sk->sk_peercred.uid)
-+ && ct->xid[!dir]>0 && (sockettype==0)) {
-+ connection_sk->sk_peercred.gid = connection_sk->sk_peercred.uid = ct->xid[!dir];
-+ }
-+
-+ /* The peercred is set, and is not equal to the XID of 'the other side' */
-+ else if (PEERCRED_SET(connection_sk->sk_peercred.uid) && (connection_sk->sk_peercred.uid != ct->xid[!dir]) && (sockettype==0)) {
-+ mark = connection_sk->sk_peercred.uid;
-+ }
-+
-+ /* Has this connection already been tagged? */
-+ if (ct->xid[dir] < 1) {
-+ /* No - let's tag it */
-+ ct->xid[dir]=connection_sk->sk_nid;
-+
-+ }
-+
-+ if (mark==-1 && (ct->xid[dir]!= 0))
-+ mark = ct->xid[dir];
-+
-+ if (connection_sk->sk_state == TCP_TIME_WAIT) {
-+ inet_twsk_put(inet_twsk(connection_sk));
-+ break;
-+ }
-+ else
-+ sock_put(connection_sk);
- }
-
-+ /* All else failed. Is this a connection over raw sockets? That explains
-+ * why we couldn't get anything out of skb->sk, or look up a "real" connection.*/
-+ if (ct->xid[dir]<1) {
-+ if ((*pskb)->skb_tag) {
-+ ct->xid[dir]=(*pskb)->skb_tag;
-+ }
-+ }
-+
-+ /* Covers CoDemux case */
-+ if (mark < 1 && (ct->xid[dir]>0)) {
-+ mark = ct->xid[dir];
-+ }
-+
-+ if (mark < 1 && (ct->xid[!dir]>0)) {
-+ mark = ct->xid[!dir];
-+ }
-+ break;
-+ }
++ case XT_MARK_COPYXID:
++ dif = ((struct rtable *)(*pskb)->dst)->rt_iif;
++
++ ct = nf_ct_get((*pskb), &ctinfo);
++ if (!ct)
++ break;
++
++ dir = CTINFO2DIR(ctinfo);
++ src_ip = ct->tuplehash[dir].tuple.src.u3.ip;
++ dst_ip = ct->tuplehash[dir].tuple.dst.u3.ip;
++ src_port = get_src_port(&ct->tuplehash[dir].tuple);
++ proto = ct->tuplehash[dir].tuple.dst.protonum;
++
++ ip = ct->tuplehash[dir].tuple.dst.u3.ip;
++ port = get_dst_port(&ct->tuplehash[dir].tuple);
++
++ if (proto == 1) {
++ if ((*pskb)->mark > 0)
++ /* The packet is marked, it's going out */
++ ct->xid[0] = (*pskb)->mark;
++
++ if (ct->xid[0] > 0)
++ mark = ct->xid[0];
+ }
-+ if (mark != -1) {
- (*pskb)->mark = mark;
++ else if (proto == 17) {
++ struct sock *sk;
++ if (!(*pskb)->mark) {
++ sk = __udp4_lib_lookup(src_ip, src_port,
++ ip, port, dif, udp_hash);
++
++ if (sk && hooknum == NF_IP_LOCAL_IN)
++ mark = sk->sk_nid;
++
++ if (sk)
++ sock_put(sk);
++ }
++ else if ((*pskb)->mark > 0)
++ /* The packet is marked, it's going out */
++ ct->xid[0] = (*pskb)->mark;
+ }
-+
-+ curtag=&__get_cpu_var(sknid_elevator);
-+ if (mark > 0 && *curtag==-2 && hooknum==NF_IP_LOCAL_IN)
-+ {
-+ *curtag = mark;
++ else if (proto == 6) /* TCP */{
++ int sockettype = 0; /* Established socket */
++
++ /* Looks for an established socket or a listening
++ socket corresponding to the 4-tuple, in that order.
++ The order is important for Codemux connections
++ to be handled properly */
++
++ connection_sk = inet_lookup_established(&tcp_hashinfo,
++ src_ip, src_port, ip, port, dif);
++
++ if (!connection_sk) {
++ connection_sk = inet_lookup_listener(&tcp_hashinfo,
++ ip, port, dif);
++ sockettype = 1; /* Listening socket */
++ }
++
++ if (connection_sk) {
++ /* The peercred is not set. We set it if the other side has an xid. */
++ if (!PEERCRED_SET(connection_sk->sk_peercred.uid)
++ && ct->xid[!dir] > 0 && (sockettype == 0)) {
++ connection_sk->sk_peercred.gid =
++ connection_sk->sk_peercred.uid = ct->xid[!dir];
++ }
++
++ /* The peercred is set, and is not equal to the XID of 'the other side' */
++ else if (PEERCRED_SET(connection_sk->sk_peercred.uid) &&
++ (connection_sk->sk_peercred.uid != ct->xid[!dir]) &&
++ (sockettype == 0)) {
++ mark = connection_sk->sk_peercred.uid;
++ }
++
++ /* Has this connection already been tagged? */
++ if (ct->xid[dir] < 1) {
++ /* No - let's tag it */
++ ct->xid[dir]=connection_sk->sk_nid;
++ }
++
++ if (mark == -1 && (ct->xid[dir] != 0))
++ mark = ct->xid[dir];
++
++ if (connection_sk->sk_state == TCP_TIME_WAIT) {
++ inet_twsk_put(inet_twsk(connection_sk));
++ break;
++ } else
++ sock_put(connection_sk);
++ }
++
++ /* All else failed. Is this a connection over raw sockets?
++ That explains why we couldn't get anything out of skb->sk,
++ or look up a "real" connection. */
++ if (ct->xid[dir] < 1) {
++ if ((*pskb)->skb_tag)
++ ct->xid[dir] = (*pskb)->skb_tag;
++ }
++
++ /* Covers CoDemux case */
++ if (mark < 1 && (ct->xid[dir] > 0))
++ mark = ct->xid[dir];
++
++ if (mark < 1 && (ct->xid[!dir] > 0))
++ mark = ct->xid[!dir];
++ break;
+ }
+ }
++ if (mark != -1)
++ skb->mark = mark;
++
++ curtag = &__get_cpu_var(sknid_elevator);
++ if (mark > 0 && *curtag == -2 && hooknum == NF_IP_LOCAL_IN)
++ *curtag = mark;
+
+- skb->mark = mark;
return XT_CONTINUE;
}
--
- static int
- checkentry_v0(const char *tablename,
- const void *entry,
-@@ -92,7 +330,8 @@
+@@ -95,7 +330,8 @@ mark_tg_check_v1(const char *tablename,
if (markinfo->mode != XT_MARK_SET
&& markinfo->mode != XT_MARK_AND
+ && markinfo->mode != XT_MARK_COPYXID) {
printk(KERN_WARNING "MARK: unknown mode %u\n",
markinfo->mode);
- return 0;
-diff -Nurb linux-2.6.22-521/net/netfilter/xt_SETXID.c linux-2.6.22-522/net/netfilter/xt_SETXID.c
---- linux-2.6.22-521/net/netfilter/xt_SETXID.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.22-522/net/netfilter/xt_SETXID.c 2008-09-17 17:59:53.000000000 -0400
+ return false;
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-P/net/netfilter/xt_SETXID.c linux-2.6.27.10-vs2.3.x-P522/net/netfilter/xt_SETXID.c
+--- linux-2.6.27.10-vs2.3.x-P/net/netfilter/xt_SETXID.c 1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.27.10-vs2.3.x-P522/net/netfilter/xt_SETXID.c 2009-01-12 01:18:23.000000000 +0100
@@ -0,0 +1,79 @@
+#include <linux/module.h>
+#include <linux/skbuff.h>
+
+module_init(init);
+module_exit(fini);
+
+; fixup
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-PS-02.0/net/netfilter/nf_conntrack_core.c linux-2.6.27.10-vs2.3.x-PS-02.1/net/netfilter/nf_conntrack_core.c
+--- linux-2.6.27.10-vs2.3.x-PS-02.0/net/netfilter/nf_conntrack_core.c 2009-01-25 02:29:31.000000000 +0100
++++ linux-2.6.27.10-vs2.3.x-PS-02.1/net/netfilter/nf_conntrack_core.c 2009-01-24 23:22:04.000000000 +0100
+@@ -595,8 +595,8 @@ init_conntrack(const struct nf_conntrack
+ /* Overload tuple linked list to put us in unconfirmed list. */
+ hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode, &unconfirmed);
+
+- conntrack->xid[IP_CT_DIR_ORIGINAL] = -1;
+- conntrack->xid[IP_CT_DIR_REPLY] = -1;
++ ct->xid[IP_CT_DIR_ORIGINAL] = -1;
++ ct->xid[IP_CT_DIR_REPLY] = -1;
+
+ spin_unlock_bh(&nf_conntrack_lock);
+
+diff -NurpP --exclude '*.orig' --exclude '*.rej' linux-2.6.27.10-vs2.3.x-PS-02.0/net/netfilter/xt_MARK.c linux-2.6.27.10-vs2.3.x-PS-02.1/net/netfilter/xt_MARK.c
+--- linux-2.6.27.10-vs2.3.x-PS-02.0/net/netfilter/xt_MARK.c 2009-01-25 02:29:31.000000000 +0100
++++ linux-2.6.27.10-vs2.3.x-PS-02.1/net/netfilter/xt_MARK.c 2009-01-25 00:06:34.000000000 +0100
+@@ -19,6 +19,7 @@
+ #include <net/checksum.h>
+ #include <net/route.h>
+ #include <net/inet_hashtables.h>
++#include <net/net_namespace.h>
+
+ #include <net/netfilter/nf_conntrack.h>
+ #include <linux/netfilter/x_tables.h>
+@@ -182,9 +183,9 @@ mark_tg_v1(struct sk_buff *skb, const st
+ break;
+
+ case XT_MARK_COPYXID:
+- dif = ((struct rtable *)(*pskb)->dst)->rt_iif;
++ dif = ((struct rtable *)(skb->dst))->rt_iif;
+
+- ct = nf_ct_get((*pskb), &ctinfo);
++ ct = nf_ct_get(skb, &ctinfo);
+ if (!ct)
+ break;
+
+@@ -198,43 +199,44 @@ mark_tg_v1(struct sk_buff *skb, const st
+ port = get_dst_port(&ct->tuplehash[dir].tuple);
+
+ if (proto == 1) {
+- if ((*pskb)->mark > 0)
++ if (skb->mark > 0)
+ /* The packet is marked, it's going out */
+- ct->xid[0] = (*pskb)->mark;
++ ct->xid[0] = skb->mark;
+
+ if (ct->xid[0] > 0)
+ mark = ct->xid[0];
+ }
+ else if (proto == 17) {
+ struct sock *sk;
+- if (!(*pskb)->mark) {
++ if (!skb->mark) {
+ sk = __udp4_lib_lookup(src_ip, src_port,
+ ip, port, dif, udp_hash);
+
+- if (sk && hooknum == NF_IP_LOCAL_IN)
++ if (sk && hooknum == NF_INET_LOCAL_IN)
+ mark = sk->sk_nid;
+
+ if (sk)
+ sock_put(sk);
+ }
+- else if ((*pskb)->mark > 0)
++ else if (skb->mark > 0)
+ /* The packet is marked, it's going out */
+- ct->xid[0] = (*pskb)->mark;
++ ct->xid[0] = skb->mark;
+ }
+ else if (proto == 6) /* TCP */{
+ int sockettype = 0; /* Established socket */
++ struct net *net = &init_net;
+
+ /* Looks for an established socket or a listening
+ socket corresponding to the 4-tuple, in that order.
+ The order is important for Codemux connections
+ to be handled properly */
+
+- connection_sk = inet_lookup_established(&tcp_hashinfo,
+- src_ip, src_port, ip, port, dif);
++ connection_sk = inet_lookup_established(net,
++ &tcp_hashinfo, src_ip, src_port, ip, port, dif);
+
+ if (!connection_sk) {
+- connection_sk = inet_lookup_listener(&tcp_hashinfo,
+- ip, port, dif);
++ connection_sk = inet_lookup_listener(net,
++ &tcp_hashinfo, ip, port, dif);
+ sockettype = 1; /* Listening socket */
+ }
+
+@@ -273,8 +275,8 @@ mark_tg_v1(struct sk_buff *skb, const st
+ That explains why we couldn't get anything out of skb->sk,
+ or look up a "real" connection. */
+ if (ct->xid[dir] < 1) {
+- if ((*pskb)->skb_tag)
+- ct->xid[dir] = (*pskb)->skb_tag;
++ if (skb->skb_tag)
++ ct->xid[dir] = skb->skb_tag;
+ }
+
+ /* Covers CoDemux case */
+@@ -290,7 +292,7 @@ mark_tg_v1(struct sk_buff *skb, const st
+ skb->mark = mark;
+
+ curtag = &__get_cpu_var(sknid_elevator);
+- if (mark > 0 && *curtag == -2 && hooknum == NF_IP_LOCAL_IN)
++ if (mark > 0 && *curtag == -2 && hooknum == NF_INET_LOCAL_IN)
+ *curtag = mark;
+
+ return XT_CONTINUE;
git://git.onelab.eu / linux-2.6.git / blobdiff