fedora core 6 1.2949 + vserver 2.2.0

[linux-2.6.git] / net / ipv4 / netfilter / ip_conntrack_ftp.c

diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index e627e58..0410c99 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -8,7 +8,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/netfilter.h>
 #include <linux/ip.h>
@@ -56,37 +55,48 @@ static int try_eprt(const char *, size_t, u_int32_t [], char);
 static int try_epsv_response(const char *, size_t, u_int32_t [], char);
 
 static const struct ftp_search {
-       enum ip_conntrack_dir dir;
        const char *pattern;
        size_t plen;
        char skip;
        char term;
        enum ip_ct_ftp_type ftptype;
        int (*getnum)(const char *, size_t, u_int32_t[], char);
-} search[] = {
-       {
-               IP_CT_DIR_ORIGINAL,
-               "PORT", sizeof("PORT") - 1, ' ', '\r',
-               IP_CT_FTP_PORT,
-               try_rfc959,
+} search[IP_CT_DIR_MAX][2] = {
+       [IP_CT_DIR_ORIGINAL] = {
+               {
+                       .pattern        =  "PORT",
+                       .plen           = sizeof("PORT") - 1,
+                       .skip           = ' ',
+                       .term           = '\r',
+                       .ftptype        = IP_CT_FTP_PORT,
+                       .getnum         = try_rfc959,
+               },
+               {
+                       .pattern        = "EPRT",
+                       .plen           = sizeof("EPRT") - 1,
+                       .skip           = ' ',
+                       .term           = '\r',
+                       .ftptype        = IP_CT_FTP_EPRT,
+                       .getnum         = try_eprt,
+               },
        },
-       {
-               IP_CT_DIR_REPLY,
-               "227 ", sizeof("227 ") - 1, '(', ')',
-               IP_CT_FTP_PASV,
-               try_rfc959,
-       },
-       {
-               IP_CT_DIR_ORIGINAL,
-               "EPRT", sizeof("EPRT") - 1, ' ', '\r',
-               IP_CT_FTP_EPRT,
-               try_eprt,
-       },
-       {
-               IP_CT_DIR_REPLY,
-               "229 ", sizeof("229 ") - 1, '(', ')',
-               IP_CT_FTP_EPSV,
-               try_epsv_response,
+       [IP_CT_DIR_REPLY] = {
+               {
+                       .pattern        = "227 ",
+                       .plen           = sizeof("227 ") - 1,
+                       .skip           = '(',
+                       .term           = ')',
+                       .ftptype        = IP_CT_FTP_PASV,
+                       .getnum         = try_rfc959,
+               },
+               {
+                       .pattern        = "229 ",
+                       .plen           = sizeof("229 ") - 1,
+                       .skip           = '(',
+                       .term           = ')',
+                       .ftptype        = IP_CT_FTP_EPSV,
+                       .getnum         = try_epsv_response,
+               },
        },
 };
 
@@ -300,6 +310,7 @@ static int help(struct sk_buff **pskb,
        struct ip_conntrack_expect *exp;
        unsigned int i;
        int found = 0, ends_in_nl;
+       typeof(ip_nat_ftp_hook) ip_nat_ftp;
 
        /* Until there's been traffic both ways, don't look in packets. */
        if (ctinfo != IP_CT_ESTABLISHED
@@ -346,17 +357,15 @@ static int help(struct sk_buff **pskb,
        array[2] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 8) & 0xFF;
        array[3] = ntohl(ct->tuplehash[dir].tuple.src.ip) & 0xFF;
 
-       for (i = 0; i < ARRAY_SIZE(search); i++) {
-               if (search[i].dir != dir) continue;
-
+       for (i = 0; i < ARRAY_SIZE(search[dir]); i++) {
                found = find_pattern(fb_ptr, (*pskb)->len - dataoff,
-                                    search[i].pattern,
-                                    search[i].plen,
-                                    search[i].skip,
-                                    search[i].term,
+                                    search[dir][i].pattern,
+                                    search[dir][i].plen,
+                                    search[dir][i].skip,
+                                    search[dir][i].term,
                                     &matchoff, &matchlen,
                                     array,
-                                    search[i].getnum);
+                                    search[dir][i].getnum);
                if (found) break;
        }
        if (found == -1) {
@@ -366,7 +375,7 @@ static int help(struct sk_buff **pskb,
                   this case. */
                if (net_ratelimit())
                        printk("conntrack_ftp: partial %s %u+%u\n",
-                              search[i].pattern,
+                              search[dir][i].pattern,
                               ntohl(th->seq), datalen);
                ret = NF_DROP;
                goto out;
@@ -417,17 +426,18 @@ static int help(struct sk_buff **pskb,
        exp->tuple.src.u.tcp.port = 0; /* Don't care. */
        exp->tuple.dst.protonum = IPPROTO_TCP;
        exp->mask = ((struct ip_conntrack_tuple)
-               { { 0xFFFFFFFF, { 0 } },
-                 { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
+               { { htonl(0xFFFFFFFF), { 0 } },
+                 { htonl(0xFFFFFFFF), { .tcp = { htons(0xFFFF) } }, 0xFF }});
 
        exp->expectfn = NULL;
        exp->flags = 0;
 
        /* Now, NAT might want to mangle the packet, and register the
         * (possibly changed) expectation itself. */
-       if (ip_nat_ftp_hook)
-               ret = ip_nat_ftp_hook(pskb, ctinfo, search[i].ftptype,
-                                     matchoff, matchlen, exp, &seq);
+       ip_nat_ftp = rcu_dereference(ip_nat_ftp_hook);
+       if (ip_nat_ftp)
+               ret = ip_nat_ftp(pskb, ctinfo, search[dir][i].ftptype,
+                                matchoff, matchlen, exp, &seq);
        else {
                /* Can't expect this?  Best to drop packet now. */
                if (ip_conntrack_expect_related(exp) != 0)
@@ -453,7 +463,7 @@ static struct ip_conntrack_helper ftp[MAX_PORTS];
 static char ftp_names[MAX_PORTS][sizeof("ftp-65535")];
 
 /* Not __exit: called from init() */
-static void fini(void)
+static void ip_conntrack_ftp_fini(void)
 {
        int i;
        for (i = 0; i < ports_c; i++) {
@@ -465,7 +475,7 @@ static void fini(void)
        kfree(ftp_buffer);
 }
 
-static int __init init(void)
+static int __init ip_conntrack_ftp_init(void)
 {
        int i, ret;
        char *tmpname;
@@ -480,7 +490,7 @@ static int __init init(void)
        for (i = 0; i < ports_c; i++) {
                ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
                ftp[i].tuple.dst.protonum = IPPROTO_TCP;
-               ftp[i].mask.src.u.tcp.port = 0xFFFF;
+               ftp[i].mask.src.u.tcp.port = htons(0xFFFF);
                ftp[i].mask.dst.protonum = 0xFF;
                ftp[i].max_expected = 1;
                ftp[i].timeout = 5 * 60; /* 5 minutes */
@@ -499,12 +509,12 @@ static int __init init(void)
                ret = ip_conntrack_helper_register(&ftp[i]);
 
                if (ret) {
-                       fini();
+                       ip_conntrack_ftp_fini();
                        return ret;
                }
        }
        return 0;
 }
 
-module_init(init);
-module_exit(fini);
+module_init(ip_conntrack_ftp_init);
+module_exit(ip_conntrack_ftp_fini);