fedora core 6 1.2949 + vserver 2.2.0

[linux-2.6.git] / net / netfilter / nf_queue.c

diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index d9f0d7e..4d8936e 100644 (file)
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -1,4 +1,3 @@
-#include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -17,7 +16,6 @@
  * for queueing and must reinject all packets it receives, no matter what.
  */
 static struct nf_queue_handler *queue_handler[NPROTO];
-static struct nf_queue_rerouter *queue_rerouter[NPROTO];
 
 static DEFINE_RWLOCK(queue_handler_lock);
 
@@ -59,32 +57,6 @@ int nf_unregister_queue_handler(int pf)
 }
 EXPORT_SYMBOL(nf_unregister_queue_handler);
 
-int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer)
-{
-       if (pf >= NPROTO)
-               return -EINVAL;
-
-       write_lock_bh(&queue_handler_lock);
-       rcu_assign_pointer(queue_rerouter[pf], rer);
-       write_unlock_bh(&queue_handler_lock);
-
-       return 0;
-}
-EXPORT_SYMBOL_GPL(nf_register_queue_rerouter);
-
-int nf_unregister_queue_rerouter(int pf)
-{
-       if (pf >= NPROTO)
-               return -EINVAL;
-
-       write_lock_bh(&queue_handler_lock);
-       rcu_assign_pointer(queue_rerouter[pf], NULL);
-       write_unlock_bh(&queue_handler_lock);
-       synchronize_rcu();
-       return 0;
-}
-EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);
-
 void nf_unregister_queue_handlers(struct nf_queue_handler *qh)
 {
        int pf;
@@ -102,13 +74,13 @@ EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
  * Any packet that leaves via this function must come back 
  * through nf_reinject().
  */
-int nf_queue(struct sk_buff **skb, 
-            struct list_head *elem, 
-            int pf, unsigned int hook,
-            struct net_device *indev,
-            struct net_device *outdev,
-            int (*okfn)(struct sk_buff *),
-            unsigned int queuenum)
+static int __nf_queue(struct sk_buff *skb,
+                     struct list_head *elem,
+                     int pf, unsigned int hook,
+                     struct net_device *indev,
+                     struct net_device *outdev,
+                     int (*okfn)(struct sk_buff *),
+                     unsigned int queuenum)
 {
        int status;
        struct nf_info *info;
@@ -116,23 +88,30 @@ int nf_queue(struct sk_buff **skb,
        struct net_device *physindev = NULL;
        struct net_device *physoutdev = NULL;
 #endif
-       struct nf_queue_rerouter *rerouter;
+       struct nf_afinfo *afinfo;
 
        /* QUEUE == DROP if noone is waiting, to be safe. */
        read_lock(&queue_handler_lock);
        if (!queue_handler[pf]) {
                read_unlock(&queue_handler_lock);
-               kfree_skb(*skb);
+               kfree_skb(skb);
                return 1;
        }
 
-       info = kmalloc(sizeof(*info)+queue_rerouter[pf]->rer_size, GFP_ATOMIC);
+       afinfo = nf_get_afinfo(pf);
+       if (!afinfo) {
+               read_unlock(&queue_handler_lock);
+               kfree_skb(skb);
+               return 1;
+       }
+
+       info = kmalloc(sizeof(*info) + afinfo->route_key_size, GFP_ATOMIC);
        if (!info) {
                if (net_ratelimit())
                        printk(KERN_ERR "OOM queueing packet %p\n",
-                              *skb);
+                              skb);
                read_unlock(&queue_handler_lock);
-               kfree_skb(*skb);
+               kfree_skb(skb);
                return 1;
        }
 
@@ -151,18 +130,15 @@ int nf_queue(struct sk_buff **skb,
        if (outdev) dev_hold(outdev);
 
 #ifdef CONFIG_BRIDGE_NETFILTER
-       if ((*skb)->nf_bridge) {
-               physindev = (*skb)->nf_bridge->physindev;
+       if (skb->nf_bridge) {
+               physindev = skb->nf_bridge->physindev;
                if (physindev) dev_hold(physindev);
-               physoutdev = (*skb)->nf_bridge->physoutdev;
+               physoutdev = skb->nf_bridge->physoutdev;
                if (physoutdev) dev_hold(physoutdev);
        }
 #endif
-       rerouter = rcu_dereference(queue_rerouter[pf]);
-       if (rerouter)
-               rerouter->save(*skb, info);
-
-       status = queue_handler[pf]->outfn(*skb, info, queuenum,
+       afinfo->saveroute(skb, info);
+       status = queue_handler[pf]->outfn(skb, info, queuenum,
                                          queue_handler[pf]->data);
 
        read_unlock(&queue_handler_lock);
@@ -177,7 +153,7 @@ int nf_queue(struct sk_buff **skb,
 #endif
                module_put(info->elem->owner);
                kfree(info);
-               kfree_skb(*skb);
+               kfree_skb(skb);
 
                return 1;
        }
@@ -185,12 +161,52 @@ int nf_queue(struct sk_buff **skb,
        return 1;
 }
 
+int nf_queue(struct sk_buff *skb,
+            struct list_head *elem,
+            int pf, unsigned int hook,
+            struct net_device *indev,
+            struct net_device *outdev,
+            int (*okfn)(struct sk_buff *),
+            unsigned int queuenum)
+{
+       struct sk_buff *segs;
+
+       if (!skb_is_gso(skb))
+               return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
+                                 queuenum);
+
+       switch (pf) {
+       case AF_INET:
+               skb->protocol = htons(ETH_P_IP);
+               break;
+       case AF_INET6:
+               skb->protocol = htons(ETH_P_IPV6);
+               break;
+       }
+
+       segs = skb_gso_segment(skb, 0);
+       kfree_skb(skb);
+       if (unlikely(IS_ERR(segs)))
+               return 1;
+
+       do {
+               struct sk_buff *nskb = segs->next;
+
+               segs->next = NULL;
+               if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn,
+                               queuenum))
+                       kfree_skb(segs);
+               segs = nskb;
+       } while (segs);
+       return 1;
+}
+
 void nf_reinject(struct sk_buff *skb, struct nf_info *info,
                 unsigned int verdict)
 {
        struct list_head *elem = &info->elem->list;
        struct list_head *i;
-       struct nf_queue_rerouter *rerouter;
+       struct nf_afinfo *afinfo;
 
        rcu_read_lock();
 
@@ -228,8 +244,8 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
        }
 
        if (verdict == NF_ACCEPT) {
-               rerouter = rcu_dereference(queue_rerouter[info->pf]);
-               if (rerouter && rerouter->reroute(&skb, info) < 0)
+               afinfo = nf_get_afinfo(info->pf);
+               if (!afinfo || afinfo->reroute(&skb, info) < 0)
                        verdict = NF_DROP;
        }
 
@@ -243,21 +259,20 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
 
        switch (verdict & NF_VERDICT_MASK) {
        case NF_ACCEPT:
+       case NF_STOP:
                info->okfn(skb);
+       case NF_STOLEN:
                break;
-
        case NF_QUEUE:
-               if (!nf_queue(&skb, elem, info->pf, info->hook, 
-                             info->indev, info->outdev, info->okfn,
-                             verdict >> NF_VERDICT_BITS))
+               if (!__nf_queue(skb, elem, info->pf, info->hook,
+                               info->indev, info->outdev, info->okfn,
+                               verdict >> NF_VERDICT_BITS))
                        goto next_hook;
                break;
+       default:
+               kfree_skb(skb);
        }
        rcu_read_unlock();
-
-       if (verdict == NF_DROP)
-               kfree_skb(skb);
-
        kfree(info);
        return;
 }