[SECMARK]: Add CONNSECMARK xtables target

[linux-2.6] / net / netfilter / nf_conntrack_core.c

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 56389c83557c6f791c0c01dfaa5f3088e489898c..cd299f4b7db1989c5e5d1897698d987c370db48a 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -146,7 +146,7 @@ static void nf_ct_event_cache_flush(void)
        struct nf_conntrack_ecache *ecache;
        int cpu;
 
-       for_each_cpu(cpu) {
+       for_each_possible_cpu(cpu) {
                ecache = &per_cpu(nf_conntrack_ecache, cpu);
                if (ecache->ct)
                        nf_ct_put(ecache->ct);
@@ -178,9 +178,6 @@ static struct {
        /* allocated slab cache + modules which uses this slab cache */
        int use;
 
-       /* Initialization */
-       int (*init_conntrack)(struct nf_conn *, u_int32_t);
-
 } nf_ct_cache[NF_CT_F_NUM];
 
 /* protect members of nf_ct_cache except of "use" */
@@ -208,10 +205,8 @@ nf_ct_proto_find_get(u_int16_t l3proto, u_int8_t protocol)
 
        preempt_disable();
        p = __nf_ct_proto_find(l3proto, protocol);
-       if (p) {
-               if (!try_module_get(p->me))
-                       p = &nf_conntrack_generic_protocol;
-       }
+       if (!try_module_get(p->me))
+               p = &nf_conntrack_generic_protocol;
        preempt_enable();
        
        return p;
@@ -229,10 +224,8 @@ nf_ct_l3proto_find_get(u_int16_t l3proto)
 
        preempt_disable();
        p = __nf_ct_l3proto_find(l3proto);
-       if (p) {
-               if (!try_module_get(p->me))
-                       p = &nf_conntrack_generic_l3proto;
-       }
+       if (!try_module_get(p->me))
+               p = &nf_conntrack_generic_l3proto;
        preempt_enable();
 
        return p;
@@ -996,6 +989,9 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                conntrack->master = exp->master;
 #ifdef CONFIG_NF_CONNTRACK_MARK
                conntrack->mark = exp->master->mark;
+#endif
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+               conntrack->secmark = exp->master->secmark;
 #endif
                nf_conntrack_get(&conntrack->master->ct_general);
                NF_CT_STAT_INC(expect_new);
@@ -1403,6 +1399,12 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
 
        write_lock_bh(&nf_conntrack_lock);
 
+       /* Only update if this is not a fixed timeout */
+       if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
+               write_unlock_bh(&nf_conntrack_lock);
+               return;
+       }
+
        /* If not in hash table, timer will not be active yet */
        if (!nf_ct_is_confirmed(ct)) {
                ct->timeout.expires = extra_jiffies;