[NETFILTER]: nf_conntrack_h323: turn some printks into DEBUGPs

[linux-2.6] / net / netfilter / nf_conntrack_ftp.c

diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index a186799f654212ef218a7560f5991f99ee407832..cd9c2d00cc09e69782169b684db9b3dcd8cc6d8c 100644 (file)
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -48,8 +48,7 @@ unsigned int (*nf_nat_ftp_hook)(struct sk_buff **pskb,
                                enum nf_ct_ftp_type type,
                                unsigned int matchoff,
                                unsigned int matchlen,
-                               struct nf_conntrack_expect *exp,
-                               u32 *seq);
+                               struct nf_conntrack_expect *exp);
 EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);
 
 #if 0
@@ -335,15 +334,17 @@ static void update_nl_seq(u32 nl_seq, struct nf_ct_ftp_master *info, int dir,
                if (info->seq_aft_nl[dir][i] == nl_seq)
                        return;
 
-               if (oldest == info->seq_aft_nl_num[dir]
-                   || before(info->seq_aft_nl[dir][i], oldest))
+               if (oldest == info->seq_aft_nl_num[dir] ||
+                   before(info->seq_aft_nl[dir][i],
+                          info->seq_aft_nl[dir][oldest]))
                        oldest = i;
        }
 
        if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
                info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
-       } else if (oldest != NUM_SEQ_TO_REMEMBER) {
+       } else if (oldest != NUM_SEQ_TO_REMEMBER &&
+                  after(nl_seq, info->seq_aft_nl[dir][oldest])) {
                info->seq_aft_nl[dir][oldest] = nl_seq;
                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
        }
@@ -363,6 +364,7 @@ static int help(struct sk_buff **pskb,
        unsigned int matchlen, matchoff;
        struct nf_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
        struct nf_conntrack_expect *exp;
+       union nf_conntrack_address *daddr;
        struct nf_conntrack_man cmd = {};
        unsigned int i;
        int found = 0, ends_in_nl;
@@ -444,7 +446,7 @@ static int help(struct sk_buff **pskb,
               (int)matchlen, fb_ptr + matchoff,
               matchlen, ntohl(th->seq) + matchoff);
 
-       exp = nf_conntrack_expect_alloc(ct);
+       exp = nf_ct_expect_alloc(ct);
        if (exp == NULL) {
                ret = NF_DROP;
                goto out;
@@ -453,7 +455,7 @@ static int help(struct sk_buff **pskb,
        /* We refer to the reverse direction ("!dir") tuples here,
         * because we're expecting something in the other direction.
         * Doesn't matter unless NAT is happening.  */
-       exp->tuple.dst.u3 = ct->tuplehash[!dir].tuple.dst.u3;
+       daddr = &ct->tuplehash[!dir].tuple.dst.u3;
 
        /* Update the ftp info */
        if ((cmd.l3num == ct->tuplehash[dir].tuple.src.l3num) &&
@@ -482,54 +484,29 @@ static int help(struct sk_buff **pskb,
                        ret = NF_ACCEPT;
                        goto out_put_expect;
                }
-               memcpy(&exp->tuple.dst.u3, &cmd.u3.all,
-                      sizeof(exp->tuple.dst.u3));
+               daddr = &cmd.u3;
        }
 
-       exp->tuple.src.u3 = ct->tuplehash[!dir].tuple.src.u3;
-       exp->tuple.src.l3num = cmd.l3num;
-       exp->tuple.src.u.tcp.port = 0;
-       exp->tuple.dst.u.tcp.port = cmd.u.tcp.port;
-       exp->tuple.dst.protonum = IPPROTO_TCP;
-
-       exp->mask = (struct nf_conntrack_tuple)
-                   { .src = { .l3num = 0xFFFF,
-                              .u = { .tcp = { 0 }},
-                            },
-                     .dst = { .protonum = 0xFF,
-                              .u = { .tcp = { __constant_htons(0xFFFF) }},
-                            },
-                   };
-       if (cmd.l3num == PF_INET) {
-               exp->mask.src.u3.ip = htonl(0xFFFFFFFF);
-               exp->mask.dst.u3.ip = htonl(0xFFFFFFFF);
-       } else {
-               memset(exp->mask.src.u3.ip6, 0xFF,
-                      sizeof(exp->mask.src.u3.ip6));
-               memset(exp->mask.dst.u3.ip6, 0xFF,
-                      sizeof(exp->mask.src.u3.ip6));
-       }
-
-       exp->expectfn = NULL;
-       exp->helper = NULL;
-       exp->flags = 0;
+       nf_ct_expect_init(exp, cmd.l3num,
+                         &ct->tuplehash[!dir].tuple.src.u3, daddr,
+                         IPPROTO_TCP, NULL, &cmd.u.tcp.port);
 
        /* Now, NAT might want to mangle the packet, and register the
         * (possibly changed) expectation itself. */
        nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
        if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
                ret = nf_nat_ftp(pskb, ctinfo, search[dir][i].ftptype,
-                                matchoff, matchlen, exp, &seq);
+                                matchoff, matchlen, exp);
        else {
                /* Can't expect this?  Best to drop packet now. */
-               if (nf_conntrack_expect_related(exp) != 0)
+               if (nf_ct_expect_related(exp) != 0)
                        ret = NF_DROP;
                else
                        ret = NF_ACCEPT;
        }
 
 out_put_expect:
-       nf_conntrack_expect_put(exp);
+       nf_ct_expect_put(exp);
 
 out_update_nl:
        /* Now if this ends in \n, update ftp info.  Seq may have been
@@ -541,8 +518,8 @@ out_update_nl:
        return ret;
 }
 
-static struct nf_conntrack_helper ftp[MAX_PORTS][2];
-static char ftp_names[MAX_PORTS][2][sizeof("ftp-65535")];
+static struct nf_conntrack_helper ftp[MAX_PORTS][2] __read_mostly;
+static char ftp_names[MAX_PORTS][2][sizeof("ftp-65535")] __read_mostly;
 
 /* don't make this __exit, since it's called from __init ! */
 static void nf_conntrack_ftp_fini(void)
@@ -583,9 +560,6 @@ static int __init nf_conntrack_ftp_init(void)
                for (j = 0; j < 2; j++) {
                        ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]);
                        ftp[i][j].tuple.dst.protonum = IPPROTO_TCP;
-                       ftp[i][j].mask.src.l3num = 0xFFFF;
-                       ftp[i][j].mask.src.u.tcp.port = htons(0xFFFF);
-                       ftp[i][j].mask.dst.protonum = 0xFF;
                        ftp[i][j].max_expected = 1;
                        ftp[i][j].timeout = 5 * 60;     /* 5 Minutes */
                        ftp[i][j].me = THIS_MODULE;