[NETFILTER]: xt_TCPMSS: don't allow netfilter --setmss to increase mss

[linux-2.6] / net / netfilter / xt_conntrack.c

diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 189ded5f378bb100035e6d5b69770f9d8577b52e..eb7e135ca6c692fc859a6144abf8535a0a8a072f 100644 (file)
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -19,22 +19,18 @@ MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
 MODULE_DESCRIPTION("iptables connection tracking match module");
 MODULE_ALIAS("ipt_conntrack");
 
-static int
-match(const struct sk_buff *skb,
-      const struct net_device *in,
-      const struct net_device *out,
-      const struct xt_match *match,
-      const void *matchinfo,
-      int offset,
-      unsigned int protoff,
-      int *hotdrop)
+static bool
+conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
+             const struct net_device *out, const struct xt_match *match,
+             const void *matchinfo, int offset, unsigned int protoff,
+             bool *hotdrop)
 {
        const struct xt_conntrack_info *sinfo = matchinfo;
-       struct nf_conn *ct;
+       const struct nf_conn *ct;
        enum ip_conntrack_info ctinfo;
        unsigned int statebit;
 
-       ct = nf_ct_get((struct sk_buff *)skb, &ctinfo);
+       ct = nf_ct_get(skb, &ctinfo);
 
 #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
 
@@ -54,53 +50,53 @@ match(const struct sk_buff *skb,
                }
                if (FWINV((statebit & sinfo->statemask) == 0,
                          XT_CONNTRACK_STATE))
-                       return 0;
+                       return false;
        }
 
        if (ct == NULL) {
                if (sinfo->flags & ~XT_CONNTRACK_STATE)
-                       return 0;
-               return 1;
+                       return false;
+               return true;
        }
 
        if (sinfo->flags & XT_CONNTRACK_PROTO &&
            FWINV(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum !=
                  sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum,
                  XT_CONNTRACK_PROTO))
-               return 0;
+               return false;
 
        if (sinfo->flags & XT_CONNTRACK_ORIGSRC &&
            FWINV((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip &
                   sinfo->sipmsk[IP_CT_DIR_ORIGINAL].s_addr) !=
                  sinfo->tuple[IP_CT_DIR_ORIGINAL].src.ip,
                  XT_CONNTRACK_ORIGSRC))
-               return 0;
+               return false;
 
        if (sinfo->flags & XT_CONNTRACK_ORIGDST &&
            FWINV((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.ip &
                   sinfo->dipmsk[IP_CT_DIR_ORIGINAL].s_addr) !=
                  sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.ip,
                  XT_CONNTRACK_ORIGDST))
-               return 0;
+               return false;
 
        if (sinfo->flags & XT_CONNTRACK_REPLSRC &&
            FWINV((ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip &
                   sinfo->sipmsk[IP_CT_DIR_REPLY].s_addr) !=
                  sinfo->tuple[IP_CT_DIR_REPLY].src.ip,
                  XT_CONNTRACK_REPLSRC))
-               return 0;
+               return false;
 
        if (sinfo->flags & XT_CONNTRACK_REPLDST &&
            FWINV((ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip &
                   sinfo->dipmsk[IP_CT_DIR_REPLY].s_addr) !=
                  sinfo->tuple[IP_CT_DIR_REPLY].dst.ip,
                  XT_CONNTRACK_REPLDST))
-               return 0;
+               return false;
 
        if (sinfo->flags & XT_CONNTRACK_STATUS &&
            FWINV((ct->status & sinfo->statusmask) == 0,
                  XT_CONNTRACK_STATUS))
-               return 0;
+               return false;
 
        if(sinfo->flags & XT_CONNTRACK_EXPIRES) {
                unsigned long expires = timer_pending(&ct->timeout) ?
@@ -109,27 +105,26 @@ match(const struct sk_buff *skb,
                if (FWINV(!(expires >= sinfo->expires_min &&
                            expires <= sinfo->expires_max),
                          XT_CONNTRACK_EXPIRES))
-                       return 0;
+                       return false;
        }
-       return 1;
+       return true;
 }
 
-static int
-checkentry(const char *tablename,
-          const void *ip,
-          const struct xt_match *match,
-          void *matchinfo,
-          unsigned int hook_mask)
+static bool
+conntrack_mt_check(const char *tablename, const void *ip,
+                   const struct xt_match *match, void *matchinfo,
+                   unsigned int hook_mask)
 {
        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
                printk(KERN_WARNING "can't load conntrack support for "
                                    "proto=%d\n", match->family);
-               return 0;
+               return false;
        }
-       return 1;
+       return true;
 }
 
-static void destroy(const struct xt_match *match, void *matchinfo)
+static void
+conntrack_mt_destroy(const struct xt_match *match, void *matchinfo)
 {
        nf_ct_l3proto_module_put(match->family);
 }
@@ -148,9 +143,9 @@ struct compat_xt_conntrack_info
        u_int8_t                        invflags;
 };
 
-static void compat_from_user(void *dst, void *src)
+static void conntrack_mt_compat_from_user(void *dst, void *src)
 {
-       struct compat_xt_conntrack_info *cm = src;
+       const struct compat_xt_conntrack_info *cm = src;
        struct xt_conntrack_info m = {
                .statemask      = cm->statemask,
                .statusmask     = cm->statusmask,
@@ -165,9 +160,9 @@ static void compat_from_user(void *dst, void *src)
        memcpy(dst, &m, sizeof(m));
 }
 
-static int compat_to_user(void __user *dst, void *src)
+static int conntrack_mt_compat_to_user(void __user *dst, void *src)
 {
-       struct xt_conntrack_info *m = src;
+       const struct xt_conntrack_info *m = src;
        struct compat_xt_conntrack_info cm = {
                .statemask      = m->statemask,
                .statusmask     = m->statusmask,
@@ -183,30 +178,30 @@ static int compat_to_user(void __user *dst, void *src)
 }
 #endif
 
-static struct xt_match conntrack_match = {
+static struct xt_match conntrack_mt_reg __read_mostly = {
        .name           = "conntrack",
-       .match          = match,
-       .checkentry     = checkentry,
-       .destroy        = destroy,
+       .match          = conntrack_mt,
+       .checkentry     = conntrack_mt_check,
+       .destroy        = conntrack_mt_destroy,
        .matchsize      = sizeof(struct xt_conntrack_info),
 #ifdef CONFIG_COMPAT
        .compatsize     = sizeof(struct compat_xt_conntrack_info),
-       .compat_from_user = compat_from_user,
-       .compat_to_user = compat_to_user,
+       .compat_from_user = conntrack_mt_compat_from_user,
+       .compat_to_user = conntrack_mt_compat_to_user,
 #endif
        .family         = AF_INET,
        .me             = THIS_MODULE,
 };
 
-static int __init xt_conntrack_init(void)
+static int __init conntrack_mt_init(void)
 {
-       return xt_register_match(&conntrack_match);
+       return xt_register_match(&conntrack_mt_reg);
 }
 
-static void __exit xt_conntrack_fini(void)
+static void __exit conntrack_mt_exit(void)
 {
-       xt_unregister_match(&conntrack_match);
+       xt_unregister_match(&conntrack_mt_reg);
 }
 
-module_init(xt_conntrack_init);
-module_exit(xt_conntrack_fini);
+module_init(conntrack_mt_init);
+module_exit(conntrack_mt_exit);