[NETFILTER]: nf_conntrack: reduce masks to a subset of tuples

Since conntrack currently allows to use masks for every bit of both
helper and expectation tuples, we can't hash them and have to keep
them on two global lists that are searched for every new connection.

This patch removes the never used ability to use masks for the
destination part of the expectation tuple and completely removes
masks from helpers since the only reasonable choice is a full
match on l3num, protonum and src.u.all.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index c0b1d1fb23e1504ab67175a966dd69c9edd855bf..13643f7f7422c8fc59ff82d0f03d6e3aad5e7060 100644 (file)
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -16,7 +16,8 @@ struct nf_conntrack_expect
        struct list_head list;
 
        /* We expect this tuple, with the following mask */
-       struct nf_conntrack_tuple tuple, mask;
+       struct nf_conntrack_tuple tuple;
+       struct nf_conntrack_tuple_mask mask;
 
        /* Function to call after setup and insertion */
        void (*expectfn)(struct nf_conn *new,

diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index b43a75ba44ac7fecb63a88a1345d7d53bcf3f613..d62e6f093af40a98a9721fc8d29c720553688fb9 100644 (file)
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -24,10 +24,9 @@ struct nf_conntrack_helper
                                         * expected connections */
        unsigned int timeout;           /* timeout for expecteds */
 
-       /* Mask of things we will help (compared against server response) */
+       /* Tuple of things we will help (compared against server response) */
        struct nf_conntrack_tuple tuple;
-       struct nf_conntrack_tuple mask;
-       
+
        /* Function to call when data passes; return verdict, or -1 to
            invalidate. */
        int (*help)(struct sk_buff **pskb,

diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index d02ce876b4caf5e6b407954b2f0fffb1676eb80e..99934ab538e6e3be93f42cf94748ff000570272a 100644 (file)
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -100,6 +100,14 @@ struct nf_conntrack_tuple
        } dst;
 };
 
+struct nf_conntrack_tuple_mask
+{
+       struct {
+               union nf_conntrack_address u3;
+               union nf_conntrack_man_proto u;
+       } src;
+};
+
 /* This is optimized opposed to a memset of the whole structure.  Everything we
  * really care about is the  source/destination unions */
 #define NF_CT_TUPLE_U_BLANK(tuple)                                     \
@@ -161,31 +169,44 @@ static inline int nf_ct_tuple_equal(const struct nf_conntrack_tuple *t1,
        return nf_ct_tuple_src_equal(t1, t2) && nf_ct_tuple_dst_equal(t1, t2);
 }
 
+static inline int nf_ct_tuple_mask_equal(const struct nf_conntrack_tuple_mask *m1,
+                                        const struct nf_conntrack_tuple_mask *m2)
+{
+       return (m1->src.u3.all[0] == m2->src.u3.all[0] &&
+               m1->src.u3.all[1] == m2->src.u3.all[1] &&
+               m1->src.u3.all[2] == m2->src.u3.all[2] &&
+               m1->src.u3.all[3] == m2->src.u3.all[3] &&
+               m1->src.u.all == m2->src.u.all);
+}
+
+static inline int nf_ct_tuple_src_mask_cmp(const struct nf_conntrack_tuple *t1,
+                                          const struct nf_conntrack_tuple *t2,
+                                          const struct nf_conntrack_tuple_mask *mask)
+{
+       int count;
+
+       for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++) {
+               if ((t1->src.u3.all[count] ^ t2->src.u3.all[count]) &
+                   mask->src.u3.all[count])
+                       return 0;
+       }
+
+       if ((t1->src.u.all ^ t2->src.u.all) & mask->src.u.all)
+               return 0;
+
+       if (t1->src.l3num != t2->src.l3num ||
+           t1->dst.protonum != t2->dst.protonum)
+               return 0;
+
+       return 1;
+}
+
 static inline int nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,
                                       const struct nf_conntrack_tuple *tuple,
-                                      const struct nf_conntrack_tuple *mask)
+                                      const struct nf_conntrack_tuple_mask *mask)
 {
-       int count = 0;
-
-        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
-                if ((t->src.u3.all[count] ^ tuple->src.u3.all[count]) &
-                    mask->src.u3.all[count])
-                        return 0;
-        }
-
-        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
-                if ((t->dst.u3.all[count] ^ tuple->dst.u3.all[count]) &
-                    mask->dst.u3.all[count])
-                        return 0;
-        }
-
-        if ((t->src.u.all ^ tuple->src.u.all) & mask->src.u.all ||
-            (t->dst.u.all ^ tuple->dst.u.all) & mask->dst.u.all ||
-            (t->src.l3num ^ tuple->src.l3num) & mask->src.l3num ||
-            (t->dst.protonum ^ tuple->dst.protonum) & mask->dst.protonum)
-                return 0;
-
-        return 1;
+       return nf_ct_tuple_src_mask_cmp(t, tuple, mask) &&
+              nf_ct_tuple_dst_equal(t, tuple);
 }
 
 #endif /* _NF_CONNTRACK_TUPLE_H */

diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 6e88505d61625b7e9939c5f90257bb76ce772135..6bfcd3a90f08d2d60fe76e32dd6173c36c614f2b 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1276,9 +1276,6 @@ static struct nf_conntrack_helper snmp_helper __read_mostly = {
        .tuple.src.l3num        = AF_INET,
        .tuple.src.u.udp.port   = __constant_htons(SNMP_PORT),
        .tuple.dst.protonum     = IPPROTO_UDP,
-       .mask.src.l3num         = 0xFFFF,
-       .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-       .mask.dst.protonum      = 0xFF,
 };
 
 static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
@@ -1290,9 +1287,6 @@ static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
        .tuple.src.l3num        = AF_INET,
        .tuple.src.u.udp.port   = __constant_htons(SNMP_TRAP_PORT),
        .tuple.dst.protonum     = IPPROTO_UDP,
-       .mask.src.l3num         = 0xFFFF,
-       .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-       .mask.dst.protonum      = 0xFF,
 };
 
 /*****************************************************************************

diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index d21359e6c14c8d48c2430ffd0f5af517b430159b..e42ab230ad884089a494a505c0053fb3159e47c7 100644 (file)
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -174,9 +174,6 @@ static struct nf_conntrack_helper amanda_helper[2] __read_mostly = {
                .tuple.src.l3num        = AF_INET,
                .tuple.src.u.udp.port   = __constant_htons(10080),
                .tuple.dst.protonum     = IPPROTO_UDP,
-               .mask.src.l3num         = 0xFFFF,
-               .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-               .mask.dst.protonum      = 0xFF,
        },
        {
                .name                   = "amanda",
@@ -187,9 +184,6 @@ static struct nf_conntrack_helper amanda_helper[2] __read_mostly = {
                .tuple.src.l3num        = AF_INET6,
                .tuple.src.u.udp.port   = __constant_htons(10080),
                .tuple.dst.protonum     = IPPROTO_UDP,
-               .mask.src.l3num         = 0xFFFF,
-               .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-               .mask.dst.protonum      = 0xFF,
        },
 };
 

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4130ea662c48f33415ffe57bde5bb900848458e6..83b5ad85e0eed5f8b76bdc84c188d3cbe5803e61 100644 (file)
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -141,25 +141,16 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
 {
        /* Part covered by intersection of masks must be unequal,
           otherwise they clash */
-       struct nf_conntrack_tuple intersect_mask;
+       struct nf_conntrack_tuple_mask intersect_mask;
        int count;
 
-       intersect_mask.src.l3num = a->mask.src.l3num & b->mask.src.l3num;
        intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all;
-       intersect_mask.dst.u.all = a->mask.dst.u.all & b->mask.dst.u.all;
-       intersect_mask.dst.protonum = a->mask.dst.protonum
-                                       & b->mask.dst.protonum;
 
        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
                intersect_mask.src.u3.all[count] =
                        a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
        }
 
-       for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
-               intersect_mask.dst.u3.all[count] =
-                       a->mask.dst.u3.all[count] & b->mask.dst.u3.all[count];
-       }
-
        return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
 }
 
@@ -168,7 +159,7 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
 {
        return a->master == b->master
                && nf_ct_tuple_equal(&a->tuple, &b->tuple)
-               && nf_ct_tuple_equal(&a->mask, &b->mask);
+               && nf_ct_tuple_mask_equal(&a->mask, &b->mask);
 }
 
 /* Generally a bad idea to call this: could have matched already. */
@@ -224,8 +215,6 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
        exp->helper = NULL;
        exp->tuple.src.l3num = family;
        exp->tuple.dst.protonum = proto;
-       exp->mask.src.l3num = 0xFFFF;
-       exp->mask.dst.protonum = 0xFF;
 
        if (saddr) {
                memcpy(&exp->tuple.src.u3, saddr, len);
@@ -242,21 +231,6 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
                memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3));
        }
 
-       if (daddr) {
-               memcpy(&exp->tuple.dst.u3, daddr, len);
-               if (sizeof(exp->tuple.dst.u3) > len)
-                       /* address needs to be cleared for nf_ct_tuple_equal */
-                       memset((void *)&exp->tuple.dst.u3 + len, 0x00,
-                              sizeof(exp->tuple.dst.u3) - len);
-               memset(&exp->mask.dst.u3, 0xFF, len);
-               if (sizeof(exp->mask.dst.u3) > len)
-                       memset((void *)&exp->mask.dst.u3 + len, 0x00,
-                              sizeof(exp->mask.dst.u3) - len);
-       } else {
-               memset(&exp->tuple.dst.u3, 0x00, sizeof(exp->tuple.dst.u3));
-               memset(&exp->mask.dst.u3, 0x00, sizeof(exp->mask.dst.u3));
-       }
-
        if (src) {
                exp->tuple.src.u.all = (__force u16)*src;
                exp->mask.src.u.all = 0xFFFF;
@@ -265,13 +239,13 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
                exp->mask.src.u.all = 0;
        }
 
-       if (dst) {
-               exp->tuple.dst.u.all = (__force u16)*dst;
-               exp->mask.dst.u.all = 0xFFFF;
-       } else {
-               exp->tuple.dst.u.all = 0;
-               exp->mask.dst.u.all = 0;
-       }
+       memcpy(&exp->tuple.dst.u3, daddr, len);
+       if (sizeof(exp->tuple.dst.u3) > len)
+               /* address needs to be cleared for nf_ct_tuple_equal */
+               memset((void *)&exp->tuple.dst.u3 + len, 0x00,
+                      sizeof(exp->tuple.dst.u3) - len);
+
+       exp->tuple.dst.u.all = (__force u16)*dst;
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
 

diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 9ad15191bb44d0074ae8976af0512791c37340aa..198330b8ada4bd7fc5bd97d829f870095a46c205 100644 (file)
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -560,9 +560,6 @@ static int __init nf_conntrack_ftp_init(void)
                for (j = 0; j < 2; j++) {
                        ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]);
                        ftp[i][j].tuple.dst.protonum = IPPROTO_TCP;
-                       ftp[i][j].mask.src.l3num = 0xFFFF;
-                       ftp[i][j].mask.src.u.tcp.port = htons(0xFFFF);
-                       ftp[i][j].mask.dst.protonum = 0xFF;
                        ftp[i][j].max_expected = 1;
                        ftp[i][j].timeout = 5 * 60;     /* 5 Minutes */
                        ftp[i][j].me = THIS_MODULE;

diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 61ae90fb328a5470ec5931c490fd23d95fe8dfdc..8c57b8119bfbf8b12d7a74228abafc688da4e475 100644 (file)
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -626,8 +626,6 @@ static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = {
        .max_expected           = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */,
        .timeout                = 240,
        .tuple.dst.protonum     = IPPROTO_UDP,
-       .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-       .mask.dst.protonum      = 0xFF,
        .help                   = h245_help
 };
 
@@ -1173,9 +1171,6 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
                .tuple.src.l3num        = AF_INET,
                .tuple.src.u.tcp.port   = __constant_htons(Q931_PORT),
                .tuple.dst.protonum     = IPPROTO_TCP,
-               .mask.src.l3num         = 0xFFFF,
-               .mask.src.u.tcp.port    = __constant_htons(0xFFFF),
-               .mask.dst.protonum      = 0xFF,
                .help                   = q931_help
        },
        {
@@ -1187,9 +1182,6 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
                .tuple.src.l3num        = AF_INET6,
                .tuple.src.u.tcp.port   = __constant_htons(Q931_PORT),
                .tuple.dst.protonum     = IPPROTO_TCP,
-               .mask.src.l3num         = 0xFFFF,
-               .mask.src.u.tcp.port    = __constant_htons(0xFFFF),
-               .mask.dst.protonum      = 0xFF,
                .help                   = q931_help
        },
 };
@@ -1751,9 +1743,6 @@ static struct nf_conntrack_helper nf_conntrack_helper_ras[] __read_mostly = {
                .tuple.src.l3num        = AF_INET,
                .tuple.src.u.udp.port   = __constant_htons(RAS_PORT),
                .tuple.dst.protonum     = IPPROTO_UDP,
-               .mask.src.l3num         = 0xFFFF,
-               .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-               .mask.dst.protonum      = 0xFF,
                .help                   = ras_help,
        },
        {
@@ -1764,9 +1753,6 @@ static struct nf_conntrack_helper nf_conntrack_helper_ras[] __read_mostly = {
                .tuple.src.l3num        = AF_INET6,
                .tuple.src.u.udp.port   = __constant_htons(RAS_PORT),
                .tuple.dst.protonum     = IPPROTO_UDP,
-               .mask.src.l3num         = 0xFFFF,
-               .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-               .mask.dst.protonum      = 0xFF,
                .help                   = ras_help,
        },
 };

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 89a5f7333d388ed19702beede4c4e92ee7bd062e..fdabf823f8cd5648e2e6b1d33be65d2c5575f07f 100644 (file)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -34,9 +34,10 @@ struct nf_conntrack_helper *
 __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
 {
        struct nf_conntrack_helper *h;
+       struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) };
 
        list_for_each_entry(h, &helpers, list) {
-               if (nf_ct_tuple_mask_cmp(tuple, &h->tuple, &h->mask))
+               if (nf_ct_tuple_src_mask_cmp(tuple, &h->tuple, &mask))
                        return h;
        }
        return NULL;

diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 79da93e4396bbb0fe5bc0b6c4aea58f4b1c7540f..8c7340794bf663b00120d9579f84c650c1db6762 100644 (file)
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -239,9 +239,6 @@ static int __init nf_conntrack_irc_init(void)
                irc[i].tuple.src.l3num = AF_INET;
                irc[i].tuple.src.u.tcp.port = htons(ports[i]);
                irc[i].tuple.dst.protonum = IPPROTO_TCP;
-               irc[i].mask.src.l3num = 0xFFFF;
-               irc[i].mask.src.u.tcp.port = htons(0xFFFF);
-               irc[i].mask.dst.protonum = 0xFF;
                irc[i].max_expected = max_dcc_channels;
                irc[i].timeout = dcc_timeout;
                irc[i].me = THIS_MODULE;

diff --git a/net/netfilter/nf_conntrack_netbios_ns.c b/net/netfilter/nf_conntrack_netbios_ns.c
index ea585c789a834778e4fd6f6e2fbdad0d3d1cf53e..1d59fabeb5f723554216880d95dc1f2fd195e4ba 100644 (file)
--- a/net/netfilter/nf_conntrack_netbios_ns.c
+++ b/net/netfilter/nf_conntrack_netbios_ns.c
@@ -83,9 +83,6 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
 
        exp->mask.src.u3.ip       = mask;
        exp->mask.src.u.udp.port  = htons(0xFFFF);
-       exp->mask.dst.u3.ip       = htonl(0xFFFFFFFF);
-       exp->mask.dst.u.udp.port  = htons(0xFFFF);
-       exp->mask.dst.protonum    = 0xFF;
 
        exp->expectfn             = NULL;
        exp->flags                = NF_CT_EXPECT_PERMANENT;
@@ -104,9 +101,6 @@ static struct nf_conntrack_helper helper __read_mostly = {
        .tuple.src.l3num        = AF_INET,
        .tuple.src.u.udp.port   = __constant_htons(NMBD_PORT),
        .tuple.dst.protonum     = IPPROTO_UDP,
-       .mask.src.l3num         = 0xFFFF,
-       .mask.src.u.udp.port    = __constant_htons(0xFFFF),
-       .mask.dst.protonum      = 0xFF,
        .max_expected           = 1,
        .me                     = THIS_MODULE,
        .help                   = help,

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 954cc58b9d045bfd823ddc74d7b75190314eae51..206491488f4ebeb9b77c4b3de4bc7cc61cb8dc87 100644 (file)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1094,22 +1094,29 @@ nfattr_failure:
 static inline int
 ctnetlink_exp_dump_mask(struct sk_buff *skb,
                        const struct nf_conntrack_tuple *tuple,
-                       const struct nf_conntrack_tuple *mask)
+                       const struct nf_conntrack_tuple_mask *mask)
 {
        int ret;
        struct nf_conntrack_l3proto *l3proto;
        struct nf_conntrack_l4proto *l4proto;
-       struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
+       struct nf_conntrack_tuple m;
+       struct nfattr *nest_parms;
+
+       memset(&m, 0xFF, sizeof(m));
+       m.src.u.all = mask->src.u.all;
+       memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+
+       nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
 
        l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
-       ret = ctnetlink_dump_tuples_ip(skb, mask, l3proto);
+       ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
        nf_ct_l3proto_put(l3proto);
 
        if (unlikely(ret < 0))
                goto nfattr_failure;
 
        l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
-       ret = ctnetlink_dump_tuples_proto(skb, mask, l4proto);
+       ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
        nf_ct_l4proto_put(l4proto);
        if (unlikely(ret < 0))
                goto nfattr_failure;
@@ -1447,7 +1454,8 @@ ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
        exp->master = ct;
        exp->helper = NULL;
        memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
-       memcpy(&exp->mask, &mask, sizeof(struct nf_conntrack_tuple));
+       memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
+       exp->mask.src.u.all = mask.src.u.all;
 
        err = nf_ct_expect_related(exp);
        nf_ct_expect_put(exp);

diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 916e106d36bc839552f2d52dba80d72af6fae02e..63dac5eb959fc5bd43ebdd472777676fb2f8d300 100644 (file)
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -585,9 +585,6 @@ static struct nf_conntrack_helper pptp __read_mostly = {
        .tuple.src.l3num        = AF_INET,
        .tuple.src.u.tcp.port   = __constant_htons(PPTP_CONTROL_PORT),
        .tuple.dst.protonum     = IPPROTO_TCP,
-       .mask.src.l3num         = 0xffff,
-       .mask.src.u.tcp.port    = __constant_htons(0xffff),
-       .mask.dst.protonum      = 0xff,
        .help                   = conntrack_pptp_help,
        .destroy                = pptp_destroy_siblings,
 };

diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index 28ed303c565bb28d35bdcc4448b5aa7946b3b1ce..edd10df8aa0869bfc3a08820d8771054912a5d1e 100644 (file)
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -206,8 +206,6 @@ static int __init nf_conntrack_sane_init(void)
                for (j = 0; j < 2; j++) {
                        sane[i][j].tuple.src.u.tcp.port = htons(ports[i]);
                        sane[i][j].tuple.dst.protonum = IPPROTO_TCP;
-                       sane[i][j].mask.src.u.tcp.port = 0xFFFF;
-                       sane[i][j].mask.dst.protonum = 0xFF;
                        sane[i][j].max_expected = 1;
                        sane[i][j].timeout = 5 * 60;    /* 5 Minutes */
                        sane[i][j].me = THIS_MODULE;

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 1f17f8040cd2540013a9da92da93144267ed188b..5b78f0e1f63b2d12461c4a3493603a9c3f75ab5e 100644 (file)
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -506,9 +506,6 @@ static int __init nf_conntrack_sip_init(void)
                for (j = 0; j < 2; j++) {
                        sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
                        sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
-                       sip[i][j].mask.src.l3num = 0xFFFF;
-                       sip[i][j].mask.src.u.udp.port = htons(0xFFFF);
-                       sip[i][j].mask.dst.protonum = 0xFF;
                        sip[i][j].max_expected = 2;
                        sip[i][j].timeout = 3 * 60; /* 3 minutes */
                        sip[i][j].me = THIS_MODULE;

diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index 53d57b4c0de7647f5385c1ac99292dcec1a661c9..db0387cf9bac68d2e9a7dd4ed8a0a04899cd92bf 100644 (file)
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -126,9 +126,6 @@ static int __init nf_conntrack_tftp_init(void)
                for (j = 0; j < 2; j++) {
                        tftp[i][j].tuple.dst.protonum = IPPROTO_UDP;
                        tftp[i][j].tuple.src.u.udp.port = htons(ports[i]);
-                       tftp[i][j].mask.src.l3num = 0xFFFF;
-                       tftp[i][j].mask.dst.protonum = 0xFF;
-                       tftp[i][j].mask.src.u.udp.port = htons(0xFFFF);
                        tftp[i][j].max_expected = 1;
                        tftp[i][j].timeout = 5 * 60; /* 5 minutes */
                        tftp[i][j].me = THIS_MODULE;