aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-09-20 15:09:34 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-09-22 18:20:13 -0400
commitcf9f81523ef3e95d9f222c896d266e4562999150 (patch)
tree6fa5175b120b150a28e495a8b87704bb139bbb69 /net
parent857c06da2ba2e00b81677c2f6740048d87da0207 (diff)
[NETFILTER]: PPTP conntrack: simplify expectation handling
Remove duplicated expectation handling in the NAT helper and simplify the remains in the conntrack helper. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/netfilter/ip_conntrack_helper_pptp.c92
-rw-r--r--net/ipv4/netfilter/ip_nat_helper_pptp.c58
2 files changed, 34 insertions, 116 deletions
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
index 5f7af6ef3881..57eac6e3871a 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
@@ -80,7 +80,7 @@ int
80 struct PptpControlHeader *ctlh, 80 struct PptpControlHeader *ctlh,
81 union pptp_ctrl_union *pptpReq); 81 union pptp_ctrl_union *pptpReq);
82 82
83int 83void
84(*ip_nat_pptp_hook_exp_gre)(struct ip_conntrack_expect *expect_orig, 84(*ip_nat_pptp_hook_exp_gre)(struct ip_conntrack_expect *expect_orig,
85 struct ip_conntrack_expect *expect_reply); 85 struct ip_conntrack_expect *expect_reply);
86 86
@@ -219,93 +219,63 @@ static void pptp_destroy_siblings(struct ip_conntrack *ct)
219 219
220/* expect GRE connections (PNS->PAC and PAC->PNS direction) */ 220/* expect GRE connections (PNS->PAC and PAC->PNS direction) */
221static inline int 221static inline int
222exp_gre(struct ip_conntrack *master, 222exp_gre(struct ip_conntrack *ct,
223 __be16 callid, 223 __be16 callid,
224 __be16 peer_callid) 224 __be16 peer_callid)
225{ 225{
226 struct ip_conntrack_tuple inv_tuple;
227 struct ip_conntrack_tuple exp_tuples[] = {
228 /* tuple in original direction, PNS->PAC */
229 { .src = { .ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip,
230 .u = { .gre = { .key = peer_callid } }
231 },
232 .dst = { .ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip,
233 .u = { .gre = { .key = callid } },
234 .protonum = IPPROTO_GRE
235 },
236 },
237 /* tuple in reply direction, PAC->PNS */
238 { .src = { .ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip,
239 .u = { .gre = { .key = callid } }
240 },
241 .dst = { .ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip,
242 .u = { .gre = { .key = peer_callid } },
243 .protonum = IPPROTO_GRE
244 },
245 }
246 };
247 struct ip_conntrack_expect *exp_orig, *exp_reply; 226 struct ip_conntrack_expect *exp_orig, *exp_reply;
248 int ret = 1; 227 int ret = 1;
249 228
250 exp_orig = ip_conntrack_expect_alloc(master); 229 exp_orig = ip_conntrack_expect_alloc(ct);
251 if (exp_orig == NULL) 230 if (exp_orig == NULL)
252 goto out; 231 goto out;
253 232
254 exp_reply = ip_conntrack_expect_alloc(master); 233 exp_reply = ip_conntrack_expect_alloc(ct);
255 if (exp_reply == NULL) 234 if (exp_reply == NULL)
256 goto out_put_orig; 235 goto out_put_orig;
257 236
258 memcpy(&exp_orig->tuple, &exp_tuples[0], sizeof(exp_orig->tuple)); 237 /* original direction, PNS->PAC */
238 exp_orig->tuple.src.ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
239 exp_orig->tuple.src.u.gre.key = peer_callid;
240 exp_orig->tuple.dst.ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
241 exp_orig->tuple.dst.u.gre.key = callid;
242 exp_orig->tuple.dst.protonum = IPPROTO_GRE;
259 243
260 exp_orig->mask.src.ip = 0xffffffff; 244 exp_orig->mask.src.ip = 0xffffffff;
261 exp_orig->mask.src.u.all = 0; 245 exp_orig->mask.src.u.all = 0;
262 exp_orig->mask.dst.u.all = 0;
263 exp_orig->mask.dst.u.gre.key = htons(0xffff); 246 exp_orig->mask.dst.u.gre.key = htons(0xffff);
264 exp_orig->mask.dst.ip = 0xffffffff; 247 exp_orig->mask.dst.ip = 0xffffffff;
265 exp_orig->mask.dst.protonum = 0xff; 248 exp_orig->mask.dst.protonum = 0xff;
266 249
267 exp_orig->master = master; 250 exp_orig->master = ct;
268 exp_orig->expectfn = pptp_expectfn; 251 exp_orig->expectfn = pptp_expectfn;
269 exp_orig->flags = 0; 252 exp_orig->flags = 0;
270 253
271 /* both expectations are identical apart from tuple */ 254 /* both expectations are identical apart from tuple */
272 memcpy(exp_reply, exp_orig, sizeof(*exp_reply)); 255 memcpy(exp_reply, exp_orig, sizeof(*exp_reply));
273 memcpy(&exp_reply->tuple, &exp_tuples[1], sizeof(exp_reply->tuple));
274
275 if (ip_nat_pptp_hook_exp_gre)
276 ret = ip_nat_pptp_hook_exp_gre(exp_orig, exp_reply);
277 else {
278 256
279 DEBUGP("calling expect_related PNS->PAC"); 257 /* reply direction, PAC->PNS */
280 DUMP_TUPLE(&exp_orig->tuple); 258 exp_reply->tuple.src.ip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
259 exp_reply->tuple.src.u.gre.key = callid;
260 exp_reply->tuple.dst.ip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
261 exp_reply->tuple.dst.u.gre.key = peer_callid;
262 exp_reply->tuple.dst.protonum = IPPROTO_GRE;
281 263
282 if (ip_conntrack_expect_related(exp_orig) != 0) { 264 if (ip_nat_pptp_hook_exp_gre)
283 DEBUGP("cannot expect_related()\n"); 265 ip_nat_pptp_hook_exp_gre(exp_orig, exp_reply);
284 goto out_put_both; 266 if (ip_conntrack_expect_related(exp_orig) != 0)
285 } 267 goto out_put_both;
286 268 if (ip_conntrack_expect_related(exp_reply) != 0)
287 DEBUGP("calling expect_related PAC->PNS"); 269 goto out_unexpect_orig;
288 DUMP_TUPLE(&exp_reply->tuple); 270
289 271 /* Add GRE keymap entries */
290 if (ip_conntrack_expect_related(exp_reply) != 0) { 272 if (ip_ct_gre_keymap_add(ct, &exp_orig->tuple, 0) != 0)
291 DEBUGP("cannot expect_related()\n"); 273 goto out_unexpect_both;
292 goto out_unexpect_orig; 274 if (ip_ct_gre_keymap_add(ct, &exp_reply->tuple, 1) != 0) {
293 } 275 ip_ct_gre_keymap_destroy(ct);
294 276 goto out_unexpect_both;
295 /* Add GRE keymap entries */
296 if (ip_ct_gre_keymap_add(master, &exp_reply->tuple, 0) != 0) {
297 DEBUGP("cannot keymap_add() exp\n");
298 goto out_unexpect_both;
299 }
300
301 invert_tuplepr(&inv_tuple, &exp_reply->tuple);
302 if (ip_ct_gre_keymap_add(master, &inv_tuple, 1) != 0) {
303 ip_ct_gre_keymap_destroy(master);
304 DEBUGP("cannot keymap_add() exp_inv\n");
305 goto out_unexpect_both;
306 }
307 ret = 0;
308 } 277 }
278 ret = 0;
309 279
310out_put_both: 280out_put_both:
311 ip_conntrack_expect_put(exp_reply); 281 ip_conntrack_expect_put(exp_reply);
diff --git a/net/ipv4/netfilter/ip_nat_helper_pptp.c b/net/ipv4/netfilter/ip_nat_helper_pptp.c
index 0f5e753b481d..84f6bd09fcd4 100644
--- a/net/ipv4/netfilter/ip_nat_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_nat_helper_pptp.c
@@ -211,80 +211,28 @@ pptp_outbound_pkt(struct sk_buff **pskb,
211 return NF_ACCEPT; 211 return NF_ACCEPT;
212} 212}
213 213
214static int 214static void
215pptp_exp_gre(struct ip_conntrack_expect *expect_orig, 215pptp_exp_gre(struct ip_conntrack_expect *expect_orig,
216 struct ip_conntrack_expect *expect_reply) 216 struct ip_conntrack_expect *expect_reply)
217{ 217{
218 struct ip_ct_pptp_master *ct_pptp_info =
219 &expect_orig->master->help.ct_pptp_info;
220 struct ip_nat_pptp *nat_pptp_info =
221 &expect_orig->master->nat.help.nat_pptp_info;
222
223 struct ip_conntrack *ct = expect_orig->master; 218 struct ip_conntrack *ct = expect_orig->master;
224 219 struct ip_ct_pptp_master *ct_pptp_info = &ct->help.ct_pptp_info;
225 struct ip_conntrack_tuple inv_t; 220 struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info;
226 struct ip_conntrack_tuple *orig_t, *reply_t;
227 221
228 /* save original PAC call ID in nat_info */ 222 /* save original PAC call ID in nat_info */
229 nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id; 223 nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id;
230 224
231 /* alter expectation */
232 orig_t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
233 reply_t = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
234
235 /* alter expectation for PNS->PAC direction */ 225 /* alter expectation for PNS->PAC direction */
236 invert_tuplepr(&inv_t, &expect_orig->tuple);
237 expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id; 226 expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id;
238 expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id; 227 expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id;
239 expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id; 228 expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id;
240 expect_orig->dir = IP_CT_DIR_ORIGINAL; 229 expect_orig->dir = IP_CT_DIR_ORIGINAL;
241 inv_t.src.ip = reply_t->src.ip;
242 inv_t.dst.ip = reply_t->dst.ip;
243 inv_t.src.u.gre.key = nat_pptp_info->pac_call_id;
244 inv_t.dst.u.gre.key = ct_pptp_info->pns_call_id;
245
246 if (!ip_conntrack_expect_related(expect_orig)) {
247 DEBUGP("successfully registered expect\n");
248 } else {
249 DEBUGP("can't expect_related(expect_orig)\n");
250 return 1;
251 }
252 230
253 /* alter expectation for PAC->PNS direction */ 231 /* alter expectation for PAC->PNS direction */
254 invert_tuplepr(&inv_t, &expect_reply->tuple);
255 expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id; 232 expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id;
256 expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id; 233 expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id;
257 expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id; 234 expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id;
258 expect_reply->dir = IP_CT_DIR_REPLY; 235 expect_reply->dir = IP_CT_DIR_REPLY;
259 inv_t.src.ip = orig_t->src.ip;
260 inv_t.dst.ip = orig_t->dst.ip;
261 inv_t.src.u.gre.key = nat_pptp_info->pns_call_id;
262 inv_t.dst.u.gre.key = ct_pptp_info->pac_call_id;
263
264 if (!ip_conntrack_expect_related(expect_reply)) {
265 DEBUGP("successfully registered expect\n");
266 } else {
267 DEBUGP("can't expect_related(expect_reply)\n");
268 ip_conntrack_unexpect_related(expect_orig);
269 return 1;
270 }
271
272 if (ip_ct_gre_keymap_add(ct, &expect_reply->tuple, 0) < 0) {
273 DEBUGP("can't register original keymap\n");
274 ip_conntrack_unexpect_related(expect_orig);
275 ip_conntrack_unexpect_related(expect_reply);
276 return 1;
277 }
278
279 if (ip_ct_gre_keymap_add(ct, &inv_t, 1) < 0) {
280 DEBUGP("can't register reply keymap\n");
281 ip_conntrack_unexpect_related(expect_orig);
282 ip_conntrack_unexpect_related(expect_reply);
283 ip_ct_gre_keymap_destroy(ct);
284 return 1;
285 }
286
287 return 0;
288} 236}
289 237
290/* inbound packets == from PAC to PNS */ 238/* inbound packets == from PAC to PNS */