aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/net/netfilter/nf_nat_rule.h11
-rw-r--r--net/ipv4/netfilter/nf_nat_rule.c13
-rw-r--r--net/ipv4/netfilter/nf_nat_standalone.c11
3 files changed, 10 insertions, 25 deletions
diff --git a/include/net/netfilter/nf_nat_rule.h b/include/net/netfilter/nf_nat_rule.h
index e76565459ad9..f9743187d57f 100644
--- a/include/net/netfilter/nf_nat_rule.h
+++ b/include/net/netfilter/nf_nat_rule.h
@@ -10,16 +10,11 @@ extern int nf_nat_rule_find(struct sk_buff **pskb,
10 unsigned int hooknum, 10 unsigned int hooknum,
11 const struct net_device *in, 11 const struct net_device *in,
12 const struct net_device *out, 12 const struct net_device *out,
13 struct nf_conn *ct, 13 struct nf_conn *ct);
14 struct nf_nat_info *info);
15 14
16extern unsigned int 15extern unsigned int
17alloc_null_binding(struct nf_conn *ct, 16alloc_null_binding(struct nf_conn *ct, unsigned int hooknum);
18 struct nf_nat_info *info,
19 unsigned int hooknum);
20 17
21extern unsigned int 18extern unsigned int
22alloc_null_binding_confirmed(struct nf_conn *ct, 19alloc_null_binding_confirmed(struct nf_conn *ct, unsigned int hooknum);
23 struct nf_nat_info *info,
24 unsigned int hooknum);
25#endif /* _NF_NAT_RULE_H */ 20#endif /* _NF_NAT_RULE_H */
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 07e99e309402..6740736c5e79 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -173,9 +173,7 @@ static int ipt_dnat_checkentry(const char *tablename,
173} 173}
174 174
175inline unsigned int 175inline unsigned int
176alloc_null_binding(struct nf_conn *ct, 176alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
177 struct nf_nat_info *info,
178 unsigned int hooknum)
179{ 177{
180 /* Force range to this IP; let proto decide mapping for 178 /* Force range to this IP; let proto decide mapping for
181 per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED). 179 per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
@@ -194,9 +192,7 @@ alloc_null_binding(struct nf_conn *ct,
194} 192}
195 193
196unsigned int 194unsigned int
197alloc_null_binding_confirmed(struct nf_conn *ct, 195alloc_null_binding_confirmed(struct nf_conn *ct, unsigned int hooknum)
198 struct nf_nat_info *info,
199 unsigned int hooknum)
200{ 196{
201 __be32 ip 197 __be32 ip
202 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC 198 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
@@ -218,8 +214,7 @@ int nf_nat_rule_find(struct sk_buff **pskb,
218 unsigned int hooknum, 214 unsigned int hooknum,
219 const struct net_device *in, 215 const struct net_device *in,
220 const struct net_device *out, 216 const struct net_device *out,
221 struct nf_conn *ct, 217 struct nf_conn *ct)
222 struct nf_nat_info *info)
223{ 218{
224 int ret; 219 int ret;
225 220
@@ -228,7 +223,7 @@ int nf_nat_rule_find(struct sk_buff **pskb,
228 if (ret == NF_ACCEPT) { 223 if (ret == NF_ACCEPT) {
229 if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum))) 224 if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
230 /* NUL mapping */ 225 /* NUL mapping */
231 ret = alloc_null_binding(ct, info, hooknum); 226 ret = alloc_null_binding(ct, hooknum);
232 } 227 }
233 return ret; 228 return ret;
234} 229}
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 64bbed2ba780..55dac36dbc85 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -80,7 +80,6 @@ nf_nat_fn(unsigned int hooknum,
80 struct nf_conn *ct; 80 struct nf_conn *ct;
81 enum ip_conntrack_info ctinfo; 81 enum ip_conntrack_info ctinfo;
82 struct nf_conn_nat *nat; 82 struct nf_conn_nat *nat;
83 struct nf_nat_info *info;
84 /* maniptype == SRC for postrouting. */ 83 /* maniptype == SRC for postrouting. */
85 enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum); 84 enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
86 85
@@ -129,7 +128,6 @@ nf_nat_fn(unsigned int hooknum,
129 } 128 }
130 /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */ 129 /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
131 case IP_CT_NEW: 130 case IP_CT_NEW:
132 info = &nat->info;
133 131
134 /* Seen it before? This can happen for loopback, retrans, 132 /* Seen it before? This can happen for loopback, retrans,
135 or local packets.. */ 133 or local packets.. */
@@ -138,14 +136,13 @@ nf_nat_fn(unsigned int hooknum,
138 136
139 if (unlikely(nf_ct_is_confirmed(ct))) 137 if (unlikely(nf_ct_is_confirmed(ct)))
140 /* NAT module was loaded late */ 138 /* NAT module was loaded late */
141 ret = alloc_null_binding_confirmed(ct, info, 139 ret = alloc_null_binding_confirmed(ct, hooknum);
142 hooknum);
143 else if (hooknum == NF_IP_LOCAL_IN) 140 else if (hooknum == NF_IP_LOCAL_IN)
144 /* LOCAL_IN hook doesn't have a chain! */ 141 /* LOCAL_IN hook doesn't have a chain! */
145 ret = alloc_null_binding(ct, info, hooknum); 142 ret = alloc_null_binding(ct, hooknum);
146 else 143 else
147 ret = nf_nat_rule_find(pskb, hooknum, in, out, 144 ret = nf_nat_rule_find(pskb, hooknum, in, out,
148 ct, info); 145 ct);
149 146
150 if (ret != NF_ACCEPT) { 147 if (ret != NF_ACCEPT) {
151 return ret; 148 return ret;
@@ -160,10 +157,8 @@ nf_nat_fn(unsigned int hooknum,
160 /* ESTABLISHED */ 157 /* ESTABLISHED */
161 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED || 158 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
162 ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY)); 159 ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
163 info = &nat->info;
164 } 160 }
165 161
166 NF_CT_ASSERT(info);
167 return nf_nat_packet(ct, ctinfo, hooknum, pskb); 162 return nf_nat_packet(ct, ctinfo, hooknum, pskb);
168} 163}
169 164