5 files changed, 149 insertions, 163 deletions

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 831fe1879dc0..7505dff4ffdf 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -231,6 +231,12 @@ static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
         return (struct arpt_entry *)(base + offset);
 }
 
+static inline __pure
+struct arpt_entry *arpt_next_entry(const struct arpt_entry *entry)
+{
+        return (void *)entry + entry->next_offset;
+}
+
 unsigned int arpt_do_table(struct sk_buff *skb,
                            unsigned int hook,
                            const struct net_device *in,
@@ -267,67 +273,64 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 
         arp = arp_hdr(skb);
         do {
-                if (arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
-                        struct arpt_entry_target *t;
-                        int hdr_len;
-
-                        hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
-                                (2 * skb->dev->addr_len);
+                struct arpt_entry_target *t;
+                int hdr_len;
 
-                        ADD_COUNTER(e->counters, hdr_len, 1);
+                if (!arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
+                        e = arpt_next_entry(e);
+                        continue;
+                }
 
-                        t = arpt_get_target(e);
+                hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
+                        (2 * skb->dev->addr_len);
+                ADD_COUNTER(e->counters, hdr_len, 1);
 
-                        /* Standard target? */
-                        if (!t->u.kernel.target->target) {
-                                int v;
+                t = arpt_get_target(e);
 
-                                v = ((struct arpt_standard_target *)t)->verdict;
-                                if (v < 0) {
-                                        /* Pop from stack? */
-                                        if (v != ARPT_RETURN) {
-                                                verdict = (unsigned)(-v) - 1;
-                                                break;
-                                        }
-                                        e = back;
-                                        back = get_entry(table_base,
-                                                         back->comefrom);
-                                        continue;
-                                }
-                                if (table_base + v
-                                    != (void *)e + e->next_offset) {
-                                        /* Save old back ptr in next entry */
-                                        struct arpt_entry *next
-                                                = (void *)e + e->next_offset;
-                                        next->comefrom =
-                                                (void *)back - table_base;
-
-                                        /* set back pointer to next entry */
-                                        back = next;
-                                }
+                /* Standard target? */
+                if (!t->u.kernel.target->target) {
+                        int v;
 
-                                e = get_entry(table_base, v);
-                        } else {
-                                /* Targets which reenter must return
-                                 * abs. verdicts
-                                 */
-                                tgpar.target   = t->u.kernel.target;
-                                tgpar.targinfo = t->data;
-                                verdict = t->u.kernel.target->target(skb,
-                                                                     &tgpar);
-
-                                /* Target might have changed stuff. */
-                                arp = arp_hdr(skb);
-
-                                if (verdict == ARPT_CONTINUE)
-                                        e = (void *)e + e->next_offset;
-                                else
-                                        /* Verdict */
+                        v = ((struct arpt_standard_target *)t)->verdict;
+                        if (v < 0) {
+                                /* Pop from stack? */
+                                if (v != ARPT_RETURN) {
+                                        verdict = (unsigned)(-v) - 1;
                                         break;
+                                }
+                                e = back;
+                                back = get_entry(table_base, back->comefrom);
+                                continue;
                         }
-                } else {
-                        e = (void *)e + e->next_offset;
+                        if (table_base + v
+                            != arpt_next_entry(e)) {
+                                /* Save old back ptr in next entry */
+                                struct arpt_entry *next = arpt_next_entry(e);
+                                next->comefrom = (void *)back - table_base;
+
+                                /* set back pointer to next entry */
+                                back = next;
+                        }
+
+                        e = get_entry(table_base, v);
+                        continue;
                 }
+
+                /* Targets which reenter must return
+                 * abs. verdicts
+                 */
+                tgpar.target   = t->u.kernel.target;
+                tgpar.targinfo = t->data;
+                verdict = t->u.kernel.target->target(skb, &tgpar);
+
+                /* Target might have changed stuff. */
+                arp = arp_hdr(skb);
+
+                if (verdict == ARPT_CONTINUE)
+                        e = arpt_next_entry(e);
+                else
+                        /* Verdict */
+                        break;
         } while (!hotdrop);
         xt_info_rdunlock_bh();
 
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 5f22c91c6e15..c156db215987 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -596,7 +596,7 @@ static int __init ip_queue_init(void)
 #ifdef CONFIG_SYSCTL
         ipq_sysctl_header = register_sysctl_paths(net_ipv4_ctl_path, ipq_table);
 #endif
-        status = nf_register_queue_handler(PF_INET, &nfqh);
+        status = nf_register_queue_handler(NFPROTO_IPV4, &nfqh);
         if (status < 0) {
                 printk(KERN_ERR "ip_queue: failed to register queue handler\n");
                 goto cleanup_sysctl;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 2ec8d7290c40..5bf7c3f185da 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -238,8 +238,8 @@ static struct nf_loginfo trace_loginfo = {
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
 get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
-                      char *hookname, char **chainname,
-                      char **comment, unsigned int *rulenum)
+                      const char *hookname, const char **chainname,
+                      const char **comment, unsigned int *rulenum)
 {
         struct ipt_standard_target *t = (void *)ipt_get_target(s);
 
@@ -257,8 +257,8 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
                    && unconditional(&s->ip)) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
-                                ? (char *)comments[NF_IP_TRACE_COMMENT_POLICY]
-                                : (char *)comments[NF_IP_TRACE_COMMENT_RETURN];
+                                ? comments[NF_IP_TRACE_COMMENT_POLICY]
+                                : comments[NF_IP_TRACE_COMMENT_RETURN];
                 }
                 return 1;
         } else
@@ -277,14 +277,14 @@ static void trace_packet(struct sk_buff *skb,
 {
         void *table_base;
         const struct ipt_entry *root;
-        char *hookname, *chainname, *comment;
+        const char *hookname, *chainname, *comment;
         unsigned int rulenum = 0;
 
-        table_base = (void *)private->entries[smp_processor_id()];
+        table_base = private->entries[smp_processor_id()];
         root = get_entry(table_base, private->hook_entry[hook]);
 
-        hookname = chainname = (char *)hooknames[hook];
-        comment = (char *)comments[NF_IP_TRACE_COMMENT_RULE];
+        hookname = chainname = hooknames[hook];
+        comment = comments[NF_IP_TRACE_COMMENT_RULE];
 
         IPT_ENTRY_ITERATE(root,
                           private->size - private->hook_entry[hook],
@@ -297,6 +297,12 @@ static void trace_packet(struct sk_buff *skb,
 }
 #endif
 
+static inline __pure
+struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
+{
+        return (void *)entry + entry->next_offset;
+}
+
 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 unsigned int
 ipt_do_table(struct sk_buff *skb,
@@ -305,6 +311,8 @@ ipt_do_table(struct sk_buff *skb,
              const struct net_device *out,
              struct xt_table *table)
 {
+#define tb_comefrom ((struct ipt_entry *)table_base)->comefrom
+
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
         const struct iphdr *ip;
         u_int16_t datalen;
@@ -335,7 +343,7 @@ ipt_do_table(struct sk_buff *skb,
         mtpar.in      = tgpar.in  = in;
         mtpar.out     = tgpar.out = out;
         mtpar.family  = tgpar.family = NFPROTO_IPV4;
-        tgpar.hooknum = hook;
+        mtpar.hooknum = tgpar.hooknum = hook;
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
         xt_info_rdlock_bh();
@@ -348,92 +356,84 @@ ipt_do_table(struct sk_buff *skb,
         back = get_entry(table_base, private->underflow[hook]);
 
         do {
+                struct ipt_entry_target *t;
+
                 IP_NF_ASSERT(e);
                 IP_NF_ASSERT(back);
-                if (ip_packet_match(ip, indev, outdev,
-                    &e->ip, mtpar.fragoff)) {
-                        struct ipt_entry_target *t;
-
-                        if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
-                                goto no_match;
+                if (!ip_packet_match(ip, indev, outdev,
+                    &e->ip, mtpar.fragoff) ||
+                    IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
+                        e = ipt_next_entry(e);
+                        continue;
+                }
 
-                        ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
+                ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
 
-                        t = ipt_get_target(e);
-                        IP_NF_ASSERT(t->u.kernel.target);
+                t = ipt_get_target(e);
+                IP_NF_ASSERT(t->u.kernel.target);
 
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
-                        /* The packet is traced: log it */
-                        if (unlikely(skb->nf_trace))
-                                trace_packet(skb, hook, in, out,
-                                             table->name, private, e);
+                /* The packet is traced: log it */
+                if (unlikely(skb->nf_trace))
+                        trace_packet(skb, hook, in, out,
+                                     table->name, private, e);
 #endif
-                        /* Standard target? */
-                        if (!t->u.kernel.target->target) {
-                                int v;
-
-                                v = ((struct ipt_standard_target *)t)->verdict;
-                                if (v < 0) {
-                                        /* Pop from stack? */
-                                        if (v != IPT_RETURN) {
-                                                verdict = (unsigned)(-v) - 1;
-                                                break;
-                                        }
-                                        e = back;
-                                        back = get_entry(table_base,
-                                                         back->comefrom);
-                                        continue;
-                                }
-                                if (table_base + v != (void *)e + e->next_offset
-                                    && !(e->ip.flags & IPT_F_GOTO)) {
-                                        /* Save old back ptr in next entry */
-                                        struct ipt_entry *next
-                                                = (void *)e + e->next_offset;
-                                        next->comefrom
-                                                = (void *)back - table_base;
-                                        /* set back pointer to next entry */
-                                        back = next;
+                /* Standard target? */
+                if (!t->u.kernel.target->target) {
+                        int v;
+
+                        v = ((struct ipt_standard_target *)t)->verdict;
+                        if (v < 0) {
+                                /* Pop from stack? */
+                                if (v != IPT_RETURN) {
+                                        verdict = (unsigned)(-v) - 1;
+                                        break;
                                 }
+                                e = back;
+                                back = get_entry(table_base, back->comefrom);
+                                continue;
+                        }
+                        if (table_base + v != ipt_next_entry(e)
+                            && !(e->ip.flags & IPT_F_GOTO)) {
+                                /* Save old back ptr in next entry */
+                                struct ipt_entry *next = ipt_next_entry(e);
+                                next->comefrom = (void *)back - table_base;
+                                /* set back pointer to next entry */
+                                back = next;
+                        }
+
+                        e = get_entry(table_base, v);
+                        continue;
+                }
+
+                /* Targets which reenter must return
+                   abs. verdicts */
+                tgpar.target   = t->u.kernel.target;
+                tgpar.targinfo = t->data;
+
 
-                                e = get_entry(table_base, v);
-                        } else {
-                                /* Targets which reenter must return
-                                   abs. verdicts */
-                                tgpar.target   = t->u.kernel.target;
-                                tgpar.targinfo = t->data;
 #ifdef CONFIG_NETFILTER_DEBUG
-                                ((struct ipt_entry *)table_base)->comefrom
-                                        = 0xeeeeeeec;
+                tb_comefrom = 0xeeeeeeec;
 #endif
-                                verdict = t->u.kernel.target->target(skb,
-                                                                     &tgpar);
+                verdict = t->u.kernel.target->target(skb, &tgpar);
 #ifdef CONFIG_NETFILTER_DEBUG
-                                if (((struct ipt_entry *)table_base)->comefrom
-                                    != 0xeeeeeeec
-                                    && verdict == IPT_CONTINUE) {
-                                        printk("Target %s reentered!\n",
-                                               t->u.kernel.target->name);
-                                        verdict = NF_DROP;
-                                }
-                                ((struct ipt_entry *)table_base)->comefrom
-                                        = 0x57acc001;
+                if (comefrom != 0xeeeeeeec && verdict == IPT_CONTINUE) {
+                        printk("Target %s reentered!\n",
+                               t->u.kernel.target->name);
+                        verdict = NF_DROP;
+                }
+                tb_comefrom = 0x57acc001;
 #endif
-                                /* Target might have changed stuff. */
-                                ip = ip_hdr(skb);
-                                datalen = skb->len - ip->ihl * 4;
-
-                                if (verdict == IPT_CONTINUE)
-                                        e = (void *)e + e->next_offset;
-                                else
-                                        /* Verdict */
-                                        break;
-                        }
-                } else {
+                /* Target might have changed stuff. */
+                ip = ip_hdr(skb);
+                datalen = skb->len - ip->ihl * 4;
 
-                no_match:
-                        e = (void *)e + e->next_offset;
-                }
+                if (verdict == IPT_CONTINUE)
+                        e = ipt_next_entry(e);
+                else
+                        /* Verdict */
+                        break;
         } while (!hotdrop);
         xt_info_rdunlock_bh();
 
@@ -444,6 +444,8 @@ ipt_do_table(struct sk_buff *skb,
                 return NF_DROP;
         else return verdict;
 #endif
+
+#undef tb_comefrom
 }
 
 /* Figures out from what hook each rule can be called: returns 0 if
@@ -2158,7 +2160,7 @@ static bool icmp_checkentry(const struct xt_mtchk_param *par)
 static struct xt_target ipt_standard_target __read_mostly = {
         .name           = IPT_STANDARD_TARGET,
         .targetsize     = sizeof(int),
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
 #ifdef CONFIG_COMPAT
         .compatsize     = sizeof(compat_int_t),
         .compat_from_user = compat_standard_from_user,
@@ -2170,7 +2172,7 @@ static struct xt_target ipt_error_target __read_mostly = {
         .name           = IPT_ERROR_TARGET,
         .target         = ipt_error,
         .targetsize     = IPT_FUNCTION_MAXNAMELEN,
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
 };
 
 static struct nf_sockopt_ops ipt_sockopts = {
@@ -2196,17 +2198,17 @@ static struct xt_match icmp_matchstruct __read_mostly = {
         .matchsize      = sizeof(struct ipt_icmp),
         .checkentry     = icmp_checkentry,
         .proto          = IPPROTO_ICMP,
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
 };
 
 static int __net_init ip_tables_net_init(struct net *net)
 {
-        return xt_proto_init(net, AF_INET);
+        return xt_proto_init(net, NFPROTO_IPV4);
 }
 
 static void __net_exit ip_tables_net_exit(struct net *net)
 {
-        xt_proto_fini(net, AF_INET);
+        xt_proto_fini(net, NFPROTO_IPV4);
 }
 
 static struct pernet_operations ip_tables_net_ops = {
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index c0992c75bdac..dada0863946d 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -27,9 +27,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: automatic-address SNAT");
 
-/* Lock protects masq region inside conntrack */
-static DEFINE_RWLOCK(masq_lock);
-
 /* FIXME: Multiple targets. --RR */
 static bool masquerade_tg_check(const struct xt_tgchk_param *par)
 {
@@ -79,9 +76,7 @@ masquerade_tg(struct sk_buff *skb, const struct xt_target_param *par)
                 return NF_DROP;
         }
 
-        write_lock_bh(&masq_lock);
         nat->masq_index = par->out->ifindex;
-        write_unlock_bh(&masq_lock);
 
         /* Transfer from original range. */
         newrange = ((struct nf_nat_range)
@@ -97,16 +92,11 @@ static int
 device_cmp(struct nf_conn *i, void *ifindex)
 {
         const struct nf_conn_nat *nat = nfct_nat(i);
-        int ret;
 
         if (!nat)
                 return 0;
 
-        read_lock_bh(&masq_lock);
-        ret = (nat->masq_index == (int)(long)ifindex);
-        read_unlock_bh(&masq_lock);
-
-        return ret;
+        return nat->masq_index == (int)(long)ifindex;
 }
 
 static int masq_device_event(struct notifier_block *this,
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 23b2c2ee869a..d71ba7677344 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -82,18 +82,10 @@ static int icmp_packet(struct nf_conn *ct,
                        u_int8_t pf,
                        unsigned int hooknum)
 {
-        /* Try to delete connection immediately after all replies:
-           won't actually vanish as we still have skb, and del_timer
-           means this will only run once even if count hits zero twice
-           (theoretically possible with SMP) */
-        if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
-                if (atomic_dec_and_test(&ct->proto.icmp.count))
-                        nf_ct_kill_acct(ct, ctinfo, skb);
-        } else {
-                atomic_inc(&ct->proto.icmp.count);
-                nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, ct);
-                nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmp_timeout);
-        }
+        /* Do not immediately delete the connection after the first
+           successful reply to avoid excessive conntrackd traffic
+           and also to handle correctly ICMP echo reply duplicates. */
+        nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmp_timeout);
 
         return NF_ACCEPT;
 }
@@ -117,7 +109,6 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
                 nf_ct_dump_tuple_ip(&ct->tuplehash[0].tuple);
                 return false;
         }
-        atomic_set(&ct->proto.icmp.count, 0);
         return true;
 }