[NETFILTER]: Call POST_ROUTING hook before fragmentation

[safe/jmp/linux-2.6] / net / ipv4 / netfilter / ip_nat_standalone.c

diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index bc59d0d..f04111f 100644 (file)
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -73,8 +73,6 @@ ip_nat_fn(unsigned int hooknum,
        IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off
                       & htons(IP_MF|IP_OFFSET)));
 
-       (*pskb)->nfcache |= NFC_UNKNOWN;
-
        /* If we had a hardware checksum before, it's now invalid */
        if ((*pskb)->ip_summed == CHECKSUM_HW)
                if (skb_checksum_help(*pskb, (out == NULL)))
@@ -102,12 +100,16 @@ ip_nat_fn(unsigned int hooknum,
                return NF_ACCEPT;
        }
 
+       /* Don't try to NAT if this packet is not conntracked */
+       if (ct == &ip_conntrack_untracked)
+               return NF_ACCEPT;
+
        switch (ctinfo) {
        case IP_CT_RELATED:
        case IP_CT_RELATED+IP_CT_IS_REPLY:
                if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
-                       if (!icmp_reply_translation(pskb, ct, maniptype,
-                                                   CTINFO2DIR(ctinfo)))
+                       if (!ip_nat_icmp_reply_translation(pskb, ct, maniptype,
+                                                          CTINFO2DIR(ctinfo)))
                                return NF_DROP;
                        else
                                return NF_ACCEPT;
@@ -121,8 +123,12 @@ ip_nat_fn(unsigned int hooknum,
                if (!ip_nat_initialized(ct, maniptype)) {
                        unsigned int ret;
 
-                       /* LOCAL_IN hook doesn't have a chain!  */
-                       if (hooknum == NF_IP_LOCAL_IN)
+                       if (unlikely(is_confirmed(ct)))
+                               /* NAT module was loaded late */
+                               ret = alloc_null_binding_confirmed(ct, info,
+                                                                  hooknum);
+                       else if (hooknum == NF_IP_LOCAL_IN)
+                               /* LOCAL_IN hook doesn't have a chain!  */
                                ret = alloc_null_binding(ct, info, hooknum);
                        else
                                ret = ip_nat_rule_find(pskb, hooknum,
@@ -146,7 +152,7 @@ ip_nat_fn(unsigned int hooknum,
        }
 
        IP_NF_ASSERT(info);
-       return nat_packet(ct, ctinfo, hooknum, pskb);
+       return ip_nat_packet(ct, ctinfo, hooknum, pskb);
 }
 
 static unsigned int
@@ -184,23 +190,6 @@ ip_nat_out(unsigned int hooknum,
            || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
                return NF_ACCEPT;
 
-       /* We can hit fragment here; forwarded packets get
-          defragmented by connection tracking coming in, then
-          fragmented (grr) by the forward code.
-
-          In future: If we have nfct != NULL, AND we have NAT
-          initialized, AND there is no helper, then we can do full
-          NAPT on the head, and IP-address-only NAT on the rest.
-
-          I'm starting to have nightmares about fragments.  */
-
-       if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
-               *pskb = ip_ct_gather_frags(*pskb, IP_DEFRAG_NAT_OUT);
-
-               if (!*pskb)
-                       return NF_STOLEN;
-       }
-
        return ip_nat_fn(hooknum, pskb, in, out, okfn);
 }
 
@@ -319,15 +308,10 @@ static int init_or_cleanup(int init)
                printk("ip_nat_init: can't setup rules.\n");
                goto cleanup_nothing;
        }
-       ret = ip_nat_init();
-       if (ret < 0) {
-               printk("ip_nat_init: can't setup rules.\n");
-               goto cleanup_rule_init;
-       }
        ret = nf_register_hook(&ip_nat_in_ops);
        if (ret < 0) {
                printk("ip_nat_init: can't register in hook.\n");
-               goto cleanup_nat;
+               goto cleanup_rule_init;
        }
        ret = nf_register_hook(&ip_nat_out_ops);
        if (ret < 0) {
@@ -368,8 +352,6 @@ static int init_or_cleanup(int init)
        nf_unregister_hook(&ip_nat_out_ops);
  cleanup_inops:
        nf_unregister_hook(&ip_nat_in_ops);
- cleanup_nat:
-       ip_nat_cleanup();
  cleanup_rule_init:
        ip_nat_rule_cleanup();
  cleanup_nothing:
@@ -389,12 +371,4 @@ static void __exit fini(void)
 module_init(init);
 module_exit(fini);
 
-EXPORT_SYMBOL(ip_nat_setup_info);
-EXPORT_SYMBOL(ip_nat_protocol_register);
-EXPORT_SYMBOL(ip_nat_protocol_unregister);
-EXPORT_SYMBOL(ip_nat_cheat_check);
-EXPORT_SYMBOL(ip_nat_mangle_tcp_packet);
-EXPORT_SYMBOL(ip_nat_mangle_udp_packet);
-EXPORT_SYMBOL(ip_nat_used_tuple);
-EXPORT_SYMBOL(ip_nat_follow_master);
 MODULE_LICENSE("GPL");