netfilter: xt_connlimit: fix regression caused by zero family value

[safe/jmp/linux-2.6] / net / netfilter / xt_connlimit.c

diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index bfb3ee6..38f03f7 100644 (file)
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -103,18 +103,17 @@ static int count_them(struct xt_connlimit_data *data,
                      const struct nf_conntrack_tuple *tuple,
                      const union nf_inet_addr *addr,
                      const union nf_inet_addr *mask,
-                     const struct xt_match *match)
+                     u_int8_t family)
 {
        const struct nf_conntrack_tuple_hash *found;
        struct xt_connlimit_conn *conn;
        struct xt_connlimit_conn *tmp;
-       const struct nf_conn *found_ct;
+       struct nf_conn *found_ct;
        struct list_head *hash;
        bool addit = true;
        int matches = 0;
 
-
-       if (match->family == NFPROTO_IPV6)
+       if (family == NFPROTO_IPV6)
                hash = &data->iphash[connlimit_iphash6(addr, mask)];
        else
                hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
@@ -123,7 +122,7 @@ static int count_them(struct xt_connlimit_data *data,
 
        /* check the saved connections */
        list_for_each_entry_safe(conn, tmp, hash, list) {
-               found    = __nf_conntrack_find(&init_net, &conn->tuple);
+               found    = nf_conntrack_find_get(&init_net, &conn->tuple);
                found_ct = NULL;
 
                if (found != NULL)
@@ -151,15 +150,16 @@ static int count_them(struct xt_connlimit_data *data,
                         * we do not care about connections which are
                         * closed already -> ditch it
                         */
+                       nf_ct_put(found_ct);
                        list_del(&conn->list);
                        kfree(conn);
                        continue;
                }
 
-               if (same_source_net(addr, mask, &conn->tuple.src.u3,
-                   match->family))
+               if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
                        /* same source network -> be counted! */
                        ++matches;
+               nf_ct_put(found_ct);
        }
 
        rcu_read_unlock();
@@ -192,10 +192,10 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
        if (ct != NULL)
                tuple_ptr = &ct->tuplehash[0].tuple;
        else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
-                                   par->match->family, &tuple))
+                                   par->family, &tuple))
                goto hotdrop;
 
-       if (par->match->family == NFPROTO_IPV6) {
+       if (par->family == NFPROTO_IPV6) {
                const struct ipv6hdr *iph = ipv6_hdr(skb);
                memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));
        } else {
@@ -205,7 +205,7 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 
        spin_lock_bh(&info->data->lock);
        connections = count_them(info->data, tuple_ptr, &addr,
-                                &info->mask, par->match);
+                                &info->mask, par->family);
        spin_unlock_bh(&info->data->lock);
 
        if (connections < 0) {
@@ -226,16 +226,16 @@ static bool connlimit_mt_check(const struct xt_mtchk_param *par)
        struct xt_connlimit_info *info = par->matchinfo;
        unsigned int i;
 
-       if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
+       if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                printk(KERN_WARNING "cannot load conntrack support for "
-                      "address family %u\n", par->match->family);
+                      "address family %u\n", par->family);
                return false;
        }
 
        /* init private data */
        info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);
        if (info->data == NULL) {
-               nf_ct_l3proto_module_put(par->match->family);
+               nf_ct_l3proto_module_put(par->family);
                return false;
        }
 
@@ -254,7 +254,7 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
        struct list_head *hash = info->data->iphash;
        unsigned int i;
 
-       nf_ct_l3proto_module_put(par->match->family);
+       nf_ct_l3proto_module_put(par->family);
 
        for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
                list_for_each_entry_safe(conn, tmp, &hash[i], list) {
@@ -266,41 +266,30 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
        kfree(info->data);
 }
 
-static struct xt_match connlimit_mt_reg[] __read_mostly = {
-       {
-               .name       = "connlimit",
-               .family     = NFPROTO_IPV4,
-               .checkentry = connlimit_mt_check,
-               .match      = connlimit_mt,
-               .matchsize  = sizeof(struct xt_connlimit_info),
-               .destroy    = connlimit_mt_destroy,
-               .me         = THIS_MODULE,
-       },
-       {
-               .name       = "connlimit",
-               .family     = NFPROTO_IPV6,
-               .checkentry = connlimit_mt_check,
-               .match      = connlimit_mt,
-               .matchsize  = sizeof(struct xt_connlimit_info),
-               .destroy    = connlimit_mt_destroy,
-               .me         = THIS_MODULE,
-       },
+static struct xt_match connlimit_mt_reg __read_mostly = {
+       .name       = "connlimit",
+       .revision   = 0,
+       .family     = NFPROTO_UNSPEC,
+       .checkentry = connlimit_mt_check,
+       .match      = connlimit_mt,
+       .matchsize  = sizeof(struct xt_connlimit_info),
+       .destroy    = connlimit_mt_destroy,
+       .me         = THIS_MODULE,
 };
 
 static int __init connlimit_mt_init(void)
 {
-       return xt_register_matches(connlimit_mt_reg,
-              ARRAY_SIZE(connlimit_mt_reg));
+       return xt_register_match(&connlimit_mt_reg);
 }
 
 static void __exit connlimit_mt_exit(void)
 {
-       xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
+       xt_unregister_match(&connlimit_mt_reg);
 }
 
 module_init(connlimit_mt_init);
 module_exit(connlimit_mt_exit);
-MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
 MODULE_DESCRIPTION("Xtables: Number of connections matching");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_connlimit");