diff options
author | Patrick McHardy <kaber@trash.net> | 2008-04-14 09:15:52 (GMT) |
---|---|---|
committer | Patrick McHardy <kaber@trash.net> | 2008-04-14 09:15:52 (GMT) |
commit | dd13b010368f85dfa59364ba87bfe8ae930b2832 (patch) | |
tree | f7f0a8fa77858674564aeb614499f40dd3c6dcd8 /net/ipv4/netfilter/nf_nat_core.c | |
parent | 55871d04793d9c069ee277b1e98794b88d92ed80 (diff) | |
download | linux-fsl-qoriq-dd13b010368f85dfa59364ba87bfe8ae930b2832.tar.xz |
[NETFILTER]: nf_nat: kill helper and seq_adjust hooks
Connection tracking helpers (specifically FTP) need to be called
before NAT sequence numbers adjustments are performed to be able
to compare them against previously seen ones. We've introduced
two new hooks around 2.6.11 to maintain this ordering when NAT
modules were changed to get called from conntrack helpers directly.
The cost of netfilter hooks is quite high and sequence number
adjustments are only rarely needed however. Add a RCU-protected
sequence number adjustment function pointer and call it from
IPv4 conntrack after calling the helper.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/ipv4/netfilter/nf_nat_core.c')
-rw-r--r-- | net/ipv4/netfilter/nf_nat_core.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c index 9320c7a..25c3efe 100644 --- a/net/ipv4/netfilter/nf_nat_core.c +++ b/net/ipv4/netfilter/nf_nat_core.c @@ -618,6 +618,9 @@ static int __init nf_nat_init(void) nf_conntrack_untracked.status |= IPS_NAT_DONE_MASK; l3proto = nf_ct_l3proto_find_get((u_int16_t)AF_INET); + + BUG_ON(nf_nat_seq_adjust_hook != NULL); + rcu_assign_pointer(nf_nat_seq_adjust_hook, nf_nat_seq_adjust); return 0; cleanup_extend: @@ -644,6 +647,8 @@ static void __exit nf_nat_cleanup(void) nf_ct_free_hashtable(bysource, nf_nat_vmalloced, nf_nat_htable_size); nf_ct_l3proto_put(l3proto); nf_ct_extend_unregister(&nat_extend); + rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL); + synchronize_net(); } MODULE_LICENSE("GPL"); |