netfilter: nf_nat: use hash random for bysource hash

[mirror_ubuntu-artful-kernel.git] / net / ipv4 / netfilter / nf_nat_core.c

diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 447bc5cfdc6c83703215db60a9ea631ef46774c8..76600f8d434b31351964a6fcdb9a6f84eaec4de9 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -57,7 +57,7 @@ hash_by_src(const struct net *net, u16 zone,
        /* Original src, to ensure we map it consistently if poss. */
        hash = jhash_3words((__force u32)tuple->src.u3.ip,
                            (__force u32)tuple->src.u.all ^ zone,
-                           tuple->dst.protonum, 0);
+                           tuple->dst.protonum, nf_conntrack_hash_rnd);
        return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
 }
 
@@ -82,14 +82,14 @@ EXPORT_SYMBOL(nf_nat_used_tuple);
  * that meet the constraints of range. */
 static int
 in_range(const struct nf_conntrack_tuple *tuple,
-        const struct nf_nat_range *range)
+        const struct nf_nat_ipv4_range *range)
 {
        const struct nf_nat_protocol *proto;
        int ret = 0;
 
        /* If we are supposed to map IPs, then we must be in the
           range specified, otherwise let this drag us onto a new src IP. */
-       if (range->flags & IP_NAT_RANGE_MAP_IPS) {
+       if (range->flags & NF_NAT_RANGE_MAP_IPS) {
                if (ntohl(tuple->src.u3.ip) < ntohl(range->min_ip) ||
                    ntohl(tuple->src.u3.ip) > ntohl(range->max_ip))
                        return 0;
@@ -97,8 +97,8 @@ in_range(const struct nf_conntrack_tuple *tuple,
 
        rcu_read_lock();
        proto = __nf_nat_proto_find(tuple->dst.protonum);
-       if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) ||
-           proto->in_range(tuple, IP_NAT_MANIP_SRC,
+       if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) ||
+           proto->in_range(tuple, NF_NAT_MANIP_SRC,
                            &range->min, &range->max))
                ret = 1;
        rcu_read_unlock();
@@ -123,7 +123,7 @@ static int
 find_appropriate_src(struct net *net, u16 zone,
                     const struct nf_conntrack_tuple *tuple,
                     struct nf_conntrack_tuple *result,
-                    const struct nf_nat_range *range)
+                    const struct nf_nat_ipv4_range *range)
 {
        unsigned int h = hash_by_src(net, zone, tuple);
        const struct nf_conn_nat *nat;
@@ -157,7 +157,7 @@ find_appropriate_src(struct net *net, u16 zone,
 */
 static void
 find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
-                   const struct nf_nat_range *range,
+                   const struct nf_nat_ipv4_range *range,
                    const struct nf_conn *ct,
                    enum nf_nat_manip_type maniptype)
 {
@@ -166,10 +166,10 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
        u_int32_t minip, maxip, j;
 
        /* No IP mapping?  Do nothing. */
-       if (!(range->flags & IP_NAT_RANGE_MAP_IPS))
+       if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
                return;
 
-       if (maniptype == IP_NAT_MANIP_SRC)
+       if (maniptype == NF_NAT_MANIP_SRC)
                var_ipp = &tuple->src.u3.ip;
        else
                var_ipp = &tuple->dst.u3.ip;
@@ -189,7 +189,7 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
        minip = ntohl(range->min_ip);
        maxip = ntohl(range->max_ip);
        j = jhash_2words((__force u32)tuple->src.u3.ip,
-                        range->flags & IP_NAT_RANGE_PERSISTENT ?
+                        range->flags & NF_NAT_RANGE_PERSISTENT ?
                                0 : (__force u32)tuple->dst.u3.ip ^ zone, 0);
        j = ((u64)j * (maxip - minip + 1)) >> 32;
        *var_ipp = htonl(minip + j);
@@ -204,7 +204,7 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
 static void
 get_unique_tuple(struct nf_conntrack_tuple *tuple,
                 const struct nf_conntrack_tuple *orig_tuple,
-                const struct nf_nat_range *range,
+                const struct nf_nat_ipv4_range *range,
                 struct nf_conn *ct,
                 enum nf_nat_manip_type maniptype)
 {
@@ -219,8 +219,8 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
           This is only required for source (ie. NAT/masq) mappings.
           So far, we don't do local source mappings, so multiple
           manips not an issue.  */
-       if (maniptype == IP_NAT_MANIP_SRC &&
-           !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
+       if (maniptype == NF_NAT_MANIP_SRC &&
+           !(range->flags & NF_NAT_RANGE_PROTO_RANDOM)) {
                /* try the original tuple first */
                if (in_range(orig_tuple, range)) {
                        if (!nf_nat_used_tuple(orig_tuple, ct)) {
@@ -247,8 +247,8 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
        proto = __nf_nat_proto_find(orig_tuple->dst.protonum);
 
        /* Only bother mapping if it's not already in range and unique */
-       if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
-               if (range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
+       if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM)) {
+               if (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
                        if (proto->in_range(tuple, maniptype, &range->min,
                                            &range->max) &&
                            (range->min.all == range->max.all ||
@@ -267,7 +267,7 @@ out:
 
 unsigned int
 nf_nat_setup_info(struct nf_conn *ct,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_ipv4_range *range,
                  enum nf_nat_manip_type maniptype)
 {
        struct net *net = nf_ct_net(ct);
@@ -284,8 +284,8 @@ nf_nat_setup_info(struct nf_conn *ct,
                }
        }
 
-       NF_CT_ASSERT(maniptype == IP_NAT_MANIP_SRC ||
-                    maniptype == IP_NAT_MANIP_DST);
+       NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
+                    maniptype == NF_NAT_MANIP_DST);
        BUG_ON(nf_nat_initialized(ct, maniptype));
 
        /* What we've got will look like inverse of reply. Normally
@@ -306,13 +306,13 @@ nf_nat_setup_info(struct nf_conn *ct,
                nf_conntrack_alter_reply(ct, &reply);
 
                /* Non-atomic: we own this at the moment. */
-               if (maniptype == IP_NAT_MANIP_SRC)
+               if (maniptype == NF_NAT_MANIP_SRC)
                        ct->status |= IPS_SRC_NAT;
                else
                        ct->status |= IPS_DST_NAT;
        }
 
-       if (maniptype == IP_NAT_MANIP_SRC) {
+       if (maniptype == NF_NAT_MANIP_SRC) {
                unsigned int srchash;
 
                srchash = hash_by_src(net, nf_ct_zone(ct),
@@ -327,7 +327,7 @@ nf_nat_setup_info(struct nf_conn *ct,
        }
 
        /* It's done. */
-       if (maniptype == IP_NAT_MANIP_DST)
+       if (maniptype == NF_NAT_MANIP_DST)
                ct->status |= IPS_DST_NAT_DONE;
        else
                ct->status |= IPS_SRC_NAT_DONE;
@@ -361,7 +361,7 @@ manip_pkt(u_int16_t proto,
 
        iph = (void *)skb->data + iphdroff;
 
-       if (maniptype == IP_NAT_MANIP_SRC) {
+       if (maniptype == NF_NAT_MANIP_SRC) {
                csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
                iph->saddr = target->src.u3.ip;
        } else {
@@ -381,7 +381,7 @@ unsigned int nf_nat_packet(struct nf_conn *ct,
        unsigned long statusbit;
        enum nf_nat_manip_type mtype = HOOK2MANIP(hooknum);
 
-       if (mtype == IP_NAT_MANIP_SRC)
+       if (mtype == NF_NAT_MANIP_SRC)
                statusbit = IPS_SRC_NAT;
        else
                statusbit = IPS_DST_NAT;
@@ -447,7 +447,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
                        return 0;
        }
 
-       if (manip == IP_NAT_MANIP_SRC)
+       if (manip == NF_NAT_MANIP_SRC)
                statusbit = IPS_SRC_NAT;
        else
                statusbit = IPS_DST_NAT;
@@ -602,7 +602,7 @@ static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
 
 static int nfnetlink_parse_nat_proto(struct nlattr *attr,
                                     const struct nf_conn *ct,
-                                    struct nf_nat_range *range)
+                                    struct nf_nat_ipv4_range *range)
 {
        struct nlattr *tb[CTA_PROTONAT_MAX+1];
        const struct nf_nat_protocol *npt;
@@ -626,7 +626,7 @@ static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
 
 static int
 nfnetlink_parse_nat(const struct nlattr *nat,
-                   const struct nf_conn *ct, struct nf_nat_range *range)
+                   const struct nf_conn *ct, struct nf_nat_ipv4_range *range)
 {
        struct nlattr *tb[CTA_NAT_MAX+1];
        int err;
@@ -646,7 +646,7 @@ nfnetlink_parse_nat(const struct nlattr *nat,
                range->max_ip = nla_get_be32(tb[CTA_NAT_MAXIP]);
 
        if (range->min_ip)
-               range->flags |= IP_NAT_RANGE_MAP_IPS;
+               range->flags |= NF_NAT_RANGE_MAP_IPS;
 
        if (!tb[CTA_NAT_PROTO])
                return 0;
@@ -663,7 +663,7 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
                          enum nf_nat_manip_type manip,
                          const struct nlattr *attr)
 {
-       struct nf_nat_range range;
+       struct nf_nat_ipv4_range range;
 
        if (nfnetlink_parse_nat(attr, ct, &range) < 0)
                return -EINVAL;