[NETFILTER]: xt_policy: remove dups in .family
[linux-2.6.git] / net / netfilter / nf_conntrack_ftp.c
index ab0c920..0c17a5b 100644 (file)
  * Derived from net/ipv4/netfilter/ip_conntrack_ftp.c
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/ctype.h>
+#include <linux/inet.h>
 #include <net/checksum.h>
 #include <net/tcp.h>
 
@@ -67,135 +67,59 @@ static int try_epsv_response(const char *, size_t, struct nf_conntrack_man *,
                             char);
 
 static struct ftp_search {
-       enum ip_conntrack_dir dir;
        const char *pattern;
        size_t plen;
        char skip;
        char term;
        enum ip_ct_ftp_type ftptype;
        int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char);
-} search[] = {
-       {
-               IP_CT_DIR_ORIGINAL,
-               "PORT", sizeof("PORT") - 1, ' ', '\r',
-               IP_CT_FTP_PORT,
-               try_rfc959,
+} search[IP_CT_DIR_MAX][2] = {
+       [IP_CT_DIR_ORIGINAL] = {
+               {
+                       .pattern        = "PORT",
+                       .plen           = sizeof("PORT") - 1,
+                       .skip           = ' ',
+                       .term           = '\r',
+                       .ftptype        = IP_CT_FTP_PORT,
+                       .getnum         = try_rfc959,
+               },
+               {
+                       .pattern        = "EPRT",
+                       .plen           = sizeof("EPRT") - 1,
+                       .skip           = ' ',
+                       .term           = '\r',
+                       .ftptype        = IP_CT_FTP_EPRT,
+                       .getnum         = try_eprt,
+               },
        },
-       {
-               IP_CT_DIR_REPLY,
-               "227 ", sizeof("227 ") - 1, '(', ')',
-               IP_CT_FTP_PASV,
-               try_rfc959,
-       },
-       {
-               IP_CT_DIR_ORIGINAL,
-               "EPRT", sizeof("EPRT") - 1, ' ', '\r',
-               IP_CT_FTP_EPRT,
-               try_eprt,
-       },
-       {
-               IP_CT_DIR_REPLY,
-               "229 ", sizeof("229 ") - 1, '(', ')',
-               IP_CT_FTP_EPSV,
-               try_epsv_response,
+       [IP_CT_DIR_REPLY] = {
+               {
+                       .pattern        = "227 ",
+                       .plen           = sizeof("227 ") - 1,
+                       .skip           = '(',
+                       .term           = ')',
+                       .ftptype        = IP_CT_FTP_PASV,
+                       .getnum         = try_rfc959,
+               },
+               {
+                       .pattern        = "229 ",
+                       .plen           = sizeof("229 ") - 1,
+                       .skip           = '(',
+                       .term           = ')',
+                       .ftptype        = IP_CT_FTP_EPSV,
+                       .getnum         = try_epsv_response,
+               },
        },
 };
 
-/* This code is based on inet_pton() in glibc-2.2.4 */
 static int
 get_ipv6_addr(const char *src, size_t dlen, struct in6_addr *dst, u_int8_t term)
 {
-       static const char xdigits[] = "0123456789abcdef";
-       u_int8_t tmp[16], *tp, *endp, *colonp;
-       int ch, saw_xdigit;
-       u_int32_t val;
-       size_t clen = 0;
-
-       tp = memset(tmp, '\0', sizeof(tmp));
-       endp = tp + sizeof(tmp);
-       colonp = NULL;
-
-       /* Leading :: requires some special handling. */
-       if (*src == ':'){
-               if (*++src != ':') {
-                       DEBUGP("invalid \":\" at the head of addr\n");
-                       return 0;
-               }
-               clen++;
-       }
-
-       saw_xdigit = 0;
-       val = 0;
-       while ((clen < dlen) && (*src != term)) {
-               const char *pch;
-
-               ch = tolower(*src++);
-               clen++;
-
-                pch = strchr(xdigits, ch);
-                if (pch != NULL) {
-                        val <<= 4;
-                        val |= (pch - xdigits);
-                        if (val > 0xffff)
-                                return 0;
-
-                       saw_xdigit = 1;
-                        continue;
-                }
-               if (ch != ':') {
-                       DEBUGP("get_ipv6_addr: invalid char. \'%c\'\n", ch);
-                       return 0;
-               }
-
-               if (!saw_xdigit) {
-                       if (colonp) {
-                               DEBUGP("invalid location of \"::\".\n");
-                               return 0;
-                       }
-                       colonp = tp;
-                       continue;
-               } else if (*src == term) {
-                       DEBUGP("trancated IPv6 addr\n");
-                       return 0;
-               }
-
-               if (tp + 2 > endp)
-                       return 0;
-               *tp++ = (u_int8_t) (val >> 8) & 0xff;
-               *tp++ = (u_int8_t) val & 0xff;
-
-               saw_xdigit = 0;
-               val = 0;
-               continue;
-        }
-        if (saw_xdigit) {
-                if (tp + 2 > endp)
-                        return 0;
-                *tp++ = (u_int8_t) (val >> 8) & 0xff;
-                *tp++ = (u_int8_t) val & 0xff;
-        }
-        if (colonp != NULL) {
-                /*
-                 * Since some memmove()'s erroneously fail to handle
-                 * overlapping regions, we'll do the shift by hand.
-                 */
-                const int n = tp - colonp;
-                int i;
-
-                if (tp == endp)
-                        return 0;
-
-                for (i = 1; i <= n; i++) {
-                        endp[- i] = colonp[n - i];
-                        colonp[n - i] = 0;
-                }
-                tp = endp;
-        }
-        if (tp != endp || (*src != term))
-                return 0;
-
-        memcpy(dst->s6_addr, tmp, sizeof(dst->s6_addr));
-        return clen;
+       const char *end;
+       int ret = in6_pton(src, min_t(size_t, dlen, 0xffff), (u8 *)dst, term, &end);
+       if (ret > 0)
+               return (int)(end - src);
+       return 0;
 }
 
 static int try_number(const char *data, size_t dlen, u_int32_t array[],
@@ -440,7 +364,7 @@ static int help(struct sk_buff **pskb,
        u32 seq;
        int dir = CTINFO2DIR(ctinfo);
        unsigned int matchlen, matchoff;
-       struct ip_ct_ftp_master *ct_ftp_info = &ct->help->ct_ftp_info;
+       struct ip_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
        struct nf_conntrack_expect *exp;
        struct nf_conntrack_man cmd = {};
 
@@ -492,17 +416,15 @@ static int help(struct sk_buff **pskb,
        memcpy(cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
               sizeof(cmd.u3.all));
 
-       for (i = 0; i < ARRAY_SIZE(search); i++) {
-               if (search[i].dir != dir) continue;
-
+       for (i = 0; i < ARRAY_SIZE(search[dir]); i++) {
                found = find_pattern(fb_ptr, datalen,
-                                    search[i].pattern,
-                                    search[i].plen,
-                                    search[i].skip,
-                                    search[i].term,
+                                    search[dir][i].pattern,
+                                    search[dir][i].plen,
+                                    search[dir][i].skip,
+                                    search[dir][i].term,
                                     &matchoff, &matchlen,
                                     &cmd,
-                                    search[i].getnum);
+                                    search[dir][i].getnum);
                if (found) break;
        }
        if (found == -1) {
@@ -512,7 +434,7 @@ static int help(struct sk_buff **pskb,
                   this case. */
                if (net_ratelimit())
                        printk("conntrack_ftp: partial %s %u+%u\n",
-                              search[i].pattern,
+                              search[dir][i].pattern,
                               ntohl(th->seq), datalen);
                ret = NF_DROP;
                goto out;
@@ -597,7 +519,7 @@ static int help(struct sk_buff **pskb,
        /* Now, NAT might want to mangle the packet, and register the
         * (possibly changed) expectation itself. */
        if (nf_nat_ftp_hook)
-               ret = nf_nat_ftp_hook(pskb, ctinfo, search[i].ftptype,
+               ret = nf_nat_ftp_hook(pskb, ctinfo, search[dir][i].ftptype,
                                      matchoff, matchlen, exp, &seq);
        else {
                /* Can't expect this?  Best to drop packet now. */
@@ -624,7 +546,7 @@ static struct nf_conntrack_helper ftp[MAX_PORTS][2];
 static char ftp_names[MAX_PORTS][2][sizeof("ftp-65535")];
 
 /* don't make this __exit, since it's called from __init ! */
-static void fini(void)
+static void nf_conntrack_ftp_fini(void)
 {
        int i, j;
        for (i = 0; i < ports_c; i++) {
@@ -642,7 +564,7 @@ static void fini(void)
        kfree(ftp_buffer);
 }
 
-static int __init init(void)
+static int __init nf_conntrack_ftp_init(void)
 {
        int i, j = -1, ret = 0;
        char *tmpname;
@@ -657,8 +579,6 @@ static int __init init(void)
        /* FIXME should be configurable whether IPv4 and IPv6 FTP connections
                 are tracked or not - YK */
        for (i = 0; i < ports_c; i++) {
-               memset(&ftp[i], 0, sizeof(struct nf_conntrack_helper));
-
                ftp[i][0].tuple.src.l3num = PF_INET;
                ftp[i][1].tuple.src.l3num = PF_INET6;
                for (j = 0; j < 2; j++) {
@@ -685,7 +605,7 @@ static int __init init(void)
                                printk("nf_ct_ftp: failed to register helper "
                                       " for pf: %d port: %d\n",
                                        ftp[i][j].tuple.src.l3num, ports[i]);
-                               fini();
+                               nf_conntrack_ftp_fini();
                                return ret;
                        }
                }
@@ -694,5 +614,5 @@ static int __init init(void)
        return 0;
 }
 
-module_init(init);
-module_exit(fini);
+module_init(nf_conntrack_ftp_init);
+module_exit(nf_conntrack_ftp_fini);