Port nfnetlink and nfnetlink_conntrack to 2.6

@@ -42,14 +42,9 @@
 static char __initdata nfversion[] = "0.12";
 
 #if 1
-static int nf_debug_level = 1;
-#define nf_debug(level, format, arg...)					\
-do {									\
-	if (nf_debug_level > level)					\
-		printk(KERN_DEBUG "%s: " format, __FUNCTION__, ## arg);	\
-} while(0)
+#define DEBUGP printk
 #else
-#define nf_debug(level, format, arg...)
+#define DEBUGP(format, args...)
 #endif
 
 static struct sock *nfnl = NULL;

@@ -87,9 +82,7 @@
 
 int nfnetlink_subsys_register(struct nfnetlink_subsystem *n)
 {
-	MOD_INC_USE_COUNT;
-
-	nf_debug(0, "registering subsystem ID %u\n", n->subsys_id);
+	DEBUGP("registering subsystem ID %u\n", n->subsys_id);
 
 	nfnl_lock();
 	list_add(&n->list, &subsys_list);

@@ -101,15 +94,13 @@
 
 int nfnetlink_subsys_unregister(struct nfnetlink_subsystem *n)
 {
-	nf_debug(0, "unregistering subsystem ID %u\n", n->subsys_id);
+	DEBUGP("unregistering subsystem ID %u\n", n->subsys_id);
 
 	nfnl_lock();
 	subsys_table[n->subsys_id] = NULL;
 	list_del(&n->list);
 	nfnl_unlock();
 
-	MOD_DEC_USE_COUNT;
-
 	return 0;
 }
 

@@ -126,8 +117,7 @@
 	ss = subsys_table[subsys_id];
 
 	if (type >= ss->cb_count) {
-		nf_debug(0, "msgtype %u >= %u, returning\n", type, 
-			 ss->cb_count);
+		DEBUGP("msgtype %u >= %u, returning\n", type, ss->cb_count);
 		return NULL;
 	}
 

@@ -222,38 +212,38 @@
 	struct nfnl_callback *nc;
 	int type, err = 0;
 
-	nf_debug(0, "entered; subsys=%u, msgtype=%u\n",
+	DEBUGP("entered; subsys=%u, msgtype=%u\n",
 		 NFNL_SUBSYS_ID(nlh->nlmsg_type),
 		 NFNL_MSG_TYPE(nlh->nlmsg_type));
 
 	/* Only requests are handled by kernel now. */
 	if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) {
-		nf_debug(0, "received non-request message\n");
+		DEBUGP("received non-request message\n");
 		return 0;
 	}
 
 	/* Unknown message: reply with EINVAL */
 	type = nlh->nlmsg_type;
 	if (NFNL_SUBSYS_ID(type) > NFNL_SUBSYS_COUNT) {
-		nf_debug(0, "subsys_id > subsys_count\n");
+		DEBUGP("subsys_id > subsys_count\n");
 		goto err_inval;
 	}
 
 	/* All the messages must have at least 1 byte length */
 	if (nlh->nlmsg_len < NLMSG_LENGTH(sizeof(struct nfgenmsg))) {
-		nf_debug(0, "received message was too short\n");
+		DEBUGP("received message was too short\n");
 		return 0;
 	}
 
 	nc = nfnetlink_find_client(type);
 	if (!nc) {
-		nf_debug(0, "unable to find client for type %d\n", type);
+		DEBUGP("unable to find client for type %d\n", type);
 		goto err_inval;
 	}
 
 	if (nc->cap_required && 
 	    !cap_raised(NETLINK_CB(skb).eff_cap, nc->cap_required)) {
-		nf_debug(0, "permission denied for type %d\n", type);
+		DEBUGP("permission denied for type %d\n", type);
 		*errp = -EPERM;
 		return -1;
 	}

@@ -304,10 +294,11 @@
 		if (nfnl_shlock_nowait())
 			return;
 
-		while ((skb = skb_dequeue(&sk->receive_queue)) != NULL) {
+		while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
 			if (nfnetlink_rcv_skb(skb)) {
 				if (skb->len)
-					skb_queue_head(&sk->receive_queue, skb);
+					skb_queue_head(&sk->sk_receive_queue,
+						       skb);
 				else
 					kfree_skb(skb);
 				break;

@@ -316,13 +307,13 @@
 		}
 
 		up(&nfnl_sem);
-	} while(nfnl && nfnl->receive_queue.qlen);
+	} while(nfnl && nfnl->sk_receive_queue.qlen);
 }
 
 void __exit nfnetlink_exit(void)
 {
 	printk("Netfilter removing netlink socket.\n");
-	sock_release(nfnl->socket);
+	sock_release(nfnl->sk_socket);
 	return;
 }
 

@@ -72,8 +72,9 @@
 #define NFM_PAYLOAD(n)  NLMSG_PAYLOAD(n, sizeof(struct nfgenmsg))
 
 
+/* Now it's uses NETLINK_FIREWALL */
 #ifndef NETLINK_NETFILTER
-#define NETLINK_NETFILTER	6
+#define NETLINK_NETFILTER	3
 #endif
 
 /* netfilter netlink message types are split in two pieces:

760 lines not on this page · raw message

@@ -5,6 +5,12 @@
 
 /* CTNETLINK for ip_conntrack */
 
+/* TODO: Add more message types:
+ *
+ * 	o CTNL_MSG_UPDCONNTRACK, update conntracks
+ * 	o CTNL_MSG_DMPCONNTRACK, dump conntrack table
+ * 	o CTNL_MSG_FSHCONNTRACK, flush conntrack table
+ */
 enum cntl_msg_types {
 	CTNL_MSG_NEWCONNTRACK,
 	CTNL_MSG_GETCONNTRACK,

@@ -28,15 +34,14 @@
 	CTA_STATUS,     /* [unsigned long] Status of connection. */
 	CTA_PROTOINFO,  /* [cta_proto] Protocol specific ct information. */
 	CTA_HELPINFO,   /* [cta_help] Helper specific information. */
-	CTA_NATINFO,    /* [cta_nat] Any NAT transformations. */
 	CTA_TIMEOUT,    /* [unsigned long] timer */
 	CTA_MARK,       /* [unsigned long] mark .*/
+	CTA_ID,		/* [unsigned int] id */
 	
 	CTA_EXP_TUPLE,	/* [ip_conntrack_tuple] Expected tuple */
 	CTA_EXP_MASK,	/* [ip_conntrack_tuple] Mask for EXP_TUPLE */
 	CTA_EXP_SEQNO,	/* [u_int32_t] sequence number */
 	CTA_EXP_PROTO,	/* [cta_exp_proto] */
-	CTA_EXP_HELP,	/* [cta_exp_help] */
 	CTA_EXP_TIMEOUT,/* [unsigned long] timer */
 
 	CTA_MAX = CTA_EXP_TIMEOUT

@@ -45,12 +50,6 @@
 /* Attribute specific data structures.
  */
 
-#include <linux/netfilter_ipv4/ip_nat.h>
-struct cta_nat {
-	unsigned int num_manips;
-	struct ip_nat_info_manip manips[IP_NAT_MAX_MANIPS];
-};
-
 struct cta_proto {
 	unsigned char num_proto;	/* Protocol number IPPROTO_X */
 	union ip_conntrack_proto proto;

@@ -67,10 +66,6 @@
 	union ip_conntrack_expect_proto proto;
 };
 
-struct cta_exp_help {
-	union ip_conntrack_expect_help help;
-};
-
 /* ctnetlink multicast groups: reports any change of ctinfo,
  * ctstatus, or protocol state change.
  */