[IP]: Introduce ip_hdrlen()

[net-next-2.6.git] / net / ipv4 / netfilter / ip_conntrack_proto_icmp.c

diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 23f1c504586dbf9930dd010181b1f31f44715896..e253f3ee52d040057d0c3f6ea45d7f8ecf20a061 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -7,7 +7,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/netfilter.h>
 #include <linux/in.h>
@@ -21,7 +20,7 @@
 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
 
-unsigned int ip_ct_icmp_timeout = 30*HZ;
+unsigned int ip_ct_icmp_timeout __read_mostly = 30*HZ;
 
 #if 0
 #define DEBUGP printk
@@ -94,9 +93,9 @@ static int icmp_packet(struct ip_conntrack *ct,
                       enum ip_conntrack_info ctinfo)
 {
        /* Try to delete connection immediately after all replies:
-           won't actually vanish as we still have skb, and del_timer
-           means this will only run once even if count hits zero twice
-           (theoretically possible with SMP) */
+          won't actually vanish as we still have skb, and del_timer
+          means this will only run once even if count hits zero twice
+          (theoretically possible with SMP) */
        if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
                if (atomic_dec_and_test(&ct->proto.icmp.count)
                    && del_timer(&ct->timeout))
@@ -114,11 +113,11 @@ static int icmp_packet(struct ip_conntrack *ct,
 static int icmp_new(struct ip_conntrack *conntrack,
                    const struct sk_buff *skb)
 {
-       static const u_int8_t valid_new[] = { 
+       static const u_int8_t valid_new[] = {
                [ICMP_ECHO] = 1,
                [ICMP_TIMESTAMP] = 1,
                [ICMP_INFO_REQUEST] = 1,
-               [ICMP_ADDRESS] = 1 
+               [ICMP_ADDRESS] = 1
        };
 
        if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
@@ -150,7 +149,7 @@ icmp_error_message(struct sk_buff *skb,
        IP_NF_ASSERT(skb->nfct == NULL);
 
        /* Not enough header? */
-       inside = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_in), &_in);
+       inside = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_in), &_in);
        if (inside == NULL)
                return -NF_ACCEPT;
 
@@ -162,7 +161,7 @@ icmp_error_message(struct sk_buff *skb,
        }
 
        innerproto = ip_conntrack_proto_find_get(inside->ip.protocol);
-       dataoff = skb->nh.iph->ihl*4 + sizeof(inside->icmp) + inside->ip.ihl*4;
+       dataoff = ip_hdrlen(skb) + sizeof(inside->icmp) + inside->ip.ihl * 4;
        /* Are they talking about one of our connections? */
        if (!ip_ct_get_tuple(&inside->ip, skb, dataoff, &origtuple, innerproto)) {
                DEBUGP("icmp_error: ! get_tuple p=%u", inside->ip.protocol);
@@ -215,7 +214,7 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
        struct icmphdr _ih, *icmph;
 
        /* Not enough header? */
-       icmph = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_ih), &_ih);
+       icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
        if (icmph == NULL) {
                if (LOG_INVALID(IPPROTO_ICMP))
                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
@@ -225,7 +224,7 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 
        /* See ip_conntrack_proto_tcp.c */
        if (ip_conntrack_checksum && hooknum == NF_IP_PRE_ROUTING &&
-           nf_ip_checksum(skb, hooknum, skb->nh.iph->ihl * 4, 0)) {
+           nf_ip_checksum(skb, hooknum, ip_hdrlen(skb), 0)) {
                if (LOG_INVALID(IPPROTO_ICMP))
                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                      "ip_ct_icmp: bad ICMP checksum ");
@@ -261,7 +260,7 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 static int icmp_tuple_to_nfattr(struct sk_buff *skb,
                                const struct ip_conntrack_tuple *t)
 {
-       NFA_PUT(skb, CTA_PROTO_ICMP_ID, sizeof(u_int16_t),
+       NFA_PUT(skb, CTA_PROTO_ICMP_ID, sizeof(__be16),
                &t->src.u.icmp.id);
        NFA_PUT(skb, CTA_PROTO_ICMP_TYPE, sizeof(u_int8_t),
                &t->dst.u.icmp.type);
@@ -282,12 +281,12 @@ static int icmp_nfattr_to_tuple(struct nfattr *tb[],
            || !tb[CTA_PROTO_ICMP_ID-1])
                return -EINVAL;
 
-       tuple->dst.u.icmp.type = 
+       tuple->dst.u.icmp.type =
                        *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_TYPE-1]);
        tuple->dst.u.icmp.code =
                        *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_CODE-1]);
        tuple->src.u.icmp.id =
-                       *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
+                       *(__be16 *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
 
        if (tuple->dst.u.icmp.type >= sizeof(invmap)
            || !invmap[tuple->dst.u.icmp.type])