[NETFILTER 00/05]: updated nf_nat patch

[Patrick McHardy <kaber@trash.net>]

I've updated your nf_nat patch to apply on top of Martin's patches
(on top of the current git tree) and merged the changes we had in
IPv4 NAT since then.

I've also reviewed the patch a bit, the main problem I found so
far is the nf_conntrack allocation scheme, which requires all
features to be known at creation time, so it doesn't allow
nf_conntrack_alter_reply to assign a helper to a connection
that previously didn't have one (same problem for helpers
like H.323 which manually assign helpers in their expectfns).

Other than that it seems (and works) fine so far, if we find
a good solution for the helper problem I would like to merge
this as fast as possible if you don't have any objections.


 include/linux/netfilter/nf_conntrack_ftp.h     |    6 
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h |   20 
 include/net/netfilter/nf_conntrack.h           |   28 
 include/net/netfilter/nf_conntrack_core.h      |    3 
 include/net/netfilter/nf_conntrack_expect.h    |    2 
 include/net/netfilter/nf_nat.h                 |   88 ++-
 include/net/netfilter/nf_nat_core.h            |   34 +
 include/net/netfilter/nf_nat_helper.h          |   33 +
 include/net/netfilter/nf_nat_protocol.h        |   74 ++
 include/net/netfilter/nf_nat_rule.h            |   38 +
 net/ipv4/netfilter/Kconfig                     |   73 +-
 net/ipv4/netfilter/Makefile                    |   12 
 net/ipv4/netfilter/ipt_MASQUERADE.c            |   29 -
 net/ipv4/netfilter/ipt_NETMAP.c                |    4 
 net/ipv4/netfilter/ipt_REDIRECT.c              |    6 
 net/ipv4/netfilter/ipt_SAME.c                  |   12 
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |    7 
 net/ipv4/netfilter/nf_nat_core.c               |  725 +++++++++++++++++++++++--
 net/ipv4/netfilter/nf_nat_ftp.c                |  192 ++++++
 net/ipv4/netfilter/nf_nat_helper.c             |  531 +++++++++++++++++-
 net/ipv4/netfilter/nf_nat_proto_icmp.c         |   99 +++
 net/ipv4/netfilter/nf_nat_proto_tcp.c          |  168 +++++
 net/ipv4/netfilter/nf_nat_proto_udp.c          |  159 +++++
 net/ipv4/netfilter/nf_nat_proto_unknown.c      |   55 +
 net/ipv4/netfilter/nf_nat_rule.c               |  349 +++++++++++-
 net/ipv4/netfilter/nf_nat_standalone.c         |  428 ++++++++++++++
 net/netfilter/Kconfig                          |   47 +
 net/netfilter/nf_conntrack_core.c              |   20 
 net/netfilter/nf_conntrack_netlink.c           |   48 -
 net/netfilter/nf_conntrack_proto_tcp.c         |    2 
 net/netfilter/nf_conntrack_standalone.c        |    5 
 31 files changed, 3096 insertions(+), 201 deletions(-)

Patrick McHardy:
      [NETFILTER]: The IPv4 NAT ported to nf_conntrack
      [NETFILTER]: nf_nat: get rid of HW checksum invalidation
      [NETFILTER]: nf_nat: use tcp_sack_block_wire
      [NETFILTER]: nf_nat: NAT annotations
      [NETFILTER]: nf_nat: work around crash in nf_conntrack_alter_reply