Re: [PATCH 08/09]: netfilter: nf_conntrack: add support for "conntrack zones"

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> On Monday 2010-01-25 16:37, Patrick McHardy wrote:
>> diff --git a/include/linux/netfilter/xt_CT.h b/include/linux/netfilter/xt_CT.h
>> index a4c1880..fe4ee76 100644
>> --- a/include/linux/netfilter/xt_CT.h
>> +++ b/include/linux/netfilter/xt_CT.h
>> @@ -5,6 +5,7 @@ struct xt_ct_target_info {
>> 	u_int32_t	ct_events;
>> 	u_int32_t	exp_events;
>> 	char		helper[16];
>> +	u_int16_t	zone;
>>
>> 	/* Used internally by the kernel */
>> 	struct nf_conn	*ct __attribute__((aligned(8)));
> 
>> diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
>> index d171b12..9c1560d 100644
>> --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
>> +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
>> @@ -266,7 +266,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
>> 		return -EINVAL;
>> 	}
>>
>> -	h = nf_conntrack_find_get(sock_net(sk), &tuple);
>> +	h = nf_conntrack_find_get(sock_net(sk), 0, &tuple);
> 
> I would prefer to avoid literal numbers where doing so meaningful;
> perhaps we can introduce a symbolic constant NF_CT_GLOBAL_ZONE
> or similar here.

Sure, I'll add that.