Skip to contentSkip to conversation

: Remove NET_ACT_NAT dependency on NETFILTER

PATCH In review Patrick McHardy 2 participants 4 messages Nov 29, 2007

Subsystems (4)
Networking Network drivers netfilter Traffic control (tc)
lore
Share & tools
lore

Patrick McHardy

author
#0 lore raw

cover : Remove NET_ACT_NAT dependency on NETFILTER

These patches remove the dependency of NET_ACT_NAT on NETFILTER by moving the netfilter checksum helpers to include/net/checksum and net/core/utils.c. I didn't find more appropriate locations, but I'd happily change it if someone suggests something better.

 include/linux/netfilter.h              |   22 ----------------------
 include/net/checksum.h                 |   25 +++++++++++++++++++++++++
 net/core/utils.c                       |   16 ++++++++++++++++
 net/ipv4/netfilter/ipt_ECN.c           |    6 +++---
 net/ipv4/netfilter/ipt_TOS.c           |    2 +-
 net/ipv4/netfilter/ipt_TTL.c           |    4 ++--
 net/ipv4/netfilter/nf_nat_core.c       |    4 ++--
 net/ipv4/netfilter/nf_nat_helper.c     |   20 ++++++++++----------
 net/ipv4/netfilter/nf_nat_proto_icmp.c |    4 ++--
 net/ipv4/netfilter/nf_nat_proto_tcp.c  |    4 ++--
 net/ipv4/netfilter/nf_nat_proto_udp.c  |    6 +++---
 net/netfilter/core.c                   |   16 ----------------
 net/netfilter/xt_TCPMSS.c              |   17 +++++++++--------
 net/sched/Kconfig                      |    1 -
 net/sched/act_nat.c                    |   12 ++++++------
 15 files changed, 81 insertions(+), 78 deletions(-)

Patrick McHardy (2):
[NET]: Move netfilter checksum helpers to net/core/utils.c [NETFILTER]: Convert old checksum helper names

author
#1 lore raw

PATCH 1/2 : Move netfilter checksum helpers to net/core/utils.c

[NET]: Move netfilter checksum helpers to net/core/utils.c

This allows to get rid of the CONFIG_NETFILTER dependency of NET_ACT_NAT. This patch redefines the old names to keep the noise low, the next patch converts all users.

Signed-off-by Patrick McHardy <[email protected]>

---
commit 01879e49c8b53ea8cfb28f275db18ee7cbe54304
tree 3a62d0d28d01b8d3a32b1927ccf854c4af7dc1dc
parent c748e53090d0511fdecb9a91cd3619bd2d7a39f6
author Patrick McHardy <[email protected]> Thu, 29 Nov 2007 10:43:11 +0100 committer Patrick McHardy <[email protected]> Thu, 29 Nov 2007 10:43:11 +0100

 include/linux/netfilter.h |   25 ++++---------------------
 include/net/checksum.h    |   25 +++++++++++++++++++++++++
 net/core/utils.c          |   16 ++++++++++++++++
 net/netfilter/core.c      |   16 ----------------
 4 files changed, 45 insertions(+), 37 deletions(-)
include/linux/netfilter.h +4 -21
index 25fc122..e2bf6d2 100644
@@ -298,27 +298,10 @@ extern void nf_invalidate_cache(int pf);
    Returns true or false. */
 extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
 
-static inline void nf_csum_replace4(__sum16 *sum, __be32 from, __be32 to)
-{
-	__be32 diff[] = { ~from, to };
-
-	*sum = csum_fold(csum_partial((char *)diff, sizeof(diff), ~csum_unfold(*sum)));
-}
-
-static inline void nf_csum_replace2(__sum16 *sum, __be16 from, __be16 to)
-{
-	nf_csum_replace4(sum, (__force __be32)from, (__force __be32)to);
-}
-
-extern void nf_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
-				      __be32 from, __be32 to, int pseudohdr);
-
-static inline void nf_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
-				      __be16 from, __be16 to, int pseudohdr)
-{
-	nf_proto_csum_replace4(sum, skb, (__force __be32)from,
-				(__force __be32)to, pseudohdr);
-}
+#define nf_csum_replace4	csum_replace4
+#define nf_csum_replace2	csum_replace2
+#define nf_proto_csum_replace4	inet_proto_csum_replace4
+#define nf_proto_csum_replace2	inet_proto_csum_replace2
 
 struct nf_afinfo {
 	unsigned short	family;
include/net/checksum.h +25 -0
index 1242461..07602b7 100644
@@ -93,4 +93,29 @@ static inline __wsum csum_unfold(__sum16 n)
 }
 
 #define CSUM_MANGLED_0 ((__force __sum16)0xffff)
+
+static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to)
+{
+	__be32 diff[] = { ~from, to };
+
+	*sum = csum_fold(csum_partial((char *)diff, sizeof(diff), ~csum_unfold(*sum)));
+}
+
+static inline void csum_replace2(__sum16 *sum, __be16 from, __be16 to)
+{
+	csum_replace4(sum, (__force __be32)from, (__force __be32)to);
+}
+
+struct sk_buff;
+extern void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+				     __be32 from, __be32 to, int pseudohdr);
+
+static inline void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
+					    __be16 from, __be16 to,
+					    int pseudohdr)
+{
+	inet_proto_csum_replace4(sum, skb, (__force __be32)from,
+				 (__force __be32)to, pseudohdr);
+}
+
 #endif
net/core/utils.c +16 -0
index 0bf17da..34459c4 100644
@@ -293,3 +293,19 @@ out:
 }
 
 EXPORT_SYMBOL(in6_pton);
+
+void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+			      __be32 from, __be32 to, int pseudohdr)
+{
+	__be32 diff[] = { ~from, to };
+	if (skb->ip_summed != CHECKSUM_PARTIAL) {
+		*sum = csum_fold(csum_partial(diff, sizeof(diff),
+				~csum_unfold(*sum)));
+		if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
+			skb->csum = ~csum_partial(diff, sizeof(diff),
+						~skb->csum);
+	} else if (pseudohdr)
+		*sum = ~csum_fold(csum_partial(diff, sizeof(diff),
+				csum_unfold(*sum)));
+}
+EXPORT_SYMBOL(inet_proto_csum_replace4);
net/netfilter/core.c +0 -16
index bed9ba0..631d269 100644
@@ -217,22 +217,6 @@ int skb_make_writable(struct sk_buff *skb, unsigned int writable_len)
 }
 EXPORT_SYMBOL(skb_make_writable);
 
-void nf_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
-			    __be32 from, __be32 to, int pseudohdr)
-{
-	__be32 diff[] = { ~from, to };
-	if (skb->ip_summed != CHECKSUM_PARTIAL) {
-		*sum = csum_fold(csum_partial(diff, sizeof(diff),
-				~csum_unfold(*sum)));
-		if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
-			skb->csum = ~csum_partial(diff, sizeof(diff),
-						~skb->csum);
-	} else if (pseudohdr)
-		*sum = ~csum_fold(csum_partial(diff, sizeof(diff),
-				csum_unfold(*sum)));
-}
-EXPORT_SYMBOL(nf_proto_csum_replace4);
-
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 /* This does not belong here, but locally generated errors need it if connection
    tracking in use: without this, connection may not be in hash table, and hence
author
#2 lore raw

PATCH 2/2 : Convert old checksum helper names

In reply to Patrick McHardy

[NETFILTER]: Convert old checksum helper names

Kill the defines again, convert to the new checksum helper names and remove the dependency of NET_ACT_NAT on NETFILTER.

Signed-off-by Patrick McHardy <[email protected]>

---
commit da8ffc485b6e8e429c51f7f1c03a0ae824eca848
tree 2198c531b224c82e74b66b3029dc8fec1c555105
parent 01879e49c8b53ea8cfb28f275db18ee7cbe54304
author Patrick McHardy <[email protected]> Thu, 29 Nov 2007 10:48:52 +0100 committer Patrick McHardy <[email protected]> Thu, 29 Nov 2007 10:48:52 +0100

 include/linux/netfilter.h              |    5 -----
 net/ipv4/netfilter/ipt_ECN.c           |    6 +++---
 net/ipv4/netfilter/ipt_TOS.c           |    2 +-
 net/ipv4/netfilter/ipt_TTL.c           |    4 ++--
 net/ipv4/netfilter/nf_nat_core.c       |    4 ++--
 net/ipv4/netfilter/nf_nat_helper.c     |   20 ++++++++++----------
 net/ipv4/netfilter/nf_nat_proto_icmp.c |    4 ++--
 net/ipv4/netfilter/nf_nat_proto_tcp.c  |    4 ++--
 net/ipv4/netfilter/nf_nat_proto_udp.c  |    6 +++---
 net/netfilter/xt_TCPMSS.c              |   17 +++++++++--------
 net/sched/Kconfig                      |    1 -
 net/sched/act_nat.c                    |   12 ++++++------
 12 files changed, 40 insertions(+), 45 deletions(-)
include/linux/netfilter.h +0 -5
index e2bf6d2..f42e436 100644
@@ -298,11 +298,6 @@ extern void nf_invalidate_cache(int pf);
    Returns true or false. */
 extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
 
-#define nf_csum_replace4	csum_replace4
-#define nf_csum_replace2	csum_replace2
-#define nf_proto_csum_replace4	inet_proto_csum_replace4
-#define nf_proto_csum_replace2	inet_proto_csum_replace2
-
 struct nf_afinfo {
 	unsigned short	family;
 	__sum16		(*checksum)(struct sk_buff *skb, unsigned int hook,
net/ipv4/netfilter/ipt_ECN.c +3 -3
index add1100..e8d5f68 100644
@@ -38,7 +38,7 @@ set_ect_ip(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
 		oldtos = iph->tos;
 		iph->tos &= ~IPT_ECN_IP_MASK;
 		iph->tos |= (einfo->ip_ect & IPT_ECN_IP_MASK);
-		nf_csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
+		csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
 	}
 	return true;
 }

@@ -71,8 +71,8 @@ set_ect_tcp(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
 	if (einfo->operation & IPT_ECN_OP_SET_CWR)
 		tcph->cwr = einfo->proto.tcp.cwr;
 
-	nf_proto_csum_replace2(&tcph->check, skb,
-				oldval, ((__be16 *)tcph)[6], 0);
+	inet_proto_csum_replace2(&tcph->check, skb,
+				 oldval, ((__be16 *)tcph)[6], 0);
 	return true;
 }
net/ipv4/netfilter/ipt_TOS.c +1 -1
index d4573ba..7b4a6ca 100644
@@ -38,7 +38,7 @@ target(struct sk_buff *skb,
 		iph = ip_hdr(skb);
 		oldtos = iph->tos;
 		iph->tos = (iph->tos & IPTOS_PREC_MASK) | tosinfo->tos;
-		nf_csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
+		csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
 	}
 	return XT_CONTINUE;
 }
net/ipv4/netfilter/ipt_TTL.c +2 -2
index c620a05..00ddfbe 100644
@@ -54,8 +54,8 @@ ipt_ttl_target(struct sk_buff *skb,
 	}
 
 	if (new_ttl != iph->ttl) {
-		nf_csum_replace2(&iph->check, htons(iph->ttl << 8),
-					      htons(new_ttl << 8));
+		csum_replace2(&iph->check, htons(iph->ttl << 8),
+					   htons(new_ttl << 8));
 		iph->ttl = new_ttl;
 	}
net/ipv4/netfilter/nf_nat_core.c +2 -2
index d237511..746c2ef 100644
@@ -372,10 +372,10 @@ manip_pkt(u_int16_t proto,
 	iph = (void *)skb->data + iphdroff;
 
 	if (maniptype == IP_NAT_MANIP_SRC) {
-		nf_csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
+		csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
 		iph->saddr = target->src.u3.ip;
 	} else {
-		nf_csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip);
+		csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip);
 		iph->daddr = target->dst.u3.ip;
 	}
 	return 1;
net/ipv4/netfilter/nf_nat_helper.c +10 -10
index d00b8b2..53f79a3 100644
@@ -180,8 +180,8 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
 								datalen, 0));
 		}
 	} else
-		nf_proto_csum_replace2(&tcph->check, skb,
-				       htons(oldlen), htons(datalen), 1);
+		inet_proto_csum_replace2(&tcph->check, skb,
+					 htons(oldlen), htons(datalen), 1);
 
 	if (rep_len != match_len) {
 		set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);

@@ -270,8 +270,8 @@ nf_nat_mangle_udp_packet(struct sk_buff *skb,
 				udph->check = CSUM_MANGLED_0;
 		}
 	} else
-		nf_proto_csum_replace2(&udph->check, skb,
-				       htons(oldlen), htons(datalen), 1);
+		inet_proto_csum_replace2(&udph->check, skb,
+					 htons(oldlen), htons(datalen), 1);
 
 	return 1;
 }

@@ -310,10 +310,10 @@ sack_adjust(struct sk_buff *skb,
 			 ntohl(sack->start_seq), new_start_seq,
 			 ntohl(sack->end_seq), new_end_seq);
 
-		nf_proto_csum_replace4(&tcph->check, skb,
-				       sack->start_seq, new_start_seq, 0);
-		nf_proto_csum_replace4(&tcph->check, skb,
-				       sack->end_seq, new_end_seq, 0);
+		inet_proto_csum_replace4(&tcph->check, skb,
+					 sack->start_seq, new_start_seq, 0);
+		inet_proto_csum_replace4(&tcph->check, skb,
+					 sack->end_seq, new_end_seq, 0);
 		sack->start_seq = new_start_seq;
 		sack->end_seq = new_end_seq;
 		sackoff += sizeof(*sack);

@@ -397,8 +397,8 @@ nf_nat_seq_adjust(struct sk_buff *skb,
 	else
 		newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
 
-	nf_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
-	nf_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
+	inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
+	inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
 
 	pr_debug("Adjusting sequence number from %u->%u, ack from %u->%u\n",
 		 ntohl(tcph->seq), ntohl(newseq), ntohl(tcph->ack_seq),
net/ipv4/netfilter/nf_nat_proto_icmp.c +2 -2
index b9fc724..088bb14 100644
@@ -65,8 +65,8 @@ icmp_manip_pkt(struct sk_buff *skb,
 		return 0;
 
 	hdr = (struct icmphdr *)(skb->data + hdroff);
-	nf_proto_csum_replace2(&hdr->checksum, skb,
-			       hdr->un.echo.id, tuple->src.u.icmp.id, 0);
+	inet_proto_csum_replace2(&hdr->checksum, skb,
+				 hdr->un.echo.id, tuple->src.u.icmp.id, 0);
 	hdr->un.echo.id = tuple->src.u.icmp.id;
 	return 1;
 }
net/ipv4/netfilter/nf_nat_proto_tcp.c +2 -2
index 6bab2e1..633c53f 100644
@@ -132,8 +132,8 @@ tcp_manip_pkt(struct sk_buff *skb,
 	if (hdrsize < sizeof(*hdr))
 		return 1;
 
-	nf_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
-	nf_proto_csum_replace2(&hdr->check, skb, oldport, newport, 0);
+	inet_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
+	inet_proto_csum_replace2(&hdr->check, skb, oldport, newport, 0);
 	return 1;
 }
net/ipv4/netfilter/nf_nat_proto_udp.c +3 -3
index cbf1a61..9c6519c 100644
@@ -117,9 +117,9 @@ udp_manip_pkt(struct sk_buff *skb,
 		portptr = &hdr->dest;
 	}
 	if (hdr->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-		nf_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
-		nf_proto_csum_replace2(&hdr->check, skb, *portptr, newport,
-				       0);
+		inet_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
+		inet_proto_csum_replace2(&hdr->check, skb, *portptr, newport,
+					 0);
 		if (!hdr->check)
 			hdr->check = CSUM_MANGLED_0;
 	}
net/netfilter/xt_TCPMSS.c +9 -8
index 851e121..307c94c 100644
@@ -95,8 +95,9 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 			opt[i+2] = (newmss & 0xff00) >> 8;
 			opt[i+3] = newmss & 0x00ff;
 
-			nf_proto_csum_replace2(&tcph->check, skb,
-					       htons(oldmss), htons(newmss), 0);
+			inet_proto_csum_replace2(&tcph->check, skb,
+						 htons(oldmss), htons(newmss),
+						 0);
 			return 0;
 		}
 	}

@@ -117,19 +118,19 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 	opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
 	memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
 
-	nf_proto_csum_replace2(&tcph->check, skb,
-			       htons(tcplen), htons(tcplen + TCPOLEN_MSS), 1);
+	inet_proto_csum_replace2(&tcph->check, skb,
+				 htons(tcplen), htons(tcplen + TCPOLEN_MSS), 1);
 	opt[0] = TCPOPT_MSS;
 	opt[1] = TCPOLEN_MSS;
 	opt[2] = (newmss & 0xff00) >> 8;
 	opt[3] = newmss & 0x00ff;
 
-	nf_proto_csum_replace4(&tcph->check, skb, 0, *((__be32 *)opt), 0);
+	inet_proto_csum_replace4(&tcph->check, skb, 0, *((__be32 *)opt), 0);
 
 	oldval = ((__be16 *)tcph)[6];
 	tcph->doff += TCPOLEN_MSS/4;
-	nf_proto_csum_replace2(&tcph->check, skb,
-				oldval, ((__be16 *)tcph)[6], 0);
+	inet_proto_csum_replace2(&tcph->check, skb,
+				 oldval, ((__be16 *)tcph)[6], 0);
 	return TCPOLEN_MSS;
 }
 

@@ -152,7 +153,7 @@ xt_tcpmss_target4(struct sk_buff *skb,
 	if (ret > 0) {
 		iph = ip_hdr(skb);
 		newlen = htons(ntohs(iph->tot_len) + ret);
-		nf_csum_replace2(&iph->check, iph->tot_len, newlen);
+		csum_replace2(&iph->check, iph->tot_len, newlen);
 		iph->tot_len = newlen;
 	}
 	return XT_CONTINUE;
net/sched/Kconfig +0 -1
index 9c15c48..f5ab54b 100644
@@ -445,7 +445,6 @@ config NET_ACT_IPT
 config NET_ACT_NAT
         tristate "Stateless NAT"
         depends on NET_CLS_ACT
-        select NETFILTER
         ---help---
 	  Say Y here to do stateless NAT on IPv4 packets.  You should use
 	  netfilter for NAT unless you know what you are doing.
net/sched/act_nat.c +6 -6
index c96273b..da5c1ea 100644
@@ -151,7 +151,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 		else
 			iph->daddr = new_addr;
 
-		nf_csum_replace4(&iph->check, addr, new_addr);
+		csum_replace4(&iph->check, addr, new_addr);
 	}
 
 	ihl = iph->ihl * 4;

@@ -169,7 +169,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 			goto drop;
 
 		tcph = (void *)(skb_network_header(skb) + ihl);
-		nf_proto_csum_replace4(&tcph->check, skb, addr, new_addr, 1);
+		inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, 1);
 		break;
 	}
 	case IPPROTO_UDP:

@@ -184,8 +184,8 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 
 		udph = (void *)(skb_network_header(skb) + ihl);
 		if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-			nf_proto_csum_replace4(&udph->check, skb, addr,
-					       new_addr, 1);
+			inet_proto_csum_replace4(&udph->check, skb, addr,
+						 new_addr, 1);
 			if (!udph->check)
 				udph->check = CSUM_MANGLED_0;
 		}

@@ -232,8 +232,8 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 		else
 			iph->saddr = new_addr;
 
-		nf_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
-				       1);
+		inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
+					 1);
 		break;
 	}
 	default:
#3 lore raw
In reply to Patrick McHardy
Quoted 4 lines · Patrick McHardy

These patches remove the dependency of NET_ACT_NAT on NETFILTER by moving the netfilter checksum helpers to include/net/checksum and net/core/utils.c. I didn't find more appropriate locations, but I'd happily change it if someone suggests something better.

Looks good to me. I've applied both to net-2.6.25. Thanks Patrick!

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt