Simplify netfilter and network namespaces
Subsystems (13)
cover Simplify netfilter and network namespaces
While looking into what it would take to route packets out to network devices in other network namespaces I started looking at the netfilter hooks, and there is a lot of nasty code to figure out which network namespace to filter the packets in.
Just passing the network namespace into the netfilter hooks looks like a significant simplication in the code, and worth it as the first thing most netfilter hooks do is compute the network namespace.
We probably even want per network namespace netfilter hooks as nftables tries (and fails to use). nftables currently has a fairly serious bug where the tables for one network namespace run for packets in all network namespaces. I do not have a fix yet but I think this patchset making it easy to get at the network namespace is a good starting place for a fix.
This patshset roots out all of the very weird network namespace computation logic (except for the code in ipvs) and fixes it. I really don't like how the code has been essentially guessing which network namespace to use.
Probably the worst guessing is in ipvs in the function skb_net. I have some preliminary changes to fix ipvs but they are not quite ready yet. Cleaning up ipvs enough that I can kill skb_net is on my short list.
There are a few extra cleanups sprinkled in as I noticed a few other things as I was sorting out the network namespace computation logic.
Eric W. Biederman (15):
netfilter: Kill unused copies of RCV_SKB_FAIL
netfilter: Pass struct net into the netfilter hooks
netfilter: Use nf_hook_state.net
ebtables: Simplify the arguments to ebt_do_table
inet netfilter: Remove hook from ip6t_do_table, arp_do_table, ipt_do_table inet netfilter: Prefer state->hook to ops->hooknum
nftables: kill nft_pktinfo.ops
tc: Simplify em_ipset_match
x_tables: Pass struct net in xt_action_param
x_tables: Use par->net instead of computing from the passed net devices
nftables: Pass struct net in nft_pktinfo
nf_tables: Use pkt->net instead of computing net from the passed net_devices
nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple
ipv4: Pass struct net into ip_defrag and ip_check_defrag
ipv6: Pass struct net into nf_ct_frag6_gather
drivers/net/macvlan.c | 2 +- include/linux/netfilter.h | 37 +++++++++++++++----------- include/linux/netfilter/x_tables.h | 2 ++ include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_bridge/ebtables.h | 6 ++--- include/linux/netfilter_ingress.h | 2 +- include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - include/net/ip.h | 6 ++--- include/net/netfilter/ipv6/nf_defrag_ipv6.h | 2 +- include/net/netfilter/nf_conntrack.h | 3 ++- include/net/netfilter/nf_conntrack_core.h | 1 + include/net/netfilter/nf_conntrack_l4proto.h | 2 +- include/net/netfilter/nf_tables.h | 11 ++++---- include/net/netfilter/nf_tables_ipv4.h | 3 +-- include/net/netfilter/nf_tables_ipv6.h | 3 +-- net/bridge/br_forward.c | 12 ++++----- net/bridge/br_input.c | 13 ++++----- net/bridge/br_multicast.c | 4 +-- net/bridge/br_netfilter.c | 37 ++++++++++++++------------ net/bridge/br_stp_bpdu.c | 4 +-- net/bridge/netfilter/ebt_log.c | 2 +- net/bridge/netfilter/ebt_nflog.c | 2 +- net/bridge/netfilter/ebtable_broute.c | 8 ++++-- net/bridge/netfilter/ebtable_filter.c | 6 ++--- net/bridge/netfilter/ebtable_nat.c | 6 ++--- net/bridge/netfilter/ebtables.c | 14 +++++----- net/bridge/netfilter/nf_tables_bridge.c | 16 +++++------ net/bridge/netfilter/nft_reject_bridge.c | 19 +++++++------ net/decnet/dn_neigh.c | 15 ++++++----- net/decnet/dn_nsp_in.c | 4 +-- net/decnet/dn_route.c | 24 ++++++++--------- net/ipv4/arp.c | 10 ++++--- net/ipv4/ip_forward.c | 11 +++++--- net/ipv4/ip_fragment.c | 8 +++--- net/ipv4/ip_input.c | 30 ++++++++++++--------- net/ipv4/ip_output.c | 28 +++++++++++-------- net/ipv4/ipmr.c | 6 ++--- net/ipv4/netfilter/arp_tables.c | 3 ++- net/ipv4/netfilter/arptable_filter.c | 5 +--- net/ipv4/netfilter/ip_tables.c | 11 ++++---- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 4 +-- net/ipv4/netfilter/ipt_rpfilter.c | 5 ++-- net/ipv4/netfilter/iptable_filter.c | 7 ++--- net/ipv4/netfilter/iptable_mangle.c | 15 +++++------ net/ipv4/netfilter/iptable_nat.c | 4 +-- net/ipv4/netfilter/iptable_raw.c | 7 ++--- net/ipv4/netfilter/iptable_security.c | 8 ++---- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 +-- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 4 +-- net/ipv4/netfilter/nf_defrag_ipv4.c | 9 ++++--- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 14 +++++----- net/ipv4/netfilter/nf_tables_arp.c | 2 +- net/ipv4/netfilter/nf_tables_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_nat_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/netfilter/nft_masq_ipv4.c | 2 +- net/ipv4/netfilter/nft_redir_ipv4.c | 2 +- net/ipv4/netfilter/nft_reject_ipv4.c | 5 ++-- net/ipv4/raw.c | 5 ++-- net/ipv4/xfrm4_input.c | 4 +-- net/ipv4/xfrm4_output.c | 6 +++-- net/ipv6/ip6_input.c | 10 +++---- net/ipv6/ip6_output.c | 30 ++++++++++----------- net/ipv6/ip6mr.c | 4 +-- net/ipv6/mcast.c | 7 ++--- net/ipv6/ndisc.c | 4 +-- net/ipv6/netfilter/ip6_tables.c | 11 ++++---- net/ipv6/netfilter/ip6t_REJECT.c | 2 +- net/ipv6/netfilter/ip6t_SYNPROXY.c | 4 +-- net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++--- net/ipv6/netfilter/ip6table_filter.c | 4 +-- net/ipv6/netfilter/ip6table_mangle.c | 14 +++++----- net/ipv6/netfilter/ip6table_nat.c | 4 +-- net/ipv6/netfilter/ip6table_raw.c | 4 +-- net/ipv6/netfilter/ip6table_security.c | 5 +--- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 4 +-- net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 3 ++- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 +-- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 5 ++-- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 14 +++++----- net/ipv6/netfilter/nf_tables_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_nat_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/netfilter/nft_redir_ipv6.c | 3 +-- net/ipv6/netfilter/nft_reject_ipv6.c | 7 +++-- net/ipv6/output_core.c | 6 +++-- net/ipv6/raw.c | 10 ++++--- net/ipv6/xfrm6_input.c | 4 +-- net/ipv6/xfrm6_output.c | 6 +++-- net/netfilter/ipset/ip_set_core.c | 9 +++---- net/netfilter/ipvs/ip_vs_core.c | 2 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +-- net/netfilter/nf_conntrack_core.c | 10 ++++--- net/netfilter/nf_conntrack_proto_dccp.c | 2 +- net/netfilter/nf_conntrack_proto_generic.c | 2 +- net/netfilter/nf_conntrack_proto_gre.c | 3 +-- net/netfilter/nf_conntrack_proto_sctp.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_proto_udp.c | 1 + net/netfilter/nf_conntrack_proto_udplite.c | 1 + net/netfilter/nf_tables_core.c | 4 +-- net/netfilter/nf_tables_netdev.c | 16 +++++------ net/netfilter/nfnetlink_log.c | 2 -- net/netfilter/nfnetlink_queue_core.c | 5 +--- net/netfilter/nft_log.c | 3 +-- net/netfilter/nft_meta.c | 4 +-- net/netfilter/nft_queue.c | 2 +- net/netfilter/nft_reject_inet.c | 19 +++++++------ net/netfilter/xt_LOG.c | 2 +- net/netfilter/xt_NFLOG.c | 2 +- net/netfilter/xt_TCPMSS.c | 2 +- net/netfilter/xt_TEE.c | 24 +++-------------- net/netfilter/xt_TPROXY.c | 24 ++++++++--------- net/netfilter/xt_addrtype.c | 4 +-- net/netfilter/xt_connlimit.c | 4 +-- net/netfilter/xt_osf.c | 2 +- net/netfilter/xt_recent.c | 2 +- net/netfilter/xt_socket.c | 14 +++++----- net/packet/af_packet.c | 6 ++--- net/sched/act_connmark.c | 2 +- net/sched/act_ipt.c | 1 + net/sched/em_ipset.c | 5 ++-- net/xfrm/xfrm_output.c | 4 ++- 125 files changed, 426 insertions(+), 442 deletions(-)
Eric
PATCH 1/15 netfilter: Kill unused copies of RCV_SKB_FAIL
This appears to have been a dead macro in both nfnetlink_log.c and nfnetlink_queue_core.c since these pieces of code were added in 2005.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/netfilter/nfnetlink_log.c | 2 -- net/netfilter/nfnetlink_queue_core.c | 2 -- 2 files changed, 4 deletions(-)
net/netfilter/nfnetlink_log.c +0 -2
@@ -598,8 +598,6 @@ nla_put_failure:return -1 ; } -#define RCV_SKB_FAIL (err) do { netlink_ack(skb, nlh, (err)); return; } while (0) -static struct nf_loginfo default_loginfo = { .type =NF_LOG_TYPE_ULOG , .u = {
net/netfilter/nfnetlink_queue_core.c +0 -2
@@ -806,8 +806,6 @@ nfqnl_dev_drop(struct net *net, int ifindex)rcu_read_unlock (); } -#define RCV_SKB_FAIL (err) do { netlink_ack(skb, nlh, (err)); return; } while (0) -static int nfqnl_rcv_dev_event (struct notifier_block *this,unsigned long event,void *ptr)
Signature · 1 line
2.2.1
PATCH 2/15 netfilter: Pass struct net into the netfilter hooks
In reply to Eric W. BiedermanPass a network namespace parameter into the netfilter hooks. At the call site of the netfilter hooks the path a packet is taking through the network stack is well known which allows the network namespace to be easily and reliabily.
This allows the replacement of magic code like "dev_net(state->in?:state->out)" that appears at the start of most netfilter hooks with "state->net".
This simplifies the code, and allows for the possibility of per network namespace netfilter hook lists (that nftables appears to want).
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter.h | 37 ++++++++++++++++++------------- include/linux/netfilter_ingress.h | 2 +- net/bridge/br_forward.c | 12 +++++----- net/bridge/br_input.c | 13 ++++++----- net/bridge/br_multicast.c | 4 ++-- net/bridge/br_netfilter.c | 37 +++++++++++++++++-------------- net/bridge/br_stp_bpdu.c | 4 ++-- net/decnet/dn_neigh.c | 15 ++++++++----- net/decnet/dn_nsp_in.c | 4 ++-- net/decnet/dn_route.c | 24 ++++++++++---------- net/ipv4/arp.c | 10 +++++---- net/ipv4/ip_forward.c | 11 +++++---- net/ipv4/ip_input.c | 24 +++++++++++--------- net/ipv4/ip_output.c | 28 ++++++++++++++--------- net/ipv4/ipmr.c | 6 ++--- net/ipv4/raw.c | 5 +++-- net/ipv4/xfrm4_input.c | 4 ++-- net/ipv4/xfrm4_output.c | 6 +++-- net/ipv6/ip6_input.c | 10 ++++----- net/ipv6/ip6_output.c | 30 ++++++++++++------------- net/ipv6/ip6mr.c | 4 ++-- net/ipv6/mcast.c | 7 +++--- net/ipv6/ndisc.c | 4 ++-- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 2 +- net/ipv6/output_core.c | 6 +++-- net/ipv6/raw.c | 10 +++++---- net/ipv6/xfrm6_input.c | 4 ++-- net/ipv6/xfrm6_output.c | 6 +++-- net/netfilter/ipvs/ip_vs_xmit.c | 4 ++-- net/xfrm/xfrm_output.c | 4 +++- 30 files changed, 187 insertions(+), 150 deletions(-)
include/linux/netfilter.h +21 -16
@@ -54,6 +54,7 @@ struct nf_hook_state {struct net_device *in;struct net_device *out;struct sock *sk; +struct net *net;struct list_head *hook_list;int (*okfn)(struct sock *,struct sk_buff *); };
@@ -65,6 +66,7 @@ static inline void nf_hook_state_init(struct nf_hook_state *p,struct net_device *indev, struct net_device *outdev, struct sock *sk, + struct net *net, int (*okfn)(struct sock *, struct sk_buff *)) { p->hook = hook;
@@ -73,6 +75,7 @@ static inline void nf_hook_state_init(struct nf_hook_state *p, p->in = indev; p->out = outdev; p->sk = sk; + p->net = net; p->hook_list = hook_list; p->okfn = okfn; }
@@ -167,6 +170,7 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state);* value indicates the packet has been consumed by the hook. */ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, + struct net *net, struct sock *sk, struct sk_buff *skb, struct net_device *indev,
@@ -178,18 +182,18 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,struct nf_hook_state state;nf_hook_state_init (&state, &nf_hooks[pf][hook], hook, thresh, - pf, indev, outdev, sk, okfn); + pf, indev, outdev, sk, net, okfn);return nf_hook_slow (skb, &state); }return 1 ; } -static inline int nf_hook (u_int8_t pf,unsigned int hook,struct sock *sk, -struct sk_buff *skb,struct net_device *indev, -struct net_device *outdev, +static inline int nf_hook (u_int8_t pf,unsigned int hook,struct net *net, +struct sock *sk,struct sk_buff *skb, +struct net_device *indev,struct net_device *outdev,int (*okfn)(struct sock *,struct sk_buff *)) { -return nf_hook_thresh (pf, hook, sk, skb, indev, outdev, okfn,INT_MIN ); +return nf_hook_thresh (pf, hook, net, sk, skb, indev, outdev, okfn,INT_MIN ); }/* Activate hook; either okfn or kfree_skb called, unless a hook
@@ -210,36 +214,36 @@ static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sock *sk,*/ static inline int -NF_HOOK_THRESH (uint8_t pf,unsigned int hook,struct sock *sk, +NF_HOOK_THRESH (uint8_t pf,unsigned int hook,struct net *net,struct sock *sk,struct sk_buff *skb,struct net_device *in,struct net_device *out,int (*okfn)(struct sock *,struct sk_buff *),int thresh) { -int ret =nf_hook_thresh (pf, hook, sk, skb, in, out, okfn, thresh); +int ret =nf_hook_thresh (pf, hook, net, sk, skb, in, out, okfn, thresh);if (ret ==1 ) ret =okfn (sk, skb);return ret; }static inline int -NF_HOOK_COND (uint8_t pf,unsigned int hook,struct sock *sk, +NF_HOOK_COND (uint8_t pf,unsigned int hook,struct net *net,struct sock *sk,struct sk_buff *skb,struct net_device *in,struct net_device *out,int (*okfn)(struct sock *,struct sk_buff *),bool cond) {int ret;if (!cond || - ((ret =nf_hook_thresh (pf, hook, sk, skb, in, out, okfn,INT_MIN )) ==1 )) + ((ret =nf_hook_thresh (pf, hook, net, sk, skb, in, out, okfn,INT_MIN )) ==1 )) ret =okfn (sk, skb);return ret; }static inline int -NF_HOOK (uint8_t pf,unsigned int hook,struct sock *sk,struct sk_buff *skb, +NF_HOOK (uint8_t pf,unsigned int hook,struct net *net,struct sock *sk,struct sk_buff *skb,struct net_device *in,struct net_device *out,int (*okfn)(struct sock *,struct sk_buff *)) { -return NF_HOOK_THRESH (pf, hook, sk, skb, in, out, okfn,INT_MIN ); +return NF_HOOK_THRESH (pf, hook, net, sk, skb, in, out, okfn,INT_MIN ); }/* Call setsockopt() */
@@ -339,9 +343,10 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) }#else /* !CONFIG_NETFILTER */ -#define NF_HOOK (pf, hook, sk, skb, indev, outdev, okfn) (okfn)(sk, skb) -#define NF_HOOK_COND (pf, hook, sk, skb, indev, outdev, okfn, cond) (okfn)(sk, skb) +#define NF_HOOK (pf, hook, net, sk, skb, indev, outdev, okfn) (okfn)(sk, skb) +#define NF_HOOK_COND (pf, hook, net, sk, skb, indev, outdev, okfn, cond) (okfn)(sk, skb) static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, + struct net *net, struct sock *sk, struct sk_buff *skb, struct net_device *indev,
@@ -350,9 +355,9 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, {return okfn (sk, skb); } -static inline int nf_hook (u_int8_t pf,unsigned int hook,struct sock *sk, -struct sk_buff *skb,struct net_device *indev, -struct net_device *outdev, +static inline int nf_hook (u_int8_t pf,unsigned int hook,struct net *net, +struct sock *sk,struct sk_buff *skb, +struct net_device *indev,struct net_device *outdev,int (*okfn)(struct sock *,struct sk_buff *)) {return 1 ;
include/linux/netfilter_ingress.h +1 -1
@@ -17,7 +17,7 @@ static inline int nf_hook_ingress(struct sk_buff *skb)nf_hook_state_init (&state, &skb->dev->nf_hooks_ingress,NF_NETDEV_INGRESS ,INT_MIN ,NFPROTO_NETDEV ,NULL , - skb->dev,NULL ,NULL ); + skb->dev,NULL ,dev_net (skb->dev),NULL );return nf_hook_slow (skb, &state); }
net/bridge/br_forward.c +6 -6
@@ -51,8 +51,8 @@ EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);int br_forward_finish (struct sock *sk,struct sk_buff *skb) { -return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_POST_ROUTING , sk, skb, -NULL , skb->dev, +return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_POST_ROUTING , +dev_net (skb->dev), sk, skb,NULL , skb->dev, br_dev_queue_push_xmit); }
@@ -76,8 +76,8 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)return ; } -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT ,NULL , skb, -NULL , skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT , +dev_net (skb->dev),NULL , skb,NULL , skb->dev, br_forward_finish); }
@@ -98,8 +98,8 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb) skb->dev = to->dev;skb_forward_csum (skb); -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_FORWARD ,NULL , skb, - indev, skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_FORWARD , +dev_net (indev),NULL , skb, indev, skb->dev, br_forward_finish); }
net/bridge/br_input.c +7 -6
@@ -55,8 +55,8 @@ static int br_pass_frame_up(struct sk_buff *skb)if (!skb)return NET_RX_DROP ; -return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN ,NULL , skb, - indev,NULL , +return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN , +dev_net (indev),NULL , skb, indev,NULL , netif_receive_skb_sk); }
@@ -278,8 +278,9 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb) }/* Deliver packet to local host only */ -if (NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN ,NULL , skb, - skb->dev,NULL , br_handle_local_finish)) { +if (NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , + br_handle_local_finish)) {return RX_HANDLER_CONSUMED ;/* consumed by filter */ }else { *pskb = skb;
@@ -303,8 +304,8 @@ forward:if (ether_addr_equal (p->br->dev->dev_addr, dest)) skb->pkt_type =PACKET_HOST ; -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , br_handle_frame_finish);break ;default :
net/bridge/br_multicast.c +2 -2
@@ -814,8 +814,8 @@ static void __br_multicast_send_query(struct net_bridge *br,if (port) { skb->dev = port->dev; -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT ,NULL , skb, -NULL , skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT , +dev_net (port->dev),NULL , skb,NULL , skb->dev, br_dev_queue_push_xmit); }else {br_multicast_select_own_querier (br, ip, skb);
net/bridge/br_netfilter.c +20 -17
@@ -302,8 +302,8 @@ static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb) skb->dev = nf_bridge->physindev;nf_bridge_update_protocol (skb);nf_bridge_push_encap_header (skb); -NF_HOOK_THRESH (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING , sk, skb, - skb->dev,NULL , +NF_HOOK_THRESH (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING , +dev_net (skb->dev), sk, skb, skb->dev,NULL , br_handle_frame_finish,1 );return 0 ;
@@ -403,6 +403,7 @@ static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb) {struct net_device *dev = skb->dev;struct iphdr *iph =ip_hdr (skb); +struct net *net =dev_net (dev);struct nf_bridge_info *nf_bridge =nf_bridge_info_get (skb);struct rtable *rt;int err;
@@ -430,7 +431,7 @@ static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb)if (err != -EHOSTUNREACH || !in_dev ||IN_DEV_FORWARD (in_dev)) goto free_skb; - rt =ip_route_output (dev_net (dev), iph->daddr,0 , + rt =ip_route_output (net, iph->daddr,0 ,RT_TOS (iph->tos),0 );if (!IS_ERR (rt)) {/* - Bridged-and-DNAT'ed traffic doesn't
@@ -452,7 +453,7 @@ bridged_dnat:nf_bridge_push_encap_header (skb);NF_HOOK_THRESH (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING , - sk, skb, skb->dev,NULL , + net, sk, skb, skb->dev,NULL , br_nf_pre_routing_finish_bridge,1 );return 0 ;
@@ -472,8 +473,8 @@ bridged_dnat: skb->dev = nf_bridge->physindev;nf_bridge_update_protocol (skb);nf_bridge_push_encap_header (skb); -NF_HOOK_THRESH (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING , sk, skb, - skb->dev,NULL , +NF_HOOK_THRESH (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING , + net, sk, skb, skb->dev,NULL , br_handle_frame_finish,1 );return 0 ;
@@ -610,8 +611,8 @@ static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,return NF_DROP ; skb->protocol =htons (ETH_P_IPV6 ); -NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , state->sk, skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , + state->net, state->sk, skb, skb->dev,NULL , br_nf_pre_routing_finish_ipv6);return NF_STOLEN ;
@@ -670,8 +671,8 @@ static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops, skb->protocol =htons (ETH_P_IP ); -NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , state->sk, skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , + state->net, state->sk, skb, skb->dev,NULL , br_nf_pre_routing_finish);return NF_STOLEN ;
@@ -718,8 +719,9 @@ static int br_nf_forward_finish(struct sock *sk, struct sk_buff *skb) }nf_bridge_push_encap_header (skb); -NF_HOOK_THRESH (NFPROTO_BRIDGE ,NF_BR_FORWARD , sk, skb, - in, skb->dev, br_forward_finish,1 ); +NF_HOOK_THRESH (NFPROTO_BRIDGE ,NF_BR_FORWARD , +dev_net (in), sk, skb, in, skb->dev, + br_forward_finish,1 );return 0 ; }
@@ -782,7 +784,7 @@ static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops,else skb->protocol =htons (ETH_P_IPV6 ); -NF_HOOK (pf,NF_INET_FORWARD ,NULL , skb, +NF_HOOK (pf,NF_INET_FORWARD , state->net,NULL , skb,brnf_get_logical_dev (skb, state->in), parent, br_nf_forward_finish);
@@ -817,8 +819,9 @@ static unsigned int br_nf_forward_arp(const struct nf_hook_ops *ops,return NF_ACCEPT ; } *d = state->in; -NF_HOOK (NFPROTO_ARP ,NF_ARP_FORWARD , state->sk, skb, - state->in, state->out, br_nf_forward_finish); +NF_HOOK (NFPROTO_ARP ,NF_ARP_FORWARD , + state->net, state->sk, skb, state->in, state->out, + br_nf_forward_finish);return NF_STOLEN ; }
@@ -952,8 +955,8 @@ static unsigned int br_nf_post_routing(const struct nf_hook_ops *ops,else skb->protocol =htons (ETH_P_IPV6 ); -NF_HOOK (pf,NF_INET_POST_ROUTING , state->sk, skb, -NULL , realoutdev, +NF_HOOK (pf,NF_INET_POST_ROUTING , + state->net, state->sk, skb,NULL , realoutdev, br_nf_dev_queue_xmit);return NF_STOLEN ;
net/bridge/br_stp_bpdu.c +2 -2
@@ -54,8 +54,8 @@ static void br_send_bpdu(struct net_bridge_port *p,skb_reset_mac_header (skb); -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT ,NULL , skb, -NULL , skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT , +dev_net (p->dev),NULL , skb,NULL , skb->dev, dev_queue_xmit_sk); }
net/decnet/dn_neigh.c +9 -6
@@ -246,8 +246,9 @@ static int dn_long_output(struct neighbour *neigh, struct sock *sk,skb_reset_network_header (skb); -return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , sk, skb, -NULL , neigh->dev, dn_neigh_output_packet); +return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , + &init_net, sk, skb,NULL , neigh->dev, + dn_neigh_output_packet); }/*
@@ -286,8 +287,9 @@ static int dn_short_output(struct neighbour *neigh, struct sock *sk,skb_reset_network_header (skb); -return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , sk, skb, -NULL , neigh->dev, dn_neigh_output_packet); +return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , + &init_net, sk, skb,NULL , neigh->dev, + dn_neigh_output_packet); }/*
@@ -327,8 +329,9 @@ static int dn_phase3_output(struct neighbour *neigh, struct sock *sk,skb_reset_network_header (skb); -return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , sk, skb, -NULL , neigh->dev, dn_neigh_output_packet); +return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , + &init_net, sk, skb,NULL , neigh->dev, + dn_neigh_output_packet); }int dn_to_neigh_output (struct sock *sk,struct sk_buff *skb)
net/decnet/dn_nsp_in.c +2 -2
@@ -814,8 +814,8 @@ free_out:int dn_nsp_rx (struct sk_buff *skb) { -return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_IN ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_IN , + &init_net,NULL , skb, skb->dev,NULL , dn_nsp_rx_packet); }
net/decnet/dn_route.c +12 -12
@@ -573,8 +573,8 @@ static int dn_route_rx_long(struct sk_buff *skb) ptr++; cb->hops = *ptr++;/* Visit Count */ -return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING , + &init_net,NULL , skb, skb->dev,NULL , dn_route_rx_packet); drop_it:
@@ -601,8 +601,8 @@ static int dn_route_rx_short(struct sk_buff *skb) ptr +=2 ; cb->hops = *ptr &0x3f ; -return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING , + &init_net,NULL , skb, skb->dev,NULL , dn_route_rx_packet); drop_it:
@@ -706,22 +706,22 @@ int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_typeswitch (flags &DN_RT_CNTL_MSK ) {case DN_RT_PKT_HELO :return NF_HOOK (NFPROTO_DECNET ,NF_DN_HELLO , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_route_ptp_hello);case DN_RT_PKT_L1RT :case DN_RT_PKT_L2RT :return NF_HOOK (NFPROTO_DECNET ,NF_DN_ROUTE , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_route_discard);case DN_RT_PKT_ERTH :return NF_HOOK (NFPROTO_DECNET ,NF_DN_HELLO , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_neigh_router_hello);case DN_RT_PKT_EEDH :return NF_HOOK (NFPROTO_DECNET ,NF_DN_HELLO , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_neigh_endnode_hello); } }else {
@@ -770,8 +770,8 @@ static int dn_output(struct sock *sk, struct sk_buff *skb) cb->rt_flags |=DN_RT_F_IE ; cb->hops =0 ; -return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_OUT , sk, skb, -NULL , dev, +return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_OUT , + &init_net, sk, skb,NULL , dev, dn_to_neigh_output); error:
@@ -819,8 +819,8 @@ static int dn_forward(struct sk_buff *skb)if (rt->rt_flags &RTCF_DOREDIRECT ) cb->rt_flags |=DN_RT_F_IE ; -return NF_HOOK (NFPROTO_DECNET ,NF_DN_FORWARD ,NULL , skb, - dev, skb->dev, +return NF_HOOK (NFPROTO_DECNET ,NF_DN_FORWARD , + &init_net,NULL , skb, dev, skb->dev, dn_to_neigh_output); drop:
net/ipv4/arp.c +6 -4
@@ -591,8 +591,9 @@ EXPORT_SYMBOL(arp_create);void arp_xmit (struct sk_buff *skb) {/* Send it off, maybe filter it using firewalling first. */ -NF_HOOK (NFPROTO_ARP ,NF_ARP_OUT ,NULL , skb, -NULL , skb->dev, dev_queue_xmit_sk); +NF_HOOK (NFPROTO_ARP ,NF_ARP_OUT , +dev_net (skb->dev),NULL , skb,NULL , skb->dev, + dev_queue_xmit_sk); }EXPORT_SYMBOL (arp_xmit);
@@ -880,8 +881,9 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,memset (NEIGH_CB (skb),0 ,sizeof (struct neighbour_cb )); -return NF_HOOK (NFPROTO_ARP ,NF_ARP_IN ,NULL , skb, - dev,NULL , arp_process); +return NF_HOOK (NFPROTO_ARP ,NF_ARP_IN , +dev_net (dev),NULL , skb, dev,NULL , + arp_process); consumeskb:consume_skb (skb);
net/ipv4/ip_forward.c +7 -4
@@ -81,6 +81,7 @@ int ip_forward(struct sk_buff *skb)struct iphdr *iph;/* Our header */ struct rtable *rt;/* Route we use */ struct ip_options *opt = &(IPCB (skb)->opt); +struct net *net;/* that should never happen */ if (skb->pkt_type !=PACKET_HOST )
@@ -99,6 +100,7 @@ int ip_forward(struct sk_buff *skb)return NET_RX_SUCCESS ;skb_forward_csum (skb); + net =dev_net (skb->dev);/* * According to the RFC, we must first decrease the TTL field. If
@@ -119,7 +121,7 @@ int ip_forward(struct sk_buff *skb)IPCB (skb)->flags |=IPSKB_FORWARDED ; mtu =ip_dst_mtu_maybe_forward (&rt->dst, true);if (ip_exceeds_mtu (skb, mtu)) { -IP_INC_STATS (dev_net (rt->dst.dev),IPSTATS_MIB_FRAGFAILS ); +IP_INC_STATS (net,IPSTATS_MIB_FRAGFAILS );icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_FRAG_NEEDED ,htonl (mtu)); goto drop;
@@ -143,8 +145,9 @@ int ip_forward(struct sk_buff *skb) skb->priority =rt_tos2priority (iph->tos); -return NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, rt->dst.dev, ip_forward_finish); +return NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, rt->dst.dev, + ip_forward_finish); sr_failed:/*
@@ -155,7 +158,7 @@ sr_failed: too_many_hops:/* Tell the sender its packet died... */ -IP_INC_STATS_BH (dev_net (skb_dst (skb)->dev),IPSTATS_MIB_INHDRERRORS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INHDRERRORS );icmp_send (skb,ICMP_TIME_EXCEEDED ,ICMP_EXC_TTL ,0 ); drop:kfree_skb (skb);
net/ipv4/ip_input.c +13 -11
@@ -253,8 +253,8 @@ int ip_local_deliver(struct sk_buff *skb)return 0 ; } -return NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_IN ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_IN , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , ip_local_deliver_finish); }
@@ -377,6 +377,7 @@ drop:int ip_rcv (struct sk_buff *skb,struct net_device *dev,struct packet_type *pt,struct net_device *orig_dev) {const struct iphdr *iph; +struct net *net;u32 len;/* When the interface is in promisc. mode, drop all the crap
@@ -386,11 +387,12 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, goto drop; -IP_UPD_PO_STATS_BH (dev_net (dev),IPSTATS_MIB_IN , skb->len); + net =dev_net (dev); +IP_UPD_PO_STATS_BH (net,IPSTATS_MIB_IN , skb->len); skb =skb_share_check (skb,GFP_ATOMIC );if (!skb) { -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INDISCARDS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INDISCARDS ); goto out; }
@@ -416,7 +418,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,BUILD_BUG_ON (IPSTATS_MIB_ECT1PKTS !=IPSTATS_MIB_NOECTPKTS +INET_ECN_ECT_1 );BUILD_BUG_ON (IPSTATS_MIB_ECT0PKTS !=IPSTATS_MIB_NOECTPKTS +INET_ECN_ECT_0 );BUILD_BUG_ON (IPSTATS_MIB_CEPKTS !=IPSTATS_MIB_NOECTPKTS +INET_ECN_CE ); -IP_ADD_STATS_BH (dev_net (dev), +IP_ADD_STATS_BH (net,IPSTATS_MIB_NOECTPKTS + (iph->tos &INET_ECN_MASK ), max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
@@ -430,7 +432,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, len =ntohs (iph->tot_len);if (skb->len < len) { -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INTRUNCATEDPKTS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INTRUNCATEDPKTS ); goto drop; }else if (len < (iph->ihl*4 )) goto inhdr_error;
@@ -440,7 +442,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,* Note this now means skb->len holds ntohs(iph->tot_len). */ if (pskb_trim_rcsum (skb, len)) { -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INDISCARDS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INDISCARDS ); goto drop; }
@@ -452,14 +454,14 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,/* Must drop socket now because of tproxy. */ skb_orphan (skb); -return NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING ,NULL , skb, - dev,NULL , +return NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , + net,NULL , skb, dev,NULL , ip_rcv_finish); csum_error: -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_CSUMERRORS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_CSUMERRORS ); inhdr_error: -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INHDRERRORS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INHDRERRORS ); drop:kfree_skb (skb); out:
net/ipv4/ip_output.c +17 -11
@@ -97,12 +97,14 @@ EXPORT_SYMBOL(ip_send_check);static int __ip_local_out_sk (struct sock *sk,struct sk_buff *skb) { +struct net *net =dev_net (skb_dst (skb)->dev);struct iphdr *iph =ip_hdr (skb); iph->tot_len =htons (skb->len);ip_send_check (iph); -return nf_hook (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , sk, skb,NULL , -skb_dst (skb)->dev, dst_output_sk); +return nf_hook (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL ,skb_dst (skb)->dev, + dst_output_sk); }int __ip_local_out (struct sk_buff *skb)
@@ -288,11 +290,12 @@ int ip_mc_output(struct sock *sk, struct sk_buff *skb) {struct rtable *rt =skb_rtable (skb);struct net_device *dev = rt->dst.dev; +struct net *net =dev_net (dev);/* * If the indicated interface is up and running, send the packet. */ -IP_UPD_PO_STATS (dev_net (dev),IPSTATS_MIB_OUT , skb->len); +IP_UPD_PO_STATS (net,IPSTATS_MIB_OUT , skb->len); skb->dev = dev; skb->protocol =htons (ETH_P_IP );
@@ -320,7 +323,7 @@ int ip_mc_output(struct sock *sk, struct sk_buff *skb)struct sk_buff *newskb =skb_clone (skb,GFP_ATOMIC );if (newskb)NF_HOOK (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , - sk, newskb,NULL , newskb->dev, + net, sk, newskb,NULL , newskb->dev, dev_loopback_xmit); }
@@ -335,26 +338,29 @@ int ip_mc_output(struct sock *sk, struct sk_buff *skb)if (rt->rt_flags&RTCF_BROADCAST ) {struct sk_buff *newskb =skb_clone (skb,GFP_ATOMIC );if (newskb) -NF_HOOK (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, newskb, -NULL , newskb->dev, dev_loopback_xmit); +NF_HOOK (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, newskb,NULL , newskb->dev, + dev_loopback_xmit); } -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, skb,NULL , - skb->dev, ip_finish_output, +return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL , skb->dev, + ip_finish_output, !(IPCB (skb)->flags &IPSKB_REROUTED )); }int ip_output (struct sock *sk,struct sk_buff *skb) {struct net_device *dev =skb_dst (skb)->dev; +struct net *net =dev_net (dev); -IP_UPD_PO_STATS (dev_net (dev),IPSTATS_MIB_OUT , skb->len); +IP_UPD_PO_STATS (net,IPSTATS_MIB_OUT , skb->len); skb->dev = dev; skb->protocol =htons (ETH_P_IP ); -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, skb, -NULL , dev, +return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL , dev, ip_finish_output, !(IPCB (skb)->flags &IPSKB_REROUTED )); }
net/ipv4/ipmr.c +3 -3
@@ -1746,7 +1746,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,* to blackhole. */ -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_FRAGFAILS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_FRAGFAILS );ip_rt_put (rt); goto out_free; }
@@ -1788,8 +1788,8 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,* not mrouter) cannot join to more than one interface - it will * result in receiving multiple packets. */ -NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, dev, +NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, dev, ipmr_forward_finish);return ;
net/ipv4/raw.c +3 -2
@@ -411,8 +411,9 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,icmp_out_count (net, ((struct icmphdr *)skb_transport_header (skb))->type); - err =NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , rt->dst.dev, dst_output_sk); + err =NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , rt->dst.dev, + dst_output_sk);if (err >0 ) err =net_xmit_errno (err);if (err)
net/ipv4/xfrm4_input.c +2 -2
@@ -52,8 +52,8 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) iph->tot_len =htons (skb->len);ip_send_check (iph); -NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , xfrm4_rcv_encap_finish);return 0 ; }
net/ipv4/xfrm4_output.c +4 -2
@@ -96,8 +96,10 @@ static int __xfrm4_output(struct sock *sk, struct sk_buff *skb)int xfrm4_output (struct sock *sk,struct sk_buff *skb) { -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, skb, -NULL ,skb_dst (skb)->dev, __xfrm4_output, +struct net *net =dev_net (skb_dst (skb)->dev); +return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL ,skb_dst (skb)->dev, + __xfrm4_output, !(IPCB (skb)->flags &IPSKB_REROUTED )); }
net/ipv6/ip6_input.c +5 -5
@@ -108,7 +108,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptif (hdr->version !=6 ) goto err; -IP6_ADD_STATS_BH (dev_net (dev), idev, +IP6_ADD_STATS_BH (net, idev,IPSTATS_MIB_NOECTPKTS + (ipv6_get_dsfield (hdr) &INET_ECN_MASK ), max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
@@ -182,8 +182,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt/* Must drop socket now because of tproxy. */ skb_orphan (skb); -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING ,NULL , skb, - dev,NULL , +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , + net,NULL , skb, dev,NULL , ip6_rcv_finish); err:IP6_INC_STATS_BH (net, idev,IPSTATS_MIB_INHDRERRORS );
@@ -279,8 +279,8 @@ discard:int ip6_input (struct sk_buff *skb) { -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_IN ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_IN , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , ip6_input_finish); }
net/ipv6/ip6_output.c +15 -15
@@ -60,6 +60,7 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb) {struct dst_entry *dst =skb_dst (skb);struct net_device *dev = dst->dev; +struct net *net =dev_net (dev);struct neighbour *neigh;struct in6_addr *nexthop;int ret;
@@ -71,7 +72,7 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb)struct inet6_dev *idev =ip6_dst_idev (skb_dst (skb));if (!(dev->flags &IFF_LOOPBACK ) &&sk_mc_loop (sk) && - ((mroute6_socket (dev_net (dev), skb) && + ((mroute6_socket (net, skb) && !(IP6CB (skb)->flags &IP6SKB_FORWARDED )) ||ipv6_chk_mcast_addr (dev, &ipv6_hdr (skb)->daddr, &ipv6_hdr (skb)->saddr))) {
@@ -82,19 +83,18 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb)*/ if (newskb)NF_HOOK (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , - sk, newskb,NULL , newskb->dev, + net, sk, newskb,NULL , newskb->dev, dev_loopback_xmit);if (ipv6_hdr (skb)->hop_limit ==0 ) { -IP6_INC_STATS (dev_net (dev), idev, +IP6_INC_STATS (net, idev,IPSTATS_MIB_OUTDISCARDS );kfree_skb (skb);return 0 ; } } -IP6_UPD_PO_STATS (dev_net (dev), idev,IPSTATS_MIB_OUTMCAST , - skb->len); +IP6_UPD_PO_STATS (net, idev,IPSTATS_MIB_OUTMCAST , skb->len); if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <= IPV6_ADDR_SCOPE_NODELOCAL &&
@@ -116,8 +116,7 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb) }rcu_read_unlock_bh (); -IP6_INC_STATS (dev_net (dst->dev), -ip6_dst_idev (dst),IPSTATS_MIB_OUTNOROUTES ); +IP6_INC_STATS (net,ip6_dst_idev (dst),IPSTATS_MIB_OUTNOROUTES );kfree_skb (skb);return -EINVAL ; }
@@ -136,15 +135,15 @@ int ip6_output(struct sock *sk, struct sk_buff *skb) {struct net_device *dev =skb_dst (skb)->dev;struct inet6_dev *idev =ip6_dst_idev (skb_dst (skb)); +struct net *net =dev_net (dev);if (unlikely (idev->cnf.disable_ipv6)) { -IP6_INC_STATS (dev_net (dev), idev, -IPSTATS_MIB_OUTDISCARDS ); +IP6_INC_STATS (net, idev,IPSTATS_MIB_OUTDISCARDS );kfree_skb (skb);return 0 ; } -return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , sk, skb, -NULL , dev, +return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL , dev, ip6_finish_output, !(IP6CB (skb)->flags &IP6SKB_REROUTED )); }
@@ -224,8 +223,9 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,if ((skb->len <= mtu) || skb->ignore_df ||skb_is_gso (skb)) {IP6_UPD_PO_STATS (net,ip6_dst_idev (skb_dst (skb)),IPSTATS_MIB_OUT , skb->len); -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , dst->dev, dst_output_sk); +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , dst->dev, + dst_output_sk); } skb->dev = dst->dev;
@@ -512,8 +512,8 @@ int ip6_forward(struct sk_buff *skb)IP6_INC_STATS_BH (net,ip6_dst_idev (dst),IPSTATS_MIB_OUTFORWDATAGRAMS );IP6_ADD_STATS_BH (net,ip6_dst_idev (dst),IPSTATS_MIB_OUTOCTETS , skb->len); -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, dst->dev, +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, dst->dev, ip6_forward_finish); error:
net/ipv6/ip6mr.c +2 -2
@@ -2064,8 +2064,8 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,IP6CB (skb)->flags |=IP6SKB_FORWARDED ; -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, dev, +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, dev, ip6mr_forward2_finish); out_free:
net/ipv6/mcast.c +4 -3
@@ -1645,7 +1645,7 @@ static void mld_sendpack(struct sk_buff *skb) payload_len = skb->len; err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , - net->ipv6.igmp_sk, skb,NULL , skb->dev, + net, net->ipv6.igmp_sk, skb,NULL , skb->dev, dst_output_sk); out:if (!err) {
@@ -2008,8 +2008,9 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) }skb_dst_set (skb, dst); - err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , skb->dev, dst_output_sk); + err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , skb->dev, + dst_output_sk); out:if (!err) {ICMP6MSGOUT_INC_STATS (net, idev, type);
net/ipv6/ndisc.c +2 -2
@@ -463,8 +463,8 @@ static void ndisc_send_skb(struct sk_buff *skb, idev =__in6_dev_get (dst->dev);IP6_UPD_PO_STATS (net, idev,IPSTATS_MIB_OUT , skb->len); - err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , dst->dev, + err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , dst->dev, dst_output_sk);if (!err) {ICMP6MSGOUT_INC_STATS (net, idev, type);
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +1 -1
@@ -75,7 +75,7 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,nf_ct_frag6_consume_orig (reasm); -NF_HOOK_THRESH (NFPROTO_IPV6 , ops->hooknum, state->sk, reasm, +NF_HOOK_THRESH (NFPROTO_IPV6 , ops->hooknum, state->net, state->sk, reasm, state->in, state->out, state->okfn,NF_IP6_PRI_CONNTRACK_DEFRAG +1 );
net/ipv6/output_core.c +4 -2
@@ -139,6 +139,7 @@ EXPORT_SYMBOL(ip6_dst_hoplimit);static int __ip6_local_out_sk (struct sock *sk,struct sk_buff *skb) { +struct net *net =dev_net (skb_dst (skb)->dev);int len; len = skb->len -sizeof (struct ipv6hdr );
@@ -147,8 +148,9 @@ static int __ip6_local_out_sk(struct sock *sk, struct sk_buff *skb)ipv6_hdr (skb)->payload_len =htons (len);IP6CB (skb)->nhoff = offsetof(struct ipv6hdr , nexthdr); -return nf_hook (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL ,skb_dst (skb)->dev, dst_output_sk); +return nf_hook (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL ,skb_dst (skb)->dev, + dst_output_sk); }int __ip6_local_out (struct sk_buff *skb)
net/ipv6/raw.c +6 -4
@@ -613,6 +613,7 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, unsigned int flags) {struct ipv6_pinfo *np =inet6_sk (sk); +struct net *net =sock_net (sk);struct ipv6hdr *iph;struct sk_buff *skb;int err;
@@ -651,9 +652,10 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,if (err) goto error_fault; -IP6_UPD_PO_STATS (sock_net (sk), rt->rt6i_idev,IPSTATS_MIB_OUT , skb->len); - err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , rt->dst.dev, dst_output_sk); +IP6_UPD_PO_STATS (net, rt->rt6i_idev,IPSTATS_MIB_OUT , skb->len); + err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , rt->dst.dev, + dst_output_sk);if (err >0 ) err =net_xmit_errno (err);if (err)
@@ -665,7 +667,7 @@ error_fault: err = -EFAULT ;kfree_skb (skb); error: -IP6_INC_STATS (sock_net (sk), rt->rt6i_idev,IPSTATS_MIB_OUTDISCARDS ); +IP6_INC_STATS (net, rt->rt6i_idev,IPSTATS_MIB_OUTDISCARDS );if (err == -ENOBUFS && !np->recverr) err =0 ;return err;
net/ipv6/xfrm6_input.c +2 -2
@@ -42,8 +42,8 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)ipv6_hdr (skb)->payload_len =htons (skb->len);__skb_push (skb, skb->data -skb_network_header (skb)); -NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , ip6_rcv_finish);return -1 ; }
net/ipv6/xfrm6_output.c +4 -2
@@ -168,7 +168,9 @@ static int __xfrm6_output(struct sock *sk, struct sk_buff *skb)int xfrm6_output (struct sock *sk,struct sk_buff *skb) { -return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , sk, skb, -NULL ,skb_dst (skb)->dev, __xfrm6_output, +struct net *net =dev_net (skb_dst (skb)->dev); +return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL ,skb_dst (skb)->dev, + __xfrm6_output, !(IP6CB (skb)->flags &IP6SKB_REROUTED )); }
net/netfilter/ipvs/ip_vs_xmit.c +2 -2
@@ -540,7 +540,7 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,ip_vs_update_conntrack (skb, cp,1 );if (!local) {skb_forward_csum (skb); -NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb, +NF_HOOK (pf,NF_INET_LOCAL_OUT ,ip_vs_conn_net (cp),NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk); }else ret =NF_ACCEPT ;
@@ -558,7 +558,7 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb,ip_vs_notrack (skb);if (!local) {skb_forward_csum (skb); -NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb, +NF_HOOK (pf,NF_INET_LOCAL_OUT ,ip_vs_conn_net (cp),NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk); }else ret =NF_ACCEPT ;
net/xfrm/xfrm_output.c +3 -1
@@ -132,6 +132,7 @@ out:int xfrm_output_resume (struct sk_buff *skb,int err) {while (likely ((err =xfrm_output_one (skb, err)) ==0 )) { +struct net *net;nf_reset (skb); err =skb_dst (skb)->ops->local_out (skb);
@@ -141,8 +142,9 @@ int xfrm_output_resume(struct sk_buff *skb, int err)if (!skb_dst (skb)->xfrm)return dst_output (skb); + net =xs_net (skb_dst (skb)->xfrm); err =nf_hook (skb_dst (skb)->ops->family, -NF_INET_POST_ROUTING , skb->sk, skb, +NF_INET_POST_ROUTING , net, skb->sk, skb,NULL ,skb_dst (skb)->dev, xfrm_output2);if (unlikely (err !=1 )) goto out;
Signature · 1 line
2.2.1
PATCH 3/15 netfilter: Use nf_hook_state.net
In reply to Eric W. BiedermanInstead of saying "net = dev_net(state->in?state->in:state->out)" just say "state->net". As that information is now availabe, much less confusing and much less error prone.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/bridge/netfilter/ebtable_filter.c | 4 ++-- net/bridge/netfilter/ebtable_nat.c | 4 ++-- net/ipv4/netfilter/arptable_filter.c | 4 +--- net/ipv4/netfilter/ip_tables.c | 8 ++++---- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/iptable_filter.c | 6 ++---- net/ipv4/netfilter/iptable_mangle.c | 7 +++---- net/ipv4/netfilter/iptable_nat.c | 5 ++--- net/ipv4/netfilter/iptable_raw.c | 6 ++---- net/ipv4/netfilter/iptable_security.c | 5 +---- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 ++-- net/ipv6/netfilter/ip6_tables.c | 8 ++++---- net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +- net/ipv6/netfilter/ip6table_filter.c | 5 ++--- net/ipv6/netfilter/ip6table_mangle.c | 6 +++--- net/ipv6/netfilter/ip6table_nat.c | 5 ++--- net/ipv6/netfilter/ip6table_raw.c | 5 ++--- net/ipv6/netfilter/ip6table_security.c | 4 +--- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 4 ++-- net/netfilter/nfnetlink_queue_core.c | 3 +-- 21 files changed, 41 insertions(+), 58 deletions(-)
net/bridge/netfilter/ebtable_filter.c +2 -2
@@ -61,7 +61,7 @@ ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->in)->xt.frame_filter); + state->net->xt.frame_filter); } static unsigned int
@@ -69,7 +69,7 @@ ebt_out_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->out)->xt.frame_filter); + state->net->xt.frame_filter); }static struct nf_hook_ops ebt_ops_filter[]__read_mostly = {
net/bridge/netfilter/ebtable_nat.c +2 -2
@@ -61,7 +61,7 @@ ebt_nat_in(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->in)->xt.frame_nat); + state->net->xt.frame_nat); } static unsigned int
@@ -69,7 +69,7 @@ ebt_nat_out(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->out)->xt.frame_nat); + state->net->xt.frame_nat); }static struct nf_hook_ops ebt_ops_nat[]__read_mostly = {
net/ipv4/netfilter/arptable_filter.c +1 -3
@@ -30,10 +30,8 @@ static unsigned int arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - return arpt_do_table(skb, ops->hooknum, state, - net->ipv4.arptable_filter); + state->net->ipv4.arptable_filter); }static struct nf_hook_ops *arpfilter_ops__read_mostly ;
net/ipv4/netfilter/ip_tables.c +4 -4
@@ -246,7 +246,8 @@ get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,return 0 ; } -static void trace_packet(const struct sk_buff *skb, +static void trace_packet(struct net *net, + const struct sk_buff *skb, unsigned int hook, const struct net_device *in, const struct net_device *out,
@@ -259,7 +260,6 @@ static void trace_packet(const struct sk_buff *skb,const char *hookname, *chainname, *comment;const struct ipt_entry *iter;unsigned int rulenum =0 ; -struct net *net =dev_net (in ? in : out); table_base = private->entries[smp_processor_id ()]; root =get_entry (table_base, private->hook_entry[hook]);
@@ -369,8 +369,8 @@ ipt_do_table(struct sk_buff *skb,#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE )/* The packet is traced: log it */ if (unlikely (skb->nf_trace)) -trace_packet (skb, hook, state->in, state->out, - table->name, private, e); +trace_packet (state->net, skb, hook, state->in, + state->out, table->name, private, e);#endif /* Standard target? */ if (!t->u.kernel.target->target) {
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
@@ -514,7 +514,7 @@ arp_mangle(const struct nf_hook_ops *ops,struct arphdr *arp =arp_hdr (skb);struct arp_payload *payload;struct clusterip_config *c; -struct net *net =dev_net (state->in ? state->in : state->out); +struct net *net = state->net;/* we don't care about non-ethernet and non-ipv4 ARP */ if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
net/ipv4/netfilter/ipt_SYNPROXY.c +1 -1
@@ -302,7 +302,7 @@ static unsigned int ipv4_synproxy_hook(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *nhs) { - struct synproxy_net *snet = synproxy_pernet(dev_net(nhs->in ? : nhs->out)); + struct synproxy_net *snet = synproxy_pernet(nhs->net);enum ip_conntrack_info ctinfo;struct nf_conn *ct;struct nf_conn_synproxy *synproxy;
net/ipv4/netfilter/iptable_filter.c +2 -4
@@ -36,16 +36,14 @@ static unsigned int iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net; - if (ops->hooknum == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - net =dev_net (state->in ? state->in : state->out); -return ipt_do_table (skb, ops->hooknum, state, net->ipv4.iptable_filter); + return ipt_do_table(skb, ops->hooknum, state, + state->net->ipv4.iptable_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv4/netfilter/iptable_mangle.c +3 -4
@@ -39,7 +39,6 @@ static const struct xt_table packet_mangler = {static unsigned int ipt_mangle_out (struct sk_buff *skb,const struct nf_hook_state *state) { -struct net_device *out = state->out;unsigned int ret;const struct iphdr *iph;u_int8_t tos;
@@ -60,7 +59,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) tos = iph->tos; ret =ipt_do_table (skb,NF_INET_LOCAL_OUT , state, -dev_net (out)->ipv4.iptable_mangle); + state->net->ipv4.iptable_mangle);/* Reroute for ANY change. */ if (ret !=NF_DROP && ret !=NF_STOLEN ) { iph =ip_hdr (skb);
@@ -88,10 +87,10 @@ iptable_mangle_hook(const struct nf_hook_ops *ops,return ipt_mangle_out (skb, state);if (ops->hooknum ==NF_INET_POST_ROUTING )return ipt_do_table (skb, ops->hooknum, state, -dev_net (state->out)->ipv4.iptable_mangle); + state->net->ipv4.iptable_mangle);/* PREROUTING/INPUT/FORWARD: */ return ipt_do_table (skb, ops->hooknum, state, -dev_net (state->in)->ipv4.iptable_mangle); + state->net->ipv4.iptable_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv4/netfilter/iptable_nat.c +2 -3
@@ -33,9 +33,8 @@ static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - struct net *net = nf_ct_net(ct); - -return ipt_do_table (skb, ops->hooknum, state, net->ipv4.nat_table); + return ipt_do_table(skb, ops->hooknum, state, + state->net->ipv4.nat_table); } static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,
net/ipv4/netfilter/iptable_raw.c +2 -4
@@ -23,16 +23,14 @@ static unsigned int iptable_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net; - if (ops->hooknum == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - net =dev_net (state->in ? state->in : state->out); -return ipt_do_table (skb, ops->hooknum, state, net->ipv4.iptable_raw); + return ipt_do_table(skb, ops->hooknum, state, + state->net->ipv4.iptable_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv4/netfilter/iptable_security.c +1 -4
@@ -40,17 +40,14 @@ static unsigned int iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net; - if (ops->hooknum == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* Somebody is playing with raw sockets. */ return NF_ACCEPT; - net =dev_net (state->in ? state->in : state->out); return ipt_do_table(skb, ops->hooknum, state, - net->ipv4.iptable_security); + state->net->ipv4.iptable_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +2 -2
@@ -147,7 +147,7 @@ static unsigned int ipv4_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(dev_net(state->in), PF_INET, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET, ops->hooknum, skb); } static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,
@@ -158,7 +158,7 @@ static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,if (skb->len <sizeof (struct iphdr ) ||ip_hdrlen (skb) <sizeof (struct iphdr ))return NF_ACCEPT ; -return nf_conntrack_in (dev_net (state->out),PF_INET , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET , ops->hooknum, skb); }/* Connection tracking may drop packets, but never alters them, so
net/ipv6/netfilter/ip6_tables.c +4 -4
@@ -275,7 +275,8 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,return 0 ; } -static void trace_packet(const struct sk_buff *skb, +static void trace_packet(struct net *net, + const struct sk_buff *skb, unsigned int hook, const struct net_device *in, const struct net_device *out,
@@ -288,7 +289,6 @@ static void trace_packet(const struct sk_buff *skb,const char *hookname, *chainname, *comment;const struct ip6t_entry *iter;unsigned int rulenum =0 ; -struct net *net =dev_net (in ? in : out); table_base = private->entries[smp_processor_id ()]; root =get_entry (table_base, private->hook_entry[hook]);
@@ -392,8 +392,8 @@ ip6t_do_table(struct sk_buff *skb,#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE )/* The packet is traced: log it */ if (unlikely (skb->nf_trace)) -trace_packet (skb, hook, state->in, state->out, - table->name, private, e); +trace_packet (state->net, skb, hook, state->in, + state->out, table->name, private, e);#endif /* Standard target? */ if (!t->u.kernel.target->target) {
net/ipv6/netfilter/ip6t_SYNPROXY.c +1 -1
@@ -317,7 +317,7 @@ static unsigned int ipv6_synproxy_hook(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *nhs) { - struct synproxy_net *snet = synproxy_pernet(dev_net(nhs->in ? : nhs->out)); + struct synproxy_net *snet = synproxy_pernet(nhs->net);enum ip_conntrack_info ctinfo;struct nf_conn *ct;struct nf_conn_synproxy *synproxy;
net/ipv6/netfilter/ip6table_filter.c +2 -3
@@ -35,9 +35,8 @@ static unsigned int ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - -return ip6t_do_table (skb, ops->hooknum, state, net->ipv6.ip6table_filter); + return ip6t_do_table(skb, ops->hooknum, state, + state->net->ipv6.ip6table_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv6/netfilter/ip6table_mangle.c +3 -3
@@ -58,7 +58,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) flowlabel = *((u_int32_t *)ipv6_hdr (skb)); ret =ip6t_do_table (skb,NF_INET_LOCAL_OUT , state, -dev_net (state->out)->ipv6.ip6table_mangle); + state->net->ipv6.ip6table_mangle); if (ret != NF_DROP && ret != NF_STOLEN && (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@@ -83,10 +83,10 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,return ip6t_mangle_out (skb, state);if (ops->hooknum ==NF_INET_POST_ROUTING )return ip6t_do_table (skb, ops->hooknum, state, -dev_net (state->out)->ipv6.ip6table_mangle); + state->net->ipv6.ip6table_mangle);/* INPUT/FORWARD */ return ip6t_do_table (skb, ops->hooknum, state, -dev_net (state->in)->ipv6.ip6table_mangle); + state->net->ipv6.ip6table_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv6/netfilter/ip6table_nat.c +2 -3
@@ -35,9 +35,8 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - struct net *net = nf_ct_net(ct); - -return ip6t_do_table (skb, ops->hooknum, state, net->ipv6.ip6table_nat); + return ip6t_do_table(skb, ops->hooknum, state, + state->net->ipv6.ip6table_nat); } static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
net/ipv6/netfilter/ip6table_raw.c +2 -3
@@ -22,9 +22,8 @@ static unsigned int ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - -return ip6t_do_table (skb, ops->hooknum, state, net->ipv6.ip6table_raw); + return ip6t_do_table(skb, ops->hooknum, state, + state->net->ipv6.ip6table_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv6/netfilter/ip6table_security.c +1 -3
@@ -39,10 +39,8 @@ static unsigned int ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - return ip6t_do_table(skb, ops->hooknum, state, - net->ipv6.ip6table_security); + state->net->ipv6.ip6table_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +2 -2
@@ -169,7 +169,7 @@ static unsigned int ipv6_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(dev_net(state->in), PF_INET6, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET6, ops->hooknum, skb); } static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,
@@ -181,7 +181,7 @@ static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,net_notice_ratelimited ("ipv6_conntrack_local: packet too short\n" );return NF_ACCEPT ; } -return nf_conntrack_in (dev_net (state->out),PF_INET6 , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET6 , ops->hooknum, skb); }static struct nf_hook_ops ipv6_conntrack_ops[]__read_mostly = {
net/netfilter/nfnetlink_queue_core.c +1 -2
@@ -641,8 +641,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)struct nfqnl_instance *queue;struct sk_buff *skb, *segs;int err = -ENOBUFS ; -struct net *net =dev_net (entry->state.in ? - entry->state.in : entry->state.out); +struct net *net = entry->state.net;struct nfnl_queue_net *q =nfnl_queue_pernet (net);/* rcu_read_lock()ed by nf_hook_slow() */
Signature · 1 line
2.2.1
PATCH 4/15 ebtables: Simplify the arguments to ebt_do_table
In reply to Eric W. BiedermanNearly everything thing of interest to ebt_do_table is already present in nf_hook_state. Simplify ebt_do_table by just passing in the skb, nf_hook_state, and the table. This make the code easier to read and maintenance easier.
To support this create an nf_hook_state on the stack in ebt_broute (the only caller without a nf_hook_state already available). This new nf_hook_state adds no new computations to ebt_broute, but does use a few more bytes of stack.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter_bridge/ebtables.h | 6 +++--- net/bridge/netfilter/ebtable_broute.c | 8 ++++++-- net/bridge/netfilter/ebtable_filter.c | 6 ++---- net/bridge/netfilter/ebtable_nat.c | 6 ++---- net/bridge/netfilter/ebtables.c | 13 +++++++------ 5 files changed, 20 insertions(+), 19 deletions(-)
include/linux/netfilter_bridge/ebtables.h +3 -3
@@ -111,9 +111,9 @@ struct ebt_table {extern struct ebt_table *ebt_register_table (struct net *net,const struct ebt_table *table);extern void ebt_unregister_table (struct net *net,struct ebt_table *table); -extern unsigned int ebt_do_table (unsigned int hook,struct sk_buff *skb, -const struct net_device *in,const struct net_device *out, -struct ebt_table *table); +extern unsigned int ebt_do_table (struct sk_buff *skb, +const struct nf_hook_state *state, +struct ebt_table *table);/* Used in the kernel match() functions */ #define FWINV (bool,invflg) ((bool) ^ !!(info->invflags & invflg))
net/bridge/netfilter/ebtable_broute.c +6 -2
@@ -50,10 +50,14 @@ static const struct ebt_table broute_table = {static int ebt_broute (struct sk_buff *skb) { +struct nf_hook_state state;int ret; - ret =ebt_do_table (NF_BR_BROUTING , skb, skb->dev,NULL , -dev_net (skb->dev)->xt.broute_table); +nf_hook_state_init (&state,NULL ,NF_BR_BROUTING ,INT_MIN , +NFPROTO_BRIDGE , skb->dev,NULL ,NULL , +dev_net (skb->dev),NULL ); + + ret =ebt_do_table (skb, &state, state.net->xt.broute_table);if (ret ==NF_DROP )return 1 ;/* route it */ return 0 ;/* bridge it */
net/bridge/netfilter/ebtable_filter.c +2 -4
@@ -60,16 +60,14 @@ static unsigned int ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ebt_do_table(ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_filter); + return ebt_do_table(skb, state, state->net->xt.frame_filter); }static unsigned int ebt_out_hook (const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { -return ebt_do_table (ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_filter); +return ebt_do_table (skb, state, state->net->xt.frame_filter); } static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
net/bridge/netfilter/ebtable_nat.c +2 -4
@@ -60,16 +60,14 @@ static unsigned int ebt_nat_in(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ebt_do_table(ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_nat); + return ebt_do_table(skb, state, state->net->xt.frame_nat); }static unsigned int ebt_nat_out (const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { -return ebt_do_table (ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_nat); +return ebt_do_table (skb, state, state->net->xt.frame_nat); } static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
net/bridge/netfilter/ebtables.c +7 -6
@@ -183,10 +183,11 @@ struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry) }/* Do some firewalling */ -unsigned int ebt_do_table (unsigned int hook,struct sk_buff *skb, -const struct net_device *in,const struct net_device *out, -struct ebt_table *table) +unsigned int ebt_do_table (struct sk_buff *skb, +const struct nf_hook_state *state, +struct ebt_table *table) { +unsigned int hook = state->hook;int i, nentries;struct ebt_entry *point;struct ebt_counter *counter_base, *cb_base;
@@ -199,8 +200,8 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,struct xt_action_param acpar; acpar.family =NFPROTO_BRIDGE ; - acpar.in = in; - acpar.out = out; + acpar.in = state->in; + acpar.out = state->out; acpar.hotdrop = false; acpar.hooknum = hook;
@@ -220,7 +221,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb, base = private->entries; i =0 ;while (i < nentries) { -if (ebt_basic_match (point, skb, in, out)) +if (ebt_basic_match (point, skb, state->in, state->out)) goto letscontinue;if (EBT_MATCH_ITERATE (point, ebt_do_match, skb, &acpar) !=0 )
Signature · 1 line
2.2.1
PATCH 5/15 inet netfilter: Remove hook from ip6t_do_table, arp_do_table, ipt_do_table
In reply to Eric W. BiedermanThe values of ops->hooknum and state->hook are guaraneted to be equal making the hook argument to ip6t_do_table, arp_do_table, and ipt_do_table is unnecessary. Remove the unnecessary hook argument.
In the callers use state->hook instead of ops->hooknum for clarity and to reduce the number of cachelines the callers touch.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - net/ipv4/netfilter/arp_tables.c | 2 +- net/ipv4/netfilter/arptable_filter.c | 3 +-- net/ipv4/netfilter/ip_tables.c | 2 +- net/ipv4/netfilter/iptable_filter.c | 5 ++--- net/ipv4/netfilter/iptable_mangle.c | 12 +++++------- net/ipv4/netfilter/iptable_nat.c | 3 +-- net/ipv4/netfilter/iptable_raw.c | 5 ++--- net/ipv4/netfilter/iptable_security.c | 5 ++--- net/ipv6/netfilter/ip6_tables.c | 2 +- net/ipv6/netfilter/ip6table_filter.c | 3 +-- net/ipv6/netfilter/ip6table_mangle.c | 12 +++++------- net/ipv6/netfilter/ip6table_nat.c | 3 +-- net/ipv6/netfilter/ip6table_raw.c | 3 +-- net/ipv6/netfilter/ip6table_security.c | 3 +-- 17 files changed, 25 insertions(+), 41 deletions(-)
include/linux/netfilter_arp/arp_tables.h +0 -1
@@ -53,7 +53,6 @@ extern struct xt_table *arpt_register_table(struct net *net, const struct arpt_replace *repl);extern void arpt_unregister_table (struct xt_table *table);extern unsigned int arpt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table);
include/linux/netfilter_ipv4/ip_tables.h +0 -1
@@ -64,7 +64,6 @@ struct ipt_error {extern void *ipt_alloc_initial_table (const struct xt_table *);extern unsigned int ipt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table);
include/linux/netfilter_ipv6/ip6_tables.h +0 -1
@@ -30,7 +30,6 @@ extern struct xt_table *ip6t_register_table(struct net *net, const struct ip6t_replace *repl);extern void ip6t_unregister_table (struct net *net,struct xt_table *table);extern unsigned int ip6t_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table);
net/ipv4/netfilter/arp_tables.c +1 -1
@@ -247,10 +247,10 @@ struct arpt_entry *arpt_next_entry(const struct arpt_entry *entry) }unsigned int arpt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table) { +unsigned int hook = state->hook; static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));unsigned int verdict =NF_DROP ;const struct arphdr *arp;
net/ipv4/netfilter/arptable_filter.c +1 -2
@@ -30,8 +30,7 @@ static unsigned int arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return arpt_do_table(skb, ops->hooknum, state, - state->net->ipv4.arptable_filter); + return arpt_do_table(skb, state, state->net->ipv4.arptable_filter); }static struct nf_hook_ops *arpfilter_ops__read_mostly ;
net/ipv4/netfilter/ip_tables.c +1 -1
@@ -287,10 +287,10 @@ struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)/* Returns one of the generic firewall policies, like NF_ACCEPT. */ unsigned int ipt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table) { +unsigned int hook = state->hook; static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));const struct iphdr *ip;/* Initializing verdict to NF_DROP keeps gcc happy. */
net/ipv4/netfilter/iptable_filter.c +2 -3
@@ -36,14 +36,13 @@ static unsigned int iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT && + if (state->hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.iptable_filter); + return ipt_do_table(skb, state, state->net->ipv4.iptable_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv4/netfilter/iptable_mangle.c +5 -7
@@ -58,8 +58,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) daddr = iph->daddr; tos = iph->tos; - ret =ipt_do_table (skb,NF_INET_LOCAL_OUT , state, - state->net->ipv4.iptable_mangle); + ret =ipt_do_table (skb, state, state->net->ipv4.iptable_mangle);/* Reroute for ANY change. */ if (ret !=NF_DROP && ret !=NF_STOLEN ) { iph =ip_hdr (skb);
@@ -83,14 +82,13 @@ iptable_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { -if (ops->hooknum ==NF_INET_LOCAL_OUT ) +if (state->hook ==NF_INET_LOCAL_OUT )return ipt_mangle_out (skb, state); -if (ops->hooknum ==NF_INET_POST_ROUTING ) -return ipt_do_table (skb, ops->hooknum, state, +if (state->hook ==NF_INET_POST_ROUTING ) +return ipt_do_table (skb, state, state->net->ipv4.iptable_mangle);/* PREROUTING/INPUT/FORWARD: */ -return ipt_do_table (skb, ops->hooknum, state, - state->net->ipv4.iptable_mangle); +return ipt_do_table (skb, state, state->net->ipv4.iptable_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv4/netfilter/iptable_nat.c +1 -2
@@ -33,8 +33,7 @@ static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.nat_table); + return ipt_do_table(skb, state, state->net->ipv4.nat_table); } static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,
net/ipv4/netfilter/iptable_raw.c +2 -3
@@ -23,14 +23,13 @@ static unsigned int iptable_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT && + if (state->hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.iptable_raw); + return ipt_do_table(skb, state, state->net->ipv4.iptable_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv4/netfilter/iptable_security.c +2 -3
@@ -40,14 +40,13 @@ static unsigned int iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT && + if (state->hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* Somebody is playing with raw sockets. */ return NF_ACCEPT; - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.iptable_security); + return ipt_do_table(skb, state, state->net->ipv4.iptable_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
net/ipv6/netfilter/ip6_tables.c +1 -1
@@ -316,10 +316,10 @@ ip6t_next_entry(const struct ip6t_entry *entry)/* Returns one of the generic firewall policies, like NF_ACCEPT. */ unsigned int ip6t_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table) { +unsigned int hook = state->hook; static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));/* Initializing verdict to NF_DROP keeps gcc happy. */ unsigned int verdict =NF_DROP ;
net/ipv6/netfilter/ip6table_filter.c +1 -2
@@ -35,8 +35,7 @@ static unsigned int ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_filter); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv6/netfilter/ip6table_mangle.c +5 -7
@@ -57,8 +57,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)/* flowlabel and prio (includes version, which shouldn't change either */ flowlabel = *((u_int32_t *)ipv6_hdr (skb)); - ret =ip6t_do_table (skb,NF_INET_LOCAL_OUT , state, - state->net->ipv6.ip6table_mangle); + ret =ip6t_do_table (skb, state, state->net->ipv6.ip6table_mangle); if (ret != NF_DROP && ret != NF_STOLEN && (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@@ -79,14 +78,13 @@ static unsigned int ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT) + if (state->hook == NF_INET_LOCAL_OUT) return ip6t_mangle_out(skb, state); -if (ops->hooknum ==NF_INET_POST_ROUTING ) -return ip6t_do_table (skb, ops->hooknum, state, +if (state->hook ==NF_INET_POST_ROUTING ) +return ip6t_do_table (skb, state, state->net->ipv6.ip6table_mangle);/* INPUT/FORWARD */ -return ip6t_do_table (skb, ops->hooknum, state, - state->net->ipv6.ip6table_mangle); +return ip6t_do_table (skb, state, state->net->ipv6.ip6table_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv6/netfilter/ip6table_nat.c +1 -2
@@ -35,8 +35,7 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_nat); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_nat); } static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
net/ipv6/netfilter/ip6table_raw.c +1 -2
@@ -22,8 +22,7 @@ static unsigned int ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_raw); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv6/netfilter/ip6table_security.c +1 -2
@@ -39,8 +39,7 @@ static unsigned int ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_security); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
Signature · 1 line
2.2.1
PATCH 6/15 inet netfilter: Prefer state->hook to ops->hooknum
In reply to Eric W. BiedermanThe values of nf_hook_state.hook and nf_hook_ops.hooknum must be the same by definition.
We are more likely to access the fields in nf_hook_state over the fields in nf_hook_ops so with a little luck this results in fewer cache line misses, and slightly more consistent code.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 ++-- net/ipv4/netfilter/nf_defrag_ipv4.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 14 +++++++------- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 4 ++-- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 4 ++-- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 14 +++++++------- 6 files changed, 21 insertions(+), 21 deletions(-)
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +2 -2
@@ -147,7 +147,7 @@ static unsigned int ipv4_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(state->net, PF_INET, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET, state->hook, skb); } static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,
@@ -158,7 +158,7 @@ static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,if (skb->len <sizeof (struct iphdr ) ||ip_hdrlen (skb) <sizeof (struct iphdr ))return NF_ACCEPT ; -return nf_conntrack_in (state->net,PF_INET , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET , state->hook, skb); }/* Connection tracking may drop packets, but never alters them, so
net/ipv4/netfilter/nf_defrag_ipv4.c +1 -1
@@ -83,7 +83,7 @@ static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops,/* Gather fragments. */ if (ip_is_fragment (ip_hdr (skb))) {enum ip_defrag_users user = -nf_ct_defrag_user (ops->hooknum, skb); +nf_ct_defrag_user (state->hook, skb);if (nf_ct_ipv4_gather_frags (skb, user))return NF_STOLEN ;
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +7 -7
@@ -266,7 +266,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,enum ip_conntrack_info ctinfo;struct nf_conn_nat *nat;/* maniptype == SRC for postrouting. */ -enum nf_nat_manip_type maniptype =HOOK2MANIP (ops->hooknum); +enum nf_nat_manip_type maniptype =HOOK2MANIP (state->hook);/* We never see fragments: conntrack defrags on pre-routing * and local-out, and nf_nat_out protects post-routing.
@@ -295,7 +295,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,case IP_CT_RELATED_REPLY :if (ip_hdr (skb)->protocol ==IPPROTO_ICMP ) {if (!nf_nat_icmp_reply_translation (skb, ct, ctinfo, - ops->hooknum)) + state->hook))return NF_DROP ;else return NF_ACCEPT ;
@@ -312,17 +312,17 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (ret !=NF_ACCEPT )return ret; -if (nf_nat_initialized (ct,HOOK2MANIP (ops->hooknum))) +if (nf_nat_initialized (ct,HOOK2MANIP (state->hook)))break ; - ret =nf_nat_alloc_null_binding (ct, ops->hooknum); + ret =nf_nat_alloc_null_binding (ct, state->hook);if (ret !=NF_ACCEPT )return ret; }else {pr_debug ("Already setup manip %s for ct %p\n" , maniptype ==NF_NAT_MANIP_SRC ?"SRC" :"DST" , ct); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; }
@@ -332,11 +332,11 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,/* ESTABLISHED */ NF_CT_ASSERT (ctinfo ==IP_CT_ESTABLISHED || ctinfo ==IP_CT_ESTABLISHED_REPLY ); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, state->out)) +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; } -return nf_nat_packet (ct, ctinfo, ops->hooknum, skb); +return nf_nat_packet (ct, ctinfo, state->hook, skb); oif_changed:nf_ct_kill_acct (ct, ctinfo, skb);
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +2 -2
@@ -169,7 +169,7 @@ static unsigned int ipv6_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(state->net, PF_INET6, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET6, state->hook, skb); } static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,
@@ -181,7 +181,7 @@ static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,net_notice_ratelimited ("ipv6_conntrack_local: packet too short\n" );return NF_ACCEPT ; } -return nf_conntrack_in (state->net,PF_INET6 , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET6 , state->hook, skb); }static struct nf_hook_ops ipv6_conntrack_ops[]__read_mostly = {
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +2 -2
@@ -64,7 +64,7 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,return NF_ACCEPT ;#endif - reasm =nf_ct_frag6_gather (skb,nf_ct6_defrag_user (ops->hooknum, skb)); + reasm =nf_ct_frag6_gather (skb,nf_ct6_defrag_user (state->hook, skb));/* queued */ if (reasm ==NULL )return NF_STOLEN ;
@@ -75,7 +75,7 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,nf_ct_frag6_consume_orig (reasm); -NF_HOOK_THRESH (NFPROTO_IPV6 , ops->hooknum, state->net, state->sk, reasm, +NF_HOOK_THRESH (NFPROTO_IPV6 , state->hook, state->net, state->sk, reasm, state->in, state->out, state->okfn,NF_IP6_PRI_CONNTRACK_DEFRAG +1 );
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +7 -7
@@ -272,7 +272,7 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,struct nf_conn *ct;enum ip_conntrack_info ctinfo;struct nf_conn_nat *nat; -enum nf_nat_manip_type maniptype =HOOK2MANIP (ops->hooknum); +enum nf_nat_manip_type maniptype =HOOK2MANIP (state->hook);__be16 frag_off;int hdrlen;u8 nexthdr;
@@ -303,7 +303,7 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (hdrlen >=0 && nexthdr ==IPPROTO_ICMPV6 ) {if (!nf_nat_icmpv6_reply_translation (skb, ct, ctinfo, - ops->hooknum, + state->hook, hdrlen))return NF_DROP ;else
@@ -321,17 +321,17 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (ret !=NF_ACCEPT )return ret; -if (nf_nat_initialized (ct,HOOK2MANIP (ops->hooknum))) +if (nf_nat_initialized (ct,HOOK2MANIP (state->hook)))break ; - ret =nf_nat_alloc_null_binding (ct, ops->hooknum); + ret =nf_nat_alloc_null_binding (ct, state->hook);if (ret !=NF_ACCEPT )return ret; }else {pr_debug ("Already setup manip %s for ct %p\n" , maniptype ==NF_NAT_MANIP_SRC ?"SRC" :"DST" , ct); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, state->out)) +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; }break ;
@@ -340,11 +340,11 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,/* ESTABLISHED */ NF_CT_ASSERT (ctinfo ==IP_CT_ESTABLISHED || ctinfo ==IP_CT_ESTABLISHED_REPLY ); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, state->out)) +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; } -return nf_nat_packet (ct, ctinfo, ops->hooknum, skb); +return nf_nat_packet (ct, ctinfo, state->hook, skb); oif_changed:nf_ct_kill_acct (ct, ctinfo, skb);
Signature · 1 line
2.2.1
PATCH 7/15 nftables: kill nft_pktinfo.ops
In reply to Eric W. Biederman- Add nft_pktinfo.pf to replace ops->pf
- Add nft_pktinfo.hook to replace ops->hooknum
This simplifies the code, makes it more readable, and likely reduces cache line misses. Maintainability is enhanced as the details of nft_hook_ops are of no concern to the recpients of nft_pktinfo.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/nf_tables.h | 9 ++++----- include/net/netfilter/nf_tables_ipv4.h | 3 +-- include/net/netfilter/nf_tables_ipv6.h | 3 +-- net/bridge/netfilter/nf_tables_bridge.c | 16 +++++++--------- net/bridge/netfilter/nft_reject_bridge.c | 12 ++++++------ net/ipv4/netfilter/nf_tables_arp.c | 2 +- net/ipv4/netfilter/nf_tables_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_nat_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/netfilter/nft_masq_ipv4.c | 2 +- net/ipv4/netfilter/nft_redir_ipv4.c | 2 +- net/ipv4/netfilter/nft_reject_ipv4.c | 5 ++--- net/ipv6/netfilter/nf_tables_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_nat_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/netfilter/nft_redir_ipv6.c | 3 +-- net/ipv6/netfilter/nft_reject_ipv6.c | 5 ++--- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nf_tables_netdev.c | 16 +++++++--------- net/netfilter/nft_log.c | 2 +- net/netfilter/nft_meta.c | 4 ++-- net/netfilter/nft_queue.c | 2 +- net/netfilter/nft_reject_inet.c | 14 +++++++------- 23 files changed, 52 insertions(+), 62 deletions(-)
include/net/netfilter/nf_tables.h +4 -5
@@ -16,7 +16,8 @@ struct nft_pktinfo {struct sk_buff *skb;const struct net_device *in;const struct net_device *out; -const struct nf_hook_ops *ops; +u8 pf; +u8 hook;u8 nhoff;u8 thoff;u8 tprot;
@@ -25,16 +26,14 @@ struct nft_pktinfo { };static inline void nft_set_pktinfo (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { pkt->skb = skb; pkt->in = pkt->xt.in = state->in; pkt->out = pkt->xt.out = state->out; - pkt->ops = ops; - pkt->xt.hooknum = ops->hooknum; - pkt->xt.family = ops->pf; + pkt->hook = pkt->xt.hooknum = state->hook; + pkt->pf = pkt->xt.family = state->pf; }/**
include/net/netfilter/nf_tables_ipv4.h +1 -2
@@ -6,13 +6,12 @@static inline void nft_set_pktinfo_ipv4 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {struct iphdr *ip; -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); ip =ip_hdr (pkt->skb); pkt->tprot = ip->protocol;
include/net/netfilter/nf_tables_ipv6.h +1 -2
@@ -6,14 +6,13 @@static inline int nft_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {int protohdr, thoff =0 ;unsigned short frag_off; -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); protohdr =ipv6_find_hdr (pkt->skb, &thoff,-1 , &frag_off,NULL );/* If malformed, drop it */
net/bridge/netfilter/nf_tables_bridge.c +7 -9
@@ -65,27 +65,25 @@ int nft_bridge_ip6hdr_validate(struct sk_buff *skb)EXPORT_SYMBOL_GPL (nft_bridge_ip6hdr_validate);static inline void nft_bridge_set_pktinfo_ipv4 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {if (nft_bridge_iphdr_validate (skb)) -nft_set_pktinfo_ipv4 (pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (pkt, skb, state);else -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); }static inline void nft_bridge_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {#if IS_ENABLED (CONFIG_IPV6 )if (nft_bridge_ip6hdr_validate (skb) && -nft_set_pktinfo_ipv6 (pkt, ops, skb, state) ==0 ) +nft_set_pktinfo_ipv6 (pkt, skb, state) ==0 )return ;#endif -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); } static unsigned int
@@ -97,13 +95,13 @@ nft_do_chain_bridge(const struct nf_hook_ops *ops,switch (eth_hdr (skb)->h_proto) {case htons (ETH_P_IP ): -nft_bridge_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_bridge_set_pktinfo_ipv4 (&pkt, skb, state);break ;case htons (ETH_P_IPV6 ): -nft_bridge_set_pktinfo_ipv6 (&pkt, ops, skb, state); +nft_bridge_set_pktinfo_ipv6 (&pkt, skb, state);break ;default : -nft_set_pktinfo (&pkt, ops, skb, state); +nft_set_pktinfo (&pkt, skb, state);break ; }
net/bridge/netfilter/nft_reject_bridge.c +6 -6
@@ -273,16 +273,16 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nft_reject_br_send_v4_unreach (pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook, priv->icmp_code);break ;case NFT_REJECT_TCP_RST :nft_reject_br_send_v4_tcp_reset (pkt->skb, pkt->in, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nft_reject_br_send_v4_unreach (pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook,nft_reject_icmp_code (priv->icmp_code));break ; }
@@ -291,16 +291,16 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook, priv->icmp_code);break ;case NFT_REJECT_TCP_RST :nft_reject_br_send_v6_tcp_reset (net, pkt->skb, pkt->in, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook,nft_reject_icmpv6_code (priv->icmp_code));break ; }
net/ipv4/netfilter/nf_tables_arp.c +1 -1
@@ -21,7 +21,7 @@ nft_do_chain_arp(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo (&pkt, ops, skb, state); +nft_set_pktinfo (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv4/netfilter/nf_tables_ipv4.c +1 -1
@@ -24,7 +24,7 @@ static unsigned int nft_do_chain_ipv4(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv4/netfilter/nft_chain_nat_ipv4.c +1 -1
@@ -33,7 +33,7 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv4/netfilter/nft_chain_route_ipv4.c +1 -1
@@ -37,7 +37,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops, ip_hdrlen(skb) < sizeof(struct iphdr))return NF_ACCEPT ; -nft_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (&pkt, skb, state); mark = skb->mark; iph =ip_hdr (skb);
net/ipv4/netfilter/nft_masq_ipv4.c +1 -1
@@ -26,7 +26,7 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,memset (&range,0 ,sizeof (range)); range.flags = priv->flags; - regs->verdict.code =nf_nat_masquerade_ipv4 (pkt->skb, pkt->ops->hooknum, + regs->verdict.code =nf_nat_masquerade_ipv4 (pkt->skb, pkt->hook, &range, pkt->out); }
net/ipv4/netfilter/nft_redir_ipv4.c +1 -1
@@ -36,7 +36,7 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr, mr.range[0 ].flags |= priv->flags; regs->verdict.code =nf_nat_redirect_ipv4 (pkt->skb, &mr, - pkt->ops->hooknum); + pkt->hook); }static struct nft_expr_type nft_redir_ipv4_type;
net/ipv4/netfilter/nft_reject_ipv4.c +2 -3
@@ -27,11 +27,10 @@ static void nft_reject_ipv4_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach (pkt->skb, priv->icmp_code, - pkt->ops->hooknum); +nf_send_unreach (pkt->skb, priv->icmp_code, pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset (pkt->skb, pkt->ops->hooknum); +nf_send_reset (pkt->skb, pkt->hook);break ;default :break ;
net/ipv6/netfilter/nf_tables_ipv6.c +1 -1
@@ -23,7 +23,7 @@ static unsigned int nft_do_chain_ipv6(const struct nf_hook_ops *ops,struct nft_pktinfo pkt;/* malformed packet, drop it */ -if (nft_set_pktinfo_ipv6 (&pkt, ops, skb, state) <0 ) +if (nft_set_pktinfo_ipv6 (&pkt, skb, state) <0 )return NF_DROP ;return nft_do_chain (&pkt, ops);
net/ipv6/netfilter/nft_chain_nat_ipv6.c +1 -1
@@ -31,7 +31,7 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo_ipv6 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv6 (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv6/netfilter/nft_chain_route_ipv6.c +1 -1
@@ -33,7 +33,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,u32 mark, flowlabel;/* malformed packet, drop it */ -if (nft_set_pktinfo_ipv6 (&pkt, ops, skb, state) <0 ) +if (nft_set_pktinfo_ipv6 (&pkt, skb, state) <0 )return NF_DROP ;/* save source/dest address, mark, hoplimit, flowlabel, priority */
net/ipv6/netfilter/nft_redir_ipv6.c +1 -2
@@ -35,8 +35,7 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr, range.flags |= priv->flags; - regs->verdict.code =nf_nat_redirect_ipv6 (pkt->skb, &range, - pkt->ops->hooknum); + regs->verdict.code =nf_nat_redirect_ipv6 (pkt->skb, &range, pkt->hook); }static struct nft_expr_type nft_redir_ipv6_type;
net/ipv6/netfilter/nft_reject_ipv6.c +2 -3
@@ -28,11 +28,10 @@ static void nft_reject_ipv6_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach6 (net, pkt->skb, priv->icmp_code, - pkt->ops->hooknum); +nf_send_unreach6 (net, pkt->skb, priv->icmp_code, pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->ops->hooknum); +nf_send_reset6 (net, pkt->skb, pkt->hook);break ;default :break ;
net/netfilter/nf_tables_core.c +1 -1
@@ -50,7 +50,7 @@ static void __nft_trace_packet(const struct nft_pktinfo *pkt, {struct net *net =dev_net (pkt->in ? pkt->in : pkt->out); -nf_log_trace (net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in, +nf_log_trace (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &trace_loginfo,"TRACE: %s:%s:%s:%u " , chain->table->name, chain->name, comments[type], rulenum);
net/netfilter/nf_tables_netdev.c +7 -9
@@ -16,13 +16,13 @@static inline void nft_netdev_set_pktinfo_ipv4 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb, +struct sk_buff *skb,const struct nf_hook_state *state) {struct iphdr *iph, _iph;u32 len, thoff; -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); iph =skb_header_pointer (skb,skb_network_offset (skb),sizeof (*iph), &_iph);
@@ -47,7 +47,6 @@ nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,static inline void __nft_netdev_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -81,12 +80,11 @@ __nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt, }static inline void nft_netdev_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { -nft_set_pktinfo (pkt, ops, skb, state); -__nft_netdev_set_pktinfo_ipv6 (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); +__nft_netdev_set_pktinfo_ipv6 (pkt, skb, state); } static unsigned int
@@ -97,13 +95,13 @@ nft_do_chain_netdev(const struct nf_hook_ops *ops, struct sk_buff *skb,switch (eth_hdr (skb)->h_proto) {case htons (ETH_P_IP ): -nft_netdev_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_netdev_set_pktinfo_ipv4 (&pkt, skb, state);break ;case htons (ETH_P_IPV6 ): -nft_netdev_set_pktinfo_ipv6 (&pkt, ops, skb, state); +nft_netdev_set_pktinfo_ipv6 (&pkt, skb, state);break ;default : -nft_set_pktinfo (&pkt, ops, skb, state); +nft_set_pktinfo (&pkt, skb, state);break ; }
net/netfilter/nft_log.c +1 -1
@@ -33,7 +33,7 @@ static void nft_log_eval(const struct nft_expr *expr,const struct nft_log *priv =nft_expr_priv (expr);struct net *net =dev_net (pkt->in ? pkt->in : pkt->out); -nf_log_packet (net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in, +nf_log_packet (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &priv->loginfo,"%s" , priv->prefix); }
net/netfilter/nft_meta.c +2 -2
@@ -42,7 +42,7 @@ void nft_meta_get_eval(const struct nft_expr *expr, *(__be16 *)dest = skb->protocol;break ;case NFT_META_NFPROTO : - *dest = pkt->ops->pf; + *dest = pkt->pf;break ;case NFT_META_L4PROTO : *dest = pkt->tprot;
@@ -135,7 +135,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,break ; } -switch (pkt->ops->pf) { +switch (pkt->pf) {case NFPROTO_IPV4 :if (ipv4_is_multicast (ip_hdr (skb)->daddr)) *dest =PACKET_MULTICAST ;
net/netfilter/nft_queue.c +1 -1
@@ -42,7 +42,7 @@ static void nft_queue_eval(const struct nft_expr *expr, queue = priv->queuenum + cpu % priv->queues_total; }else { queue =nfqueue_hash (pkt->skb, queue, - priv->queues_total, pkt->ops->pf, + priv->queues_total, pkt->pf, jhash_initval); } }
net/netfilter/nft_reject_inet.c +7 -7
@@ -24,20 +24,20 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,struct nft_reject *priv =nft_expr_priv (expr);struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out); -switch (pkt->ops->pf) { +switch (pkt->pf) {case NFPROTO_IPV4 :switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nf_send_unreach (pkt->skb, priv->icmp_code, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset (pkt->skb, pkt->ops->hooknum); +nf_send_reset (pkt->skb, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nf_send_unreach (pkt->skb,nft_reject_icmp_code (priv->icmp_code), - pkt->ops->hooknum); + pkt->hook);break ; }break ;
@@ -45,15 +45,15 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nf_send_unreach6 (net, pkt->skb, priv->icmp_code, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->ops->hooknum); +nf_send_reset6 (net, pkt->skb, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nf_send_unreach6 (net, pkt->skb,nft_reject_icmpv6_code (priv->icmp_code), - pkt->ops->hooknum); + pkt->hook);break ; }break ;
Signature · 1 line
2.2.1
PATCH 8/15 tc: Simplify em_ipset_match
In reply to Eric W. Biedermanem->net is always set and always available, use it in preference to dev_net(skb->dev).
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/sched/em_ipset.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/em_ipset.c +2 -2
@@ -92,8 +92,8 @@ static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,rcu_read_lock (); -if (dev && skb->skb_iif) - indev =dev_get_by_index_rcu (dev_net (dev), skb->skb_iif); +if (skb->skb_iif) + indev =dev_get_by_index_rcu (em->net, skb->skb_iif); acpar.in = indev ? indev : dev; acpar.out = dev;
Signature · 1 line
2.2.1
PATCH 9/15 x_tables: Pass struct net in xt_action_param
In reply to Eric W. BiedermanAs xt_action_param lives on the stack this does not bloat any persistent data structures.
This is a first step in making netfilter code that needs to know which network namespace it is executing in simpler.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter/x_tables.h | 2 ++ include/net/netfilter/nf_tables.h | 1 + net/bridge/netfilter/ebtables.c | 1 + net/ipv4/netfilter/arp_tables.c | 1 + net/ipv4/netfilter/ip_tables.c | 1 + net/ipv6/netfilter/ip6_tables.c | 1 + net/sched/act_ipt.c | 1 + net/sched/em_ipset.c | 1 + 8 files changed, 9 insertions(+)
include/linux/netfilter/x_tables.h +2 -0
@@ -12,6 +12,7 @@* @target: the target extension * @matchinfo: per-match data * @targetinfo: per-target data +* @net network namespace of through which the action was invoked * @in: input netdevice * @out: output netdevice * @fragoff: packet is a fragment, this is the data offset
@@ -33,6 +34,7 @@ struct xt_action_param {union {const void *matchinfo, *targinfo; }; +struct net *net;const struct net_device *in, *out;int fragoff;unsigned int thoff;
include/net/netfilter/nf_tables.h +1 -0
@@ -30,6 +30,7 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, const struct nf_hook_state *state) { pkt->skb = skb; + pkt->xt.net = state->net; pkt->in = pkt->xt.in = state->in; pkt->out = pkt->xt.out = state->out; pkt->hook = pkt->xt.hooknum = state->hook;
net/bridge/netfilter/ebtables.c +1 -0
@@ -200,6 +200,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,struct xt_action_param acpar; acpar.family =NFPROTO_BRIDGE ; + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.hotdrop = false;
net/ipv4/netfilter/arp_tables.c +1 -0
@@ -280,6 +280,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, e =get_entry (table_base, private->hook_entry[hook]); back =get_entry (table_base, private->underflow[hook]); + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.hooknum = hook;
net/ipv4/netfilter/ip_tables.c +1 -0
@@ -316,6 +316,7 @@ ipt_do_table(struct sk_buff *skb, acpar.fragoff =ntohs (ip->frag_off) &IP_OFFSET ; acpar.thoff =ip_hdrlen (skb); acpar.hotdrop = false; + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.family =NFPROTO_IPV4 ;
net/ipv6/netfilter/ip6_tables.c +1 -0
@@ -341,6 +341,7 @@ ip6t_do_table(struct sk_buff *skb,* rule is also a fragment-specific rule, non-fragments won't * match it. */ acpar.hotdrop = false; + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.family =NFPROTO_IPV6 ;
net/sched/act_ipt.c +1 -0
@@ -189,6 +189,7 @@ static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a,* worry later - danger - this API seems to have changed * from earlier kernels */ + par.net =dev_net (skb->dev); par.in = skb->dev; par.out =NULL ; par.hooknum = ipt->tcfi_hook;
net/sched/em_ipset.c +1 -0
@@ -95,6 +95,7 @@ static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,if (skb->skb_iif) indev =dev_get_by_index_rcu (em->net, skb->skb_iif); + acpar.net = em->net; acpar.in = indev ? indev : dev; acpar.out = dev;
Signature · 1 line
2.2.1
PATCH 10/15 x_tables: Use par->net instead of computing from the passed net devices
In reply to Eric W. BiedermanSigned-off-by "Eric W. Biederman" <[email protected]>
--- net/bridge/netfilter/ebt_log.c | 2 +- net/bridge/netfilter/ebt_nflog.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/ipt_rpfilter.c | 5 ++--- net/ipv6/netfilter/ip6t_REJECT.c | 2 +- net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +- net/ipv6/netfilter/ip6t_rpfilter.c | 6 +++--- net/netfilter/ipset/ip_set_core.c | 9 +++------ net/netfilter/xt_LOG.c | 2 +- net/netfilter/xt_NFLOG.c | 2 +- net/netfilter/xt_TCPMSS.c | 2 +- net/netfilter/xt_TEE.c | 24 ++++-------------------- net/netfilter/xt_TPROXY.c | 24 ++++++++++++------------ net/netfilter/xt_addrtype.c | 4 ++-- net/netfilter/xt_connlimit.c | 2 +- net/netfilter/xt_osf.c | 2 +- net/netfilter/xt_recent.c | 2 +- net/netfilter/xt_socket.c | 14 ++++++++------ 18 files changed, 45 insertions(+), 63 deletions(-)
net/bridge/netfilter/ebt_log.c +1 -1
@@ -180,7 +180,7 @@ ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct ebt_log_info *info = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_LOG ; li.u.log.level = info->loglevel;
net/bridge/netfilter/ebt_nflog.c +1 -1
@@ -24,7 +24,7 @@ ebt_nflog_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct ebt_nflog_info *info = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_ULOG ; li.u.ulog.copy_len = info->len;
net/ipv4/netfilter/ipt_SYNPROXY.c +1 -1
@@ -257,7 +257,7 @@ static unsigned int synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_synproxy_info *info = par->targinfo; -struct synproxy_net *snet =synproxy_pernet (dev_net (par->in)); +struct synproxy_net *snet =synproxy_pernet (par->net);struct synproxy_options opts = {};struct tcphdr *th, _th;
net/ipv4/netfilter/ipt_rpfilter.c +2 -3
@@ -32,12 +32,11 @@ static __be32 rpfilter_get_saddr(__be32 addr)return addr; } -static bool rpfilter_lookup_reverse (struct flowi4 *fl4, +static bool rpfilter_lookup_reverse (struct net *net,struct flowi4 *fl4,const struct net_device *dev,u8 flags) {struct fib_result res;bool dev_match; -struct net *net =dev_net (dev);int ret__maybe_unused ;if (fib_lookup (net, fl4, &res))
@@ -98,7 +97,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) flow.flowi4_tos =RT_TOS (iph->tos); flow.flowi4_scope =RT_SCOPE_UNIVERSE ; -return rpfilter_lookup_reverse (&flow, par->in, info->flags) ^ invert; +return rpfilter_lookup_reverse (par->net, &flow, par->in, info->flags) ^ invert; }static int rpfilter_check (const struct xt_mtchk_param *par)
net/ipv6/netfilter/ip6t_REJECT.c +1 -1
@@ -40,7 +40,7 @@ static unsigned int reject_tg6(struct sk_buff *skb, const struct xt_action_param *par) { const struct ip6t_reject_info *reject = par->targinfo; -struct net *net =dev_net ((par->in !=NULL ) ? par->in : par->out); +struct net *net = par->net;pr_debug ("%s: medium point\n" , __func__);switch (reject->with) {
net/ipv6/netfilter/ip6t_SYNPROXY.c +1 -1
@@ -272,7 +272,7 @@ static unsigned int synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_synproxy_info *info = par->targinfo; -struct synproxy_net *snet =synproxy_pernet (dev_net (par->in)); +struct synproxy_net *snet =synproxy_pernet (par->net);struct synproxy_options opts = {};struct tcphdr *th, _th;
net/ipv6/netfilter/ip6t_rpfilter.c +3 -3
@@ -26,7 +26,7 @@ static bool rpfilter_addr_unicast(const struct in6_addr *addr)return addr_type &IPV6_ADDR_UNICAST ; } -static bool rpfilter_lookup_reverse6 (const struct sk_buff *skb, +static bool rpfilter_lookup_reverse6 (struct net *net,const struct sk_buff *skb,const struct net_device *dev,u8 flags) {struct rt6_info *rt;
@@ -53,7 +53,7 @@ static bool rpfilter_lookup_reverse6(const struct sk_buff *skb, lookup_flags |=RT6_LOOKUP_F_IFACE ; } - rt = (void *)ip6_route_lookup (dev_net (dev), &fl6, lookup_flags); + rt = (void *)ip6_route_lookup (net, &fl6, lookup_flags);if (rt->dst.error) goto out;
@@ -93,7 +93,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)if (unlikely (saddrtype ==IPV6_ADDR_ANY ))return true ^ invert;/* not routable: forward path will drop it */ -return rpfilter_lookup_reverse6 (skb, par->in, info->flags) ^ invert; +return rpfilter_lookup_reverse6 (par->net, skb, par->in, info->flags) ^ invert; }static int rpfilter_check (const struct xt_mtchk_param *par)
net/netfilter/ipset/ip_set_core.c +3 -6
@@ -510,8 +510,7 @@ int ip_set_test(ip_set_id_t index, const struct sk_buff *skb, const struct xt_action_param *par, struct ip_set_adt_opt *opt) { - struct ip_set *set = ip_set_rcu_get( -dev_net (par->in ? par->in : par->out), index); + struct ip_set *set = ip_set_rcu_get(par->net, index);int ret =0 ;BUG_ON (set ==NULL );
@@ -549,8 +548,7 @@ int ip_set_add(ip_set_id_t index, const struct sk_buff *skb, const struct xt_action_param *par, struct ip_set_adt_opt *opt) { - struct ip_set *set = ip_set_rcu_get( -dev_net (par->in ? par->in : par->out), index); + struct ip_set *set = ip_set_rcu_get(par->net, index);int ret;BUG_ON (set ==NULL );
@@ -572,8 +570,7 @@ int ip_set_del(ip_set_id_t index, const struct sk_buff *skb, const struct xt_action_param *par, struct ip_set_adt_opt *opt) { - struct ip_set *set = ip_set_rcu_get( -dev_net (par->in ? par->in : par->out), index); + struct ip_set *set = ip_set_rcu_get(par->net, index);int ret =0 ;BUG_ON (set ==NULL );
net/netfilter/xt_LOG.c +1 -1
@@ -33,7 +33,7 @@ log_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_log_info *loginfo = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_LOG ; li.u.log.level = loginfo->level;
net/netfilter/xt_NFLOG.c +1 -1
@@ -26,7 +26,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_nflog_info *info = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_ULOG ; li.u.ulog.copy_len = info->len;
net/netfilter/xt_TCPMSS.c +1 -1
@@ -108,7 +108,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,return -1 ;if (info->mss ==XT_TCPMSS_CLAMP_PMTU ) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;unsigned int in_mtu =tcpmss_reverse_mtu (net, skb, family);if (dst_mtu (skb_dst (skb)) <= minlen) {
net/netfilter/xt_TEE.c +4 -20
@@ -39,25 +39,10 @@ struct xt_tee_priv {static const union nf_inet_addr tee_zero_address; static DEFINE_PER_CPU(bool, tee_active); -static struct net *pick_net (struct sk_buff *skb) -{ -#ifdef CONFIG_NET_NS -const struct dst_entry *dst; - -if (skb->dev !=NULL ) -return dev_net (skb->dev); - dst =skb_dst (skb); -if (dst !=NULL && dst->dev !=NULL ) -return dev_net (dst->dev); -#endif -return &init_net; -} -static bool -tee_tg_route4 (struct sk_buff *skb,const struct xt_tee_tginfo *info) +tee_tg_route4 (struct net *net,struct sk_buff *skb,const struct xt_tee_tginfo *info) {const struct iphdr *iph =ip_hdr (skb); -struct net *net =pick_net (skb);struct rtable *rt;struct flowi4 fl4;
@@ -124,7 +109,7 @@ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) --iph->ttl;ip_send_check (iph); -if (tee_tg_route4 (skb, info)) { +if (tee_tg_route4 (par->net, skb, info)) {__this_cpu_write (tee_active, true);ip_local_out (skb);__this_cpu_write (tee_active, false);
@@ -136,10 +121,9 @@ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)#if IS_ENABLED (CONFIG_IPV6 )static bool -tee_tg_route6 (struct sk_buff *skb,const struct xt_tee_tginfo *info) +tee_tg_route6 (struct net *net,struct sk_buff *skb,const struct xt_tee_tginfo *info) {const struct ipv6hdr *iph =ipv6_hdr (skb); -struct net *net =pick_net (skb);struct dst_entry *dst;struct flowi6 fl6;
@@ -187,7 +171,7 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)struct ipv6hdr *iph =ipv6_hdr (skb); --iph->hop_limit; } -if (tee_tg_route6 (skb, info)) { +if (tee_tg_route6 (par->net, skb, info)) {__this_cpu_write (tee_active, true);ip6_local_out (skb);__this_cpu_write (tee_active, false);
net/netfilter/xt_TPROXY.c +12 -12
@@ -250,8 +250,8 @@ nf_tproxy_get_sock_v6(struct net *net, const u8 protocol,* no such listener is found, or NULL if the TCP header is incomplete. */ static struct sock * -tproxy_handle_time_wait4 (struct sk_buff *skb,__be32 laddr,__be16 lport, -struct sock *sk) +tproxy_handle_time_wait4 (struct net *net,struct sk_buff *skb, +__be32 laddr,__be16 lport,struct sock *sk) {const struct iphdr *iph =ip_hdr (skb);struct tcphdr _hdr, *hp;
@@ -267,7 +267,7 @@ tproxy_handle_time_wait4(struct sk_buff *skb, __be32 laddr, __be16 lport,* to a listener socket if there's one */ struct sock *sk2; - sk2 =nf_tproxy_get_sock_v4 (dev_net (skb->dev), iph->protocol, + sk2 =nf_tproxy_get_sock_v4 (net, iph->protocol, iph->saddr, laddr ? laddr : iph->daddr, hp->source, lport ? lport : hp->dest, skb->dev,NFT_LOOKUP_LISTENER );
@@ -291,7 +291,7 @@ nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk) }static unsigned int -tproxy_tg4 (struct sk_buff *skb,__be32 laddr,__be16 lport, +tproxy_tg4 (struct net *net,struct sk_buff *skb,__be32 laddr,__be16 lport,u_int32_t mark_mask,u_int32_t mark_value) {const struct iphdr *iph =ip_hdr (skb);
@@ -306,7 +306,7 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,* addresses, this happens if the redirect already happened * and the current packet belongs to an already established * connection */ - sk =nf_tproxy_get_sock_v4 (dev_net (skb->dev), iph->protocol, + sk =nf_tproxy_get_sock_v4 (net, iph->protocol, iph->saddr, iph->daddr, hp->source, hp->dest, skb->dev,NFT_LOOKUP_ESTABLISHED );
@@ -318,11 +318,11 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,/* UDP has no TCP_TIME_WAIT state, so we never enter here */ if (sk && sk->sk_state ==TCP_TIME_WAIT )/* reopening a TIME_WAIT connection needs special handling */ - sk =tproxy_handle_time_wait4 (skb, laddr, lport, sk); + sk =tproxy_handle_time_wait4 (net, skb, laddr, lport, sk);else if (!sk)/* no, there's no established connection, check if * there's a listener on the redirected addr/port */ - sk =nf_tproxy_get_sock_v4 (dev_net (skb->dev), iph->protocol, + sk =nf_tproxy_get_sock_v4 (net, iph->protocol, iph->saddr, laddr, hp->source, lport, skb->dev,NFT_LOOKUP_LISTENER );
@@ -352,7 +352,7 @@ tproxy_tg4_v0(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_tproxy_target_info *tgi = par->targinfo; -return tproxy_tg4 (skb, tgi->laddr, tgi->lport, tgi->mark_mask, tgi->mark_value); +return tproxy_tg4 (par->net, skb, tgi->laddr, tgi->lport, tgi->mark_mask, tgi->mark_value); } static unsigned int
@@ -360,7 +360,7 @@ tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_tproxy_target_info_v1 *tgi = par->targinfo; -return tproxy_tg4 (skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value); +return tproxy_tg4 (par->net, skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value); }#ifdef XT_TPROXY_HAVE_IPV6
@@ -430,7 +430,7 @@ tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,* to a listener socket if there's one */ struct sock *sk2; - sk2 = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, + sk2 = nf_tproxy_get_sock_v6(par->net, tproto, &iph->saddr, tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr), hp->source,
@@ -474,7 +474,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)* addresses, this happens if the redirect already happened * and the current packet belongs to an already established * connection */ - sk =nf_tproxy_get_sock_v6 (dev_net (skb->dev), tproto, + sk =nf_tproxy_get_sock_v6 (par->net, tproto, &iph->saddr, &iph->daddr, hp->source, hp->dest, par->in,NFT_LOOKUP_ESTABLISHED );
@@ -489,7 +489,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)else if (!sk)/* no there's no established connection, check if * there's a listener on the redirected addr/port */ - sk =nf_tproxy_get_sock_v6 (dev_net (skb->dev), tproto, + sk =nf_tproxy_get_sock_v6 (par->net, tproto, &iph->saddr, laddr, hp->source, lport, par->in,NFT_LOOKUP_LISTENER );
net/netfilter/xt_addrtype.c +2 -2
@@ -125,7 +125,7 @@ static inline bool match_type(struct net *net, const struct net_device *dev,static bool addrtype_mt_v0 (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;const struct xt_addrtype_info *info = par->matchinfo;const struct iphdr *iph =ip_hdr (skb);bool ret = true;
@@ -143,7 +143,7 @@ addrtype_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)static bool addrtype_mt_v1 (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;const struct xt_addrtype_info_v1 *info = par->matchinfo;const struct iphdr *iph;const struct net_device *dev =NULL ;
net/netfilter/xt_connlimit.c +1 -1
@@ -316,7 +316,7 @@ static int count_them(struct net *net,static bool connlimit_mt (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;const struct xt_connlimit_info *info = par->matchinfo;union nf_inet_addr addr;struct nf_conntrack_tuple tuple;
net/netfilter/xt_osf.c +1 -1
@@ -200,7 +200,7 @@ xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)unsigned char opts[MAX_IPOPTLEN ];const struct xt_osf_finger *kf;const struct xt_osf_user_finger *f; -struct net *net =dev_net (p->in ? p->in : p->out); +struct net *net = p->net;if (!info)return false;
net/netfilter/xt_recent.c +1 -1
@@ -237,7 +237,7 @@ static void recent_table_flush(struct recent_table *t)static bool recent_mt (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;struct recent_net *recent_net =recent_pernet (net);const struct xt_recent_mtinfo_v1 *info = par->matchinfo;struct recent_table *t;
net/netfilter/xt_socket.c +8 -6
@@ -143,7 +143,8 @@ static bool xt_socket_sk_is_transparent(struct sock *sk) } } -static struct sock *xt_socket_lookup_slow_v4 (const struct sk_buff *skb, +static struct sock *xt_socket_lookup_slow_v4 (struct net *net, +const struct sk_buff *skb,const struct net_device *indev) {const struct iphdr *iph =ip_hdr (skb);
@@ -197,7 +198,7 @@ static struct sock *xt_socket_lookup_slow_v4(const struct sk_buff *skb, }#endif -return xt_socket_get_sock_v4 (dev_net (skb->dev), protocol, saddr, daddr, +return xt_socket_get_sock_v4 (net, protocol, saddr, daddr, sport, dport, indev); }
@@ -208,7 +209,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,struct sock *sk = skb->sk;if (!sk) - sk =xt_socket_lookup_slow_v4 (skb, par->in); + sk =xt_socket_lookup_slow_v4 (par->net, skb, par->in);if (sk) {bool wildcard;bool transparent = true;
@@ -330,7 +331,8 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,return NULL ; } -static struct sock *xt_socket_lookup_slow_v6 (const struct sk_buff *skb, +static struct sock *xt_socket_lookup_slow_v6 (struct net *net, +const struct sk_buff *skb,const struct net_device *indev) {__be16 uninitialized_var (dport ),uninitialized_var (sport );
@@ -366,7 +368,7 @@ static struct sock *xt_socket_lookup_slow_v6(const struct sk_buff *skb,return NULL ; } -return xt_socket_get_sock_v6 (dev_net (skb->dev), tproto, saddr, daddr, +return xt_socket_get_sock_v6 (net, tproto, saddr, daddr, sport, dport, indev); }
@@ -377,7 +379,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)struct sock *sk = skb->sk;if (!sk) - sk =xt_socket_lookup_slow_v6 (skb, par->in); + sk =xt_socket_lookup_slow_v6 (par->net, skb, par->in);if (sk) {bool wildcard;bool transparent = true;
Signature · 1 line
2.2.1
PATCH 11/15 nftables: Pass struct net in nft_pktinfo
In reply to Eric W. Biedermannft_pktinfo is passed on the stack so this does not bloat any in core data structures.
By centrally computing this information this makes maintence of the code simpler, and understading of the code easier.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/nf_tables.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/net/netfilter/nf_tables.h +2 -1
@@ -14,6 +14,7 @@struct nft_pktinfo {struct sk_buff *skb; +struct net *net;const struct net_device *in;const struct net_device *out;u8 pf;
@@ -30,7 +31,7 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, const struct nf_hook_state *state) { pkt->skb = skb; - pkt->xt.net = state->net; + pkt->net = pkt->xt.net = state->net; pkt->in = pkt->xt.in = state->in; pkt->out = pkt->xt.out = state->out; pkt->hook = pkt->xt.hooknum = state->hook;
Signature · 1 line
2.2.1
PATCH 12/15 nf_tables: Use pkt->net instead of computing net from the passed net_devices
In reply to Eric W. BiedermanSigned-off-by "Eric W. Biederman" <[email protected]>
--- net/bridge/netfilter/nft_reject_bridge.c | 13 ++++++------- net/ipv6/netfilter/nft_reject_ipv6.c | 6 +++--- net/netfilter/nf_tables_core.c | 4 +--- net/netfilter/nft_log.c | 3 +-- net/netfilter/nft_reject_inet.c | 7 +++---- 5 files changed, 14 insertions(+), 19 deletions(-)
net/bridge/netfilter/nft_reject_bridge.c +6 -7
@@ -261,7 +261,6 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {struct nft_reject *priv =nft_expr_priv (expr); -struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out);const unsigned char *dest =eth_hdr (pkt->skb)->h_dest; if (is_broadcast_ether_addr(dest) ||
@@ -290,17 +289,17 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,case htons (ETH_P_IPV6 ):switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->hook, +nft_reject_br_send_v6_unreach (pkt->net, pkt->skb, + pkt->in, pkt->hook, priv->icmp_code);break ;case NFT_REJECT_TCP_RST : -nft_reject_br_send_v6_tcp_reset (net, pkt->skb, pkt->in, - pkt->hook); +nft_reject_br_send_v6_tcp_reset (pkt->net, pkt->skb, + pkt->in, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH : -nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->hook, +nft_reject_br_send_v6_unreach (pkt->net, pkt->skb, + pkt->in, pkt->hook,nft_reject_icmpv6_code (priv->icmp_code));break ; }
net/ipv6/netfilter/nft_reject_ipv6.c +3 -3
@@ -24,14 +24,14 @@ static void nft_reject_ipv6_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {struct nft_reject *priv =nft_expr_priv (expr); -struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out);switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach6 (net, pkt->skb, priv->icmp_code, pkt->hook); +nf_send_unreach6 (pkt->net, pkt->skb, priv->icmp_code, + pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->hook); +nf_send_reset6 (pkt->net, pkt->skb, pkt->hook);break ;default :break ;
net/netfilter/nf_tables_core.c +1 -3
@@ -48,9 +48,7 @@ static void __nft_trace_packet(const struct nft_pktinfo *pkt, const struct nft_chain *chain, int rulenum, enum nft_trace type) { - struct net *net = dev_net(pkt->in ? pkt->in : pkt->out); - -nf_log_trace (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, + nf_log_trace(pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ", chain->table->name, chain->name, comments[type], rulenum);
net/netfilter/nft_log.c +1 -2
@@ -31,9 +31,8 @@ static void nft_log_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {const struct nft_log *priv =nft_expr_priv (expr); -struct net *net =dev_net (pkt->in ? pkt->in : pkt->out); -nf_log_packet (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, +nf_log_packet (pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &priv->loginfo,"%s" , priv->prefix); }
net/netfilter/nft_reject_inet.c +3 -4
@@ -22,7 +22,6 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {struct nft_reject *priv =nft_expr_priv (expr); -struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out);switch (pkt->pf) {case NFPROTO_IPV4 :
@@ -44,14 +43,14 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,case NFPROTO_IPV6 :switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach6 (net, pkt->skb, priv->icmp_code, +nf_send_unreach6 (pkt->net, pkt->skb, priv->icmp_code, pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->hook); +nf_send_reset6 (pkt->net, pkt->skb, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH : -nf_send_unreach6 (net, pkt->skb, +nf_send_unreach6 (pkt->net, pkt->skb,nft_reject_icmpv6_code (priv->icmp_code), pkt->hook);break ;
Signature · 1 line
2.2.1
PATCH 13/15 nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple
In reply to Eric W. BiedermanAs gre does not have the srckey in the packet gre_pkt_to_tuple needs to perform a lookup in it's per network namespace tables.
Pass in the proper network namespace to all pkt_to_tuple implementations to ensure gre (and any similar protocols) can get this right.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/nf_conntrack.h | 3 ++- include/net/netfilter/nf_conntrack_core.h | 1 + include/net/netfilter/nf_conntrack_l4proto.h | 2 +- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 4 ++-- net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 3 ++- net/netfilter/nf_conntrack_core.c | 10 ++++++---- net/netfilter/nf_conntrack_proto_dccp.c | 2 +- net/netfilter/nf_conntrack_proto_generic.c | 2 +- net/netfilter/nf_conntrack_proto_gre.c | 3 +-- net/netfilter/nf_conntrack_proto_sctp.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_proto_udp.c | 1 + net/netfilter/nf_conntrack_proto_udplite.c | 1 + net/netfilter/xt_connlimit.c | 2 +- net/sched/act_connmark.c | 2 +- 15 files changed, 23 insertions(+), 17 deletions(-)
include/net/netfilter/nf_conntrack.h +2 -1
@@ -191,7 +191,8 @@ int nf_conntrack_hash_check_insert(struct nf_conn *ct);bool nf_ct_delete (struct nf_conn *ct,u32 pid,int report);bool nf_ct_get_tuplepr (const struct sk_buff *skb,unsigned int nhoff, -u_int16_t l3num,struct nf_conntrack_tuple *tuple); +u_int16_t l3num,struct net *net, +struct nf_conntrack_tuple *tuple);bool nf_ct_invert_tuplepr (struct nf_conntrack_tuple *inverse,const struct nf_conntrack_tuple *orig);
include/net/netfilter/nf_conntrack_core.h +1 -0
@@ -41,6 +41,7 @@ void nf_conntrack_cleanup_end(void);bool nf_ct_get_tuple (const struct sk_buff *skb,unsigned int nhoff,unsigned int dataoff,u_int16_t l3num,u_int8_t protonum, +struct net *net,struct nf_conntrack_tuple *tuple,const struct nf_conntrack_l3proto *l3proto,const struct nf_conntrack_l4proto *l4proto);
include/net/netfilter/nf_conntrack_l4proto.h +1 -1
@@ -26,7 +26,7 @@ struct nf_conntrack_l4proto {/* Try to fill in the third arg: dataoff is offset past network protocol hdr. Return true if possible. */ bool (*pkt_to_tuple)(const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple); +struct net *net,struct nf_conntrack_tuple *tuple);/* Invert the per-proto part of the tuple: ie. turn xmit into reply. * Some packets can't be inverted: return 0 in that case.
net/ipv4/netfilter/nf_conntrack_proto_icmp.c +2 -2
@@ -30,7 +30,7 @@ static inline struct nf_icmp_net *icmp_pernet(struct net *net) }static bool icmp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {const struct icmphdr *hp;struct icmphdr _hdr;
@@ -142,7 +142,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,if (!nf_ct_get_tuplepr (skb,skb_network_offset (skb) +ip_hdrlen (skb) +sizeof (struct icmphdr ), -PF_INET , &origtuple)) { +PF_INET , net, &origtuple)) {pr_debug ("icmp_error_message: failed to get tuple\n" );return -NF_ACCEPT ; }
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +2 -1
@@ -36,6 +36,7 @@ static inline struct nf_icmp_net *icmpv6_pernet(struct net *net)static bool icmpv6_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct net *net,struct nf_conntrack_tuple *tuple) {const struct icmp6hdr *hp;
@@ -159,7 +160,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl, skb_network_offset(skb) + sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr), - PF_INET6, &origtuple)) { + PF_INET6, net, &origtuple)) {pr_debug ("icmpv6_error: Can't get tuple\n" );return -NF_ACCEPT ; }
net/netfilter/nf_conntrack_core.c +6 -4
@@ -168,6 +168,7 @@ nf_ct_get_tuple(const struct sk_buff *skb,unsigned int dataoff, u_int16_t l3num, u_int8_t protonum, + struct net *net, struct nf_conntrack_tuple *tuple, const struct nf_conntrack_l3proto *l3proto, const struct nf_conntrack_l4proto *l4proto)
@@ -181,12 +182,13 @@ nf_ct_get_tuple(const struct sk_buff *skb, tuple->dst.protonum = protonum; tuple->dst.dir =IP_CT_DIR_ORIGINAL ; -return l4proto->pkt_to_tuple (skb, dataoff, tuple); +return l4proto->pkt_to_tuple (skb, dataoff, net, tuple); }EXPORT_SYMBOL_GPL (nf_ct_get_tuple);bool nf_ct_get_tuplepr (const struct sk_buff *skb,unsigned int nhoff, -u_int16_t l3num,struct nf_conntrack_tuple *tuple) +u_int16_t l3num, +struct net *net,struct nf_conntrack_tuple *tuple) {struct nf_conntrack_l3proto *l3proto;struct nf_conntrack_l4proto *l4proto;
@@ -205,7 +207,7 @@ bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff, l4proto =__nf_ct_l4proto_find (l3num, protonum); - ret =nf_ct_get_tuple (skb, nhoff, protoff, l3num, protonum, tuple, + ret =nf_ct_get_tuple (skb, nhoff, protoff, l3num, protonum, net, tuple, l3proto, l4proto);rcu_read_unlock ();
@@ -1011,7 +1013,7 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,u32 hash;if (!nf_ct_get_tuple (skb,skb_network_offset (skb), - dataoff, l3num, protonum, &tuple, l3proto, + dataoff, l3num, protonum, net, &tuple, l3proto, l4proto)) {pr_debug ("resolve_normal_ct: Can't get tuple\n" );return NULL ;
net/netfilter/nf_conntrack_proto_dccp.c +1 -1
@@ -398,7 +398,7 @@ static inline struct dccp_net *dccp_pernet(struct net *net) }static bool dccp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {struct dccp_hdr _hdr, *dh;
net/netfilter/nf_conntrack_proto_generic.c +1 -1
@@ -45,7 +45,7 @@ static inline struct nf_generic_net *generic_pernet(struct net *net)static bool generic_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) { tuple->src.u.all =0 ; tuple->dst.u.all =0 ;
net/netfilter/nf_conntrack_proto_gre.c +1 -2
@@ -190,9 +190,8 @@ static bool gre_invert_tuple(struct nf_conntrack_tuple *tuple,/* gre hdr info to tuple */ static bool gre_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) { -struct net *net =dev_net (skb->dev ? skb->dev :skb_dst (skb)->dev);const struct gre_hdr_pptp *pgrehdr;struct gre_hdr_pptp _pgrehdr;__be16 srckey;
net/netfilter/nf_conntrack_proto_sctp.c +1 -1
@@ -142,7 +142,7 @@ static inline struct sctp_net *sctp_pernet(struct net *net) }static bool sctp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {const struct sctphdr *hp;struct sctphdr _hdr;
net/netfilter/nf_conntrack_proto_tcp.c +1 -1
@@ -277,7 +277,7 @@ static inline struct nf_tcp_net *tcp_pernet(struct net *net) }static bool tcp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {const struct tcphdr *hp;struct tcphdr _hdr;
net/netfilter/nf_conntrack_proto_udp.c +1 -0
@@ -38,6 +38,7 @@ static inline struct nf_udp_net *udp_pernet(struct net *net)static bool udp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct net *net,struct nf_conntrack_tuple *tuple) {const struct udphdr *hp;
net/netfilter/nf_conntrack_proto_udplite.c +1 -0
@@ -48,6 +48,7 @@ static inline struct udplite_net *udplite_pernet(struct net *net)static bool udplite_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct net *net,struct nf_conntrack_tuple *tuple) {const struct udphdr *hp;
net/netfilter/xt_connlimit.c +1 -1
@@ -331,7 +331,7 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple; zone =nf_ct_zone (ct); }else if (!nf_ct_get_tuplepr (skb,skb_network_offset (skb), - par->family, &tuple)) { + par->family, net, &tuple)) { goto hotdrop; }
net/sched/act_connmark.c +1 -1
@@ -67,7 +67,7 @@ static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a, }if (!nf_ct_get_tuplepr (skb,skb_network_offset (skb), - proto, &tuple)) + proto, ca->net, &tuple)) goto out; thash =nf_conntrack_find_get (dev_net (skb->dev), ca->zone, &tuple);
Signature · 1 line
2.2.1
PATCH 14/15 ipv4: Pass struct net into ip_defrag and ip_check_defrag
In reply to Eric W. BiedermanDon't make ip_defrag guess which network namespace it needs to defragment packets in.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- drivers/net/macvlan.c | 2 +- include/net/ip.h | 6 +++--- net/ipv4/ip_fragment.c | 8 +++----- net/ipv4/ip_input.c | 8 +++++--- net/ipv4/netfilter/nf_defrag_ipv4.c | 7 ++++--- net/netfilter/ipvs/ip_vs_core.c | 2 +- net/packet/af_packet.c | 6 +++--- 7 files changed, 20 insertions(+), 19 deletions(-)
drivers/net/macvlan.c +1 -1
@@ -412,7 +412,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) port =macvlan_port_get_rcu (skb->dev);if (is_multicast_ether_addr (eth->h_dest)) { - skb =ip_check_defrag (skb,IP_DEFRAG_MACVLAN ); + skb =ip_check_defrag (dev_net (skb->dev), skb,IP_DEFRAG_MACVLAN );if (!skb)return RX_HANDLER_CONSUMED ; eth =eth_hdr (skb);
include/net/ip.h +3 -3
@@ -505,11 +505,11 @@ static inline bool ip_defrag_user_in_between(u32 user,return user >= lower_bond && user <= upper_bond; } -int ip_defrag (struct sk_buff *skb,u32 user); +int ip_defrag (struct net *net,struct sk_buff *skb,u32 user);#ifdef CONFIG_INET -struct sk_buff *ip_check_defrag (struct sk_buff *skb,u32 user); +struct sk_buff *ip_check_defrag (struct net *net,struct sk_buff *skb,u32 user);#else -static inline struct sk_buff *ip_check_defrag (struct sk_buff *skb,u32 user) +static inline struct sk_buff *ip_check_defrag (struct net *net,struct sk_buff *skb,u32 user) {return skb; }
net/ipv4/ip_fragment.c +3 -5
@@ -658,12 +658,10 @@ out_fail: }/* Process an incoming IP datagram fragment. */ -int ip_defrag (struct sk_buff *skb,u32 user) +int ip_defrag (struct net *net,struct sk_buff *skb,u32 user) {struct ipq *qp; -struct net *net; - net = skb->dev ?dev_net (skb->dev) :dev_net (skb_dst (skb)->dev);IP_INC_STATS_BH (net,IPSTATS_MIB_REASMREQDS );/* Lookup (or create) queue header */
@@ -686,7 +684,7 @@ int ip_defrag(struct sk_buff *skb, u32 user) }EXPORT_SYMBOL (ip_defrag); -struct sk_buff *ip_check_defrag (struct sk_buff *skb,u32 user) +struct sk_buff *ip_check_defrag (struct net *net,struct sk_buff *skb,u32 user) {struct iphdr iph;int netoff;
@@ -715,7 +713,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)if (pskb_trim_rcsum (skb, netoff + len))return skb;memset (IPCB (skb),0 ,sizeof (struct inet_skb_parm )); -if (ip_defrag (skb, user)) +if (ip_defrag (net, skb, user))return NULL ;skb_clear_hash (skb); }
net/ipv4/ip_input.c +5 -3
@@ -168,7 +168,8 @@ bool ip_call_ra_chain(struct sk_buff *skb) sk->sk_bound_dev_if == dev->ifindex) && net_eq(sock_net(sk), dev_net(dev))) {if (ip_is_fragment (ip_hdr (skb))) { -if (ip_defrag (skb,IP_DEFRAG_CALL_RA_CHAIN )) +if (ip_defrag (dev_net (skb->dev), skb, +IP_DEFRAG_CALL_RA_CHAIN ))return true; }if (last) {
@@ -247,14 +248,15 @@ int ip_local_deliver(struct sk_buff *skb)/* * Reassemble IP fragments. */ +struct net *net =dev_net (skb->dev);if (ip_is_fragment (ip_hdr (skb))) { -if (ip_defrag (skb,IP_DEFRAG_LOCAL_DELIVER )) +if (ip_defrag (net, skb,IP_DEFRAG_LOCAL_DELIVER ))return 0 ; }return NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_IN , -dev_net (skb->dev),NULL , skb, skb->dev,NULL , + net,NULL , skb, skb->dev,NULL , ip_local_deliver_finish); }
net/ipv4/netfilter/nf_defrag_ipv4.c +4 -3
@@ -22,14 +22,15 @@#endif #include <net/netfilter/nf_conntrack_zones.h> -static int nf_ct_ipv4_gather_frags (struct sk_buff *skb,u_int32_t user) +static int nf_ct_ipv4_gather_frags (struct net *net,struct sk_buff *skb, +u_int32_t user) {int err;skb_orphan (skb);local_bh_disable (); - err =ip_defrag (skb, user); + err =ip_defrag (net, skb, user);local_bh_enable ();if (!err) {
@@ -85,7 +86,7 @@ static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops,enum ip_defrag_users user =nf_ct_defrag_user (state->hook, skb); -if (nf_ct_ipv4_gather_frags (skb, user)) +if (nf_ct_ipv4_gather_frags (state->net, skb, user))return NF_STOLEN ; }return NF_ACCEPT ;
net/netfilter/ipvs/ip_vs_core.c +1 -1
@@ -657,7 +657,7 @@ static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)int err;local_bh_disable (); - err =ip_defrag (skb, user); + err =ip_defrag (skb_net (skb), skb, user);local_bh_enable ();if (!err)ip_send_check (ip_hdr (skb));
net/packet/af_packet.c +3 -3
@@ -1440,17 +1440,17 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev, {struct packet_fanout *f = pt->af_packet_priv;unsigned int num = f->num_members; +struct net *net =read_pnet (&f->net);struct packet_sock *po;unsigned int idx; -if (!net_eq (dev_net (dev),read_pnet (&f->net)) || - !num) { +if (!net_eq (dev_net (dev), net) || !num) {kfree_skb (skb);return 0 ; }if (fanout_has_flag (f,PACKET_FANOUT_FLAG_DEFRAG )) { - skb =ip_check_defrag (skb,IP_DEFRAG_AF_PACKET ); + skb =ip_check_defrag (net, skb,IP_DEFRAG_AF_PACKET );if (!skb)return 0 ; }
Signature · 1 line
2.2.1
PATCH 15/15 ipv6: Pass struct net into nf_ct_frag6_gather
In reply to Eric W. BiedermanMake it explicit which network namespace the packets are being reassembled in, don't make nf_cf_frag6_gather guess.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/ipv6/nf_defrag_ipv6.h | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 +--- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 3 ++- 3 files changed, 4 insertions(+), 5 deletions(-)
include/net/netfilter/ipv6/nf_defrag_ipv6.h +1 -1
@@ -5,7 +5,7 @@ void nf_defrag_ipv6_enable(void);int nf_ct_frag6_init (void );void nf_ct_frag6_cleanup (void ); -struct sk_buff *nf_ct_frag6_gather (struct sk_buff *skb,u32 user); +struct sk_buff *nf_ct_frag6_gather (struct net *net,struct sk_buff *skb,u32 user);void nf_ct_frag6_consume_orig (struct sk_buff *skb);struct inet_frags_ctl ;
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -3
@@ -563,12 +563,10 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)return 0 ; } -struct sk_buff *nf_ct_frag6_gather (struct sk_buff *skb,u32 user) +struct sk_buff *nf_ct_frag6_gather (struct net *net,struct sk_buff *skb,u32 user) {struct sk_buff *clone;struct net_device *dev = skb->dev; -struct net *net =skb_dst (skb) ?dev_net (skb_dst (skb)->dev) - :dev_net (skb->dev);struct frag_hdr *fhdr;struct frag_queue *fq;struct ipv6hdr *hdr;
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +2 -1
@@ -64,7 +64,8 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,return NF_ACCEPT ;#endif - reasm =nf_ct_frag6_gather (skb,nf_ct6_defrag_user (state->hook, skb)); + reasm =nf_ct_frag6_gather (state->net, skb, +nf_ct6_defrag_user (state->hook, skb));/* queued */ if (reasm ==NULL )return NF_STOLEN ;
Signature · 1 line
2.2.1
Pablo Neira Ayuso
maintainerHi Eric,
Quoted 10 lines · Eric W. Biederman
While looking into what it would take to route packets out to network devices in other network namespaces I started looking at the netfilter hooks, and there is a lot of nasty code to figure out which network namespace to filter the packets in.
Just passing the network namespace into the netfilter hooks looks like a significant simplication in the code, and worth it as the first thing most netfilter hooks do is compute the network namespace.
Quoted 6 lines
We probably even want per network namespace netfilter hooks as nftables tries (and fails to use). nftables currently has a fairly serious bug where the tables for one network namespace run for packets in all network namespaces. I do not have a fix yet but I think this patchset making it easy to get at the network namespace is a good starting place for a fix.
I have a patchset that is almost ready to convert netfilter to pernet hooks, it partially clashes with this. Will send it out today and will Cc you so you can review it.
I think it should take me little time to rebase it on top of yours. It's rather large changeset, which quite a lot of boiler plate code though.
Quoted 20 lines · Pablo Neira Ayuso
Hi Eric,
Quoted 10 lines · Eric W. Biederman
While looking into what it would take to route packets out to network devices in other network namespaces I started looking at the netfilter hooks, and there is a lot of nasty code to figure out which network namespace to filter the packets in.
Just passing the network namespace into the netfilter hooks looks like a significant simplication in the code, and worth it as the first thing most netfilter hooks do is compute the network namespace.
Quoted 6 lines
We probably even want per network namespace netfilter hooks as nftables tries (and fails to use). nftables currently has a fairly serious bug where the tables for one network namespace run for packets in all network namespaces. I do not have a fix yet but I think this patchset making it easy to get at the network namespace is a good starting place for a fix.
Quoted 7 lines
I have a patchset that is almost ready to convert netfilter to pernet hooks, it partially clashes with this. Will send it out today and will Cc you so you can review it.
I think it should take me little time to rebase it on top of yours. It's rather large changeset, which quite a lot of boiler plate code though.
Hmm.
I will wait and take a look. I think going from where I am to pernet netfilter hooks is about one simple patch, so I don't know where the large about of boiler plate comes from. I think I will code that up so I can verify that and we can compare notes later today.
Eric
Pablo Neira Ayuso
maintainerQuoted 30 lines · Eric W. Biederman
Quoted 20 lines · Pablo Neira Ayuso
Hi Eric,
Quoted 10 lines · Eric W. Biederman
While looking into what it would take to route packets out to network devices in other network namespaces I started looking at the netfilter hooks, and there is a lot of nasty code to figure out which network namespace to filter the packets in.
Just passing the network namespace into the netfilter hooks looks like a significant simplication in the code, and worth it as the first thing most netfilter hooks do is compute the network namespace.
Quoted 6 lines
We probably even want per network namespace netfilter hooks as nftables tries (and fails to use). nftables currently has a fairly serious bug where the tables for one network namespace run for packets in all network namespaces. I do not have a fix yet but I think this patchset making it easy to get at the network namespace is a good starting place for a fix.
Quoted 7 lines
I have a patchset that is almost ready to convert netfilter to pernet hooks, it partially clashes with this. Will send it out today and will Cc you so you can review it.
I think it should take me little time to rebase it on top of yours. It's rather large changeset, which quite a lot of boiler plate code though.
Quoted 5 lines
Hmm.
I will wait and take a look. I think going from where I am to pernet netfilter hooks is about one simple patch, so I don't know where the large about of boiler plate comes from.
You have to register the struct nf_hook_ops for each nf_register_hooks() caller from the pernet .init.
Quoted 2 lines
I think I will code that up so I can verify that and we can compare notes later today.
This is basically done here, I'll post this asap.
David Miller
maintainerFrom: [email protected] (Eric W. Biederman)
Date: Sun, 14 Jun 2015 22:07:30 -0500
Quoted 4 lines
While looking into what it would take to route packets out to network devices in other network namespaces I started looking at the netfilter hooks, and there is a lot of nasty code to figure out which network namespace to filter the packets in.
I am assume that you and Pablo are going to look at eachother's work and decide how to proceed and therefore I'm getting another series to actually apply at some point in the future.
Quoted 11 lines · David Miller
From: [email protected] (Eric W. Biederman)
Date: Sun, 14 Jun 2015 22:07:30 -0500Quoted 4 lines
While looking into what it would take to route packets out to network devices in other network namespaces I started looking at the netfilter hooks, and there is a lot of nasty code to figure out which network namespace to filter the packets in.
I am assume that you and Pablo are going to look at eachother's work and decide how to proceed and therefore I'm getting another series to actually apply at some point in the future.
I am busily looking, and being slightly challenged by the fact that the netfilter code is a moving target in net-next. That is not really a bad thing as some of Pablo's patches were against the patches that were merged today.
It does look like Pablo's path to getting per network namespace netfilter hooks is the best path to a good long term result, for per network namespace hooks. I am busily agumenting it with a Kconfig guard so bisection that disables network namespaces support while netfilter only works on the initial network namespace. As otherwise bisection will be a lost cause. AKA
config NET_NS
depends on !NETFILTER
At the same time it looks like Pablos patches come out cleaner when rebased on my patchset.
The number of conflicts between the two patchsets is very small and easily resolved.
So what I am in the processes of doing is reviewing and testing the combined set of patches and hopefully I will have something for you soon (tomorrow?). Unless Pablo has objections.
Right now I am attempting to verify that I have found all of the places in Pablo's patchset where the patches do not compile on their own, as there were some silly left-overs.
But overall I think Pablo's patches look good.
Eric
David Miller
maintainerFrom: [email protected] (Eric W. Biederman)
Date: Mon, 15 Jun 2015 19:26:13 -0500
Quoted 3 lines
So what I am in the processes of doing is reviewing and testing the combined set of patches and hopefully I will have something for you soon (tomorrow?). Unless Pablo has objections.
I will be travelling tomorrow so there is no rush.
Pablo Neira Ayuso
maintainerOn Mon, Jun 15, 2015 at 07:26:13PM -0500, Eric W. Biederman wrote:
[...]
Quoted 3 lines
So what I am in the processes of doing is reviewing and testing the combined set of patches and hopefully I will have something for you soon (tomorrow?). Unless Pablo has objections.
Please, feel free to take over my patchset and improve it. That has consumed part of my weekend and I have several open branches in my internal tree that I need to push forward.
So I'd be really happy if you polish them and get this done.
Let me know if I can help in any case.
Thanks a lot Eric.
Quoted 6 lines · Pablo Neira Ayuso
On Mon, Jun 15, 2015 at 07:26:13PM -0500, Eric W. Biederman wrote:
[...]Quoted 3 lines
So what I am in the processes of doing is reviewing and testing the combined set of patches and hopefully I will have something for you soon (tomorrow?). Unless Pablo has objections.
Quoted 7 lines
Please, feel free to take over my patchset and improve it. That has consumed part of my weekend and I have several open branches in my internal tree that I need to push forward.
So I'd be really happy if you polish them and get this done.
Let me know if I can help in any case.
Will do. I have found more bugs lurking in your boilter plate changes that I am comfortable with so I am in the process of refactoring things a bit more than you did so the sweeping changes are more pedantic and much less likely to introduce bugs.
Eric
cover Simplify netfilter and network namespaces (take 2)
In reply to Eric W. BiedermanWhile looking into what it would take to route packets out to network devices in other network namespaces I started looking at the netfilter hooks, and there is a lot of nasty code to figure out which network namespace to filter the packets in.
Passing the network namespace into the netfilter hooks is a significant simplication in the code, and worth it as the first thing most netfilter hooks do is compute the network namespace.
I collided with Pablos work on per network namespace netfilter hooks the first time I submitted his changes, so now this patchset includes a per network namespace nftable hooks. Inspired by Pablos work but largely rewritten to fix and avoid the bugs I was finding in Pablos work to register the netfilter hooks per network namespace.
These per network namespace netfilter hooks fix a long standing bug in nftables, where packets passing through nftables would be run against the nftables configuration of every network namespace.
I have noticed what appears to be one more bug in nftables. Today the nf_queue code takes a module reference count to prevent the netfilter hook that it stops at from being unregistered. As it is the module initialization and module cleanup code that call nf_unregister_hook[s] in everything but nftables this works. Unfortunately it appears that someone can cause a packet to be queued, delete the nftable chain that caused the queueing and then cause the packet to be reinjected. So it looks like nfqnl_rcv_dev_event is needed for netfilter hook unregistration.
The first group of changes roots out all of the very weird network namespace computation logic (except for the code in ipvs) and fixes it. I really don't like how the code has been essentially guessing which network namespace to use.
Probably the worst guessing is in ipvs in the function skb_net. I have some preliminary changes to fix ipvs but they are not quite ready yet. Cleaning up ipvs enough that I can kill skb_net is on my short list.
There are a few extra cleanups in the first group of changes sprinkled in as I noticed a few other things as I was sorting out the network namespace computation logic.
There rest of the changes are based on Pablos per network namespace netfilter hook work and include related cleanups and simplifications. The most non-obvious detail were the necessary header file cleanups.
The changes where I started with Pablos patches in some cases the credits get a little weird and the descriptions are a little weaker than I would like but overall I think it is all close enough.
Eric W. Biederman (36):
ipvs: Read hooknum from state rather than ops->hooknum
netfilter: Pass priv instead of nf_hook_ops to netfilter hooks
netfilter: Add a network namespace Kconfig conflict
netfilter: Add a struct net parameter to nf_register_hook[s]
netfilter: Add a struct net parameter to nf_unregister_hook[s]
netfilter: Make the netfilter hooks per network namespace
netfilter: Make nf_hook_ops just a parameter structure
netfitler: Remove spurios included of netfilter.h
x_tables: Add magical hook registration in the common case
x_tables: Where possible convert to the new hook registration method
x_tables: Kill xt_[un]hook_link
x_tables: Update ip?table_nat to register their hooks in all network namespaces
netfilter: bridge: adapt it to pernet hooks
ipvs: Register netfilter hooks in all network namespaces
netfilter: nf_conntract: Register netfilter hooks in all network namespaces
netfilter: nf_defrag: Register netfilter hooks in all network namespaces
netfilter: synproxy: Register netfilter hooks in all network namespaces
smack: adapt it to pernet hooks
netfilter bridge: Make the sysctl knobs per network namespace
netfilter: Skip unnecessary calls to synchronize_net
netfilter: Kill unused copies of RCV_SKB_FAIL
netfilter: Pass struct net into the netfilter hooks
netfilter: Use nf_hook_state.net
ebtables: Simplify the arguments to ebt_do_table
inet netfilter: Remove hook from ip6t_do_table, arp_do_table, ipt_do_table inet netfilter: Prefer state->hook to ops->hooknum
nftables: kill nft_pktinfo.ops
tc: Simplify em_ipset_match
x_tables: Pass struct net in xt_action_param
x_tables: Use par->net instead of computing from the passed net devices
nftables: Pass struct net in nft_pktinfo
nf_tables: Use pkt->net instead of computing net from the passed net_devices
nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple
ipv4: Pass struct net into ip_defrag and ip_check_defrag
ipv6: Pass struct net into nf_ct_frag6_gather
netfilter: Remove the network namespace Kconfig conflict
Pablo Neira Ayuso (7):
net: include missing headers in net/net_namespace.h
netfilter: use forward declaration instead of including linux/proc_fs.h
netfilter: don't pull include/linux/netfilter.h from netns headers
netfilter: nf_tables: adapt it to pernet hooks
netfilter: ipt_CLUSTERIP: adapt it to support pernet hooks
netfilter: ebtables: adapt the filter and nat table to pernet hooks
selinux: adapt it to pernet hooks
Eric
PATCH 1/43 netfilter: Kill unused copies of RCV_SKB_FAIL
This appears to have been a dead macro in both nfnetlink_log.c and nfnetlink_queue_core.c since these pieces of code were added in 2005.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/netfilter/nfnetlink_log.c | 2 -- net/netfilter/nfnetlink_queue_core.c | 2 -- 2 files changed, 4 deletions(-)
net/netfilter/nfnetlink_log.c +0 -2
@@ -598,8 +598,6 @@ nla_put_failure:return -1 ; } -#define RCV_SKB_FAIL (err) do { netlink_ack(skb, nlh, (err)); return; } while (0) -static struct nf_loginfo default_loginfo = { .type =NF_LOG_TYPE_ULOG , .u = {
net/netfilter/nfnetlink_queue_core.c +0 -2
@@ -806,8 +806,6 @@ nfqnl_dev_drop(struct net *net, int ifindex)rcu_read_unlock (); } -#define RCV_SKB_FAIL (err) do { netlink_ack(skb, nlh, (err)); return; } while (0) -static int nfqnl_rcv_dev_event (struct notifier_block *this,unsigned long event,void *ptr)
Signature · 1 line
2.2.1
PATCH 2/43 netfilter: Pass struct net into the netfilter hooks
In reply to Eric W. BiedermanPass a network namespace parameter into the netfilter hooks. At the call site of the netfilter hooks the path a packet is taking through the network stack is well known which allows the network namespace to be easily and reliabily.
This allows the replacement of magic code like "dev_net(state->in?:state->out)" that appears at the start of most netfilter hooks with "state->net".
This simplifies the code, and allows for the possibility of per network namespace netfilter hook lists (that nftables appears to want).
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter.h | 37 ++++++++++++++++------------ include/linux/netfilter_ingress.h | 2 +- net/bridge/br_forward.c | 12 ++++----- net/bridge/br_input.c | 13 +++++----- net/bridge/br_multicast.c | 4 +-- net/bridge/br_netfilter.c | 41 +++++++++++++++++-------------- net/bridge/br_stp_bpdu.c | 4 +-- net/decnet/dn_neigh.c | 15 ++++++----- net/decnet/dn_nsp_in.c | 4 +-- net/decnet/dn_route.c | 24 +++++++++--------- net/ipv4/arp.c | 10 +++++--- net/ipv4/ip_forward.c | 11 ++++++--- net/ipv4/ip_input.c | 24 +++++++++--------- net/ipv4/ip_output.c | 28 ++++++++++++--------- net/ipv4/ipmr.c | 6 ++--- net/ipv4/raw.c | 5 ++-- net/ipv4/xfrm4_input.c | 4 +-- net/ipv4/xfrm4_output.c | 6 +++-- net/ipv6/ip6_input.c | 10 ++++---- net/ipv6/ip6_output.c | 30 +++++++++++----------- net/ipv6/ip6mr.c | 4 +-- net/ipv6/mcast.c | 7 +++--- net/ipv6/ndisc.c | 4 +-- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 2 +- net/ipv6/output_core.c | 6 +++-- net/ipv6/raw.c | 10 +++++--- net/ipv6/xfrm6_input.c | 4 +-- net/ipv6/xfrm6_output.c | 6 +++-- net/netfilter/ipvs/ip_vs_xmit.c | 4 +-- net/xfrm/xfrm_output.c | 4 ++- 30 files changed, 190 insertions(+), 151 deletions(-)
include/linux/netfilter.h +21 -16
@@ -54,6 +54,7 @@ struct nf_hook_state {struct net_device *in;struct net_device *out;struct sock *sk; +struct net *net;struct list_head *hook_list;int (*okfn)(struct sock *,struct sk_buff *); };
@@ -65,6 +66,7 @@ static inline void nf_hook_state_init(struct nf_hook_state *p,struct net_device *indev, struct net_device *outdev, struct sock *sk, + struct net *net, int (*okfn)(struct sock *, struct sk_buff *)) { p->hook = hook;
@@ -73,6 +75,7 @@ static inline void nf_hook_state_init(struct nf_hook_state *p, p->in = indev; p->out = outdev; p->sk = sk; + p->net = net; p->hook_list = hook_list; p->okfn = okfn; }
@@ -167,6 +170,7 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state);* value indicates the packet has been consumed by the hook. */ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, + struct net *net, struct sock *sk, struct sk_buff *skb, struct net_device *indev,
@@ -178,18 +182,18 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,struct nf_hook_state state;nf_hook_state_init (&state, &nf_hooks[pf][hook], hook, thresh, - pf, indev, outdev, sk, okfn); + pf, indev, outdev, sk, net, okfn);return nf_hook_slow (skb, &state); }return 1 ; } -static inline int nf_hook (u_int8_t pf,unsigned int hook,struct sock *sk, -struct sk_buff *skb,struct net_device *indev, -struct net_device *outdev, +static inline int nf_hook (u_int8_t pf,unsigned int hook,struct net *net, +struct sock *sk,struct sk_buff *skb, +struct net_device *indev,struct net_device *outdev,int (*okfn)(struct sock *,struct sk_buff *)) { -return nf_hook_thresh (pf, hook, sk, skb, indev, outdev, okfn,INT_MIN ); +return nf_hook_thresh (pf, hook, net, sk, skb, indev, outdev, okfn,INT_MIN ); }/* Activate hook; either okfn or kfree_skb called, unless a hook
@@ -210,36 +214,36 @@ static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sock *sk,*/ static inline int -NF_HOOK_THRESH (uint8_t pf,unsigned int hook,struct sock *sk, +NF_HOOK_THRESH (uint8_t pf,unsigned int hook,struct net *net,struct sock *sk,struct sk_buff *skb,struct net_device *in,struct net_device *out,int (*okfn)(struct sock *,struct sk_buff *),int thresh) { -int ret =nf_hook_thresh (pf, hook, sk, skb, in, out, okfn, thresh); +int ret =nf_hook_thresh (pf, hook, net, sk, skb, in, out, okfn, thresh);if (ret ==1 ) ret =okfn (sk, skb);return ret; }static inline int -NF_HOOK_COND (uint8_t pf,unsigned int hook,struct sock *sk, +NF_HOOK_COND (uint8_t pf,unsigned int hook,struct net *net,struct sock *sk,struct sk_buff *skb,struct net_device *in,struct net_device *out,int (*okfn)(struct sock *,struct sk_buff *),bool cond) {int ret;if (!cond || - ((ret =nf_hook_thresh (pf, hook, sk, skb, in, out, okfn,INT_MIN )) ==1 )) + ((ret =nf_hook_thresh (pf, hook, net, sk, skb, in, out, okfn,INT_MIN )) ==1 )) ret =okfn (sk, skb);return ret; }static inline int -NF_HOOK (uint8_t pf,unsigned int hook,struct sock *sk,struct sk_buff *skb, +NF_HOOK (uint8_t pf,unsigned int hook,struct net *net,struct sock *sk,struct sk_buff *skb,struct net_device *in,struct net_device *out,int (*okfn)(struct sock *,struct sk_buff *)) { -return NF_HOOK_THRESH (pf, hook, sk, skb, in, out, okfn,INT_MIN ); +return NF_HOOK_THRESH (pf, hook, net, sk, skb, in, out, okfn,INT_MIN ); }/* Call setsockopt() */
@@ -339,9 +343,10 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) }#else /* !CONFIG_NETFILTER */ -#define NF_HOOK (pf, hook, sk, skb, indev, outdev, okfn) (okfn)(sk, skb) -#define NF_HOOK_COND (pf, hook, sk, skb, indev, outdev, okfn, cond) (okfn)(sk, skb) +#define NF_HOOK (pf, hook, net, sk, skb, indev, outdev, okfn) (okfn)(sk, skb) +#define NF_HOOK_COND (pf, hook, net, sk, skb, indev, outdev, okfn, cond) (okfn)(sk, skb) static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, + struct net *net, struct sock *sk, struct sk_buff *skb, struct net_device *indev,
@@ -350,9 +355,9 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, {return okfn (sk, skb); } -static inline int nf_hook (u_int8_t pf,unsigned int hook,struct sock *sk, -struct sk_buff *skb,struct net_device *indev, -struct net_device *outdev, +static inline int nf_hook (u_int8_t pf,unsigned int hook,struct net *net, +struct sock *sk,struct sk_buff *skb, +struct net_device *indev,struct net_device *outdev,int (*okfn)(struct sock *,struct sk_buff *)) {return 1 ;
include/linux/netfilter_ingress.h +1 -1
@@ -17,7 +17,7 @@ static inline int nf_hook_ingress(struct sk_buff *skb)nf_hook_state_init (&state, &skb->dev->nf_hooks_ingress,NF_NETDEV_INGRESS ,INT_MIN ,NFPROTO_NETDEV ,NULL , - skb->dev,NULL ,NULL ); + skb->dev,NULL ,dev_net (skb->dev),NULL );return nf_hook_slow (skb, &state); }
net/bridge/br_forward.c +6 -6
@@ -51,8 +51,8 @@ EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);int br_forward_finish (struct sock *sk,struct sk_buff *skb) { -return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_POST_ROUTING , sk, skb, -NULL , skb->dev, +return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_POST_ROUTING , +dev_net (skb->dev), sk, skb,NULL , skb->dev, br_dev_queue_push_xmit); }
@@ -76,8 +76,8 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)return ; } -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT ,NULL , skb, -NULL , skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT , +dev_net (skb->dev),NULL , skb,NULL , skb->dev, br_forward_finish); }
@@ -98,8 +98,8 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb) skb->dev = to->dev;skb_forward_csum (skb); -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_FORWARD ,NULL , skb, - indev, skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_FORWARD , +dev_net (indev),NULL , skb, indev, skb->dev, br_forward_finish); }
net/bridge/br_input.c +7 -6
@@ -55,8 +55,8 @@ static int br_pass_frame_up(struct sk_buff *skb)if (!skb)return NET_RX_DROP ; -return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN ,NULL , skb, - indev,NULL , +return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN , +dev_net (indev),NULL , skb, indev,NULL , netif_receive_skb_sk); }
@@ -278,8 +278,9 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb) }/* Deliver packet to local host only */ -if (NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN ,NULL , skb, - skb->dev,NULL , br_handle_local_finish)) { +if (NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , + br_handle_local_finish)) {return RX_HANDLER_CONSUMED ;/* consumed by filter */ }else { *pskb = skb;
@@ -303,8 +304,8 @@ forward:if (ether_addr_equal (p->br->dev->dev_addr, dest)) skb->pkt_type =PACKET_HOST ; -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_PRE_ROUTING , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , br_handle_frame_finish);break ;default :
net/bridge/br_multicast.c +2 -2
@@ -814,8 +814,8 @@ static void __br_multicast_send_query(struct net_bridge *br,if (port) { skb->dev = port->dev; -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT ,NULL , skb, -NULL , skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT , +dev_net (port->dev),NULL , skb,NULL , skb->dev, br_dev_queue_push_xmit); }else {br_multicast_select_own_querier (br, ip, skb);
net/bridge/br_netfilter.c +23 -18
125 lines not on this page · raw message
net/bridge/br_stp_bpdu.c +2 -2
@@ -54,8 +54,8 @@ static void br_send_bpdu(struct net_bridge_port *p,skb_reset_mac_header (skb); -NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT ,NULL , skb, -NULL , skb->dev, +NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_OUT , +dev_net (p->dev),NULL , skb,NULL , skb->dev, dev_queue_xmit_sk); }
net/decnet/dn_neigh.c +9 -6
@@ -246,8 +246,9 @@ static int dn_long_output(struct neighbour *neigh, struct sock *sk,skb_reset_network_header (skb); -return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , sk, skb, -NULL , neigh->dev, dn_neigh_output_packet); +return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , + &init_net, sk, skb,NULL , neigh->dev, + dn_neigh_output_packet); }/*
@@ -286,8 +287,9 @@ static int dn_short_output(struct neighbour *neigh, struct sock *sk,skb_reset_network_header (skb); -return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , sk, skb, -NULL , neigh->dev, dn_neigh_output_packet); +return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , + &init_net, sk, skb,NULL , neigh->dev, + dn_neigh_output_packet); }/*
@@ -327,8 +329,9 @@ static int dn_phase3_output(struct neighbour *neigh, struct sock *sk,skb_reset_network_header (skb); -return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , sk, skb, -NULL , neigh->dev, dn_neigh_output_packet); +return NF_HOOK (NFPROTO_DECNET ,NF_DN_POST_ROUTING , + &init_net, sk, skb,NULL , neigh->dev, + dn_neigh_output_packet); }int dn_to_neigh_output (struct sock *sk,struct sk_buff *skb)
net/decnet/dn_nsp_in.c +2 -2
@@ -814,8 +814,8 @@ free_out:int dn_nsp_rx (struct sk_buff *skb) { -return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_IN ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_IN , + &init_net,NULL , skb, skb->dev,NULL , dn_nsp_rx_packet); }
net/decnet/dn_route.c +12 -12
@@ -573,8 +573,8 @@ static int dn_route_rx_long(struct sk_buff *skb) ptr++; cb->hops = *ptr++;/* Visit Count */ -return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING , + &init_net,NULL , skb, skb->dev,NULL , dn_route_rx_packet); drop_it:
@@ -601,8 +601,8 @@ static int dn_route_rx_short(struct sk_buff *skb) ptr +=2 ; cb->hops = *ptr &0x3f ; -return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_DECNET ,NF_DN_PRE_ROUTING , + &init_net,NULL , skb, skb->dev,NULL , dn_route_rx_packet); drop_it:
@@ -706,22 +706,22 @@ int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_typeswitch (flags &DN_RT_CNTL_MSK ) {case DN_RT_PKT_HELO :return NF_HOOK (NFPROTO_DECNET ,NF_DN_HELLO , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_route_ptp_hello);case DN_RT_PKT_L1RT :case DN_RT_PKT_L2RT :return NF_HOOK (NFPROTO_DECNET ,NF_DN_ROUTE , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_route_discard);case DN_RT_PKT_ERTH :return NF_HOOK (NFPROTO_DECNET ,NF_DN_HELLO , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_neigh_router_hello);case DN_RT_PKT_EEDH :return NF_HOOK (NFPROTO_DECNET ,NF_DN_HELLO , -NULL , skb, skb->dev,NULL , + &init_net,NULL , skb, skb->dev,NULL , dn_neigh_endnode_hello); } }else {
@@ -770,8 +770,8 @@ static int dn_output(struct sock *sk, struct sk_buff *skb) cb->rt_flags |=DN_RT_F_IE ; cb->hops =0 ; -return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_OUT , sk, skb, -NULL , dev, +return NF_HOOK (NFPROTO_DECNET ,NF_DN_LOCAL_OUT , + &init_net, sk, skb,NULL , dev, dn_to_neigh_output); error:
@@ -819,8 +819,8 @@ static int dn_forward(struct sk_buff *skb)if (rt->rt_flags &RTCF_DOREDIRECT ) cb->rt_flags |=DN_RT_F_IE ; -return NF_HOOK (NFPROTO_DECNET ,NF_DN_FORWARD ,NULL , skb, - dev, skb->dev, +return NF_HOOK (NFPROTO_DECNET ,NF_DN_FORWARD , + &init_net,NULL , skb, dev, skb->dev, dn_to_neigh_output); drop:
net/ipv4/arp.c +6 -4
@@ -591,8 +591,9 @@ EXPORT_SYMBOL(arp_create);void arp_xmit (struct sk_buff *skb) {/* Send it off, maybe filter it using firewalling first. */ -NF_HOOK (NFPROTO_ARP ,NF_ARP_OUT ,NULL , skb, -NULL , skb->dev, dev_queue_xmit_sk); +NF_HOOK (NFPROTO_ARP ,NF_ARP_OUT , +dev_net (skb->dev),NULL , skb,NULL , skb->dev, + dev_queue_xmit_sk); }EXPORT_SYMBOL (arp_xmit);
@@ -880,8 +881,9 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,memset (NEIGH_CB (skb),0 ,sizeof (struct neighbour_cb )); -return NF_HOOK (NFPROTO_ARP ,NF_ARP_IN ,NULL , skb, - dev,NULL , arp_process); +return NF_HOOK (NFPROTO_ARP ,NF_ARP_IN , +dev_net (dev),NULL , skb, dev,NULL , + arp_process); consumeskb:consume_skb (skb);
net/ipv4/ip_forward.c +7 -4
@@ -81,6 +81,7 @@ int ip_forward(struct sk_buff *skb)struct iphdr *iph;/* Our header */ struct rtable *rt;/* Route we use */ struct ip_options *opt = &(IPCB (skb)->opt); +struct net *net;/* that should never happen */ if (skb->pkt_type !=PACKET_HOST )
@@ -99,6 +100,7 @@ int ip_forward(struct sk_buff *skb)return NET_RX_SUCCESS ;skb_forward_csum (skb); + net =dev_net (skb->dev);/* * According to the RFC, we must first decrease the TTL field. If
@@ -119,7 +121,7 @@ int ip_forward(struct sk_buff *skb)IPCB (skb)->flags |=IPSKB_FORWARDED ; mtu =ip_dst_mtu_maybe_forward (&rt->dst, true);if (ip_exceeds_mtu (skb, mtu)) { -IP_INC_STATS (dev_net (rt->dst.dev),IPSTATS_MIB_FRAGFAILS ); +IP_INC_STATS (net,IPSTATS_MIB_FRAGFAILS );icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_FRAG_NEEDED ,htonl (mtu)); goto drop;
@@ -143,8 +145,9 @@ int ip_forward(struct sk_buff *skb) skb->priority =rt_tos2priority (iph->tos); -return NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, rt->dst.dev, ip_forward_finish); +return NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, rt->dst.dev, + ip_forward_finish); sr_failed:/*
@@ -155,7 +158,7 @@ sr_failed: too_many_hops:/* Tell the sender its packet died... */ -IP_INC_STATS_BH (dev_net (skb_dst (skb)->dev),IPSTATS_MIB_INHDRERRORS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INHDRERRORS );icmp_send (skb,ICMP_TIME_EXCEEDED ,ICMP_EXC_TTL ,0 ); drop:kfree_skb (skb);
net/ipv4/ip_input.c +13 -11
@@ -253,8 +253,8 @@ int ip_local_deliver(struct sk_buff *skb)return 0 ; } -return NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_IN ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_IN , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , ip_local_deliver_finish); }
@@ -377,6 +377,7 @@ drop:int ip_rcv (struct sk_buff *skb,struct net_device *dev,struct packet_type *pt,struct net_device *orig_dev) {const struct iphdr *iph; +struct net *net;u32 len;/* When the interface is in promisc. mode, drop all the crap
@@ -386,11 +387,12 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, goto drop; -IP_UPD_PO_STATS_BH (dev_net (dev),IPSTATS_MIB_IN , skb->len); + net =dev_net (dev); +IP_UPD_PO_STATS_BH (net,IPSTATS_MIB_IN , skb->len); skb =skb_share_check (skb,GFP_ATOMIC );if (!skb) { -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INDISCARDS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INDISCARDS ); goto out; }
@@ -416,7 +418,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,BUILD_BUG_ON (IPSTATS_MIB_ECT1PKTS !=IPSTATS_MIB_NOECTPKTS +INET_ECN_ECT_1 );BUILD_BUG_ON (IPSTATS_MIB_ECT0PKTS !=IPSTATS_MIB_NOECTPKTS +INET_ECN_ECT_0 );BUILD_BUG_ON (IPSTATS_MIB_CEPKTS !=IPSTATS_MIB_NOECTPKTS +INET_ECN_CE ); -IP_ADD_STATS_BH (dev_net (dev), +IP_ADD_STATS_BH (net,IPSTATS_MIB_NOECTPKTS + (iph->tos &INET_ECN_MASK ), max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
@@ -430,7 +432,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, len =ntohs (iph->tot_len);if (skb->len < len) { -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INTRUNCATEDPKTS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INTRUNCATEDPKTS ); goto drop; }else if (len < (iph->ihl*4 )) goto inhdr_error;
@@ -440,7 +442,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,* Note this now means skb->len holds ntohs(iph->tot_len). */ if (pskb_trim_rcsum (skb, len)) { -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INDISCARDS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INDISCARDS ); goto drop; }
@@ -452,14 +454,14 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,/* Must drop socket now because of tproxy. */ skb_orphan (skb); -return NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING ,NULL , skb, - dev,NULL , +return NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , + net,NULL , skb, dev,NULL , ip_rcv_finish); csum_error: -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_CSUMERRORS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_CSUMERRORS ); inhdr_error: -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_INHDRERRORS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_INHDRERRORS ); drop:kfree_skb (skb); out:
net/ipv4/ip_output.c +17 -11
@@ -97,12 +97,14 @@ EXPORT_SYMBOL(ip_send_check);static int __ip_local_out_sk (struct sock *sk,struct sk_buff *skb) { +struct net *net =dev_net (skb_dst (skb)->dev);struct iphdr *iph =ip_hdr (skb); iph->tot_len =htons (skb->len);ip_send_check (iph); -return nf_hook (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , sk, skb,NULL , -skb_dst (skb)->dev, dst_output_sk); +return nf_hook (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL ,skb_dst (skb)->dev, + dst_output_sk); }int __ip_local_out (struct sk_buff *skb)
@@ -288,11 +290,12 @@ int ip_mc_output(struct sock *sk, struct sk_buff *skb) {struct rtable *rt =skb_rtable (skb);struct net_device *dev = rt->dst.dev; +struct net *net =dev_net (dev);/* * If the indicated interface is up and running, send the packet. */ -IP_UPD_PO_STATS (dev_net (dev),IPSTATS_MIB_OUT , skb->len); +IP_UPD_PO_STATS (net,IPSTATS_MIB_OUT , skb->len); skb->dev = dev; skb->protocol =htons (ETH_P_IP );
@@ -320,7 +323,7 @@ int ip_mc_output(struct sock *sk, struct sk_buff *skb)struct sk_buff *newskb =skb_clone (skb,GFP_ATOMIC );if (newskb)NF_HOOK (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , - sk, newskb,NULL , newskb->dev, + net, sk, newskb,NULL , newskb->dev, dev_loopback_xmit); }
@@ -335,26 +338,29 @@ int ip_mc_output(struct sock *sk, struct sk_buff *skb)if (rt->rt_flags&RTCF_BROADCAST ) {struct sk_buff *newskb =skb_clone (skb,GFP_ATOMIC );if (newskb) -NF_HOOK (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, newskb, -NULL , newskb->dev, dev_loopback_xmit); +NF_HOOK (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, newskb,NULL , newskb->dev, + dev_loopback_xmit); } -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, skb,NULL , - skb->dev, ip_finish_output, +return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL , skb->dev, + ip_finish_output, !(IPCB (skb)->flags &IPSKB_REROUTED )); }int ip_output (struct sock *sk,struct sk_buff *skb) {struct net_device *dev =skb_dst (skb)->dev; +struct net *net =dev_net (dev); -IP_UPD_PO_STATS (dev_net (dev),IPSTATS_MIB_OUT , skb->len); +IP_UPD_PO_STATS (net,IPSTATS_MIB_OUT , skb->len); skb->dev = dev; skb->protocol =htons (ETH_P_IP ); -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, skb, -NULL , dev, +return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL , dev, ip_finish_output, !(IPCB (skb)->flags &IPSKB_REROUTED )); }
net/ipv4/ipmr.c +3 -3
@@ -1746,7 +1746,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,* to blackhole. */ -IP_INC_STATS_BH (dev_net (dev),IPSTATS_MIB_FRAGFAILS ); +IP_INC_STATS_BH (net,IPSTATS_MIB_FRAGFAILS );ip_rt_put (rt); goto out_free; }
@@ -1788,8 +1788,8 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,* not mrouter) cannot join to more than one interface - it will * result in receiving multiple packets. */ -NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, dev, +NF_HOOK (NFPROTO_IPV4 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, dev, ipmr_forward_finish);return ;
net/ipv4/raw.c +3 -2
@@ -411,8 +411,9 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,icmp_out_count (net, ((struct icmphdr *)skb_transport_header (skb))->type); - err =NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , rt->dst.dev, dst_output_sk); + err =NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , rt->dst.dev, + dst_output_sk);if (err >0 ) err =net_xmit_errno (err);if (err)
net/ipv4/xfrm4_input.c +2 -2
@@ -52,8 +52,8 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) iph->tot_len =htons (skb->len);ip_send_check (iph); -NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , xfrm4_rcv_encap_finish);return 0 ; }
net/ipv4/xfrm4_output.c +4 -2
@@ -96,8 +96,10 @@ static int __xfrm4_output(struct sock *sk, struct sk_buff *skb)int xfrm4_output (struct sock *sk,struct sk_buff *skb) { -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , sk, skb, -NULL ,skb_dst (skb)->dev, __xfrm4_output, +struct net *net =dev_net (skb_dst (skb)->dev); +return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL ,skb_dst (skb)->dev, + __xfrm4_output, !(IPCB (skb)->flags &IPSKB_REROUTED )); }
net/ipv6/ip6_input.c +5 -5
@@ -108,7 +108,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptif (hdr->version !=6 ) goto err; -IP6_ADD_STATS_BH (dev_net (dev), idev, +IP6_ADD_STATS_BH (net, idev,IPSTATS_MIB_NOECTPKTS + (ipv6_get_dsfield (hdr) &INET_ECN_MASK ), max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
@@ -182,8 +182,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt/* Must drop socket now because of tproxy. */ skb_orphan (skb); -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING ,NULL , skb, - dev,NULL , +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , + net,NULL , skb, dev,NULL , ip6_rcv_finish); err:IP6_INC_STATS_BH (net, idev,IPSTATS_MIB_INHDRERRORS );
@@ -277,8 +277,8 @@ discard:int ip6_input (struct sk_buff *skb) { -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_IN ,NULL , skb, - skb->dev,NULL , +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_IN , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , ip6_input_finish); }
net/ipv6/ip6_output.c +15 -15
@@ -60,6 +60,7 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb) {struct dst_entry *dst =skb_dst (skb);struct net_device *dev = dst->dev; +struct net *net =dev_net (dev);struct neighbour *neigh;struct in6_addr *nexthop;int ret;
@@ -71,7 +72,7 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb)struct inet6_dev *idev =ip6_dst_idev (skb_dst (skb));if (!(dev->flags &IFF_LOOPBACK ) &&sk_mc_loop (sk) && - ((mroute6_socket (dev_net (dev), skb) && + ((mroute6_socket (net, skb) && !(IP6CB (skb)->flags &IP6SKB_FORWARDED )) ||ipv6_chk_mcast_addr (dev, &ipv6_hdr (skb)->daddr, &ipv6_hdr (skb)->saddr))) {
@@ -82,19 +83,18 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb)*/ if (newskb)NF_HOOK (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , - sk, newskb,NULL , newskb->dev, + net, sk, newskb,NULL , newskb->dev, dev_loopback_xmit);if (ipv6_hdr (skb)->hop_limit ==0 ) { -IP6_INC_STATS (dev_net (dev), idev, +IP6_INC_STATS (net, idev,IPSTATS_MIB_OUTDISCARDS );kfree_skb (skb);return 0 ; } } -IP6_UPD_PO_STATS (dev_net (dev), idev,IPSTATS_MIB_OUTMCAST , - skb->len); +IP6_UPD_PO_STATS (net, idev,IPSTATS_MIB_OUTMCAST , skb->len); if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <= IPV6_ADDR_SCOPE_NODELOCAL &&
@@ -116,8 +116,7 @@ static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb) }rcu_read_unlock_bh (); -IP6_INC_STATS (dev_net (dst->dev), -ip6_dst_idev (dst),IPSTATS_MIB_OUTNOROUTES ); +IP6_INC_STATS (net,ip6_dst_idev (dst),IPSTATS_MIB_OUTNOROUTES );kfree_skb (skb);return -EINVAL ; }
@@ -136,15 +135,15 @@ int ip6_output(struct sock *sk, struct sk_buff *skb) {struct net_device *dev =skb_dst (skb)->dev;struct inet6_dev *idev =ip6_dst_idev (skb_dst (skb)); +struct net *net =dev_net (dev);if (unlikely (idev->cnf.disable_ipv6)) { -IP6_INC_STATS (dev_net (dev), idev, -IPSTATS_MIB_OUTDISCARDS ); +IP6_INC_STATS (net, idev,IPSTATS_MIB_OUTDISCARDS );kfree_skb (skb);return 0 ; } -return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , sk, skb, -NULL , dev, +return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL , dev, ip6_finish_output, !(IP6CB (skb)->flags &IP6SKB_REROUTED )); }
@@ -224,8 +223,9 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,if ((skb->len <= mtu) || skb->ignore_df ||skb_is_gso (skb)) {IP6_UPD_PO_STATS (net,ip6_dst_idev (skb_dst (skb)),IPSTATS_MIB_OUT , skb->len); -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , dst->dev, dst_output_sk); +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , dst->dev, + dst_output_sk); } skb->dev = dst->dev;
@@ -512,8 +512,8 @@ int ip6_forward(struct sk_buff *skb)IP6_INC_STATS_BH (net,ip6_dst_idev (dst),IPSTATS_MIB_OUTFORWDATAGRAMS );IP6_ADD_STATS_BH (net,ip6_dst_idev (dst),IPSTATS_MIB_OUTOCTETS , skb->len); -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, dst->dev, +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, dst->dev, ip6_forward_finish); error:
net/ipv6/ip6mr.c +2 -2
@@ -2064,8 +2064,8 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,IP6CB (skb)->flags |=IP6SKB_FORWARDED ; -return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD ,NULL , skb, - skb->dev, dev, +return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD , + net,NULL , skb, skb->dev, dev, ip6mr_forward2_finish); out_free:
net/ipv6/mcast.c +4 -3
@@ -1645,7 +1645,7 @@ static void mld_sendpack(struct sk_buff *skb) payload_len = skb->len; err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , - net->ipv6.igmp_sk, skb,NULL , skb->dev, + net, net->ipv6.igmp_sk, skb,NULL , skb->dev, dst_output_sk); out:if (!err) {
@@ -2008,8 +2008,9 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) }skb_dst_set (skb, dst); - err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , skb->dev, dst_output_sk); + err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , skb->dev, + dst_output_sk); out:if (!err) {ICMP6MSGOUT_INC_STATS (net, idev, type);
net/ipv6/ndisc.c +2 -2
@@ -463,8 +463,8 @@ static void ndisc_send_skb(struct sk_buff *skb, idev =__in6_dev_get (dst->dev);IP6_UPD_PO_STATS (net, idev,IPSTATS_MIB_OUT , skb->len); - err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , dst->dev, + err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , dst->dev, dst_output_sk);if (!err) {ICMP6MSGOUT_INC_STATS (net, idev, type);
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +1 -1
@@ -75,7 +75,7 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,nf_ct_frag6_consume_orig (reasm); -NF_HOOK_THRESH (NFPROTO_IPV6 , ops->hooknum, state->sk, reasm, +NF_HOOK_THRESH (NFPROTO_IPV6 , ops->hooknum, state->net, state->sk, reasm, state->in, state->out, state->okfn,NF_IP6_PRI_CONNTRACK_DEFRAG +1 );
net/ipv6/output_core.c +4 -2
@@ -139,6 +139,7 @@ EXPORT_SYMBOL(ip6_dst_hoplimit);static int __ip6_local_out_sk (struct sock *sk,struct sk_buff *skb) { +struct net *net =dev_net (skb_dst (skb)->dev);int len; len = skb->len -sizeof (struct ipv6hdr );
@@ -147,8 +148,9 @@ static int __ip6_local_out_sk(struct sock *sk, struct sk_buff *skb)ipv6_hdr (skb)->payload_len =htons (len);IP6CB (skb)->nhoff = offsetof(struct ipv6hdr , nexthdr); -return nf_hook (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL ,skb_dst (skb)->dev, dst_output_sk); +return nf_hook (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL ,skb_dst (skb)->dev, + dst_output_sk); }int __ip6_local_out (struct sk_buff *skb)
net/ipv6/raw.c +6 -4
@@ -613,6 +613,7 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, unsigned int flags) {struct ipv6_pinfo *np =inet6_sk (sk); +struct net *net =sock_net (sk);struct ipv6hdr *iph;struct sk_buff *skb;int err;
@@ -651,9 +652,10 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,if (err) goto error_fault; -IP6_UPD_PO_STATS (sock_net (sk), rt->rt6i_idev,IPSTATS_MIB_OUT , skb->len); - err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , sk, skb, -NULL , rt->dst.dev, dst_output_sk); +IP6_UPD_PO_STATS (net, rt->rt6i_idev,IPSTATS_MIB_OUT , skb->len); + err =NF_HOOK (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , + net, sk, skb,NULL , rt->dst.dev, + dst_output_sk);if (err >0 ) err =net_xmit_errno (err);if (err)
@@ -665,7 +667,7 @@ error_fault: err = -EFAULT ;kfree_skb (skb); error: -IP6_INC_STATS (sock_net (sk), rt->rt6i_idev,IPSTATS_MIB_OUTDISCARDS ); +IP6_INC_STATS (net, rt->rt6i_idev,IPSTATS_MIB_OUTDISCARDS );if (err == -ENOBUFS && !np->recverr) err =0 ;return err;
net/ipv6/xfrm6_input.c +2 -2
@@ -42,8 +42,8 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)ipv6_hdr (skb)->payload_len =htons (skb->len);__skb_push (skb, skb->data -skb_network_header (skb)); -NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING ,NULL , skb, - skb->dev,NULL , +NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , +dev_net (skb->dev),NULL , skb, skb->dev,NULL , ip6_rcv_finish);return -1 ; }
net/ipv6/xfrm6_output.c +4 -2
@@ -168,7 +168,9 @@ static int __xfrm6_output(struct sock *sk, struct sk_buff *skb)int xfrm6_output (struct sock *sk,struct sk_buff *skb) { -return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , sk, skb, -NULL ,skb_dst (skb)->dev, __xfrm6_output, +struct net *net =dev_net (skb_dst (skb)->dev); +return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , + net, sk, skb,NULL ,skb_dst (skb)->dev, + __xfrm6_output, !(IP6CB (skb)->flags &IP6SKB_REROUTED )); }
net/netfilter/ipvs/ip_vs_xmit.c +2 -2
@@ -540,7 +540,7 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,ip_vs_update_conntrack (skb, cp,1 );if (!local) {skb_forward_csum (skb); -NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb, +NF_HOOK (pf,NF_INET_LOCAL_OUT ,ip_vs_conn_net (cp),NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk); }else ret =NF_ACCEPT ;
@@ -558,7 +558,7 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb,ip_vs_notrack (skb);if (!local) {skb_forward_csum (skb); -NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb, +NF_HOOK (pf,NF_INET_LOCAL_OUT ,ip_vs_conn_net (cp),NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk); }else ret =NF_ACCEPT ;
net/xfrm/xfrm_output.c +3 -1
@@ -132,6 +132,7 @@ out:int xfrm_output_resume (struct sk_buff *skb,int err) {while (likely ((err =xfrm_output_one (skb, err)) ==0 )) { +struct net *net;nf_reset (skb); err =skb_dst (skb)->ops->local_out (skb);
@@ -141,8 +142,9 @@ int xfrm_output_resume(struct sk_buff *skb, int err)if (!skb_dst (skb)->xfrm)return dst_output (skb); + net =xs_net (skb_dst (skb)->xfrm); err =nf_hook (skb_dst (skb)->ops->family, -NF_INET_POST_ROUTING , skb->sk, skb, +NF_INET_POST_ROUTING , net, skb->sk, skb,NULL ,skb_dst (skb)->dev, xfrm_output2);if (unlikely (err !=1 )) goto out;
Signature · 1 line
2.2.1
PATCH 3/43 netfilter: Use nf_hook_state.net
In reply to Eric W. BiedermanInstead of saying "net = dev_net(state->in?state->in:state->out)" just say "state->net". As that information is now availabe, much less confusing and much less error prone.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/bridge/netfilter/ebtable_filter.c | 4 ++-- net/bridge/netfilter/ebtable_nat.c | 4 ++-- net/ipv4/netfilter/arptable_filter.c | 4 +--- net/ipv4/netfilter/ip_tables.c | 8 ++++---- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/iptable_filter.c | 6 ++---- net/ipv4/netfilter/iptable_mangle.c | 7 +++---- net/ipv4/netfilter/iptable_nat.c | 5 ++--- net/ipv4/netfilter/iptable_raw.c | 6 ++---- net/ipv4/netfilter/iptable_security.c | 5 +---- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 ++-- net/ipv6/netfilter/ip6_tables.c | 8 ++++---- net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +- net/ipv6/netfilter/ip6table_filter.c | 5 ++--- net/ipv6/netfilter/ip6table_mangle.c | 6 +++--- net/ipv6/netfilter/ip6table_nat.c | 5 ++--- net/ipv6/netfilter/ip6table_raw.c | 5 ++--- net/ipv6/netfilter/ip6table_security.c | 4 +--- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 4 ++-- net/netfilter/nfnetlink_queue_core.c | 3 +-- 21 files changed, 41 insertions(+), 58 deletions(-)
net/bridge/netfilter/ebtable_filter.c +2 -2
@@ -61,7 +61,7 @@ ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->in)->xt.frame_filter); + state->net->xt.frame_filter); } static unsigned int
@@ -69,7 +69,7 @@ ebt_out_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->out)->xt.frame_filter); + state->net->xt.frame_filter); }static struct nf_hook_ops ebt_ops_filter[]__read_mostly = {
net/bridge/netfilter/ebtable_nat.c +2 -2
@@ -61,7 +61,7 @@ ebt_nat_in(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->in)->xt.frame_nat); + state->net->xt.frame_nat); } static unsigned int
@@ -69,7 +69,7 @@ ebt_nat_out(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) {return ebt_do_table (ops->hooknum, skb, state->in, state->out, -dev_net (state->out)->xt.frame_nat); + state->net->xt.frame_nat); }static struct nf_hook_ops ebt_ops_nat[]__read_mostly = {
net/ipv4/netfilter/arptable_filter.c +1 -3
@@ -30,10 +30,8 @@ static unsigned int arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - return arpt_do_table(skb, ops->hooknum, state, - net->ipv4.arptable_filter); + state->net->ipv4.arptable_filter); }static struct nf_hook_ops *arpfilter_ops__read_mostly ;
net/ipv4/netfilter/ip_tables.c +4 -4
@@ -246,7 +246,8 @@ get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,return 0 ; } -static void trace_packet(const struct sk_buff *skb, +static void trace_packet(struct net *net, + const struct sk_buff *skb, unsigned int hook, const struct net_device *in, const struct net_device *out,
@@ -258,7 +259,6 @@ static void trace_packet(const struct sk_buff *skb,const char *hookname, *chainname, *comment;const struct ipt_entry *iter;unsigned int rulenum =0 ; -struct net *net =dev_net (in ? in : out); root =get_entry (private->entries, private->hook_entry[hook]);
@@ -369,8 +369,8 @@ ipt_do_table(struct sk_buff *skb,#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE )/* The packet is traced: log it */ if (unlikely (skb->nf_trace)) -trace_packet (skb, hook, state->in, state->out, - table->name, private, e); +trace_packet (state->net, skb, hook, state->in, + state->out, table->name, private, e);#endif /* Standard target? */ if (!t->u.kernel.target->target) {
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
@@ -514,7 +514,7 @@ arp_mangle(const struct nf_hook_ops *ops,struct arphdr *arp =arp_hdr (skb);struct arp_payload *payload;struct clusterip_config *c; -struct net *net =dev_net (state->in ? state->in : state->out); +struct net *net = state->net;/* we don't care about non-ethernet and non-ipv4 ARP */ if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
net/ipv4/netfilter/ipt_SYNPROXY.c +1 -1
@@ -302,7 +302,7 @@ static unsigned int ipv4_synproxy_hook(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *nhs) { - struct synproxy_net *snet = synproxy_pernet(dev_net(nhs->in ? : nhs->out)); + struct synproxy_net *snet = synproxy_pernet(nhs->net);enum ip_conntrack_info ctinfo;struct nf_conn *ct;struct nf_conn_synproxy *synproxy;
net/ipv4/netfilter/iptable_filter.c +2 -4
@@ -36,16 +36,14 @@ static unsigned int iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net; - if (ops->hooknum == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - net =dev_net (state->in ? state->in : state->out); -return ipt_do_table (skb, ops->hooknum, state, net->ipv4.iptable_filter); + return ipt_do_table(skb, ops->hooknum, state, + state->net->ipv4.iptable_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv4/netfilter/iptable_mangle.c +3 -4
@@ -39,7 +39,6 @@ static const struct xt_table packet_mangler = {static unsigned int ipt_mangle_out (struct sk_buff *skb,const struct nf_hook_state *state) { -struct net_device *out = state->out;unsigned int ret;const struct iphdr *iph;u_int8_t tos;
@@ -60,7 +59,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) tos = iph->tos; ret =ipt_do_table (skb,NF_INET_LOCAL_OUT , state, -dev_net (out)->ipv4.iptable_mangle); + state->net->ipv4.iptable_mangle);/* Reroute for ANY change. */ if (ret !=NF_DROP && ret !=NF_STOLEN ) { iph =ip_hdr (skb);
@@ -88,10 +87,10 @@ iptable_mangle_hook(const struct nf_hook_ops *ops,return ipt_mangle_out (skb, state);if (ops->hooknum ==NF_INET_POST_ROUTING )return ipt_do_table (skb, ops->hooknum, state, -dev_net (state->out)->ipv4.iptable_mangle); + state->net->ipv4.iptable_mangle);/* PREROUTING/INPUT/FORWARD: */ return ipt_do_table (skb, ops->hooknum, state, -dev_net (state->in)->ipv4.iptable_mangle); + state->net->ipv4.iptable_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv4/netfilter/iptable_nat.c +2 -3
@@ -33,9 +33,8 @@ static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - struct net *net = nf_ct_net(ct); - -return ipt_do_table (skb, ops->hooknum, state, net->ipv4.nat_table); + return ipt_do_table(skb, ops->hooknum, state, + state->net->ipv4.nat_table); } static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,
net/ipv4/netfilter/iptable_raw.c +2 -4
@@ -23,16 +23,14 @@ static unsigned int iptable_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net; - if (ops->hooknum == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - net =dev_net (state->in ? state->in : state->out); -return ipt_do_table (skb, ops->hooknum, state, net->ipv4.iptable_raw); + return ipt_do_table(skb, ops->hooknum, state, + state->net->ipv4.iptable_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv4/netfilter/iptable_security.c +1 -4
@@ -40,17 +40,14 @@ static unsigned int iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net; - if (ops->hooknum == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* Somebody is playing with raw sockets. */ return NF_ACCEPT; - net =dev_net (state->in ? state->in : state->out); return ipt_do_table(skb, ops->hooknum, state, - net->ipv4.iptable_security); + state->net->ipv4.iptable_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +2 -2
@@ -147,7 +147,7 @@ static unsigned int ipv4_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(dev_net(state->in), PF_INET, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET, ops->hooknum, skb); } static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,
@@ -158,7 +158,7 @@ static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,if (skb->len <sizeof (struct iphdr ) ||ip_hdrlen (skb) <sizeof (struct iphdr ))return NF_ACCEPT ; -return nf_conntrack_in (dev_net (state->out),PF_INET , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET , ops->hooknum, skb); }/* Connection tracking may drop packets, but never alters them, so
net/ipv6/netfilter/ip6_tables.c +4 -4
@@ -275,7 +275,8 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,return 0 ; } -static void trace_packet(const struct sk_buff *skb, +static void trace_packet(struct net *net, + const struct sk_buff *skb, unsigned int hook, const struct net_device *in, const struct net_device *out,
@@ -287,7 +288,6 @@ static void trace_packet(const struct sk_buff *skb,const char *hookname, *chainname, *comment;const struct ip6t_entry *iter;unsigned int rulenum =0 ; -struct net *net =dev_net (in ? in : out); root =get_entry (private->entries, private->hook_entry[hook]);
@@ -392,8 +392,8 @@ ip6t_do_table(struct sk_buff *skb,#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE )/* The packet is traced: log it */ if (unlikely (skb->nf_trace)) -trace_packet (skb, hook, state->in, state->out, - table->name, private, e); +trace_packet (state->net, skb, hook, state->in, + state->out, table->name, private, e);#endif /* Standard target? */ if (!t->u.kernel.target->target) {
net/ipv6/netfilter/ip6t_SYNPROXY.c +1 -1
@@ -317,7 +317,7 @@ static unsigned int ipv6_synproxy_hook(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *nhs) { - struct synproxy_net *snet = synproxy_pernet(dev_net(nhs->in ? : nhs->out)); + struct synproxy_net *snet = synproxy_pernet(nhs->net);enum ip_conntrack_info ctinfo;struct nf_conn *ct;struct nf_conn_synproxy *synproxy;
net/ipv6/netfilter/ip6table_filter.c +2 -3
@@ -35,9 +35,8 @@ static unsigned int ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - -return ip6t_do_table (skb, ops->hooknum, state, net->ipv6.ip6table_filter); + return ip6t_do_table(skb, ops->hooknum, state, + state->net->ipv6.ip6table_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv6/netfilter/ip6table_mangle.c +3 -3
@@ -58,7 +58,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) flowlabel = *((u_int32_t *)ipv6_hdr (skb)); ret =ip6t_do_table (skb,NF_INET_LOCAL_OUT , state, -dev_net (state->out)->ipv6.ip6table_mangle); + state->net->ipv6.ip6table_mangle); if (ret != NF_DROP && ret != NF_STOLEN && (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@@ -83,10 +83,10 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,return ip6t_mangle_out (skb, state);if (ops->hooknum ==NF_INET_POST_ROUTING )return ip6t_do_table (skb, ops->hooknum, state, -dev_net (state->out)->ipv6.ip6table_mangle); + state->net->ipv6.ip6table_mangle);/* INPUT/FORWARD */ return ip6t_do_table (skb, ops->hooknum, state, -dev_net (state->in)->ipv6.ip6table_mangle); + state->net->ipv6.ip6table_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv6/netfilter/ip6table_nat.c +2 -3
@@ -35,9 +35,8 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - struct net *net = nf_ct_net(ct); - -return ip6t_do_table (skb, ops->hooknum, state, net->ipv6.ip6table_nat); + return ip6t_do_table(skb, ops->hooknum, state, + state->net->ipv6.ip6table_nat); } static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
net/ipv6/netfilter/ip6table_raw.c +2 -3
@@ -22,9 +22,8 @@ static unsigned int ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - -return ip6t_do_table (skb, ops->hooknum, state, net->ipv6.ip6table_raw); + return ip6t_do_table(skb, ops->hooknum, state, + state->net->ipv6.ip6table_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv6/netfilter/ip6table_security.c +1 -3
@@ -39,10 +39,8 @@ static unsigned int ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - const struct net *net = dev_net(state->in ? state->in : state->out); - return ip6t_do_table(skb, ops->hooknum, state, - net->ipv6.ip6table_security); + state->net->ipv6.ip6table_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +2 -2
@@ -169,7 +169,7 @@ static unsigned int ipv6_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(dev_net(state->in), PF_INET6, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET6, ops->hooknum, skb); } static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,
@@ -181,7 +181,7 @@ static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,net_notice_ratelimited ("ipv6_conntrack_local: packet too short\n" );return NF_ACCEPT ; } -return nf_conntrack_in (dev_net (state->out),PF_INET6 , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET6 , ops->hooknum, skb); }static struct nf_hook_ops ipv6_conntrack_ops[]__read_mostly = {
net/netfilter/nfnetlink_queue_core.c +1 -2
@@ -641,8 +641,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)struct nfqnl_instance *queue;struct sk_buff *skb, *segs;int err = -ENOBUFS ; -struct net *net =dev_net (entry->state.in ? - entry->state.in : entry->state.out); +struct net *net = entry->state.net;struct nfnl_queue_net *q =nfnl_queue_pernet (net);/* rcu_read_lock()ed by nf_hook_slow() */
Signature · 1 line
2.2.1
PATCH 4/43 ebtables: Simplify the arguments to ebt_do_table
In reply to Eric W. BiedermanNearly everything thing of interest to ebt_do_table is already present in nf_hook_state. Simplify ebt_do_table by just passing in the skb, nf_hook_state, and the table. This make the code easier to read and maintenance easier.
To support this create an nf_hook_state on the stack in ebt_broute (the only caller without a nf_hook_state already available). This new nf_hook_state adds no new computations to ebt_broute, but does use a few more bytes of stack.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter_bridge/ebtables.h | 6 +++--- net/bridge/netfilter/ebtable_broute.c | 8 ++++++-- net/bridge/netfilter/ebtable_filter.c | 6 ++---- net/bridge/netfilter/ebtable_nat.c | 6 ++---- net/bridge/netfilter/ebtables.c | 13 +++++++------ 5 files changed, 20 insertions(+), 19 deletions(-)
include/linux/netfilter_bridge/ebtables.h +3 -3
@@ -111,9 +111,9 @@ struct ebt_table {extern struct ebt_table *ebt_register_table (struct net *net,const struct ebt_table *table);extern void ebt_unregister_table (struct net *net,struct ebt_table *table); -extern unsigned int ebt_do_table (unsigned int hook,struct sk_buff *skb, -const struct net_device *in,const struct net_device *out, -struct ebt_table *table); +extern unsigned int ebt_do_table (struct sk_buff *skb, +const struct nf_hook_state *state, +struct ebt_table *table);/* Used in the kernel match() functions */ #define FWINV (bool,invflg) ((bool) ^ !!(info->invflags & invflg))
net/bridge/netfilter/ebtable_broute.c +6 -2
@@ -50,10 +50,14 @@ static const struct ebt_table broute_table = {static int ebt_broute (struct sk_buff *skb) { +struct nf_hook_state state;int ret; - ret =ebt_do_table (NF_BR_BROUTING , skb, skb->dev,NULL , -dev_net (skb->dev)->xt.broute_table); +nf_hook_state_init (&state,NULL ,NF_BR_BROUTING ,INT_MIN , +NFPROTO_BRIDGE , skb->dev,NULL ,NULL , +dev_net (skb->dev),NULL ); + + ret =ebt_do_table (skb, &state, state.net->xt.broute_table);if (ret ==NF_DROP )return 1 ;/* route it */ return 0 ;/* bridge it */
net/bridge/netfilter/ebtable_filter.c +2 -4
@@ -60,16 +60,14 @@ static unsigned int ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ebt_do_table(ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_filter); + return ebt_do_table(skb, state, state->net->xt.frame_filter); }static unsigned int ebt_out_hook (const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { -return ebt_do_table (ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_filter); +return ebt_do_table (skb, state, state->net->xt.frame_filter); } static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
net/bridge/netfilter/ebtable_nat.c +2 -4
@@ -60,16 +60,14 @@ static unsigned int ebt_nat_in(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ebt_do_table(ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_nat); + return ebt_do_table(skb, state, state->net->xt.frame_nat); }static unsigned int ebt_nat_out (const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { -return ebt_do_table (ops->hooknum, skb, state->in, state->out, - state->net->xt.frame_nat); +return ebt_do_table (skb, state, state->net->xt.frame_nat); } static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
net/bridge/netfilter/ebtables.c +7 -6
@@ -183,10 +183,11 @@ struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry) }/* Do some firewalling */ -unsigned int ebt_do_table (unsigned int hook,struct sk_buff *skb, -const struct net_device *in,const struct net_device *out, -struct ebt_table *table) +unsigned int ebt_do_table (struct sk_buff *skb, +const struct nf_hook_state *state, +struct ebt_table *table) { +unsigned int hook = state->hook;int i, nentries;struct ebt_entry *point;struct ebt_counter *counter_base, *cb_base;
@@ -199,8 +200,8 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,struct xt_action_param acpar; acpar.family =NFPROTO_BRIDGE ; - acpar.in = in; - acpar.out = out; + acpar.in = state->in; + acpar.out = state->out; acpar.hotdrop = false; acpar.hooknum = hook;
@@ -220,7 +221,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb, base = private->entries; i =0 ;while (i < nentries) { -if (ebt_basic_match (point, skb, in, out)) +if (ebt_basic_match (point, skb, state->in, state->out)) goto letscontinue;if (EBT_MATCH_ITERATE (point, ebt_do_match, skb, &acpar) !=0 )
Signature · 1 line
2.2.1
PATCH 5/43 inet netfilter: Remove hook from ip6t_do_table, arp_do_table, ipt_do_table
In reply to Eric W. BiedermanThe values of ops->hooknum and state->hook are guaraneted to be equal making the hook argument to ip6t_do_table, arp_do_table, and ipt_do_table is unnecessary. Remove the unnecessary hook argument.
In the callers use state->hook instead of ops->hooknum for clarity and to reduce the number of cachelines the callers touch.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - net/ipv4/netfilter/arp_tables.c | 2 +- net/ipv4/netfilter/arptable_filter.c | 3 +-- net/ipv4/netfilter/ip_tables.c | 2 +- net/ipv4/netfilter/iptable_filter.c | 5 ++--- net/ipv4/netfilter/iptable_mangle.c | 12 +++++------- net/ipv4/netfilter/iptable_nat.c | 3 +-- net/ipv4/netfilter/iptable_raw.c | 5 ++--- net/ipv4/netfilter/iptable_security.c | 5 ++--- net/ipv6/netfilter/ip6_tables.c | 2 +- net/ipv6/netfilter/ip6table_filter.c | 3 +-- net/ipv6/netfilter/ip6table_mangle.c | 12 +++++------- net/ipv6/netfilter/ip6table_nat.c | 3 +-- net/ipv6/netfilter/ip6table_raw.c | 3 +-- net/ipv6/netfilter/ip6table_security.c | 3 +-- 17 files changed, 25 insertions(+), 41 deletions(-)
include/linux/netfilter_arp/arp_tables.h +0 -1
@@ -53,7 +53,6 @@ extern struct xt_table *arpt_register_table(struct net *net, const struct arpt_replace *repl);extern void arpt_unregister_table (struct xt_table *table);extern unsigned int arpt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table);
include/linux/netfilter_ipv4/ip_tables.h +0 -1
@@ -64,7 +64,6 @@ struct ipt_error {extern void *ipt_alloc_initial_table (const struct xt_table *);extern unsigned int ipt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table);
include/linux/netfilter_ipv6/ip6_tables.h +0 -1
@@ -30,7 +30,6 @@ extern struct xt_table *ip6t_register_table(struct net *net, const struct ip6t_replace *repl);extern void ip6t_unregister_table (struct net *net,struct xt_table *table);extern unsigned int ip6t_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table);
net/ipv4/netfilter/arp_tables.c +1 -1
@@ -247,10 +247,10 @@ struct arpt_entry *arpt_next_entry(const struct arpt_entry *entry) }unsigned int arpt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table) { +unsigned int hook = state->hook; static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));unsigned int verdict =NF_DROP ;const struct arphdr *arp;
net/ipv4/netfilter/arptable_filter.c +1 -2
@@ -30,8 +30,7 @@ static unsigned int arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return arpt_do_table(skb, ops->hooknum, state, - state->net->ipv4.arptable_filter); + return arpt_do_table(skb, state, state->net->ipv4.arptable_filter); }static struct nf_hook_ops *arpfilter_ops__read_mostly ;
net/ipv4/netfilter/ip_tables.c +1 -1
@@ -285,10 +285,10 @@ struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)/* Returns one of the generic firewall policies, like NF_ACCEPT. */ unsigned int ipt_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table) { +unsigned int hook = state->hook; static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));const struct iphdr *ip;/* Initializing verdict to NF_DROP keeps gcc happy. */
net/ipv4/netfilter/iptable_filter.c +2 -3
@@ -36,14 +36,13 @@ static unsigned int iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT && + if (state->hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.iptable_filter); + return ipt_do_table(skb, state, state->net->ipv4.iptable_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv4/netfilter/iptable_mangle.c +5 -7
@@ -58,8 +58,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) daddr = iph->daddr; tos = iph->tos; - ret =ipt_do_table (skb,NF_INET_LOCAL_OUT , state, - state->net->ipv4.iptable_mangle); + ret =ipt_do_table (skb, state, state->net->ipv4.iptable_mangle);/* Reroute for ANY change. */ if (ret !=NF_DROP && ret !=NF_STOLEN ) { iph =ip_hdr (skb);
@@ -83,14 +82,13 @@ iptable_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { -if (ops->hooknum ==NF_INET_LOCAL_OUT ) +if (state->hook ==NF_INET_LOCAL_OUT )return ipt_mangle_out (skb, state); -if (ops->hooknum ==NF_INET_POST_ROUTING ) -return ipt_do_table (skb, ops->hooknum, state, +if (state->hook ==NF_INET_POST_ROUTING ) +return ipt_do_table (skb, state, state->net->ipv4.iptable_mangle);/* PREROUTING/INPUT/FORWARD: */ -return ipt_do_table (skb, ops->hooknum, state, - state->net->ipv4.iptable_mangle); +return ipt_do_table (skb, state, state->net->ipv4.iptable_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv4/netfilter/iptable_nat.c +1 -2
@@ -33,8 +33,7 @@ static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.nat_table); + return ipt_do_table(skb, state, state->net->ipv4.nat_table); } static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,
net/ipv4/netfilter/iptable_raw.c +2 -3
@@ -23,14 +23,13 @@ static unsigned int iptable_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT && + if (state->hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* root is playing with raw sockets. */ return NF_ACCEPT; - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.iptable_raw); + return ipt_do_table(skb, state, state->net->ipv4.iptable_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv4/netfilter/iptable_security.c +2 -3
@@ -40,14 +40,13 @@ static unsigned int iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT && + if (state->hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr))) /* Somebody is playing with raw sockets. */ return NF_ACCEPT; - return ipt_do_table(skb, ops->hooknum, state, - state->net->ipv4.iptable_security); + return ipt_do_table(skb, state, state->net->ipv4.iptable_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
net/ipv6/netfilter/ip6_tables.c +1 -1
@@ -314,10 +314,10 @@ ip6t_next_entry(const struct ip6t_entry *entry)/* Returns one of the generic firewall policies, like NF_ACCEPT. */ unsigned int ip6t_do_table (struct sk_buff *skb, -unsigned int hook,const struct nf_hook_state *state,struct xt_table *table) { +unsigned int hook = state->hook; static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));/* Initializing verdict to NF_DROP keeps gcc happy. */ unsigned int verdict =NF_DROP ;
net/ipv6/netfilter/ip6table_filter.c +1 -2
@@ -35,8 +35,7 @@ static unsigned int ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_filter); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_filter); }static struct nf_hook_ops *filter_ops__read_mostly ;
net/ipv6/netfilter/ip6table_mangle.c +5 -7
@@ -57,8 +57,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)/* flowlabel and prio (includes version, which shouldn't change either */ flowlabel = *((u_int32_t *)ipv6_hdr (skb)); - ret =ip6t_do_table (skb,NF_INET_LOCAL_OUT , state, - state->net->ipv6.ip6table_mangle); + ret =ip6t_do_table (skb, state, state->net->ipv6.ip6table_mangle); if (ret != NF_DROP && ret != NF_STOLEN && (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@@ -79,14 +78,13 @@ static unsigned int ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - if (ops->hooknum == NF_INET_LOCAL_OUT) + if (state->hook == NF_INET_LOCAL_OUT) return ip6t_mangle_out(skb, state); -if (ops->hooknum ==NF_INET_POST_ROUTING ) -return ip6t_do_table (skb, ops->hooknum, state, +if (state->hook ==NF_INET_POST_ROUTING ) +return ip6t_do_table (skb, state, state->net->ipv6.ip6table_mangle);/* INPUT/FORWARD */ -return ip6t_do_table (skb, ops->hooknum, state, - state->net->ipv6.ip6table_mangle); +return ip6t_do_table (skb, state, state->net->ipv6.ip6table_mangle); }static struct nf_hook_ops *mangle_ops__read_mostly ;
net/ipv6/netfilter/ip6table_nat.c +1 -2
@@ -35,8 +35,7 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,const struct nf_hook_state *state, struct nf_conn *ct) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_nat); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_nat); } static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
net/ipv6/netfilter/ip6table_raw.c +1 -2
@@ -22,8 +22,7 @@ static unsigned int ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_raw); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_raw); }static struct nf_hook_ops *rawtable_ops__read_mostly ;
net/ipv6/netfilter/ip6table_security.c +1 -2
@@ -39,8 +39,7 @@ static unsigned int ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip6t_do_table(skb, ops->hooknum, state, - state->net->ipv6.ip6table_security); + return ip6t_do_table(skb, state, state->net->ipv6.ip6table_security); }static struct nf_hook_ops *sectbl_ops__read_mostly ;
Signature · 1 line
2.2.1
PATCH 6/43 inet netfilter: Prefer state->hook to ops->hooknum
In reply to Eric W. BiedermanThe values of nf_hook_state.hook and nf_hook_ops.hooknum must be the same by definition.
We are more likely to access the fields in nf_hook_state over the fields in nf_hook_ops so with a little luck this results in fewer cache line misses, and slightly more consistent code.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 ++-- net/ipv4/netfilter/nf_defrag_ipv4.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 14 +++++++------- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 4 ++-- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 4 ++-- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 14 +++++++------- 6 files changed, 21 insertions(+), 21 deletions(-)
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +2 -2
@@ -147,7 +147,7 @@ static unsigned int ipv4_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(state->net, PF_INET, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET, state->hook, skb); } static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,
@@ -158,7 +158,7 @@ static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,if (skb->len <sizeof (struct iphdr ) ||ip_hdrlen (skb) <sizeof (struct iphdr ))return NF_ACCEPT ; -return nf_conntrack_in (state->net,PF_INET , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET , state->hook, skb); }/* Connection tracking may drop packets, but never alters them, so
net/ipv4/netfilter/nf_defrag_ipv4.c +1 -1
@@ -83,7 +83,7 @@ static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops,/* Gather fragments. */ if (ip_is_fragment (ip_hdr (skb))) {enum ip_defrag_users user = -nf_ct_defrag_user (ops->hooknum, skb); +nf_ct_defrag_user (state->hook, skb);if (nf_ct_ipv4_gather_frags (skb, user))return NF_STOLEN ;
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +7 -7
@@ -266,7 +266,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,enum ip_conntrack_info ctinfo;struct nf_conn_nat *nat;/* maniptype == SRC for postrouting. */ -enum nf_nat_manip_type maniptype =HOOK2MANIP (ops->hooknum); +enum nf_nat_manip_type maniptype =HOOK2MANIP (state->hook);/* We never see fragments: conntrack defrags on pre-routing * and local-out, and nf_nat_out protects post-routing.
@@ -295,7 +295,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,case IP_CT_RELATED_REPLY :if (ip_hdr (skb)->protocol ==IPPROTO_ICMP ) {if (!nf_nat_icmp_reply_translation (skb, ct, ctinfo, - ops->hooknum)) + state->hook))return NF_DROP ;else return NF_ACCEPT ;
@@ -312,17 +312,17 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (ret !=NF_ACCEPT )return ret; -if (nf_nat_initialized (ct,HOOK2MANIP (ops->hooknum))) +if (nf_nat_initialized (ct,HOOK2MANIP (state->hook)))break ; - ret =nf_nat_alloc_null_binding (ct, ops->hooknum); + ret =nf_nat_alloc_null_binding (ct, state->hook);if (ret !=NF_ACCEPT )return ret; }else {pr_debug ("Already setup manip %s for ct %p\n" , maniptype ==NF_NAT_MANIP_SRC ?"SRC" :"DST" , ct); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; }
@@ -332,11 +332,11 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,/* ESTABLISHED */ NF_CT_ASSERT (ctinfo ==IP_CT_ESTABLISHED || ctinfo ==IP_CT_ESTABLISHED_REPLY ); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, state->out)) +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; } -return nf_nat_packet (ct, ctinfo, ops->hooknum, skb); +return nf_nat_packet (ct, ctinfo, state->hook, skb); oif_changed:nf_ct_kill_acct (ct, ctinfo, skb);
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +2 -2
@@ -169,7 +169,7 @@ static unsigned int ipv6_conntrack_in(const struct nf_hook_ops *ops,struct sk_buff *skb, const struct nf_hook_state *state) { - return nf_conntrack_in(state->net, PF_INET6, ops->hooknum, skb); + return nf_conntrack_in(state->net, PF_INET6, state->hook, skb); } static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,
@@ -181,7 +181,7 @@ static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,net_notice_ratelimited ("ipv6_conntrack_local: packet too short\n" );return NF_ACCEPT ; } -return nf_conntrack_in (state->net,PF_INET6 , ops->hooknum, skb); +return nf_conntrack_in (state->net,PF_INET6 , state->hook, skb); }static struct nf_hook_ops ipv6_conntrack_ops[]__read_mostly = {
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +2 -2
@@ -64,7 +64,7 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,return NF_ACCEPT ;#endif - reasm =nf_ct_frag6_gather (skb,nf_ct6_defrag_user (ops->hooknum, skb)); + reasm =nf_ct_frag6_gather (skb,nf_ct6_defrag_user (state->hook, skb));/* queued */ if (reasm ==NULL )return NF_STOLEN ;
@@ -75,7 +75,7 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,nf_ct_frag6_consume_orig (reasm); -NF_HOOK_THRESH (NFPROTO_IPV6 , ops->hooknum, state->net, state->sk, reasm, +NF_HOOK_THRESH (NFPROTO_IPV6 , state->hook, state->net, state->sk, reasm, state->in, state->out, state->okfn,NF_IP6_PRI_CONNTRACK_DEFRAG +1 );
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +7 -7
@@ -272,7 +272,7 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,struct nf_conn *ct;enum ip_conntrack_info ctinfo;struct nf_conn_nat *nat; -enum nf_nat_manip_type maniptype =HOOK2MANIP (ops->hooknum); +enum nf_nat_manip_type maniptype =HOOK2MANIP (state->hook);__be16 frag_off;int hdrlen;u8 nexthdr;
@@ -303,7 +303,7 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (hdrlen >=0 && nexthdr ==IPPROTO_ICMPV6 ) {if (!nf_nat_icmpv6_reply_translation (skb, ct, ctinfo, - ops->hooknum, + state->hook, hdrlen))return NF_DROP ;else
@@ -321,17 +321,17 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (ret !=NF_ACCEPT )return ret; -if (nf_nat_initialized (ct,HOOK2MANIP (ops->hooknum))) +if (nf_nat_initialized (ct,HOOK2MANIP (state->hook)))break ; - ret =nf_nat_alloc_null_binding (ct, ops->hooknum); + ret =nf_nat_alloc_null_binding (ct, state->hook);if (ret !=NF_ACCEPT )return ret; }else {pr_debug ("Already setup manip %s for ct %p\n" , maniptype ==NF_NAT_MANIP_SRC ?"SRC" :"DST" , ct); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, state->out)) +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; }break ;
@@ -340,11 +340,11 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,/* ESTABLISHED */ NF_CT_ASSERT (ctinfo ==IP_CT_ESTABLISHED || ctinfo ==IP_CT_ESTABLISHED_REPLY ); -if (nf_nat_oif_changed (ops->hooknum, ctinfo, nat, state->out)) +if (nf_nat_oif_changed (state->hook, ctinfo, nat, state->out)) goto oif_changed; } -return nf_nat_packet (ct, ctinfo, ops->hooknum, skb); +return nf_nat_packet (ct, ctinfo, state->hook, skb); oif_changed:nf_ct_kill_acct (ct, ctinfo, skb);
Signature · 1 line
2.2.1
PATCH 7/43 nftables: kill nft_pktinfo.ops
In reply to Eric W. Biederman- Add nft_pktinfo.pf to replace ops->pf
- Add nft_pktinfo.hook to replace ops->hooknum
This simplifies the code, makes it more readable, and likely reduces cache line misses. Maintainability is enhanced as the details of nft_hook_ops are of no concern to the recpients of nft_pktinfo.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/nf_tables.h | 9 ++++----- include/net/netfilter/nf_tables_ipv4.h | 3 +-- include/net/netfilter/nf_tables_ipv6.h | 3 +-- net/bridge/netfilter/nf_tables_bridge.c | 16 +++++++--------- net/bridge/netfilter/nft_reject_bridge.c | 12 ++++++------ net/ipv4/netfilter/nf_tables_arp.c | 2 +- net/ipv4/netfilter/nf_tables_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_nat_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/netfilter/nft_masq_ipv4.c | 2 +- net/ipv4/netfilter/nft_redir_ipv4.c | 2 +- net/ipv4/netfilter/nft_reject_ipv4.c | 5 ++--- net/ipv6/netfilter/nf_tables_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_nat_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/netfilter/nft_redir_ipv6.c | 3 +-- net/ipv6/netfilter/nft_reject_ipv6.c | 5 ++--- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nf_tables_netdev.c | 16 +++++++--------- net/netfilter/nft_log.c | 2 +- net/netfilter/nft_meta.c | 4 ++-- net/netfilter/nft_queue.c | 2 +- net/netfilter/nft_reject_inet.c | 14 +++++++------- 23 files changed, 52 insertions(+), 62 deletions(-)
include/net/netfilter/nf_tables.h +4 -5
@@ -16,7 +16,8 @@ struct nft_pktinfo {struct sk_buff *skb;const struct net_device *in;const struct net_device *out; -const struct nf_hook_ops *ops; +u8 pf; +u8 hook;u8 nhoff;u8 thoff;u8 tprot;
@@ -25,16 +26,14 @@ struct nft_pktinfo { };static inline void nft_set_pktinfo (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { pkt->skb = skb; pkt->in = pkt->xt.in = state->in; pkt->out = pkt->xt.out = state->out; - pkt->ops = ops; - pkt->xt.hooknum = ops->hooknum; - pkt->xt.family = ops->pf; + pkt->hook = pkt->xt.hooknum = state->hook; + pkt->pf = pkt->xt.family = state->pf; }/**
include/net/netfilter/nf_tables_ipv4.h +1 -2
@@ -6,13 +6,12 @@static inline void nft_set_pktinfo_ipv4 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {struct iphdr *ip; -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); ip =ip_hdr (pkt->skb); pkt->tprot = ip->protocol;
include/net/netfilter/nf_tables_ipv6.h +1 -2
@@ -6,14 +6,13 @@static inline int nft_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {int protohdr, thoff =0 ;unsigned short frag_off; -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); protohdr =ipv6_find_hdr (pkt->skb, &thoff,-1 , &frag_off,NULL );/* If malformed, drop it */
net/bridge/netfilter/nf_tables_bridge.c +7 -9
@@ -65,27 +65,25 @@ int nft_bridge_ip6hdr_validate(struct sk_buff *skb)EXPORT_SYMBOL_GPL (nft_bridge_ip6hdr_validate);static inline void nft_bridge_set_pktinfo_ipv4 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {if (nft_bridge_iphdr_validate (skb)) -nft_set_pktinfo_ipv4 (pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (pkt, skb, state);else -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); }static inline void nft_bridge_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {#if IS_ENABLED (CONFIG_IPV6 )if (nft_bridge_ip6hdr_validate (skb) && -nft_set_pktinfo_ipv6 (pkt, ops, skb, state) ==0 ) +nft_set_pktinfo_ipv6 (pkt, skb, state) ==0 )return ;#endif -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); } static unsigned int
@@ -97,13 +95,13 @@ nft_do_chain_bridge(const struct nf_hook_ops *ops,switch (eth_hdr (skb)->h_proto) {case htons (ETH_P_IP ): -nft_bridge_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_bridge_set_pktinfo_ipv4 (&pkt, skb, state);break ;case htons (ETH_P_IPV6 ): -nft_bridge_set_pktinfo_ipv6 (&pkt, ops, skb, state); +nft_bridge_set_pktinfo_ipv6 (&pkt, skb, state);break ;default : -nft_set_pktinfo (&pkt, ops, skb, state); +nft_set_pktinfo (&pkt, skb, state);break ; }
net/bridge/netfilter/nft_reject_bridge.c +6 -6
@@ -273,16 +273,16 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nft_reject_br_send_v4_unreach (pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook, priv->icmp_code);break ;case NFT_REJECT_TCP_RST :nft_reject_br_send_v4_tcp_reset (pkt->skb, pkt->in, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nft_reject_br_send_v4_unreach (pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook,nft_reject_icmp_code (priv->icmp_code));break ; }
@@ -291,16 +291,16 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook, priv->icmp_code);break ;case NFT_REJECT_TCP_RST :nft_reject_br_send_v6_tcp_reset (net, pkt->skb, pkt->in, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->ops->hooknum, + pkt->hook,nft_reject_icmpv6_code (priv->icmp_code));break ; }
net/ipv4/netfilter/nf_tables_arp.c +1 -1
@@ -21,7 +21,7 @@ nft_do_chain_arp(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo (&pkt, ops, skb, state); +nft_set_pktinfo (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv4/netfilter/nf_tables_ipv4.c +1 -1
@@ -24,7 +24,7 @@ static unsigned int nft_do_chain_ipv4(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv4/netfilter/nft_chain_nat_ipv4.c +1 -1
@@ -33,7 +33,7 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv4/netfilter/nft_chain_route_ipv4.c +1 -1
@@ -37,7 +37,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops, ip_hdrlen(skb) < sizeof(struct iphdr))return NF_ACCEPT ; -nft_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv4 (&pkt, skb, state); mark = skb->mark; iph =ip_hdr (skb);
net/ipv4/netfilter/nft_masq_ipv4.c +1 -1
@@ -26,7 +26,7 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,memset (&range,0 ,sizeof (range)); range.flags = priv->flags; - regs->verdict.code =nf_nat_masquerade_ipv4 (pkt->skb, pkt->ops->hooknum, + regs->verdict.code =nf_nat_masquerade_ipv4 (pkt->skb, pkt->hook, &range, pkt->out); }
net/ipv4/netfilter/nft_redir_ipv4.c +1 -1
@@ -36,7 +36,7 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr, mr.range[0 ].flags |= priv->flags; regs->verdict.code =nf_nat_redirect_ipv4 (pkt->skb, &mr, - pkt->ops->hooknum); + pkt->hook); }static struct nft_expr_type nft_redir_ipv4_type;
net/ipv4/netfilter/nft_reject_ipv4.c +2 -3
@@ -27,11 +27,10 @@ static void nft_reject_ipv4_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach (pkt->skb, priv->icmp_code, - pkt->ops->hooknum); +nf_send_unreach (pkt->skb, priv->icmp_code, pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset (pkt->skb, pkt->ops->hooknum); +nf_send_reset (pkt->skb, pkt->hook);break ;default :break ;
net/ipv6/netfilter/nf_tables_ipv6.c +1 -1
@@ -23,7 +23,7 @@ static unsigned int nft_do_chain_ipv6(const struct nf_hook_ops *ops,struct nft_pktinfo pkt;/* malformed packet, drop it */ -if (nft_set_pktinfo_ipv6 (&pkt, ops, skb, state) <0 ) +if (nft_set_pktinfo_ipv6 (&pkt, skb, state) <0 )return NF_DROP ;return nft_do_chain (&pkt, ops);
net/ipv6/netfilter/nft_chain_nat_ipv6.c +1 -1
@@ -31,7 +31,7 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops, {struct nft_pktinfo pkt; -nft_set_pktinfo_ipv6 (&pkt, ops, skb, state); +nft_set_pktinfo_ipv6 (&pkt, skb, state);return nft_do_chain (&pkt, ops); }
net/ipv6/netfilter/nft_chain_route_ipv6.c +1 -1
@@ -33,7 +33,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,u32 mark, flowlabel;/* malformed packet, drop it */ -if (nft_set_pktinfo_ipv6 (&pkt, ops, skb, state) <0 ) +if (nft_set_pktinfo_ipv6 (&pkt, skb, state) <0 )return NF_DROP ;/* save source/dest address, mark, hoplimit, flowlabel, priority */
net/ipv6/netfilter/nft_redir_ipv6.c +1 -2
@@ -35,8 +35,7 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr, range.flags |= priv->flags; - regs->verdict.code =nf_nat_redirect_ipv6 (pkt->skb, &range, - pkt->ops->hooknum); + regs->verdict.code =nf_nat_redirect_ipv6 (pkt->skb, &range, pkt->hook); }static struct nft_expr_type nft_redir_ipv6_type;
net/ipv6/netfilter/nft_reject_ipv6.c +2 -3
@@ -28,11 +28,10 @@ static void nft_reject_ipv6_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach6 (net, pkt->skb, priv->icmp_code, - pkt->ops->hooknum); +nf_send_unreach6 (net, pkt->skb, priv->icmp_code, pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->ops->hooknum); +nf_send_reset6 (net, pkt->skb, pkt->hook);break ;default :break ;
net/netfilter/nf_tables_core.c +1 -1
@@ -50,7 +50,7 @@ static void __nft_trace_packet(const struct nft_pktinfo *pkt, {struct net *net =dev_net (pkt->in ? pkt->in : pkt->out); -nf_log_trace (net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in, +nf_log_trace (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &trace_loginfo,"TRACE: %s:%s:%s:%u " , chain->table->name, chain->name, comments[type], rulenum);
net/netfilter/nf_tables_netdev.c +7 -9
@@ -17,13 +17,13 @@static inline void nft_netdev_set_pktinfo_ipv4 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb, +struct sk_buff *skb,const struct nf_hook_state *state) {struct iphdr *iph, _iph;u32 len, thoff; -nft_set_pktinfo (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); iph =skb_header_pointer (skb,skb_network_offset (skb),sizeof (*iph), &_iph);
@@ -48,7 +48,6 @@ nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,static inline void __nft_netdev_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -82,12 +81,11 @@ __nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt, }static inline void nft_netdev_set_pktinfo_ipv6 (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops,struct sk_buff *skb,const struct nf_hook_state *state) { -nft_set_pktinfo (pkt, ops, skb, state); -__nft_netdev_set_pktinfo_ipv6 (pkt, ops, skb, state); +nft_set_pktinfo (pkt, skb, state); +__nft_netdev_set_pktinfo_ipv6 (pkt, skb, state); } static unsigned int
@@ -98,13 +96,13 @@ nft_do_chain_netdev(const struct nf_hook_ops *ops, struct sk_buff *skb,switch (eth_hdr (skb)->h_proto) {case htons (ETH_P_IP ): -nft_netdev_set_pktinfo_ipv4 (&pkt, ops, skb, state); +nft_netdev_set_pktinfo_ipv4 (&pkt, skb, state);break ;case htons (ETH_P_IPV6 ): -nft_netdev_set_pktinfo_ipv6 (&pkt, ops, skb, state); +nft_netdev_set_pktinfo_ipv6 (&pkt, skb, state);break ;default : -nft_set_pktinfo (&pkt, ops, skb, state); +nft_set_pktinfo (&pkt, skb, state);break ; }
net/netfilter/nft_log.c +1 -1
@@ -33,7 +33,7 @@ static void nft_log_eval(const struct nft_expr *expr,const struct nft_log *priv =nft_expr_priv (expr);struct net *net =dev_net (pkt->in ? pkt->in : pkt->out); -nf_log_packet (net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in, +nf_log_packet (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &priv->loginfo,"%s" , priv->prefix); }
net/netfilter/nft_meta.c +2 -2
@@ -42,7 +42,7 @@ void nft_meta_get_eval(const struct nft_expr *expr, *(__be16 *)dest = skb->protocol;break ;case NFT_META_NFPROTO : - *dest = pkt->ops->pf; + *dest = pkt->pf;break ;case NFT_META_L4PROTO : *dest = pkt->tprot;
@@ -135,7 +135,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,break ; } -switch (pkt->ops->pf) { +switch (pkt->pf) {case NFPROTO_IPV4 :if (ipv4_is_multicast (ip_hdr (skb)->daddr)) *dest =PACKET_MULTICAST ;
net/netfilter/nft_queue.c +1 -1
@@ -42,7 +42,7 @@ static void nft_queue_eval(const struct nft_expr *expr, queue = priv->queuenum + cpu % priv->queues_total; }else { queue =nfqueue_hash (pkt->skb, queue, - priv->queues_total, pkt->ops->pf, + priv->queues_total, pkt->pf, jhash_initval); } }
net/netfilter/nft_reject_inet.c +7 -7
@@ -24,20 +24,20 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,struct nft_reject *priv =nft_expr_priv (expr);struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out); -switch (pkt->ops->pf) { +switch (pkt->pf) {case NFPROTO_IPV4 :switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nf_send_unreach (pkt->skb, priv->icmp_code, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset (pkt->skb, pkt->ops->hooknum); +nf_send_reset (pkt->skb, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nf_send_unreach (pkt->skb,nft_reject_icmp_code (priv->icmp_code), - pkt->ops->hooknum); + pkt->hook);break ; }break ;
@@ -45,15 +45,15 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,switch (priv->type) {case NFT_REJECT_ICMP_UNREACH :nf_send_unreach6 (net, pkt->skb, priv->icmp_code, - pkt->ops->hooknum); + pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->ops->hooknum); +nf_send_reset6 (net, pkt->skb, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH :nf_send_unreach6 (net, pkt->skb,nft_reject_icmpv6_code (priv->icmp_code), - pkt->ops->hooknum); + pkt->hook);break ; }break ;
Signature · 1 line
2.2.1
PATCH 8/43 tc: Simplify em_ipset_match
In reply to Eric W. Biedermanem->net is always set and always available, use it in preference to dev_net(skb->dev).
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/sched/em_ipset.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/em_ipset.c +2 -2
@@ -92,8 +92,8 @@ static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,rcu_read_lock (); -if (dev && skb->skb_iif) - indev =dev_get_by_index_rcu (dev_net (dev), skb->skb_iif); +if (skb->skb_iif) + indev =dev_get_by_index_rcu (em->net, skb->skb_iif); acpar.in = indev ? indev : dev; acpar.out = dev;
Signature · 1 line
2.2.1
PATCH 9/43 x_tables: Pass struct net in xt_action_param
In reply to Eric W. BiedermanAs xt_action_param lives on the stack this does not bloat any persistent data structures.
This is a first step in making netfilter code that needs to know which network namespace it is executing in simpler.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter/x_tables.h | 2 ++ include/net/netfilter/nf_tables.h | 1 + net/bridge/netfilter/ebtables.c | 1 + net/ipv4/netfilter/arp_tables.c | 1 + net/ipv4/netfilter/ip_tables.c | 1 + net/ipv6/netfilter/ip6_tables.c | 1 + net/sched/act_ipt.c | 1 + net/sched/em_ipset.c | 1 + 8 files changed, 9 insertions(+)
include/linux/netfilter/x_tables.h +2 -0
@@ -12,6 +12,7 @@* @target: the target extension * @matchinfo: per-match data * @targetinfo: per-target data +* @net network namespace of through which the action was invoked * @in: input netdevice * @out: output netdevice * @fragoff: packet is a fragment, this is the data offset
@@ -33,6 +34,7 @@ struct xt_action_param {union {const void *matchinfo, *targinfo; }; +struct net *net;const struct net_device *in, *out;int fragoff;unsigned int thoff;
include/net/netfilter/nf_tables.h +1 -0
@@ -30,6 +30,7 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, const struct nf_hook_state *state) { pkt->skb = skb; + pkt->xt.net = state->net; pkt->in = pkt->xt.in = state->in; pkt->out = pkt->xt.out = state->out; pkt->hook = pkt->xt.hooknum = state->hook;
net/bridge/netfilter/ebtables.c +1 -0
@@ -200,6 +200,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,struct xt_action_param acpar; acpar.family =NFPROTO_BRIDGE ; + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.hotdrop = false;
net/ipv4/netfilter/arp_tables.c +1 -0
@@ -280,6 +280,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, e =get_entry (table_base, private->hook_entry[hook]); back =get_entry (table_base, private->underflow[hook]); + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.hooknum = hook;
net/ipv4/netfilter/ip_tables.c +1 -0
@@ -314,6 +314,7 @@ ipt_do_table(struct sk_buff *skb, acpar.fragoff =ntohs (ip->frag_off) &IP_OFFSET ; acpar.thoff =ip_hdrlen (skb); acpar.hotdrop = false; + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.family =NFPROTO_IPV4 ;
net/ipv6/netfilter/ip6_tables.c +1 -0
@@ -339,6 +339,7 @@ ip6t_do_table(struct sk_buff *skb,* rule is also a fragment-specific rule, non-fragments won't * match it. */ acpar.hotdrop = false; + acpar.net = state->net; acpar.in = state->in; acpar.out = state->out; acpar.family =NFPROTO_IPV6 ;
net/sched/act_ipt.c +1 -0
@@ -189,6 +189,7 @@ static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a,* worry later - danger - this API seems to have changed * from earlier kernels */ + par.net =dev_net (skb->dev); par.in = skb->dev; par.out =NULL ; par.hooknum = ipt->tcfi_hook;
net/sched/em_ipset.c +1 -0
@@ -95,6 +95,7 @@ static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,if (skb->skb_iif) indev =dev_get_by_index_rcu (em->net, skb->skb_iif); + acpar.net = em->net; acpar.in = indev ? indev : dev; acpar.out = dev;
Signature · 1 line
2.2.1
PATCH 10/43 x_tables: Use par->net instead of computing from the passed net devices
In reply to Eric W. BiedermanSigned-off-by "Eric W. Biederman" <[email protected]>
--- net/bridge/netfilter/ebt_log.c | 2 +- net/bridge/netfilter/ebt_nflog.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/ipt_rpfilter.c | 5 ++--- net/ipv6/netfilter/ip6t_REJECT.c | 2 +- net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +- net/ipv6/netfilter/ip6t_rpfilter.c | 6 +++--- net/netfilter/ipset/ip_set_core.c | 9 +++------ net/netfilter/xt_LOG.c | 2 +- net/netfilter/xt_NFLOG.c | 2 +- net/netfilter/xt_TCPMSS.c | 2 +- net/netfilter/xt_TEE.c | 24 ++++-------------------- net/netfilter/xt_TPROXY.c | 24 ++++++++++++------------ net/netfilter/xt_addrtype.c | 4 ++-- net/netfilter/xt_connlimit.c | 2 +- net/netfilter/xt_osf.c | 2 +- net/netfilter/xt_recent.c | 2 +- net/netfilter/xt_socket.c | 14 ++++++++------ 18 files changed, 45 insertions(+), 63 deletions(-)
net/bridge/netfilter/ebt_log.c +1 -1
@@ -180,7 +180,7 @@ ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct ebt_log_info *info = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_LOG ; li.u.log.level = info->loglevel;
net/bridge/netfilter/ebt_nflog.c +1 -1
@@ -24,7 +24,7 @@ ebt_nflog_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct ebt_nflog_info *info = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_ULOG ; li.u.ulog.copy_len = info->len;
net/ipv4/netfilter/ipt_SYNPROXY.c +1 -1
@@ -257,7 +257,7 @@ static unsigned int synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_synproxy_info *info = par->targinfo; -struct synproxy_net *snet =synproxy_pernet (dev_net (par->in)); +struct synproxy_net *snet =synproxy_pernet (par->net);struct synproxy_options opts = {};struct tcphdr *th, _th;
net/ipv4/netfilter/ipt_rpfilter.c +2 -3
@@ -32,12 +32,11 @@ static __be32 rpfilter_get_saddr(__be32 addr)return addr; } -static bool rpfilter_lookup_reverse (struct flowi4 *fl4, +static bool rpfilter_lookup_reverse (struct net *net,struct flowi4 *fl4,const struct net_device *dev,u8 flags) {struct fib_result res;bool dev_match; -struct net *net =dev_net (dev);int ret__maybe_unused ;if (fib_lookup (net, fl4, &res))
@@ -98,7 +97,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) flow.flowi4_tos =RT_TOS (iph->tos); flow.flowi4_scope =RT_SCOPE_UNIVERSE ; -return rpfilter_lookup_reverse (&flow, par->in, info->flags) ^ invert; +return rpfilter_lookup_reverse (par->net, &flow, par->in, info->flags) ^ invert; }static int rpfilter_check (const struct xt_mtchk_param *par)
net/ipv6/netfilter/ip6t_REJECT.c +1 -1
@@ -40,7 +40,7 @@ static unsigned int reject_tg6(struct sk_buff *skb, const struct xt_action_param *par) { const struct ip6t_reject_info *reject = par->targinfo; -struct net *net =dev_net ((par->in !=NULL ) ? par->in : par->out); +struct net *net = par->net;pr_debug ("%s: medium point\n" , __func__);switch (reject->with) {
net/ipv6/netfilter/ip6t_SYNPROXY.c +1 -1
@@ -272,7 +272,7 @@ static unsigned int synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_synproxy_info *info = par->targinfo; -struct synproxy_net *snet =synproxy_pernet (dev_net (par->in)); +struct synproxy_net *snet =synproxy_pernet (par->net);struct synproxy_options opts = {};struct tcphdr *th, _th;
net/ipv6/netfilter/ip6t_rpfilter.c +3 -3
@@ -26,7 +26,7 @@ static bool rpfilter_addr_unicast(const struct in6_addr *addr)return addr_type &IPV6_ADDR_UNICAST ; } -static bool rpfilter_lookup_reverse6 (const struct sk_buff *skb, +static bool rpfilter_lookup_reverse6 (struct net *net,const struct sk_buff *skb,const struct net_device *dev,u8 flags) {struct rt6_info *rt;
@@ -53,7 +53,7 @@ static bool rpfilter_lookup_reverse6(const struct sk_buff *skb, lookup_flags |=RT6_LOOKUP_F_IFACE ; } - rt = (void *)ip6_route_lookup (dev_net (dev), &fl6, lookup_flags); + rt = (void *)ip6_route_lookup (net, &fl6, lookup_flags);if (rt->dst.error) goto out;
@@ -93,7 +93,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)if (unlikely (saddrtype ==IPV6_ADDR_ANY ))return true ^ invert;/* not routable: forward path will drop it */ -return rpfilter_lookup_reverse6 (skb, par->in, info->flags) ^ invert; +return rpfilter_lookup_reverse6 (par->net, skb, par->in, info->flags) ^ invert; }static int rpfilter_check (const struct xt_mtchk_param *par)
net/netfilter/ipset/ip_set_core.c +3 -6
@@ -519,8 +519,7 @@ int ip_set_test(ip_set_id_t index, const struct sk_buff *skb, const struct xt_action_param *par, struct ip_set_adt_opt *opt) { - struct ip_set *set = ip_set_rcu_get( -dev_net (par->in ? par->in : par->out), index); + struct ip_set *set = ip_set_rcu_get(par->net, index);int ret =0 ;BUG_ON (!set);
@@ -558,8 +557,7 @@ int ip_set_add(ip_set_id_t index, const struct sk_buff *skb, const struct xt_action_param *par, struct ip_set_adt_opt *opt) { - struct ip_set *set = ip_set_rcu_get( -dev_net (par->in ? par->in : par->out), index); + struct ip_set *set = ip_set_rcu_get(par->net, index);int ret;BUG_ON (!set);
@@ -581,8 +579,7 @@ int ip_set_del(ip_set_id_t index, const struct sk_buff *skb, const struct xt_action_param *par, struct ip_set_adt_opt *opt) { - struct ip_set *set = ip_set_rcu_get( -dev_net (par->in ? par->in : par->out), index); + struct ip_set *set = ip_set_rcu_get(par->net, index);int ret =0 ;BUG_ON (!set);
net/netfilter/xt_LOG.c +1 -1
@@ -33,7 +33,7 @@ log_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_log_info *loginfo = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_LOG ; li.u.log.level = loginfo->level;
net/netfilter/xt_NFLOG.c +1 -1
@@ -26,7 +26,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_nflog_info *info = par->targinfo;struct nf_loginfo li; -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net; li.type =NF_LOG_TYPE_ULOG ; li.u.ulog.copy_len = info->len;
net/netfilter/xt_TCPMSS.c +1 -1
@@ -108,7 +108,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,return -1 ;if (info->mss ==XT_TCPMSS_CLAMP_PMTU ) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;unsigned int in_mtu =tcpmss_reverse_mtu (net, skb, family);if (dst_mtu (skb_dst (skb)) <= minlen) {
net/netfilter/xt_TEE.c +4 -20
@@ -39,25 +39,10 @@ struct xt_tee_priv {static const union nf_inet_addr tee_zero_address; static DEFINE_PER_CPU(bool, tee_active); -static struct net *pick_net (struct sk_buff *skb) -{ -#ifdef CONFIG_NET_NS -const struct dst_entry *dst; - -if (skb->dev !=NULL ) -return dev_net (skb->dev); - dst =skb_dst (skb); -if (dst !=NULL && dst->dev !=NULL ) -return dev_net (dst->dev); -#endif -return &init_net; -} -static bool -tee_tg_route4 (struct sk_buff *skb,const struct xt_tee_tginfo *info) +tee_tg_route4 (struct net *net,struct sk_buff *skb,const struct xt_tee_tginfo *info) {const struct iphdr *iph =ip_hdr (skb); -struct net *net =pick_net (skb);struct rtable *rt;struct flowi4 fl4;
@@ -124,7 +109,7 @@ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) --iph->ttl;ip_send_check (iph); -if (tee_tg_route4 (skb, info)) { +if (tee_tg_route4 (par->net, skb, info)) {__this_cpu_write (tee_active, true);ip_local_out (skb);__this_cpu_write (tee_active, false);
@@ -136,10 +121,9 @@ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)#if IS_ENABLED (CONFIG_IPV6 )static bool -tee_tg_route6 (struct sk_buff *skb,const struct xt_tee_tginfo *info) +tee_tg_route6 (struct net *net,struct sk_buff *skb,const struct xt_tee_tginfo *info) {const struct ipv6hdr *iph =ipv6_hdr (skb); -struct net *net =pick_net (skb);struct dst_entry *dst;struct flowi6 fl6;
@@ -187,7 +171,7 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)struct ipv6hdr *iph =ipv6_hdr (skb); --iph->hop_limit; } -if (tee_tg_route6 (skb, info)) { +if (tee_tg_route6 (par->net, skb, info)) {__this_cpu_write (tee_active, true);ip6_local_out (skb);__this_cpu_write (tee_active, false);
net/netfilter/xt_TPROXY.c +12 -12
@@ -250,8 +250,8 @@ nf_tproxy_get_sock_v6(struct net *net, const u8 protocol,* no such listener is found, or NULL if the TCP header is incomplete. */ static struct sock * -tproxy_handle_time_wait4 (struct sk_buff *skb,__be32 laddr,__be16 lport, -struct sock *sk) +tproxy_handle_time_wait4 (struct net *net,struct sk_buff *skb, +__be32 laddr,__be16 lport,struct sock *sk) {const struct iphdr *iph =ip_hdr (skb);struct tcphdr _hdr, *hp;
@@ -267,7 +267,7 @@ tproxy_handle_time_wait4(struct sk_buff *skb, __be32 laddr, __be16 lport,* to a listener socket if there's one */ struct sock *sk2; - sk2 =nf_tproxy_get_sock_v4 (dev_net (skb->dev), iph->protocol, + sk2 =nf_tproxy_get_sock_v4 (net, iph->protocol, iph->saddr, laddr ? laddr : iph->daddr, hp->source, lport ? lport : hp->dest, skb->dev,NFT_LOOKUP_LISTENER );
@@ -291,7 +291,7 @@ nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk) }static unsigned int -tproxy_tg4 (struct sk_buff *skb,__be32 laddr,__be16 lport, +tproxy_tg4 (struct net *net,struct sk_buff *skb,__be32 laddr,__be16 lport,u_int32_t mark_mask,u_int32_t mark_value) {const struct iphdr *iph =ip_hdr (skb);
@@ -306,7 +306,7 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,* addresses, this happens if the redirect already happened * and the current packet belongs to an already established * connection */ - sk =nf_tproxy_get_sock_v4 (dev_net (skb->dev), iph->protocol, + sk =nf_tproxy_get_sock_v4 (net, iph->protocol, iph->saddr, iph->daddr, hp->source, hp->dest, skb->dev,NFT_LOOKUP_ESTABLISHED );
@@ -318,11 +318,11 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,/* UDP has no TCP_TIME_WAIT state, so we never enter here */ if (sk && sk->sk_state ==TCP_TIME_WAIT )/* reopening a TIME_WAIT connection needs special handling */ - sk =tproxy_handle_time_wait4 (skb, laddr, lport, sk); + sk =tproxy_handle_time_wait4 (net, skb, laddr, lport, sk);else if (!sk)/* no, there's no established connection, check if * there's a listener on the redirected addr/port */ - sk =nf_tproxy_get_sock_v4 (dev_net (skb->dev), iph->protocol, + sk =nf_tproxy_get_sock_v4 (net, iph->protocol, iph->saddr, laddr, hp->source, lport, skb->dev,NFT_LOOKUP_LISTENER );
@@ -352,7 +352,7 @@ tproxy_tg4_v0(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_tproxy_target_info *tgi = par->targinfo; -return tproxy_tg4 (skb, tgi->laddr, tgi->lport, tgi->mark_mask, tgi->mark_value); +return tproxy_tg4 (par->net, skb, tgi->laddr, tgi->lport, tgi->mark_mask, tgi->mark_value); } static unsigned int
@@ -360,7 +360,7 @@ tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par) {const struct xt_tproxy_target_info_v1 *tgi = par->targinfo; -return tproxy_tg4 (skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value); +return tproxy_tg4 (par->net, skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value); }#ifdef XT_TPROXY_HAVE_IPV6
@@ -430,7 +430,7 @@ tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,* to a listener socket if there's one */ struct sock *sk2; - sk2 = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, + sk2 = nf_tproxy_get_sock_v6(par->net, tproto, &iph->saddr, tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr), hp->source,
@@ -474,7 +474,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)* addresses, this happens if the redirect already happened * and the current packet belongs to an already established * connection */ - sk =nf_tproxy_get_sock_v6 (dev_net (skb->dev), tproto, + sk =nf_tproxy_get_sock_v6 (par->net, tproto, &iph->saddr, &iph->daddr, hp->source, hp->dest, par->in,NFT_LOOKUP_ESTABLISHED );
@@ -489,7 +489,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)else if (!sk)/* no there's no established connection, check if * there's a listener on the redirected addr/port */ - sk =nf_tproxy_get_sock_v6 (dev_net (skb->dev), tproto, + sk =nf_tproxy_get_sock_v6 (par->net, tproto, &iph->saddr, laddr, hp->source, lport, par->in,NFT_LOOKUP_LISTENER );
net/netfilter/xt_addrtype.c +2 -2
@@ -125,7 +125,7 @@ static inline bool match_type(struct net *net, const struct net_device *dev,static bool addrtype_mt_v0 (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;const struct xt_addrtype_info *info = par->matchinfo;const struct iphdr *iph =ip_hdr (skb);bool ret = true;
@@ -143,7 +143,7 @@ addrtype_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)static bool addrtype_mt_v1 (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;const struct xt_addrtype_info_v1 *info = par->matchinfo;const struct iphdr *iph;const struct net_device *dev =NULL ;
net/netfilter/xt_connlimit.c +1 -1
@@ -316,7 +316,7 @@ static int count_them(struct net *net,static bool connlimit_mt (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;const struct xt_connlimit_info *info = par->matchinfo;union nf_inet_addr addr;struct nf_conntrack_tuple tuple;
net/netfilter/xt_osf.c +1 -1
@@ -200,7 +200,7 @@ xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)unsigned char opts[MAX_IPOPTLEN ];const struct xt_osf_finger *kf;const struct xt_osf_user_finger *f; -struct net *net =dev_net (p->in ? p->in : p->out); +struct net *net = p->net;if (!info)return false;
net/netfilter/xt_recent.c +1 -1
@@ -237,7 +237,7 @@ static void recent_table_flush(struct recent_table *t)static bool recent_mt (const struct sk_buff *skb,struct xt_action_param *par) { -struct net *net =dev_net (par->in ? par->in : par->out); +struct net *net = par->net;struct recent_net *recent_net =recent_pernet (net);const struct xt_recent_mtinfo_v1 *info = par->matchinfo;struct recent_table *t;
net/netfilter/xt_socket.c +8 -6
@@ -143,7 +143,8 @@ static bool xt_socket_sk_is_transparent(struct sock *sk) } } -static struct sock *xt_socket_lookup_slow_v4 (const struct sk_buff *skb, +static struct sock *xt_socket_lookup_slow_v4 (struct net *net, +const struct sk_buff *skb,const struct net_device *indev) {const struct iphdr *iph =ip_hdr (skb);
@@ -197,7 +198,7 @@ static struct sock *xt_socket_lookup_slow_v4(const struct sk_buff *skb, }#endif -return xt_socket_get_sock_v4 (dev_net (skb->dev), protocol, saddr, daddr, +return xt_socket_get_sock_v4 (net, protocol, saddr, daddr, sport, dport, indev); }
@@ -208,7 +209,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,struct sock *sk = skb->sk;if (!sk) - sk =xt_socket_lookup_slow_v4 (skb, par->in); + sk =xt_socket_lookup_slow_v4 (par->net, skb, par->in);if (sk) {bool wildcard;bool transparent = true;
@@ -330,7 +331,8 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,return NULL ; } -static struct sock *xt_socket_lookup_slow_v6 (const struct sk_buff *skb, +static struct sock *xt_socket_lookup_slow_v6 (struct net *net, +const struct sk_buff *skb,const struct net_device *indev) {__be16 uninitialized_var (dport ),uninitialized_var (sport );
@@ -366,7 +368,7 @@ static struct sock *xt_socket_lookup_slow_v6(const struct sk_buff *skb,return NULL ; } -return xt_socket_get_sock_v6 (dev_net (skb->dev), tproto, saddr, daddr, +return xt_socket_get_sock_v6 (net, tproto, saddr, daddr, sport, dport, indev); }
@@ -377,7 +379,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)struct sock *sk = skb->sk;if (!sk) - sk =xt_socket_lookup_slow_v6 (skb, par->in); + sk =xt_socket_lookup_slow_v6 (par->net, skb, par->in);if (sk) {bool wildcard;bool transparent = true;
Signature · 1 line
2.2.1
PATCH 11/43 nftables: Pass struct net in nft_pktinfo
In reply to Eric W. Biedermannft_pktinfo is passed on the stack so this does not bloat any in core data structures.
By centrally computing this information this makes maintence of the code simpler, and understading of the code easier.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/nf_tables.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/net/netfilter/nf_tables.h +2 -1
@@ -14,6 +14,7 @@struct nft_pktinfo {struct sk_buff *skb; +struct net *net;const struct net_device *in;const struct net_device *out;u8 pf;
@@ -30,7 +31,7 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, const struct nf_hook_state *state) { pkt->skb = skb; - pkt->xt.net = state->net; + pkt->net = pkt->xt.net = state->net; pkt->in = pkt->xt.in = state->in; pkt->out = pkt->xt.out = state->out; pkt->hook = pkt->xt.hooknum = state->hook;
Signature · 1 line
2.2.1
PATCH 12/43 nf_tables: Use pkt->net instead of computing net from the passed net_devices
In reply to Eric W. BiedermanSigned-off-by "Eric W. Biederman" <[email protected]>
--- net/bridge/netfilter/nft_reject_bridge.c | 13 ++++++------- net/ipv6/netfilter/nft_reject_ipv6.c | 6 +++--- net/netfilter/nf_tables_core.c | 4 +--- net/netfilter/nft_log.c | 3 +-- net/netfilter/nft_reject_inet.c | 7 +++---- 5 files changed, 14 insertions(+), 19 deletions(-)
net/bridge/netfilter/nft_reject_bridge.c +6 -7
@@ -261,7 +261,6 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {struct nft_reject *priv =nft_expr_priv (expr); -struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out);const unsigned char *dest =eth_hdr (pkt->skb)->h_dest; if (is_broadcast_ether_addr(dest) ||
@@ -290,17 +289,17 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,case htons (ETH_P_IPV6 ):switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->hook, +nft_reject_br_send_v6_unreach (pkt->net, pkt->skb, + pkt->in, pkt->hook, priv->icmp_code);break ;case NFT_REJECT_TCP_RST : -nft_reject_br_send_v6_tcp_reset (net, pkt->skb, pkt->in, - pkt->hook); +nft_reject_br_send_v6_tcp_reset (pkt->net, pkt->skb, + pkt->in, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH : -nft_reject_br_send_v6_unreach (net, pkt->skb, pkt->in, - pkt->hook, +nft_reject_br_send_v6_unreach (pkt->net, pkt->skb, + pkt->in, pkt->hook,nft_reject_icmpv6_code (priv->icmp_code));break ; }
net/ipv6/netfilter/nft_reject_ipv6.c +3 -3
@@ -24,14 +24,14 @@ static void nft_reject_ipv6_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {struct nft_reject *priv =nft_expr_priv (expr); -struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out);switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach6 (net, pkt->skb, priv->icmp_code, pkt->hook); +nf_send_unreach6 (pkt->net, pkt->skb, priv->icmp_code, + pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->hook); +nf_send_reset6 (pkt->net, pkt->skb, pkt->hook);break ;default :break ;
net/netfilter/nf_tables_core.c +1 -3
@@ -48,9 +48,7 @@ static void __nft_trace_packet(const struct nft_pktinfo *pkt, const struct nft_chain *chain, int rulenum, enum nft_trace type) { - struct net *net = dev_net(pkt->in ? pkt->in : pkt->out); - -nf_log_trace (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, + nf_log_trace(pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ", chain->table->name, chain->name, comments[type], rulenum);
net/netfilter/nft_log.c +1 -2
@@ -31,9 +31,8 @@ static void nft_log_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {const struct nft_log *priv =nft_expr_priv (expr); -struct net *net =dev_net (pkt->in ? pkt->in : pkt->out); -nf_log_packet (net, pkt->pf, pkt->hook, pkt->skb, pkt->in, +nf_log_packet (pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in, pkt->out, &priv->loginfo,"%s" , priv->prefix); }
net/netfilter/nft_reject_inet.c +3 -4
@@ -22,7 +22,6 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) {struct nft_reject *priv =nft_expr_priv (expr); -struct net *net =dev_net ((pkt->in !=NULL ) ? pkt->in : pkt->out);switch (pkt->pf) {case NFPROTO_IPV4 :
@@ -44,14 +43,14 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,case NFPROTO_IPV6 :switch (priv->type) {case NFT_REJECT_ICMP_UNREACH : -nf_send_unreach6 (net, pkt->skb, priv->icmp_code, +nf_send_unreach6 (pkt->net, pkt->skb, priv->icmp_code, pkt->hook);break ;case NFT_REJECT_TCP_RST : -nf_send_reset6 (net, pkt->skb, pkt->hook); +nf_send_reset6 (pkt->net, pkt->skb, pkt->hook);break ;case NFT_REJECT_ICMPX_UNREACH : -nf_send_unreach6 (net, pkt->skb, +nf_send_unreach6 (pkt->net, pkt->skb,nft_reject_icmpv6_code (priv->icmp_code), pkt->hook);break ;
Signature · 1 line
2.2.1
PATCH 13/43 nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple
In reply to Eric W. BiedermanAs gre does not have the srckey in the packet gre_pkt_to_tuple needs to perform a lookup in it's per network namespace tables.
Pass in the proper network namespace to all pkt_to_tuple implementations to ensure gre (and any similar protocols) can get this right.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/nf_conntrack.h | 3 ++- include/net/netfilter/nf_conntrack_core.h | 1 + include/net/netfilter/nf_conntrack_l4proto.h | 2 +- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 4 ++-- net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 3 ++- net/netfilter/nf_conntrack_core.c | 10 ++++++---- net/netfilter/nf_conntrack_proto_dccp.c | 2 +- net/netfilter/nf_conntrack_proto_generic.c | 2 +- net/netfilter/nf_conntrack_proto_gre.c | 3 +-- net/netfilter/nf_conntrack_proto_sctp.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_proto_udp.c | 1 + net/netfilter/nf_conntrack_proto_udplite.c | 1 + net/netfilter/xt_connlimit.c | 2 +- net/sched/act_connmark.c | 2 +- 15 files changed, 23 insertions(+), 17 deletions(-)
include/net/netfilter/nf_conntrack.h +2 -1
@@ -191,7 +191,8 @@ int nf_conntrack_hash_check_insert(struct nf_conn *ct);bool nf_ct_delete (struct nf_conn *ct,u32 pid,int report);bool nf_ct_get_tuplepr (const struct sk_buff *skb,unsigned int nhoff, -u_int16_t l3num,struct nf_conntrack_tuple *tuple); +u_int16_t l3num,struct net *net, +struct nf_conntrack_tuple *tuple);bool nf_ct_invert_tuplepr (struct nf_conntrack_tuple *inverse,const struct nf_conntrack_tuple *orig);
include/net/netfilter/nf_conntrack_core.h +1 -0
@@ -41,6 +41,7 @@ void nf_conntrack_cleanup_end(void);bool nf_ct_get_tuple (const struct sk_buff *skb,unsigned int nhoff,unsigned int dataoff,u_int16_t l3num,u_int8_t protonum, +struct net *net,struct nf_conntrack_tuple *tuple,const struct nf_conntrack_l3proto *l3proto,const struct nf_conntrack_l4proto *l4proto);
include/net/netfilter/nf_conntrack_l4proto.h +1 -1
@@ -26,7 +26,7 @@ struct nf_conntrack_l4proto {/* Try to fill in the third arg: dataoff is offset past network protocol hdr. Return true if possible. */ bool (*pkt_to_tuple)(const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple); +struct net *net,struct nf_conntrack_tuple *tuple);/* Invert the per-proto part of the tuple: ie. turn xmit into reply. * Some packets can't be inverted: return 0 in that case.
net/ipv4/netfilter/nf_conntrack_proto_icmp.c +2 -2
@@ -30,7 +30,7 @@ static inline struct nf_icmp_net *icmp_pernet(struct net *net) }static bool icmp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {const struct icmphdr *hp;struct icmphdr _hdr;
@@ -142,7 +142,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,if (!nf_ct_get_tuplepr (skb,skb_network_offset (skb) +ip_hdrlen (skb) +sizeof (struct icmphdr ), -PF_INET , &origtuple)) { +PF_INET , net, &origtuple)) {pr_debug ("icmp_error_message: failed to get tuple\n" );return -NF_ACCEPT ; }
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +2 -1
@@ -36,6 +36,7 @@ static inline struct nf_icmp_net *icmpv6_pernet(struct net *net)static bool icmpv6_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct net *net,struct nf_conntrack_tuple *tuple) {const struct icmp6hdr *hp;
@@ -159,7 +160,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl, skb_network_offset(skb) + sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr), - PF_INET6, &origtuple)) { + PF_INET6, net, &origtuple)) {pr_debug ("icmpv6_error: Can't get tuple\n" );return -NF_ACCEPT ; }
net/netfilter/nf_conntrack_core.c +6 -4
@@ -168,6 +168,7 @@ nf_ct_get_tuple(const struct sk_buff *skb,unsigned int dataoff, u_int16_t l3num, u_int8_t protonum, + struct net *net, struct nf_conntrack_tuple *tuple, const struct nf_conntrack_l3proto *l3proto, const struct nf_conntrack_l4proto *l4proto)
@@ -181,12 +182,13 @@ nf_ct_get_tuple(const struct sk_buff *skb, tuple->dst.protonum = protonum; tuple->dst.dir =IP_CT_DIR_ORIGINAL ; -return l4proto->pkt_to_tuple (skb, dataoff, tuple); +return l4proto->pkt_to_tuple (skb, dataoff, net, tuple); }EXPORT_SYMBOL_GPL (nf_ct_get_tuple);bool nf_ct_get_tuplepr (const struct sk_buff *skb,unsigned int nhoff, -u_int16_t l3num,struct nf_conntrack_tuple *tuple) +u_int16_t l3num, +struct net *net,struct nf_conntrack_tuple *tuple) {struct nf_conntrack_l3proto *l3proto;struct nf_conntrack_l4proto *l4proto;
@@ -205,7 +207,7 @@ bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff, l4proto =__nf_ct_l4proto_find (l3num, protonum); - ret =nf_ct_get_tuple (skb, nhoff, protoff, l3num, protonum, tuple, + ret =nf_ct_get_tuple (skb, nhoff, protoff, l3num, protonum, net, tuple, l3proto, l4proto);rcu_read_unlock ();
@@ -1011,7 +1013,7 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,u32 hash;if (!nf_ct_get_tuple (skb,skb_network_offset (skb), - dataoff, l3num, protonum, &tuple, l3proto, + dataoff, l3num, protonum, net, &tuple, l3proto, l4proto)) {pr_debug ("resolve_normal_ct: Can't get tuple\n" );return NULL ;
net/netfilter/nf_conntrack_proto_dccp.c +1 -1
@@ -398,7 +398,7 @@ static inline struct dccp_net *dccp_pernet(struct net *net) }static bool dccp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {struct dccp_hdr _hdr, *dh;
net/netfilter/nf_conntrack_proto_generic.c +1 -1
@@ -45,7 +45,7 @@ static inline struct nf_generic_net *generic_pernet(struct net *net)static bool generic_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) { tuple->src.u.all =0 ; tuple->dst.u.all =0 ;
net/netfilter/nf_conntrack_proto_gre.c +1 -2
@@ -190,9 +190,8 @@ static bool gre_invert_tuple(struct nf_conntrack_tuple *tuple,/* gre hdr info to tuple */ static bool gre_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) { -struct net *net =dev_net (skb->dev ? skb->dev :skb_dst (skb)->dev);const struct gre_hdr_pptp *pgrehdr;struct gre_hdr_pptp _pgrehdr;__be16 srckey;
net/netfilter/nf_conntrack_proto_sctp.c +1 -1
@@ -142,7 +142,7 @@ static inline struct sctp_net *sctp_pernet(struct net *net) }static bool sctp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {const struct sctphdr *hp;struct sctphdr _hdr;
net/netfilter/nf_conntrack_proto_tcp.c +1 -1
@@ -277,7 +277,7 @@ static inline struct nf_tcp_net *tcp_pernet(struct net *net) }static bool tcp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +struct net *net,struct nf_conntrack_tuple *tuple) {const struct tcphdr *hp;struct tcphdr _hdr;
net/netfilter/nf_conntrack_proto_udp.c +1 -0
@@ -38,6 +38,7 @@ static inline struct nf_udp_net *udp_pernet(struct net *net)static bool udp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct net *net,struct nf_conntrack_tuple *tuple) {const struct udphdr *hp;
net/netfilter/nf_conntrack_proto_udplite.c +1 -0
@@ -48,6 +48,7 @@ static inline struct udplite_net *udplite_pernet(struct net *net)static bool udplite_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct net *net,struct nf_conntrack_tuple *tuple) {const struct udphdr *hp;
net/netfilter/xt_connlimit.c +1 -1
@@ -331,7 +331,7 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple; zone =nf_ct_zone (ct); }else if (!nf_ct_get_tuplepr (skb,skb_network_offset (skb), - par->family, &tuple)) { + par->family, net, &tuple)) { goto hotdrop; }
net/sched/act_connmark.c +1 -1
@@ -67,7 +67,7 @@ static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a, }if (!nf_ct_get_tuplepr (skb,skb_network_offset (skb), - proto, &tuple)) + proto, ca->net, &tuple)) goto out; thash =nf_conntrack_find_get (dev_net (skb->dev), ca->zone, &tuple);
Signature · 1 line
2.2.1
PATCH 14/43 ipv4: Pass struct net into ip_defrag and ip_check_defrag
In reply to Eric W. BiedermanDon't make ip_defrag guess which network namespace it needs to defragment packets in.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- drivers/net/macvlan.c | 2 +- include/net/ip.h | 6 +++--- net/ipv4/ip_fragment.c | 8 +++----- net/ipv4/ip_input.c | 8 +++++--- net/ipv4/netfilter/nf_defrag_ipv4.c | 7 ++++--- net/netfilter/ipvs/ip_vs_core.c | 2 +- net/packet/af_packet.c | 6 +++--- 7 files changed, 20 insertions(+), 19 deletions(-)
drivers/net/macvlan.c +1 -1
@@ -412,7 +412,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) port =macvlan_port_get_rcu (skb->dev);if (is_multicast_ether_addr (eth->h_dest)) { - skb =ip_check_defrag (skb,IP_DEFRAG_MACVLAN ); + skb =ip_check_defrag (dev_net (skb->dev), skb,IP_DEFRAG_MACVLAN );if (!skb)return RX_HANDLER_CONSUMED ; eth =eth_hdr (skb);
include/net/ip.h +3 -3
@@ -505,11 +505,11 @@ static inline bool ip_defrag_user_in_between(u32 user,return user >= lower_bond && user <= upper_bond; } -int ip_defrag (struct sk_buff *skb,u32 user); +int ip_defrag (struct net *net,struct sk_buff *skb,u32 user);#ifdef CONFIG_INET -struct sk_buff *ip_check_defrag (struct sk_buff *skb,u32 user); +struct sk_buff *ip_check_defrag (struct net *net,struct sk_buff *skb,u32 user);#else -static inline struct sk_buff *ip_check_defrag (struct sk_buff *skb,u32 user) +static inline struct sk_buff *ip_check_defrag (struct net *net,struct sk_buff *skb,u32 user) {return skb; }
net/ipv4/ip_fragment.c +3 -5
@@ -658,12 +658,10 @@ out_fail: }/* Process an incoming IP datagram fragment. */ -int ip_defrag (struct sk_buff *skb,u32 user) +int ip_defrag (struct net *net,struct sk_buff *skb,u32 user) {struct ipq *qp; -struct net *net; - net = skb->dev ?dev_net (skb->dev) :dev_net (skb_dst (skb)->dev);IP_INC_STATS_BH (net,IPSTATS_MIB_REASMREQDS );/* Lookup (or create) queue header */
@@ -686,7 +684,7 @@ int ip_defrag(struct sk_buff *skb, u32 user) }EXPORT_SYMBOL (ip_defrag); -struct sk_buff *ip_check_defrag (struct sk_buff *skb,u32 user) +struct sk_buff *ip_check_defrag (struct net *net,struct sk_buff *skb,u32 user) {struct iphdr iph;int netoff;
@@ -715,7 +713,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)if (pskb_trim_rcsum (skb, netoff + len))return skb;memset (IPCB (skb),0 ,sizeof (struct inet_skb_parm )); -if (ip_defrag (skb, user)) +if (ip_defrag (net, skb, user))return NULL ;skb_clear_hash (skb); }
net/ipv4/ip_input.c +5 -3
@@ -168,7 +168,8 @@ bool ip_call_ra_chain(struct sk_buff *skb) sk->sk_bound_dev_if == dev->ifindex) && net_eq(sock_net(sk), dev_net(dev))) {if (ip_is_fragment (ip_hdr (skb))) { -if (ip_defrag (skb,IP_DEFRAG_CALL_RA_CHAIN )) +if (ip_defrag (dev_net (skb->dev), skb, +IP_DEFRAG_CALL_RA_CHAIN ))return true; }if (last) {
@@ -247,14 +248,15 @@ int ip_local_deliver(struct sk_buff *skb)/* * Reassemble IP fragments. */ +struct net *net =dev_net (skb->dev);if (ip_is_fragment (ip_hdr (skb))) { -if (ip_defrag (skb,IP_DEFRAG_LOCAL_DELIVER )) +if (ip_defrag (net, skb,IP_DEFRAG_LOCAL_DELIVER ))return 0 ; }return NF_HOOK (NFPROTO_IPV4 ,NF_INET_LOCAL_IN , -dev_net (skb->dev),NULL , skb, skb->dev,NULL , + net,NULL , skb, skb->dev,NULL , ip_local_deliver_finish); }
net/ipv4/netfilter/nf_defrag_ipv4.c +4 -3
@@ -22,14 +22,15 @@#endif #include <net/netfilter/nf_conntrack_zones.h> -static int nf_ct_ipv4_gather_frags (struct sk_buff *skb,u_int32_t user) +static int nf_ct_ipv4_gather_frags (struct net *net,struct sk_buff *skb, +u_int32_t user) {int err;skb_orphan (skb);local_bh_disable (); - err =ip_defrag (skb, user); + err =ip_defrag (net, skb, user);local_bh_enable ();if (!err) {
@@ -85,7 +86,7 @@ static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops,enum ip_defrag_users user =nf_ct_defrag_user (state->hook, skb); -if (nf_ct_ipv4_gather_frags (skb, user)) +if (nf_ct_ipv4_gather_frags (state->net, skb, user))return NF_STOLEN ; }return NF_ACCEPT ;
net/netfilter/ipvs/ip_vs_core.c +1 -1
@@ -657,7 +657,7 @@ static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)int err;local_bh_disable (); - err =ip_defrag (skb, user); + err =ip_defrag (skb_net (skb), skb, user);local_bh_enable ();if (!err)ip_send_check (ip_hdr (skb));
net/packet/af_packet.c +3 -3
@@ -1440,17 +1440,17 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev, {struct packet_fanout *f = pt->af_packet_priv;unsigned int num = f->num_members; +struct net *net =read_pnet (&f->net);struct packet_sock *po;unsigned int idx; -if (!net_eq (dev_net (dev),read_pnet (&f->net)) || - !num) { +if (!net_eq (dev_net (dev), net) || !num) {kfree_skb (skb);return 0 ; }if (fanout_has_flag (f,PACKET_FANOUT_FLAG_DEFRAG )) { - skb =ip_check_defrag (skb,IP_DEFRAG_AF_PACKET ); + skb =ip_check_defrag (net, skb,IP_DEFRAG_AF_PACKET );if (!skb)return 0 ; }
Signature · 1 line
2.2.1
PATCH 15/43 ipv6: Pass struct net into nf_ct_frag6_gather
In reply to Eric W. BiedermanMake it explicit which network namespace the packets are being reassembled in, don't make nf_cf_frag6_gather guess.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/net/netfilter/ipv6/nf_defrag_ipv6.h | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 +--- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 3 ++- 3 files changed, 4 insertions(+), 5 deletions(-)
include/net/netfilter/ipv6/nf_defrag_ipv6.h +1 -1
@@ -5,7 +5,7 @@ void nf_defrag_ipv6_enable(void);int nf_ct_frag6_init (void );void nf_ct_frag6_cleanup (void ); -struct sk_buff *nf_ct_frag6_gather (struct sk_buff *skb,u32 user); +struct sk_buff *nf_ct_frag6_gather (struct net *net,struct sk_buff *skb,u32 user);void nf_ct_frag6_consume_orig (struct sk_buff *skb);struct inet_frags_ctl ;
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -3
@@ -563,12 +563,10 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)return 0 ; } -struct sk_buff *nf_ct_frag6_gather (struct sk_buff *skb,u32 user) +struct sk_buff *nf_ct_frag6_gather (struct net *net,struct sk_buff *skb,u32 user) {struct sk_buff *clone;struct net_device *dev = skb->dev; -struct net *net =skb_dst (skb) ?dev_net (skb_dst (skb)->dev) - :dev_net (skb->dev);struct frag_hdr *fhdr;struct frag_queue *fq;struct ipv6hdr *hdr;
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +2 -1
@@ -64,7 +64,8 @@ static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,return NF_ACCEPT ;#endif - reasm =nf_ct_frag6_gather (skb,nf_ct6_defrag_user (state->hook, skb)); + reasm =nf_ct_frag6_gather (state->net, skb, +nf_ct6_defrag_user (state->hook, skb));/* queued */ if (reasm ==NULL )return NF_STOLEN ;
Signature · 1 line
2.2.1
PATCH 16/43 net: include missing headers in net/net_namespace.h
In reply to Eric W. BiedermanFrom: Pablo Neira Ayuso <[email protected]>
Include linux/idr.h and linux/skbuff.h since they are required by objects that are declared in the net structure.
struct net {
...
struct idr netns_ids;
...
struct sk_buff_head wext_nlevents;
...Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Eric W. Biederman <[email protected]>
--- include/net/net_namespace.h | 2 ++ 1 file changed, 2 insertions(+)
include/net/net_namespace.h +2 -0
@@ -28,6 +28,8 @@#include <net/netns/xfrm.h> #include <net/netns/mpls.h> #include <linux/ns_common.h> +#include <linux/idr.h> +#include <linux/skbuff.h> struct user_namespace ;struct proc_dir_entry ;
Signature · 1 line
2.2.1
PATCH 17/43 netfilter: use forward declaration instead of including linux/proc_fs.h
In reply to Eric W. BiedermanFrom: Pablo Neira Ayuso <[email protected]>
We don't need to pull the full definitions in that file, a simple forward declaration is enough.
Moreover, include linux/procfs.h from nf_synproxy_core, otherwise this hits a compilation error due to missing declarations, ie.
net/netfilter/nf_synproxy_core.c: In function ‘synproxy_proc_init’:net/netfilter/nf_synproxy_core.c:326:2: error: implicit declaration of function ‘proc_create’ [-Werror=implicit-function-declaration]
if (!proc_create("synproxy", S_IRUGO, net->proc_net_stat,
^
Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Eric W. Biederman <[email protected]>
--- include/net/netns/netfilter.h | 2 +- net/netfilter/nf_synproxy_core.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
include/net/netns/netfilter.h +1 -1
@@ -1,9 +1,9 @@#ifndef __NETNS_NETFILTER_H#define __NETNS_NETFILTER_H -#include <linux/proc_fs.h> #include <linux/netfilter.h> +struct proc_dir_entry ;struct nf_logger ; struct netns_nf {
net/netfilter/nf_synproxy_core.c +1 -0
@@ -11,6 +11,7 @@#include <asm/unaligned.h> #include <net/tcp.h> #include <net/netns/generic.h> +#include <linux/proc_fs.h> #include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter/x_tables.h>
Signature · 1 line
2.2.1
PATCH 18/43 netfilter: don't pull include/linux/netfilter.h from netns headers
In reply to Eric W. BiedermanFrom: Pablo Neira Ayuso <[email protected]>
This pulls the full hook netfilter definitions from all those that include net_namespace.h.
Instead let's just include the bare minimum required in the new linux/netfilter_defs.h file, and use it from the netfilter netns header files.
I also needed to include in.h and in6.h from linux/netfilter.h otherwise we hit this compilation error:
In file included from include/linux/netfilter_defs.h:4:0,
from include/net/netns/netfilter.h:4,
from include/net/net_namespace.h:22,
from include/linux/netdevice.h:43,
from net/netfilter/nfnetlink_queue_core.c:23:include/uapi/linux/netfilter.h:76:17: error: field ‘in’ has incomplete type struct in_addr in;
And also explicit include linux/netfilter.h in several spots.
Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Eric W. Biederman <[email protected]>
--- include/linux/netfilter.h | 6 ++---- include/linux/netfilter_defs.h | 9 +++++++++ include/net/netns/netfilter.h | 2 +- include/net/netns/x_tables.h | 2 +- include/uapi/linux/netfilter.h | 3 ++- net/ipv6/output_core.c | 1 + 6 files changed, 16 insertions(+), 7 deletions(-) create mode 100644 include/linux/netfilter_defs.h
include/linux/netfilter.h +2 -4
@@ -10,7 +10,8 @@#include <linux/wait.h> #include <linux/list.h> #include <linux/static_key.h> -#include <uapi/linux/netfilter.h> +#include <linux/netfilter_defs.h> +#ifdef CONFIG_NETFILTER static inline int NF_DROP_GETERR (int verdict) {
@@ -38,9 +39,6 @@ static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,int netfilter_init (void ); -/* Largest hook number + 1 */ -#define NF_MAX_HOOKS 8 -struct sk_buff ;struct nf_hook_ops ;
include/linux/netfilter_defs.h new file +9 -0
@@ -0,0 +1,9 @@ +#ifndef __LINUX_NETFILTER_CORE_H_ +#define __LINUX_NETFILTER_CORE_H_ + +#include <uapi/linux/netfilter.h> + +/* Largest hook number + 1, see uapi/linux/netfilter_decnet.h */ +#define NF_MAX_HOOKS 8 + +#endif
include/net/netns/netfilter.h +1 -1
@@ -1,7 +1,7 @@#ifndef __NETNS_NETFILTER_H#define __NETNS_NETFILTER_H -#include <linux/netfilter.h> +#include <linux/netfilter_defs.h> struct proc_dir_entry ;struct nf_logger ;
include/net/netns/x_tables.h +1 -1
@@ -2,7 +2,7 @@#define __NETNS_X_TABLES_H#include <linux/list.h> -#include <linux/netfilter.h> +#include <linux/netfilter_defs.h> struct ebt_table ;
include/uapi/linux/netfilter.h +2 -1
@@ -4,7 +4,8 @@#include <linux/types.h> #include <linux/compiler.h> #include <linux/sysctl.h> - +#include <linux/in.h> +#include <linux/in6.h> /* Responses from hook functions. */ #define NF_DROP 0
net/ipv6/output_core.c +1 -0
@@ -8,6 +8,7 @@#include <net/ip6_fib.h> #include <net/addrconf.h> #include <net/secure_seq.h> +#include <linux/netfilter.h> static u32 __ipv6_select_ident(struct net *net, u32 hashrnd, const struct in6_addr *dst,
Signature · 6 lines
2.2.1 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
PATCH 19/43 ipvs: Read hooknum from state rather than ops->hooknum
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
This should be more cache efficient as state is more likely to be in core, and the netfilter core will stop passing in ops soon.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/netfilter/ipvs/ip_vs_core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
net/netfilter/ipvs/ip_vs_core.c +8 -8
@@ -1274,7 +1274,7 @@ static unsigned int ip_vs_reply4(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(ops->hooknum, skb, AF_INET); + return ip_vs_out(state->hook, skb, AF_INET); }/*
@@ -1285,7 +1285,7 @@ static unsigned int ip_vs_local_reply4(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(ops->hooknum, skb, AF_INET); + return ip_vs_out(state->hook, skb, AF_INET); }#ifdef CONFIG_IP_VS_IPV6
@@ -1299,7 +1299,7 @@ static unsigned int ip_vs_reply6(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(ops->hooknum, skb, AF_INET6); + return ip_vs_out(state->hook, skb, AF_INET6); }/*
@@ -1310,7 +1310,7 @@ static unsigned int ip_vs_local_reply6(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(ops->hooknum, skb, AF_INET6); + return ip_vs_out(state->hook, skb, AF_INET6); }#endif
@@ -1767,7 +1767,7 @@ static unsigned int ip_vs_remote_request4(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(ops->hooknum, skb, AF_INET); + return ip_vs_in(state->hook, skb, AF_INET); }/*
@@ -1778,7 +1778,7 @@ static unsigned int ip_vs_local_request4(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(ops->hooknum, skb, AF_INET); + return ip_vs_in(state->hook, skb, AF_INET); }#ifdef CONFIG_IP_VS_IPV6
@@ -1791,7 +1791,7 @@ static unsigned int ip_vs_remote_request6(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(ops->hooknum, skb, AF_INET6); + return ip_vs_in(state->hook, skb, AF_INET6); }/*
@@ -1802,7 +1802,7 @@ static unsigned int ip_vs_local_request6(const struct nf_hook_ops *ops, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(ops->hooknum, skb, AF_INET6); + return ip_vs_in(state->hook, skb, AF_INET6); }#endif
Signature · 1 line
2.2.1
PATCH 20/43 netfilter: Pass priv instead of nf_hook_ops to netfilter hooks
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Only pass the void *priv parameter out of the nf_hook_ops. That is all any of the functions are interested now, and by limiting what is passed it becomes simpler to change implementation details.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter.h | 2 +- include/net/netfilter/nf_nat_l3proto.h | 32 +++++++++++++------------- include/net/netfilter/nf_tables.h | 3 +-- net/bridge/br_netfilter.c | 17 +++++++------- net/bridge/netfilter/ebtable_filter.c | 4 ++-- net/bridge/netfilter/ebtable_nat.c | 4 ++-- net/bridge/netfilter/nf_tables_bridge.c | 4 ++-- net/decnet/netfilter/dn_rtmsg.c | 2 +- net/ipv4/netfilter/arptable_filter.c | 2 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/iptable_filter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/iptable_nat.c | 18 +++++++-------- net/ipv4/netfilter/iptable_raw.c | 2 +- net/ipv4/netfilter/iptable_security.c | 2 +- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 +++---- net/ipv4/netfilter/nf_defrag_ipv4.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 24 +++++++++---------- net/ipv4/netfilter/nf_tables_arp.c | 4 ++-- net/ipv4/netfilter/nf_tables_ipv4.c | 8 +++---- net/ipv4/netfilter/nft_chain_nat_ipv4.c | 20 ++++++++-------- net/ipv4/netfilter/nft_chain_route_ipv4.c | 4 ++-- net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +- net/ipv6/netfilter/ip6table_filter.c | 2 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/ip6table_nat.c | 18 +++++++-------- net/ipv6/netfilter/ip6table_raw.c | 2 +- net/ipv6/netfilter/ip6table_security.c | 2 +- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 8 +++---- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 2 +- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 24 +++++++++---------- net/ipv6/netfilter/nf_tables_ipv6.c | 8 +++---- net/ipv6/netfilter/nft_chain_nat_ipv6.c | 20 ++++++++-------- net/ipv6/netfilter/nft_chain_route_ipv6.c | 4 ++-- net/netfilter/core.c | 2 +- net/netfilter/ipvs/ip_vs_core.c | 24 +++++++++---------- net/netfilter/nf_tables_core.c | 4 ++-- net/netfilter/nf_tables_netdev.c | 4 ++-- security/selinux/hooks.c | 10 ++++---- security/smack/smack_netfilter.c | 4 ++-- 41 files changed, 155 insertions(+), 157 deletions(-)
include/linux/netfilter.h +1 -1
@@ -78,7 +78,7 @@ static inline void nf_hook_state_init(struct nf_hook_state *p, p->okfn = okfn; } -typedef unsigned int nf_hookfn (const struct nf_hook_ops *ops, +typedef unsigned int nf_hookfn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state);
include/net/netfilter/nf_nat_l3proto.h +16 -16
@@ -43,31 +43,31 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb, struct nf_conn *ct,enum ip_conntrack_info ctinfo, unsigned int hooknum); -unsigned int nf_nat_ipv4_in (const struct nf_hook_ops *ops,struct sk_buff *skb, +unsigned int nf_nat_ipv4_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)); -unsigned int nf_nat_ipv4_out (const struct nf_hook_ops *ops,struct sk_buff *skb, +unsigned int nf_nat_ipv4_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)); -unsigned int nf_nat_ipv4_local_fn (const struct nf_hook_ops *ops, +unsigned int nf_nat_ipv4_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)); -unsigned int nf_nat_ipv4_fn (const struct nf_hook_ops *ops,struct sk_buff *skb, +unsigned int nf_nat_ipv4_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct));
@@ -76,31 +76,31 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, struct nf_conn *ct,enum ip_conntrack_info ctinfo, unsigned int hooknum, unsigned int hdrlen); -unsigned int nf_nat_ipv6_in (const struct nf_hook_ops *ops,struct sk_buff *skb, +unsigned int nf_nat_ipv6_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)); -unsigned int nf_nat_ipv6_out (const struct nf_hook_ops *ops,struct sk_buff *skb, +unsigned int nf_nat_ipv6_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)); -unsigned int nf_nat_ipv6_local_fn (const struct nf_hook_ops *ops, +unsigned int nf_nat_ipv6_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)); -unsigned int nf_nat_ipv6_fn (const struct nf_hook_ops *ops,struct sk_buff *skb, +unsigned int nf_nat_ipv6_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct));
include/net/netfilter/nf_tables.h +1 -2
@@ -816,8 +816,7 @@ int nft_register_basechain(struct nft_base_chain *basechain,void nft_unregister_basechain (struct nft_base_chain *basechain,unsigned int hook_nops); -unsigned int nft_do_chain (struct nft_pktinfo *pkt, -const struct nf_hook_ops *ops); +unsigned int nft_do_chain (struct nft_pktinfo *pkt,void *priv);/** * struct nft_table - nf_tables table
net/bridge/br_netfilter.c +8 -9
@@ -664,8 +664,7 @@ static struct net_device *setup_pre_routing(struct sk_buff *skb)/* Replicate the checks that IPv6 does on packet reception and pass the packet * to ip6tables. */ -static unsigned int br_nf_pre_routing_ipv6 (const struct nf_hook_ops *ops, -struct sk_buff *skb, +static unsigned int br_nf_pre_routing_ipv6 (struct sk_buff *skb,const struct nf_hook_state *state) {struct nf_bridge_info *nf_bridge;
@@ -696,7 +695,7 @@ static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,* receiving device) to make netfilter happy, the REDIRECT * target in particular. Save the original destination IP * address to be able to detect DNAT afterwards. */ -static unsigned int br_nf_pre_routing (const struct nf_hook_ops *ops, +static unsigned int br_nf_pre_routing (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -718,7 +717,7 @@ static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops,return NF_ACCEPT ;nf_bridge_pull_encap_header_rcsum (skb); -return br_nf_pre_routing_ipv6 (ops, skb, state); +return br_nf_pre_routing_ipv6 (skb, state); }if (!brnf_call_iptables && !br->nf_call_iptables)
@@ -758,7 +757,7 @@ static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops,* took place when the packet entered the bridge), but we * register an IPv4 PRE_ROUTING 'sabotage' hook that will * prevent this from happening. */ -static unsigned int br_nf_local_in (const struct nf_hook_ops *ops, +static unsigned int br_nf_local_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -804,7 +803,7 @@ static int br_nf_forward_finish(struct sock *sk, struct sk_buff *skb)* but we are still able to filter on the 'real' indev/outdev * because of the physdev module. For ARP, indev and outdev are the * bridge ports. */ -static unsigned int br_nf_forward_ip (const struct nf_hook_ops *ops, +static unsigned int br_nf_forward_ip (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -867,7 +866,7 @@ static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops,return NF_STOLEN ; } -static unsigned int br_nf_forward_arp (const struct nf_hook_ops *ops, +static unsigned int br_nf_forward_arp (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -1026,7 +1025,7 @@ static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb) }/* PF_BRIDGE/POST_ROUTING ********************************************/ -static unsigned int br_nf_post_routing (const struct nf_hook_ops *ops, +static unsigned int br_nf_post_routing (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -1075,7 +1074,7 @@ static unsigned int br_nf_post_routing(const struct nf_hook_ops *ops,/* IP/SABOTAGE *****************************************************/ /* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING * for the second time. */ -static unsigned int ip_sabotage_in (const struct nf_hook_ops *ops, +static unsigned int ip_sabotage_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/bridge/netfilter/ebtable_filter.c +2 -2
@@ -57,14 +57,14 @@ static const struct ebt_table frame_filter = { };static unsigned int -ebt_in_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +ebt_in_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ebt_do_table (skb, state, state->net->xt.frame_filter); }static unsigned int -ebt_out_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +ebt_out_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ebt_do_table (skb, state, state->net->xt.frame_filter);
net/bridge/netfilter/ebtable_nat.c +2 -2
@@ -57,14 +57,14 @@ static struct ebt_table frame_nat = { };static unsigned int -ebt_nat_in (const struct nf_hook_ops *ops,struct sk_buff *skb, +ebt_nat_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ebt_do_table (skb, state, state->net->xt.frame_nat); }static unsigned int -ebt_nat_out (const struct nf_hook_ops *ops,struct sk_buff *skb, +ebt_nat_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ebt_do_table (skb, state, state->net->xt.frame_nat);
net/bridge/netfilter/nf_tables_bridge.c +2 -2
@@ -87,7 +87,7 @@ static inline void nft_bridge_set_pktinfo_ipv6(struct nft_pktinfo *pkt, }static unsigned int -nft_do_chain_bridge (const struct nf_hook_ops *ops, +nft_do_chain_bridge (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -105,7 +105,7 @@ nft_do_chain_bridge(const struct nf_hook_ops *ops,break ; } -return nft_do_chain (&pkt, ops); +return nft_do_chain (&pkt, priv); }static struct nft_af_info nft_af_bridge__read_mostly = {
net/decnet/netfilter/dn_rtmsg.c +1 -1
@@ -87,7 +87,7 @@ static void dnrmg_send_peer(struct sk_buff *skb) } -static unsigned int dnrmg_hook (const struct nf_hook_ops *ops, +static unsigned int dnrmg_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/ipv4/netfilter/arptable_filter.c +1 -1
@@ -27,7 +27,7 @@ static const struct xt_table packet_filter = {/* The work comes in here from netfilter.c */ static unsigned int -arptable_filter_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +arptable_filter_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return arpt_do_table (skb, state, state->net->ipv4.arptable_filter);
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
@@ -507,7 +507,7 @@ static void arp_print(struct arp_payload *payload)#endif static unsigned int -arp_mangle (const struct nf_hook_ops *ops, +arp_mangle (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/ipv4/netfilter/ipt_SYNPROXY.c +1 -1
@@ -298,7 +298,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)return XT_CONTINUE ; } -static unsigned int ipv4_synproxy_hook (const struct nf_hook_ops *ops, +static unsigned int ipv4_synproxy_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *nhs) {
net/ipv4/netfilter/iptable_filter.c +1 -1
@@ -33,7 +33,7 @@ static const struct xt_table packet_filter = { };static unsigned int -iptable_filter_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +iptable_filter_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { if (state->hook == NF_INET_LOCAL_OUT &&
net/ipv4/netfilter/iptable_mangle.c +1 -1
@@ -78,7 +78,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)/* The work comes in here from netfilter.c. */ static unsigned int -iptable_mangle_hook (const struct nf_hook_ops *ops, +iptable_mangle_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/ipv4/netfilter/iptable_nat.c +9 -9
@@ -28,7 +28,7 @@ static const struct xt_table nf_nat_ipv4_table = { .af = NFPROTO_IPV4, }; -static unsigned int iptable_nat_do_chain (const struct nf_hook_ops *ops, +static unsigned int iptable_nat_do_chain (void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)
@@ -36,32 +36,32 @@ static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,return ipt_do_table (skb, state, state->net->ipv4.nat_table); } -static unsigned int iptable_nat_ipv4_fn (const struct nf_hook_ops *ops, +static unsigned int iptable_nat_ipv4_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_fn (ops, skb, state, iptable_nat_do_chain); +return nf_nat_ipv4_fn (priv, skb, state, iptable_nat_do_chain); } -static unsigned int iptable_nat_ipv4_in (const struct nf_hook_ops *ops, +static unsigned int iptable_nat_ipv4_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_in (ops, skb, state, iptable_nat_do_chain); +return nf_nat_ipv4_in (priv, skb, state, iptable_nat_do_chain); } -static unsigned int iptable_nat_ipv4_out (const struct nf_hook_ops *ops, +static unsigned int iptable_nat_ipv4_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_out (ops, skb, state, iptable_nat_do_chain); +return nf_nat_ipv4_out (priv, skb, state, iptable_nat_do_chain); } -static unsigned int iptable_nat_ipv4_local_fn (const struct nf_hook_ops *ops, +static unsigned int iptable_nat_ipv4_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_local_fn (ops, skb, state, iptable_nat_do_chain); +return nf_nat_ipv4_local_fn (priv, skb, state, iptable_nat_do_chain); }static struct nf_hook_ops nf_nat_ipv4_ops[]__read_mostly = {
net/ipv4/netfilter/iptable_raw.c +1 -1
@@ -20,7 +20,7 @@ static const struct xt_table packet_raw = {/* The work comes in here from netfilter.c. */ static unsigned int -iptable_raw_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +iptable_raw_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { if (state->hook == NF_INET_LOCAL_OUT &&
net/ipv4/netfilter/iptable_security.c +1 -1
@@ -37,7 +37,7 @@ static const struct xt_table security_table = { };static unsigned int -iptable_security_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +iptable_security_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { if (state->hook == NF_INET_LOCAL_OUT &&
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +4 -4
@@ -92,7 +92,7 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,return NF_ACCEPT ; } -static unsigned int ipv4_helper (const struct nf_hook_ops *ops, +static unsigned int ipv4_helper (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -119,7 +119,7 @@ static unsigned int ipv4_helper(const struct nf_hook_ops *ops, ct, ctinfo); } -static unsigned int ipv4_confirm (const struct nf_hook_ops *ops, +static unsigned int ipv4_confirm (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -143,14 +143,14 @@ out:return nf_conntrack_confirm (skb); } -static unsigned int ipv4_conntrack_in (const struct nf_hook_ops *ops, +static unsigned int ipv4_conntrack_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return nf_conntrack_in (state->net,PF_INET , state->hook, skb); } -static unsigned int ipv4_conntrack_local (const struct nf_hook_ops *ops, +static unsigned int ipv4_conntrack_local (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/ipv4/netfilter/nf_defrag_ipv4.c +1 -1
@@ -62,7 +62,7 @@ static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,return IP_DEFRAG_CONNTRACK_OUT + zone; } -static unsigned int ipv4_conntrack_defrag (const struct nf_hook_ops *ops, +static unsigned int ipv4_conntrack_defrag (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +12 -12
@@ -255,9 +255,9 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb,EXPORT_SYMBOL_GPL (nf_nat_icmp_reply_translation);unsigned int -nf_nat_ipv4_fn (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv4_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -308,7 +308,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (!nf_nat_initialized (ct, maniptype)) {unsigned int ret; - ret =do_chain (ops, skb, state, ct); + ret =do_chain (priv, skb, state, ct);if (ret !=NF_ACCEPT )return ret;
@@ -345,9 +345,9 @@ oif_changed:EXPORT_SYMBOL_GPL (nf_nat_ipv4_fn);unsigned int -nf_nat_ipv4_in (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv4_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -355,7 +355,7 @@ nf_nat_ipv4_in(const struct nf_hook_ops *ops, struct sk_buff *skb,unsigned int ret;__be32 daddr =ip_hdr (skb)->daddr; - ret =nf_nat_ipv4_fn (ops, skb, state, do_chain); + ret =nf_nat_ipv4_fn (priv, skb, state, do_chain);if (ret !=NF_DROP && ret !=NF_STOLEN && daddr !=ip_hdr (skb)->daddr)skb_dst_drop (skb);
@@ -365,9 +365,9 @@ nf_nat_ipv4_in(const struct nf_hook_ops *ops, struct sk_buff *skb,EXPORT_SYMBOL_GPL (nf_nat_ipv4_in);unsigned int -nf_nat_ipv4_out (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv4_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -384,7 +384,7 @@ nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb, ip_hdrlen(skb) < sizeof(struct iphdr))return NF_ACCEPT ; - ret =nf_nat_ipv4_fn (ops, skb, state, do_chain); + ret =nf_nat_ipv4_fn (priv, skb, state, do_chain);#ifdef CONFIG_XFRM if (ret != NF_DROP && ret != NF_STOLEN && !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
@@ -407,9 +407,9 @@ nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb,EXPORT_SYMBOL_GPL (nf_nat_ipv4_out);unsigned int -nf_nat_ipv4_local_fn (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv4_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -424,7 +424,7 @@ nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, ip_hdrlen(skb) < sizeof(struct iphdr))return NF_ACCEPT ; - ret =nf_nat_ipv4_fn (ops, skb, state, do_chain); + ret =nf_nat_ipv4_fn (priv, skb, state, do_chain);if (ret !=NF_DROP && ret !=NF_STOLEN && (ct =nf_ct_get (skb, &ctinfo)) !=NULL ) {enum ip_conntrack_dir dir =CTINFO2DIR (ctinfo);
net/ipv4/netfilter/nf_tables_arp.c +2 -2
@@ -15,7 +15,7 @@#include <net/netfilter/nf_tables.h> static unsigned int -nft_do_chain_arp (const struct nf_hook_ops *ops, +nft_do_chain_arp (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -23,7 +23,7 @@ nft_do_chain_arp(const struct nf_hook_ops *ops,nft_set_pktinfo (&pkt, skb, state); -return nft_do_chain (&pkt, ops); +return nft_do_chain (&pkt, priv); }static struct nft_af_info nft_af_arp__read_mostly = {
net/ipv4/netfilter/nf_tables_ipv4.c +4 -4
@@ -18,7 +18,7 @@#include <net/ip.h> #include <net/netfilter/nf_tables_ipv4.h> -static unsigned int nft_do_chain_ipv4 (const struct nf_hook_ops *ops, +static unsigned int nft_do_chain_ipv4 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -26,10 +26,10 @@ static unsigned int nft_do_chain_ipv4(const struct nf_hook_ops *ops,nft_set_pktinfo_ipv4 (&pkt, skb, state); -return nft_do_chain (&pkt, ops); +return nft_do_chain (&pkt, priv); } -static unsigned int nft_ipv4_output (const struct nf_hook_ops *ops, +static unsigned int nft_ipv4_output (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -41,7 +41,7 @@ static unsigned int nft_ipv4_output(const struct nf_hook_ops *ops,return NF_ACCEPT ; } -return nft_do_chain_ipv4 (ops, skb, state); +return nft_do_chain_ipv4 (priv, skb, state); }struct nft_af_info nft_af_ipv4__read_mostly = {
net/ipv4/netfilter/nft_chain_nat_ipv4.c +10 -10
@@ -26,7 +26,7 @@#include <net/netfilter/nf_nat_l3proto.h> #include <net/ip.h> -static unsigned int nft_nat_do_chain (const struct nf_hook_ops *ops, +static unsigned int nft_nat_do_chain (void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)
@@ -35,35 +35,35 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops,nft_set_pktinfo_ipv4 (&pkt, skb, state); -return nft_do_chain (&pkt, ops); +return nft_do_chain (&pkt, priv); } -static unsigned int nft_nat_ipv4_fn (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv4_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_fn (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv4_fn (priv, skb, state, nft_nat_do_chain); } -static unsigned int nft_nat_ipv4_in (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv4_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_in (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv4_in (priv, skb, state, nft_nat_do_chain); } -static unsigned int nft_nat_ipv4_out (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv4_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_out (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv4_out (priv, skb, state, nft_nat_do_chain); } -static unsigned int nft_nat_ipv4_local_fn (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv4_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv4_local_fn (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv4_local_fn (priv, skb, state, nft_nat_do_chain); }static const struct nf_chain_type nft_chain_nat_ipv4 = {
net/ipv4/netfilter/nft_chain_route_ipv4.c +2 -2
@@ -21,7 +21,7 @@#include <net/route.h> #include <net/ip.h> -static unsigned int nf_route_table_hook (const struct nf_hook_ops *ops, +static unsigned int nf_route_table_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -45,7 +45,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops, daddr = iph->daddr; tos = iph->tos; - ret =nft_do_chain (&pkt, ops); + ret =nft_do_chain (&pkt, priv);if (ret !=NF_DROP && ret !=NF_QUEUE ) { iph =ip_hdr (skb);
net/ipv6/netfilter/ip6t_SYNPROXY.c +1 -1
@@ -313,7 +313,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)return XT_CONTINUE ; } -static unsigned int ipv6_synproxy_hook (const struct nf_hook_ops *ops, +static unsigned int ipv6_synproxy_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *nhs) {
net/ipv6/netfilter/ip6table_filter.c +1 -1
@@ -32,7 +32,7 @@ static const struct xt_table packet_filter = {/* The work comes in here from netfilter.c. */ static unsigned int -ip6table_filter_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip6table_filter_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip6t_do_table (skb, state, state->net->ipv6.ip6table_filter);
net/ipv6/netfilter/ip6table_mangle.c +1 -1
@@ -75,7 +75,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)/* The work comes in here from netfilter.c. */ static unsigned int -ip6table_mangle_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip6table_mangle_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {if (state->hook ==NF_INET_LOCAL_OUT )
net/ipv6/netfilter/ip6table_nat.c +9 -9
@@ -30,7 +30,7 @@ static const struct xt_table nf_nat_ipv6_table = { .af = NFPROTO_IPV6, }; -static unsigned int ip6table_nat_do_chain (const struct nf_hook_ops *ops, +static unsigned int ip6table_nat_do_chain (void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)
@@ -38,32 +38,32 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,return ip6t_do_table (skb, state, state->net->ipv6.ip6table_nat); } -static unsigned int ip6table_nat_fn (const struct nf_hook_ops *ops, +static unsigned int ip6table_nat_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_fn (ops, skb, state, ip6table_nat_do_chain); +return nf_nat_ipv6_fn (priv, skb, state, ip6table_nat_do_chain); } -static unsigned int ip6table_nat_in (const struct nf_hook_ops *ops, +static unsigned int ip6table_nat_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_in (ops, skb, state, ip6table_nat_do_chain); +return nf_nat_ipv6_in (priv, skb, state, ip6table_nat_do_chain); } -static unsigned int ip6table_nat_out (const struct nf_hook_ops *ops, +static unsigned int ip6table_nat_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_out (ops, skb, state, ip6table_nat_do_chain); +return nf_nat_ipv6_out (priv, skb, state, ip6table_nat_do_chain); } -static unsigned int ip6table_nat_local_fn (const struct nf_hook_ops *ops, +static unsigned int ip6table_nat_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_local_fn (ops, skb, state, ip6table_nat_do_chain); +return nf_nat_ipv6_local_fn (priv, skb, state, ip6table_nat_do_chain); }static struct nf_hook_ops nf_nat_ipv6_ops[]__read_mostly = {
net/ipv6/netfilter/ip6table_raw.c +1 -1
@@ -19,7 +19,7 @@ static const struct xt_table packet_raw = {/* The work comes in here from netfilter.c. */ static unsigned int -ip6table_raw_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip6table_raw_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip6t_do_table (skb, state, state->net->ipv6.ip6table_raw);
net/ipv6/netfilter/ip6table_security.c +1 -1
@@ -36,7 +36,7 @@ static const struct xt_table security_table = { };static unsigned int -ip6table_security_hook (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip6table_security_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip6t_do_table (skb, state, state->net->ipv6.ip6table_security);
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +4 -4
@@ -95,7 +95,7 @@ static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,return NF_ACCEPT ; } -static unsigned int ipv6_helper (const struct nf_hook_ops *ops, +static unsigned int ipv6_helper (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -131,7 +131,7 @@ static unsigned int ipv6_helper(const struct nf_hook_ops *ops,return helper->help (skb, protoff, ct, ctinfo); } -static unsigned int ipv6_confirm (const struct nf_hook_ops *ops, +static unsigned int ipv6_confirm (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -165,14 +165,14 @@ out:return nf_conntrack_confirm (skb); } -static unsigned int ipv6_conntrack_in (const struct nf_hook_ops *ops, +static unsigned int ipv6_conntrack_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return nf_conntrack_in (state->net,PF_INET6 , state->hook, skb); } -static unsigned int ipv6_conntrack_local (const struct nf_hook_ops *ops, +static unsigned int ipv6_conntrack_local (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +1 -1
@@ -52,7 +52,7 @@ static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, } -static unsigned int ipv6_defrag (const struct nf_hook_ops *ops, +static unsigned int ipv6_defrag (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +12 -12
@@ -262,9 +262,9 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,EXPORT_SYMBOL_GPL (nf_nat_icmpv6_reply_translation);unsigned int -nf_nat_ipv6_fn (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv6_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -317,7 +317,7 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (!nf_nat_initialized (ct, maniptype)) {unsigned int ret; - ret =do_chain (ops, skb, state, ct); + ret =do_chain (priv, skb, state, ct);if (ret !=NF_ACCEPT )return ret;
@@ -353,9 +353,9 @@ oif_changed:EXPORT_SYMBOL_GPL (nf_nat_ipv6_fn);unsigned int -nf_nat_ipv6_in (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv6_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -363,7 +363,7 @@ nf_nat_ipv6_in(const struct nf_hook_ops *ops, struct sk_buff *skb,unsigned int ret;struct in6_addr daddr =ipv6_hdr (skb)->daddr; - ret =nf_nat_ipv6_fn (ops, skb, state, do_chain); + ret =nf_nat_ipv6_fn (priv, skb, state, do_chain);if (ret !=NF_DROP && ret !=NF_STOLEN &&ipv6_addr_cmp (&daddr, &ipv6_hdr (skb)->daddr))skb_dst_drop (skb);
@@ -373,9 +373,9 @@ nf_nat_ipv6_in(const struct nf_hook_ops *ops, struct sk_buff *skb,EXPORT_SYMBOL_GPL (nf_nat_ipv6_in);unsigned int -nf_nat_ipv6_out (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv6_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -391,7 +391,7 @@ nf_nat_ipv6_out(const struct nf_hook_ops *ops, struct sk_buff *skb,if (skb->len <sizeof (struct ipv6hdr ))return NF_ACCEPT ; - ret =nf_nat_ipv6_fn (ops, skb, state, do_chain); + ret =nf_nat_ipv6_fn (priv, skb, state, do_chain);#ifdef CONFIG_XFRM if (ret != NF_DROP && ret != NF_STOLEN && !(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
@@ -414,9 +414,9 @@ nf_nat_ipv6_out(const struct nf_hook_ops *ops, struct sk_buff *skb,EXPORT_SYMBOL_GPL (nf_nat_ipv6_out);unsigned int -nf_nat_ipv6_local_fn (const struct nf_hook_ops *ops,struct sk_buff *skb, +nf_nat_ipv6_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state, -unsigned int (*do_chain)(const struct nf_hook_ops *ops, +unsigned int (*do_chain)(void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct))
@@ -430,7 +430,7 @@ nf_nat_ipv6_local_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,if (skb->len <sizeof (struct ipv6hdr ))return NF_ACCEPT ; - ret =nf_nat_ipv6_fn (ops, skb, state, do_chain); + ret =nf_nat_ipv6_fn (priv, skb, state, do_chain);if (ret !=NF_DROP && ret !=NF_STOLEN && (ct =nf_ct_get (skb, &ctinfo)) !=NULL ) {enum ip_conntrack_dir dir =CTINFO2DIR (ctinfo);
net/ipv6/netfilter/nf_tables_ipv6.c +4 -4
@@ -16,7 +16,7 @@#include <net/netfilter/nf_tables.h> #include <net/netfilter/nf_tables_ipv6.h> -static unsigned int nft_do_chain_ipv6 (const struct nf_hook_ops *ops, +static unsigned int nft_do_chain_ipv6 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -26,10 +26,10 @@ static unsigned int nft_do_chain_ipv6(const struct nf_hook_ops *ops,if (nft_set_pktinfo_ipv6 (&pkt, skb, state) <0 )return NF_DROP ; -return nft_do_chain (&pkt, ops); +return nft_do_chain (&pkt, priv); } -static unsigned int nft_ipv6_output (const struct nf_hook_ops *ops, +static unsigned int nft_ipv6_output (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -40,7 +40,7 @@ static unsigned int nft_ipv6_output(const struct nf_hook_ops *ops,return NF_ACCEPT ; } -return nft_do_chain_ipv6 (ops, skb, state); +return nft_do_chain_ipv6 (priv, skb, state); }struct nft_af_info nft_af_ipv6__read_mostly = {
net/ipv6/netfilter/nft_chain_nat_ipv6.c +10 -10
@@ -24,7 +24,7 @@#include <net/netfilter/nf_nat_l3proto.h> #include <net/ipv6.h> -static unsigned int nft_nat_do_chain (const struct nf_hook_ops *ops, +static unsigned int nft_nat_do_chain (void *priv,struct sk_buff *skb,const struct nf_hook_state *state,struct nf_conn *ct)
@@ -33,35 +33,35 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops,nft_set_pktinfo_ipv6 (&pkt, skb, state); -return nft_do_chain (&pkt, ops); +return nft_do_chain (&pkt, priv); } -static unsigned int nft_nat_ipv6_fn (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv6_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_fn (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv6_fn (priv, skb, state, nft_nat_do_chain); } -static unsigned int nft_nat_ipv6_in (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv6_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_in (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv6_in (priv, skb, state, nft_nat_do_chain); } -static unsigned int nft_nat_ipv6_out (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv6_out (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_out (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv6_out (priv, skb, state, nft_nat_do_chain); } -static unsigned int nft_nat_ipv6_local_fn (const struct nf_hook_ops *ops, +static unsigned int nft_nat_ipv6_local_fn (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -return nf_nat_ipv6_local_fn (ops, skb, state, nft_nat_do_chain); +return nf_nat_ipv6_local_fn (priv, skb, state, nft_nat_do_chain); }static const struct nf_chain_type nft_chain_nat_ipv6 = {
net/ipv6/netfilter/nft_chain_route_ipv6.c +2 -2
@@ -22,7 +22,7 @@#include <net/netfilter/nf_tables_ipv6.h> #include <net/route.h> -static unsigned int nf_route_table_hook (const struct nf_hook_ops *ops, +static unsigned int nf_route_table_hook (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -45,7 +45,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,/* flowlabel and prio (includes version, which shouldn't change either */ flowlabel = *((u32 *)ipv6_hdr (skb)); - ret =nft_do_chain (&pkt, ops); + ret =nft_do_chain (&pkt, priv); if (ret != NF_DROP && ret != NF_QUEUE && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) || memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
net/netfilter/core.c +1 -1
@@ -165,7 +165,7 @@ unsigned int nf_iterate(struct list_head *head,/* Optimization: we don't need to hold module reference here, since function can't sleep. --RR */ repeat: - verdict = (*elemp)->hook (*elemp, skb, state); + verdict = (*elemp)->hook ((*elemp)->priv, skb, state);if (verdict !=NF_ACCEPT ) {#ifdef CONFIG_NETFILTER_DEBUG if (unlikely((verdict & NF_VERDICT_MASK)
net/netfilter/ipvs/ip_vs_core.c +12 -12
@@ -1271,7 +1271,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af)* Check if packet is reply for established ip_vs_conn. */ static unsigned int -ip_vs_reply4 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_reply4 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_out (state->hook, skb,AF_INET );
@@ -1282,7 +1282,7 @@ ip_vs_reply4(const struct nf_hook_ops *ops, struct sk_buff *skb,* Check if packet is reply for established ip_vs_conn. */ static unsigned int -ip_vs_local_reply4 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_local_reply4 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_out (state->hook, skb,AF_INET );
@@ -1296,7 +1296,7 @@ ip_vs_local_reply4(const struct nf_hook_ops *ops, struct sk_buff *skb,* Check if packet is reply for established ip_vs_conn. */ static unsigned int -ip_vs_reply6 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_reply6 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_out (state->hook, skb,AF_INET6 );
@@ -1307,7 +1307,7 @@ ip_vs_reply6(const struct nf_hook_ops *ops, struct sk_buff *skb,* Check if packet is reply for established ip_vs_conn. */ static unsigned int -ip_vs_local_reply6 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_local_reply6 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_out (state->hook, skb,AF_INET6 );
@@ -1764,7 +1764,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)* Schedule and forward packets from remote clients */ static unsigned int -ip_vs_remote_request4 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_remote_request4 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_in (state->hook, skb,AF_INET );
@@ -1775,7 +1775,7 @@ ip_vs_remote_request4(const struct nf_hook_ops *ops, struct sk_buff *skb,* Schedule and forward packets from local clients */ static unsigned int -ip_vs_local_request4 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_local_request4 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_in (state->hook, skb,AF_INET );
@@ -1788,7 +1788,7 @@ ip_vs_local_request4(const struct nf_hook_ops *ops, struct sk_buff *skb,* Schedule and forward packets from remote clients */ static unsigned int -ip_vs_remote_request6 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_remote_request6 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_in (state->hook, skb,AF_INET6 );
@@ -1799,7 +1799,7 @@ ip_vs_remote_request6(const struct nf_hook_ops *ops, struct sk_buff *skb,* Schedule and forward packets from local clients */ static unsigned int -ip_vs_local_request6 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_local_request6 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {return ip_vs_in (state->hook, skb,AF_INET6 );
@@ -1818,7 +1818,7 @@ ip_vs_local_request6(const struct nf_hook_ops *ops, struct sk_buff *skb,* and send them to ip_vs_in_icmp. */ static unsigned int -ip_vs_forward_icmp (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_forward_icmp (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {int r;
@@ -1834,12 +1834,12 @@ ip_vs_forward_icmp(const struct nf_hook_ops *ops, struct sk_buff *skb,if (unlikely (sysctl_backup_only (ipvs) || !ipvs->enable))return NF_ACCEPT ; -return ip_vs_in_icmp (skb, &r, ops->hooknum); +return ip_vs_in_icmp (skb, &r, state->hook); }#ifdef CONFIG_IP_VS_IPV6 static unsigned int -ip_vs_forward_icmp_v6 (const struct nf_hook_ops *ops,struct sk_buff *skb, +ip_vs_forward_icmp_v6 (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {int r;
@@ -1857,7 +1857,7 @@ ip_vs_forward_icmp_v6(const struct nf_hook_ops *ops, struct sk_buff *skb,if (unlikely (sysctl_backup_only (ipvs) || !ipvs->enable))return NF_ACCEPT ; - return ip_vs_in_icmp_v6(skb, &r, ops->hooknum, &iphdr); + return ip_vs_in_icmp_v6(skb, &r, state->hook, &iphdr); }#endif
net/netfilter/nf_tables_core.c +2 -2
@@ -109,9 +109,9 @@ struct nft_jumpstack { };unsigned int -nft_do_chain (struct nft_pktinfo *pkt,const struct nf_hook_ops *ops) +nft_do_chain (struct nft_pktinfo *pkt,void *priv) { -const struct nft_chain *chain = ops->priv, *basechain = chain; +const struct nft_chain *chain = priv, *basechain = chain;const struct net *net =read_pnet (&nft_base_chain (basechain)->pnet);const struct nft_rule *rule;const struct nft_expr *expr, *last;
net/netfilter/nf_tables_netdev.c +2 -2
@@ -89,7 +89,7 @@ static inline void nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt, }static unsigned int -nft_do_chain_netdev (const struct nf_hook_ops *ops,struct sk_buff *skb, +nft_do_chain_netdev (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {struct nft_pktinfo pkt;
@@ -106,7 +106,7 @@ nft_do_chain_netdev(const struct nf_hook_ops *ops, struct sk_buff *skb,break ; } -return nft_do_chain (&pkt, ops); +return nft_do_chain (&pkt, priv); }static struct nft_af_info nft_af_netdev__read_mostly = {
security/selinux/hooks.c +5 -5
@@ -4844,7 +4844,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb,return NF_ACCEPT ; } -static unsigned int selinux_ipv4_forward (const struct nf_hook_ops *ops, +static unsigned int selinux_ipv4_forward (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -4852,7 +4852,7 @@ static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops, }#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE ) -static unsigned int selinux_ipv6_forward (const struct nf_hook_ops *ops, +static unsigned int selinux_ipv6_forward (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -4902,7 +4902,7 @@ static unsigned int selinux_ip_output(struct sk_buff *skb,return NF_ACCEPT ; } -static unsigned int selinux_ipv4_output (const struct nf_hook_ops *ops, +static unsigned int selinux_ipv4_output (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -5077,7 +5077,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb,return NF_ACCEPT ; } -static unsigned int selinux_ipv4_postroute (const struct nf_hook_ops *ops, +static unsigned int selinux_ipv4_postroute (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -5085,7 +5085,7 @@ static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops, }#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE ) -static unsigned int selinux_ipv6_postroute (const struct nf_hook_ops *ops, +static unsigned int selinux_ipv6_postroute (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
security/smack/smack_netfilter.c +2 -2
@@ -21,7 +21,7 @@#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE ) -static unsigned int smack_ipv6_output (const struct nf_hook_ops *ops, +static unsigned int smack_ipv6_output (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
@@ -38,7 +38,7 @@ static unsigned int smack_ipv6_output(const struct nf_hook_ops *ops, }#endif /* IPV6 */ -static unsigned int smack_ipv4_output (const struct nf_hook_ops *ops, +static unsigned int smack_ipv4_output (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) {
Signature · 1 line
2.2.1
PATCH 21/43 netfilter: Add a network namespace Kconfig conflict
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Don't allow network namespaces and netfilter to both be enabled. This allows the netfilter code to be bisected through while per network namespace netfilter hooks are being implemented.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- init/Kconfig | 1 + 1 file changed, 1 insertion(+)
init/Kconfig +1 -0
@@ -1207,6 +1207,7 @@ config PID_NS config NET_NS bool "Network namespace" depends on NET + depends on !NETFILTER default y help Allow user space to create what appear to be multiple instances
Signature · 1 line
2.2.1
PATCH 22/43 netfilter: Add a struct net parameter to nf_register_hook[s]
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
This is needed to support per network namespace netfilter hooks.
Since network namespace support is temporarily disabled all of the callers can be modified to just pass init_net, without changing their behavior.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter.h | 4 ++-- net/bridge/br_netfilter.c | 2 +- net/bridge/netfilter/ebtable_filter.c | 3 ++- net/bridge/netfilter/ebtable_nat.c | 3 ++- net/decnet/netfilter/dn_rtmsg.c | 2 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/iptable_nat.c | 3 ++- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 +- net/ipv4/netfilter/nf_defrag_ipv4.c | 3 ++- net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +- net/ipv6/netfilter/ip6table_nat.c | 3 ++- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 2 +- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 3 ++- net/netfilter/core.c | 6 +++--- net/netfilter/ipvs/ip_vs_core.c | 2 +- net/netfilter/nf_queue.c | 2 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/x_tables.c | 2 +- security/selinux/hooks.c | 3 ++- security/smack/smack_netfilter.c | 3 ++- 21 files changed, 32 insertions(+), 24 deletions(-)
include/linux/netfilter.h +2 -2
@@ -121,9 +121,9 @@ struct nf_sockopt_ops { };/* Function to register/unregister hook points. */ -int nf_register_hook (struct nf_hook_ops *reg); +int nf_register_hook (struct net *net,struct nf_hook_ops *reg);void nf_unregister_hook (struct nf_hook_ops *reg); -int nf_register_hooks (struct nf_hook_ops *reg,unsigned int n); +int nf_register_hooks (struct net *net,struct nf_hook_ops *reg,unsigned int n);void nf_unregister_hooks (struct nf_hook_ops *reg,unsigned int n);/* Functions to register get/setsockopt ranges (non-inclusive). You
net/bridge/br_netfilter.c +1 -1
@@ -1250,7 +1250,7 @@ static int __init br_netfilter_init(void) {int ret; - ret =nf_register_hooks (br_nf_ops,ARRAY_SIZE (br_nf_ops)); + ret =nf_register_hooks (&init_net, br_nf_ops,ARRAY_SIZE (br_nf_ops));if (ret <0 )return ret;
net/bridge/netfilter/ebtable_filter.c +2 -1
@@ -117,7 +117,8 @@ static int __init ebtable_filter_init(void) ret =register_pernet_subsys (&frame_filter_net_ops);if (ret <0 )return ret; - ret =nf_register_hooks (ebt_ops_filter,ARRAY_SIZE (ebt_ops_filter)); + ret =nf_register_hooks (&init_net, ebt_ops_filter, +ARRAY_SIZE (ebt_ops_filter));if (ret <0 )unregister_pernet_subsys (&frame_filter_net_ops);return ret;
net/bridge/netfilter/ebtable_nat.c +2 -1
@@ -117,7 +117,8 @@ static int __init ebtable_nat_init(void) ret =register_pernet_subsys (&frame_nat_net_ops);if (ret <0 )return ret; - ret =nf_register_hooks (ebt_ops_nat,ARRAY_SIZE (ebt_ops_nat)); + ret =nf_register_hooks (&init_net, ebt_ops_nat, +ARRAY_SIZE (ebt_ops_nat));if (ret <0 )unregister_pernet_subsys (&frame_nat_net_ops);return ret;
net/decnet/netfilter/dn_rtmsg.c +1 -1
@@ -134,7 +134,7 @@ static int __init dn_rtmsg_init(void)return -ENOMEM ; } - rv =nf_register_hook (&dnrmg_ops); + rv =nf_register_hook (&init_net, &dnrmg_ops);if (rv) {netlink_kernel_release (dnrmg); }
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
@@ -767,7 +767,7 @@ static int __init clusterip_tg_init(void)if (ret <0 ) goto cleanup_subsys; - ret =nf_register_hook (&cip_arp_ops); + ret =nf_register_hook (&init_net, &cip_arp_ops);if (ret <0 ) goto cleanup_target;
net/ipv4/netfilter/ipt_SYNPROXY.c +1 -1
@@ -450,7 +450,7 @@ static int __init synproxy_tg4_init(void) {int err; - err =nf_register_hooks (ipv4_synproxy_ops, + err =nf_register_hooks (&init_net, ipv4_synproxy_ops,ARRAY_SIZE (ipv4_synproxy_ops));if (err <0 ) goto err1;
net/ipv4/netfilter/iptable_nat.c +2 -1
@@ -129,7 +129,8 @@ static int __init iptable_nat_init(void)if (err <0 ) goto err1; - err =nf_register_hooks (nf_nat_ipv4_ops,ARRAY_SIZE (nf_nat_ipv4_ops)); + err =nf_register_hooks (&init_net, nf_nat_ipv4_ops, +ARRAY_SIZE (nf_nat_ipv4_ops));if (err <0 ) goto err2;return 0 ;
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +1 -1
@@ -467,7 +467,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void) goto cleanup_sockopt; } - ret =nf_register_hooks (ipv4_conntrack_ops, + ret =nf_register_hooks (&init_net, ipv4_conntrack_ops,ARRAY_SIZE (ipv4_conntrack_ops));if (ret <0 ) {pr_err ("nf_conntrack_ipv4: can't register hooks.\n" );
net/ipv4/netfilter/nf_defrag_ipv4.c +2 -1
@@ -111,7 +111,8 @@ static struct nf_hook_ops ipv4_defrag_ops[] = {static int __init nf_defrag_init (void ) { -return nf_register_hooks (ipv4_defrag_ops,ARRAY_SIZE (ipv4_defrag_ops)); +return nf_register_hooks (&init_net, ipv4_defrag_ops, +ARRAY_SIZE (ipv4_defrag_ops)); } static void __exit nf_defrag_fini(void)
net/ipv6/netfilter/ip6t_SYNPROXY.c +1 -1
@@ -473,7 +473,7 @@ static int __init synproxy_tg6_init(void) {int err; - err =nf_register_hooks (ipv6_synproxy_ops, + err =nf_register_hooks (&init_net, ipv6_synproxy_ops,ARRAY_SIZE (ipv6_synproxy_ops));if (err <0 ) goto err1;
net/ipv6/netfilter/ip6table_nat.c +2 -1
@@ -131,7 +131,8 @@ static int __init ip6table_nat_init(void)if (err <0 ) goto err1; - err =nf_register_hooks (nf_nat_ipv6_ops,ARRAY_SIZE (nf_nat_ipv6_ops)); + err =nf_register_hooks (&init_net, nf_nat_ipv6_ops, +ARRAY_SIZE (nf_nat_ipv6_ops));if (err <0 ) goto err2;return 0 ;
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +1 -1
@@ -407,7 +407,7 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)if (ret <0 ) goto cleanup_sockopt; - ret =nf_register_hooks (ipv6_conntrack_ops, + ret =nf_register_hooks (&init_net, ipv6_conntrack_ops,ARRAY_SIZE (ipv6_conntrack_ops));if (ret <0 ) { pr_err("nf_conntrack_ipv6: can't register pre-routing defrag "
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +2 -1
@@ -109,7 +109,8 @@ static int __init nf_defrag_init(void)pr_err ("nf_defrag_ipv6: can't initialize frag6.\n" );return ret; } - ret =nf_register_hooks (ipv6_defrag_ops,ARRAY_SIZE (ipv6_defrag_ops)); + ret =nf_register_hooks (&init_net, ipv6_defrag_ops, +ARRAY_SIZE (ipv6_defrag_ops));if (ret <0 ) {pr_err ("nf_defrag_ipv6: can't register hooks\n" ); goto cleanup_frag6;
net/netfilter/core.c +3 -3
@@ -62,7 +62,7 @@ EXPORT_SYMBOL(nf_hooks_needed);static DEFINE_MUTEX (nf_hook_mutex); -int nf_register_hook (struct nf_hook_ops *reg) +int nf_register_hook (struct net *net,struct nf_hook_ops *reg) {struct list_head *nf_hook_list;struct nf_hook_ops *elem;
@@ -121,13 +121,13 @@ void nf_unregister_hook(struct nf_hook_ops *reg) }EXPORT_SYMBOL (nf_unregister_hook); -int nf_register_hooks (struct nf_hook_ops *reg,unsigned int n) +int nf_register_hooks (struct net *net,struct nf_hook_ops *reg,unsigned int n) {unsigned int i;int err =0 ;for (i =0 ; i < n; i++) { - err =nf_register_hook (®[i]); + err =nf_register_hook (net, ®[i]);if (err) goto err; }
net/netfilter/ipvs/ip_vs_core.c +1 -1
@@ -2088,7 +2088,7 @@ static int __init ip_vs_init(void)if (ret <0 ) goto cleanup_sub; - ret =nf_register_hooks (ip_vs_ops,ARRAY_SIZE (ip_vs_ops)); + ret =nf_register_hooks (&init_net, ip_vs_ops,ARRAY_SIZE (ip_vs_ops));if (ret <0 ) {pr_err ("can't register hooks.\n" ); goto cleanup_dev;
net/netfilter/nf_queue.c +1 -1
@@ -196,7 +196,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)if (verdict ==NF_ACCEPT ) { next_hook: - verdict =nf_iterate (&nf_hooks[entry->state.pf][entry->state.hook], + verdict =nf_iterate (entry->state.hook_list, skb, &entry->state, &elem); }
net/netfilter/nf_tables_api.c +1 -1
@@ -133,7 +133,7 @@ int nft_register_basechain(struct nft_base_chain *basechain,if (basechain->flags &NFT_BASECHAIN_DISABLED )return 0 ; -return nf_register_hooks (basechain->ops, hook_nops); +return nf_register_hooks (&init_net, basechain->ops, hook_nops); }EXPORT_SYMBOL_GPL (nft_register_basechain);
net/netfilter/x_tables.c +1 -1
@@ -1193,7 +1193,7 @@ struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn) ++i; } - ret =nf_register_hooks (ops, num_hooks); + ret =nf_register_hooks (&init_net, ops, num_hooks);if (ret <0 ) {kfree (ops);return ERR_PTR (ret);
security/selinux/hooks.c +2 -1
@@ -6156,7 +6156,8 @@ static int __init selinux_nf_ip_init(void)printk (KERN_DEBUG "SELinux: Registering netfilter hooks\n" ); - err =nf_register_hooks (selinux_nf_ops,ARRAY_SIZE (selinux_nf_ops)); + err =nf_register_hooks (&init_net, selinux_nf_ops, +ARRAY_SIZE (selinux_nf_ops));if (err)panic ("SELinux: nf_register_hooks: error %d\n" , err);
security/smack/smack_netfilter.c +2 -1
@@ -82,7 +82,8 @@ static int __init smack_nf_ip_init(void)printk (KERN_DEBUG "Smack: Registering netfilter hooks\n" ); - err =nf_register_hooks (smack_nf_ops,ARRAY_SIZE (smack_nf_ops)); + err =nf_register_hooks (&init_net, smack_nf_ops, +ARRAY_SIZE (smack_nf_ops));if (err)pr_info ("Smack: nf_register_hooks: error %d\n" , err);
Signature · 1 line
2.2.1
PATCH 23/43 netfilter: Add a struct net parameter to nf_unregister_hook[s]
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter.h | 4 ++-- net/bridge/br_netfilter.c | 4 ++-- net/bridge/netfilter/ebtable_filter.c | 2 +- net/bridge/netfilter/ebtable_nat.c | 2 +- net/decnet/netfilter/dn_rtmsg.c | 2 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 4 ++-- net/ipv4/netfilter/iptable_nat.c | 2 +- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 ++-- net/ipv4/netfilter/nf_defrag_ipv4.c | 2 +- net/ipv6/netfilter/ip6t_SYNPROXY.c | 4 ++-- net/ipv6/netfilter/ip6table_nat.c | 2 +- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 4 ++-- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 2 +- net/netfilter/core.c | 9 +++++---- net/netfilter/ipvs/ip_vs_core.c | 4 ++-- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/x_tables.c | 2 +- security/selinux/hooks.c | 2 +- 19 files changed, 30 insertions(+), 29 deletions(-)
include/linux/netfilter.h +2 -2
@@ -122,9 +122,9 @@ struct nf_sockopt_ops {/* Function to register/unregister hook points. */ int nf_register_hook (struct net *net,struct nf_hook_ops *reg); -void nf_unregister_hook (struct nf_hook_ops *reg); +void nf_unregister_hook (struct net *net,struct nf_hook_ops *reg);int nf_register_hooks (struct net *net,struct nf_hook_ops *reg,unsigned int n); -void nf_unregister_hooks (struct nf_hook_ops *reg,unsigned int n); +void nf_unregister_hooks (struct net *net,struct nf_hook_ops *reg,unsigned int n);/* Functions to register get/setsockopt ranges (non-inclusive). You need to check permissions yourself! */
net/bridge/br_netfilter.c +2 -2
@@ -1259,7 +1259,7 @@ static int __init br_netfilter_init(void)if (brnf_sysctl_header ==NULL ) {printk (KERN_WARNING "br_netfilter: can't register to sysctl.\n" ); -nf_unregister_hooks (br_nf_ops,ARRAY_SIZE (br_nf_ops)); +nf_unregister_hooks (&init_net, br_nf_ops,ARRAY_SIZE (br_nf_ops));return -ENOMEM ; }#endif
@@ -1271,7 +1271,7 @@ static int __init br_netfilter_init(void) static void __exit br_netfilter_fini(void) {RCU_INIT_POINTER (nf_br_ops,NULL ); -nf_unregister_hooks (br_nf_ops,ARRAY_SIZE (br_nf_ops)); +nf_unregister_hooks (&init_net, br_nf_ops,ARRAY_SIZE (br_nf_ops));#ifdef CONFIG_SYSCTL unregister_net_sysctl_table (brnf_sysctl_header);#endif
net/bridge/netfilter/ebtable_filter.c +1 -1
@@ -126,7 +126,7 @@ static int __init ebtable_filter_init(void) static void __exit ebtable_filter_fini(void) { -nf_unregister_hooks (ebt_ops_filter,ARRAY_SIZE (ebt_ops_filter)); +nf_unregister_hooks (&init_net, ebt_ops_filter,ARRAY_SIZE (ebt_ops_filter));unregister_pernet_subsys (&frame_filter_net_ops); }
net/bridge/netfilter/ebtable_nat.c +1 -1
@@ -126,7 +126,7 @@ static int __init ebtable_nat_init(void) static void __exit ebtable_nat_fini(void) { -nf_unregister_hooks (ebt_ops_nat,ARRAY_SIZE (ebt_ops_nat)); +nf_unregister_hooks (&init_net, ebt_ops_nat,ARRAY_SIZE (ebt_ops_nat));unregister_pernet_subsys (&frame_nat_net_ops); }
net/decnet/netfilter/dn_rtmsg.c +1 -1
@@ -144,7 +144,7 @@ static int __init dn_rtmsg_init(void) static void __exit dn_rtmsg_fini(void) { -nf_unregister_hook (&dnrmg_ops); +nf_unregister_hook (&init_net, &dnrmg_ops);netlink_kernel_release (dnrmg); }
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
@@ -787,7 +787,7 @@ static void __exit clusterip_tg_exit(void) {pr_info ("ClusterIP Version %s unloading\n" ,CLUSTERIP_VERSION ); -nf_unregister_hook (&cip_arp_ops); +nf_unregister_hook (&init_net, &cip_arp_ops);xt_unregister_target (&clusterip_tg_reg);unregister_pernet_subsys (&clusterip_net_ops);
net/ipv4/netfilter/ipt_SYNPROXY.c +2 -2
@@ -462,7 +462,7 @@ static int __init synproxy_tg4_init(void)return 0 ; err2: -nf_unregister_hooks (ipv4_synproxy_ops,ARRAY_SIZE (ipv4_synproxy_ops)); +nf_unregister_hooks (&init_net, ipv4_synproxy_ops,ARRAY_SIZE (ipv4_synproxy_ops)); err1:return err; }
@@ -470,7 +470,7 @@ err1: static void __exit synproxy_tg4_exit(void) {xt_unregister_target (&synproxy_tg4_reg); -nf_unregister_hooks (ipv4_synproxy_ops,ARRAY_SIZE (ipv4_synproxy_ops)); +nf_unregister_hooks (&init_net, ipv4_synproxy_ops,ARRAY_SIZE (ipv4_synproxy_ops)); }module_init (synproxy_tg4_init);
net/ipv4/netfilter/iptable_nat.c +1 -1
@@ -143,7 +143,7 @@ err1: static void __exit iptable_nat_exit(void) { -nf_unregister_hooks (nf_nat_ipv4_ops,ARRAY_SIZE (nf_nat_ipv4_ops)); +nf_unregister_hooks (&init_net, nf_nat_ipv4_ops,ARRAY_SIZE (nf_nat_ipv4_ops));unregister_pernet_subsys (&iptable_nat_net_ops); }
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +2 -2
@@ -515,7 +515,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void) cleanup_tcp4:nf_ct_l4proto_unregister (&nf_conntrack_l4proto_tcp4); cleanup_hooks: -nf_unregister_hooks (ipv4_conntrack_ops,ARRAY_SIZE (ipv4_conntrack_ops)); +nf_unregister_hooks (&init_net, ipv4_conntrack_ops,ARRAY_SIZE (ipv4_conntrack_ops)); cleanup_pernet:unregister_pernet_subsys (&ipv4_net_ops); cleanup_sockopt:
@@ -533,7 +533,7 @@ static void __exit nf_conntrack_l3proto_ipv4_fini(void)nf_ct_l4proto_unregister (&nf_conntrack_l4proto_icmp);nf_ct_l4proto_unregister (&nf_conntrack_l4proto_udp4);nf_ct_l4proto_unregister (&nf_conntrack_l4proto_tcp4); -nf_unregister_hooks (ipv4_conntrack_ops,ARRAY_SIZE (ipv4_conntrack_ops)); +nf_unregister_hooks (&init_net, ipv4_conntrack_ops,ARRAY_SIZE (ipv4_conntrack_ops));unregister_pernet_subsys (&ipv4_net_ops);nf_unregister_sockopt (&so_getorigdst); }
net/ipv4/netfilter/nf_defrag_ipv4.c +1 -1
@@ -117,7 +117,7 @@ static int __init nf_defrag_init(void) static void __exit nf_defrag_fini(void) { -nf_unregister_hooks (ipv4_defrag_ops,ARRAY_SIZE (ipv4_defrag_ops)); +nf_unregister_hooks (&init_net, ipv4_defrag_ops,ARRAY_SIZE (ipv4_defrag_ops)); }void nf_defrag_ipv4_enable (void )
net/ipv6/netfilter/ip6t_SYNPROXY.c +2 -2
@@ -485,7 +485,7 @@ static int __init synproxy_tg6_init(void)return 0 ; err2: -nf_unregister_hooks (ipv6_synproxy_ops,ARRAY_SIZE (ipv6_synproxy_ops)); +nf_unregister_hooks (&init_net, ipv6_synproxy_ops,ARRAY_SIZE (ipv6_synproxy_ops)); err1:return err; }
@@ -493,7 +493,7 @@ err1: static void __exit synproxy_tg6_exit(void) {xt_unregister_target (&synproxy_tg6_reg); -nf_unregister_hooks (ipv6_synproxy_ops,ARRAY_SIZE (ipv6_synproxy_ops)); +nf_unregister_hooks (&init_net, ipv6_synproxy_ops,ARRAY_SIZE (ipv6_synproxy_ops)); }module_init (synproxy_tg6_init);
net/ipv6/netfilter/ip6table_nat.c +1 -1
@@ -145,7 +145,7 @@ err1: static void __exit ip6table_nat_exit(void) { -nf_unregister_hooks (nf_nat_ipv6_ops,ARRAY_SIZE (nf_nat_ipv6_ops)); +nf_unregister_hooks (&init_net, nf_nat_ipv6_ops,ARRAY_SIZE (nf_nat_ipv6_ops));unregister_pernet_subsys (&ip6table_nat_net_ops); }
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +2 -2
@@ -447,7 +447,7 @@ static int __init nf_conntrack_l3proto_ipv6_init(void) cleanup_tcp6:nf_ct_l4proto_unregister (&nf_conntrack_l4proto_tcp6); cleanup_hooks: -nf_unregister_hooks (ipv6_conntrack_ops,ARRAY_SIZE (ipv6_conntrack_ops)); +nf_unregister_hooks (&init_net, ipv6_conntrack_ops,ARRAY_SIZE (ipv6_conntrack_ops)); cleanup_pernet:unregister_pernet_subsys (&ipv6_net_ops); cleanup_sockopt:
@@ -462,7 +462,7 @@ static void __exit nf_conntrack_l3proto_ipv6_fini(void)nf_ct_l4proto_unregister (&nf_conntrack_l4proto_tcp6);nf_ct_l4proto_unregister (&nf_conntrack_l4proto_udp6);nf_ct_l4proto_unregister (&nf_conntrack_l4proto_icmpv6); -nf_unregister_hooks (ipv6_conntrack_ops,ARRAY_SIZE (ipv6_conntrack_ops)); +nf_unregister_hooks (&init_net, ipv6_conntrack_ops,ARRAY_SIZE (ipv6_conntrack_ops));unregister_pernet_subsys (&ipv6_net_ops);nf_unregister_sockopt (&so_getorigdst6); }
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +1 -1
@@ -125,7 +125,7 @@ cleanup_frag6: static void __exit nf_defrag_fini(void) { -nf_unregister_hooks (ipv6_defrag_ops,ARRAY_SIZE (ipv6_defrag_ops)); +nf_unregister_hooks (&init_net, ipv6_defrag_ops,ARRAY_SIZE (ipv6_defrag_ops));nf_ct_frag6_cleanup (); }
net/netfilter/core.c +5 -4
@@ -97,7 +97,7 @@ int nf_register_hook(struct net *net, struct nf_hook_ops *reg) }EXPORT_SYMBOL (nf_register_hook); -void nf_unregister_hook (struct nf_hook_ops *reg) +void nf_unregister_hook (struct net *net,struct nf_hook_ops *reg) {mutex_lock (&nf_hook_mutex);list_del_rcu (®->list);
@@ -135,15 +135,16 @@ int nf_register_hooks(struct net *net, struct nf_hook_ops *reg, unsigned int n) err:if (i >0 ) -nf_unregister_hooks (reg, i); +nf_unregister_hooks (net, reg, i);return err; }EXPORT_SYMBOL (nf_register_hooks); -void nf_unregister_hooks (struct nf_hook_ops *reg,unsigned int n) +void nf_unregister_hooks (struct net *net,struct nf_hook_ops *reg, +unsigned int n) {while (n-- >0 ) -nf_unregister_hook (®[n]); +nf_unregister_hook (net, ®[n]); }EXPORT_SYMBOL (nf_unregister_hooks);
net/netfilter/ipvs/ip_vs_core.c +2 -2
@@ -2105,7 +2105,7 @@ static int __init ip_vs_init(void)return ret; cleanup_hooks: -nf_unregister_hooks (ip_vs_ops,ARRAY_SIZE (ip_vs_ops)); +nf_unregister_hooks (&init_net, ip_vs_ops,ARRAY_SIZE (ip_vs_ops)); cleanup_dev:unregister_pernet_device (&ipvs_core_dev_ops); cleanup_sub:
@@ -2122,7 +2122,7 @@ exit: static void __exit ip_vs_cleanup(void) {ip_vs_unregister_nl_ioctl (); -nf_unregister_hooks (ip_vs_ops,ARRAY_SIZE (ip_vs_ops)); +nf_unregister_hooks (&init_net, ip_vs_ops,ARRAY_SIZE (ip_vs_ops));unregister_pernet_device (&ipvs_core_dev_ops);unregister_pernet_subsys (&ipvs_core_ops);/* free ip_vs struct */ ip_vs_conn_cleanup ();
net/netfilter/nf_tables_api.c +1 -1
@@ -143,7 +143,7 @@ void nft_unregister_basechain(struct nft_base_chain *basechain,if (basechain->flags &NFT_BASECHAIN_DISABLED )return ; -nf_unregister_hooks (basechain->ops, hook_nops); +nf_unregister_hooks (&init_net, basechain->ops, hook_nops); }EXPORT_SYMBOL_GPL (nft_unregister_basechain);
net/netfilter/x_tables.c +1 -1
@@ -1210,7 +1210,7 @@ EXPORT_SYMBOL_GPL(xt_hook_link);*/ void xt_hook_unlink (const struct xt_table *table,struct nf_hook_ops *ops) { -nf_unregister_hooks (ops,hweight32 (table->valid_hooks)); +nf_unregister_hooks (&init_net, ops,hweight32 (table->valid_hooks));kfree (ops); }EXPORT_SYMBOL_GPL (xt_hook_unlink);
security/selinux/hooks.c +1 -1
@@ -6171,7 +6171,7 @@ static void selinux_nf_ip_exit(void) {printk (KERN_DEBUG "SELinux: Unregistering netfilter hooks\n" ); -nf_unregister_hooks (selinux_nf_ops,ARRAY_SIZE (selinux_nf_ops)); +nf_unregister_hooks (&init_net, selinux_nf_ops,ARRAY_SIZE (selinux_nf_ops)); }#endif
Signature · 1 line
2.2.1
PATCH 24/43 netfilter: Make the netfilter hooks per network namespace
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Work remains to register all of the hooks in the network namespaces where they are wanted.
Inspired-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Eric W Biederman <[email protected]>
--- include/linux/netfilter.h | 12 ++++++------ include/net/netns/netfilter.h | 1 + net/netfilter/core.c | 20 ++++++++++---------- 3 files changed, 17 insertions(+), 16 deletions(-)
include/linux/netfilter.h +6 -6
@@ -11,6 +11,7 @@#include <linux/list.h> #include <linux/static_key.h> #include <linux/netfilter_defs.h> +#include <net/net_namespace.h> #ifdef CONFIG_NETFILTER static inline int NF_DROP_GETERR (int verdict)
@@ -131,8 +132,6 @@ void nf_unregister_hooks(struct net *net, struct nf_hook_ops *reg, unsigned intint nf_register_sockopt (struct nf_sockopt_ops *reg);void nf_unregister_sockopt (struct nf_sockopt_ops *reg); -extern struct list_head nf_hooks[NFPROTO_NUMPROTO ][NF_MAX_HOOKS ]; -#ifdef HAVE_JUMP_LABEL extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO ][NF_MAX_HOOKS ];
@@ -153,9 +152,10 @@ static inline bool nf_hook_list_active(struct list_head *nf_hook_list, }#endif -static inline bool nf_hooks_active (u_int8_t pf,unsigned int hook) +static inline bool nf_hooks_active (struct net *net,u_int8_t pf, +unsigned int hook) { -return nf_hook_list_active (&nf_hooks[pf][hook], pf, hook); +return nf_hook_list_active (&net->nf.hooks[pf][hook], pf, hook); }int nf_hook_slow (struct sk_buff *skb,struct nf_hook_state *state);
@@ -176,10 +176,10 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, int (*okfn)(struct sock *, struct sk_buff *), int thresh) { - if (nf_hooks_active(pf, hook)) { + if (nf_hooks_active(net, pf, hook)) {struct nf_hook_state state; -nf_hook_state_init (&state, &nf_hooks[pf][hook], hook, thresh, +nf_hook_state_init (&state, &net->nf.hooks[pf][hook], hook, thresh, pf, indev, outdev, sk, net, okfn);return nf_hook_slow (skb, &state); }
include/net/netns/netfilter.h +1 -0
@@ -14,5 +14,6 @@ struct netns_nf {#ifdef CONFIG_SYSCTL struct ctl_table_header *nf_log_dir_header;#endif + struct list_head hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; };#endif
net/netfilter/core.c +10 -10
@@ -52,9 +52,6 @@ void nf_unregister_afinfo(const struct nf_afinfo *afinfo) }EXPORT_SYMBOL_GPL (nf_unregister_afinfo); -struct list_head nf_hooks[NFPROTO_NUMPROTO ][NF_MAX_HOOKS ]__read_mostly ; -EXPORT_SYMBOL (nf_hooks); -#ifdef HAVE_JUMP_LABEL struct static_key nf_hooks_needed[NFPROTO_NUMPROTO ][NF_MAX_HOOKS ];EXPORT_SYMBOL (nf_hooks_needed);
@@ -80,7 +77,7 @@ int nf_register_hook(struct net *net, struct nf_hook_ops *reg)#endif /* Fall through. */ default : - nf_hook_list = &nf_hooks[reg->pf][reg->hooknum]; + nf_hook_list = &net->nf.hooks[reg->pf][reg->hooknum];break ; }
@@ -297,6 +294,13 @@ EXPORT_SYMBOL(nf_nat_decode_session_hook);static int __net_init netfilter_net_init (struct net *net) { +int i, h; + +for (i =0 ; i <NFPROTO_NUMPROTO ; i++) { +for (h =0 ; h <NF_MAX_HOOKS ; h++) +INIT_LIST_HEAD (&net->nf.hooks[i][h]); + } +#ifdef CONFIG_PROC_FS net->nf.proc_netfilter =proc_net_mkdir (net,"netfilter" , net->proc_net);
@@ -307,6 +311,7 @@ static int __net_init netfilter_net_init(struct net *net) return -ENOMEM; }#endif +return 0 ; }
@@ -322,12 +327,7 @@ static struct pernet_operations netfilter_net_ops = {int __init netfilter_init (void ) { -int i, h, ret; - -for (i =0 ; i <ARRAY_SIZE (nf_hooks); i++) { -for (h =0 ; h <NF_MAX_HOOKS ; h++) -INIT_LIST_HEAD (&nf_hooks[i][h]); - } +int ret; ret =register_pernet_subsys (&netfilter_net_ops);if (ret <0 )
Signature · 1 line
2.2.1
PATCH 25/43 netfilter: Make nf_hook_ops just a parameter structure
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Add a new structure nf_hook_entry that makes up the nf_hook_lists, and dynamically allocate it nf_register_hook and free it in nf_unregister_hook.
This gives the netfilter hook code a little more freedom to evolve and removes an error case when converting netfilter hooks to be per nework namespace.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter.h | 12 +++--- include/net/netfilter/nf_queue.h | 4 +- net/netfilter/core.c | 92 +++++++++++++++++++++++++--------------- net/netfilter/nf_internals.h | 13 +++++- net/netfilter/nf_queue.c | 6 +-- 5 files changed, 80 insertions(+), 47 deletions(-)
include/linux/netfilter.h +6 -6
@@ -84,8 +84,6 @@ typedef unsigned int nf_hookfn(void *priv, const struct nf_hook_state *state);struct nf_hook_ops { -struct list_head list; -/* User fills in from here down. */ nf_hookfn *hook;struct net_device *dev;
@@ -122,10 +120,12 @@ struct nf_sockopt_ops { };/* Function to register/unregister hook points. */ -int nf_register_hook (struct net *net,struct nf_hook_ops *reg); -void nf_unregister_hook (struct net *net,struct nf_hook_ops *reg); -int nf_register_hooks (struct net *net,struct nf_hook_ops *reg,unsigned int n); -void nf_unregister_hooks (struct net *net,struct nf_hook_ops *reg,unsigned int n); +int nf_register_hook (struct net *net,const struct nf_hook_ops *reg); +void nf_unregister_hook (struct net *net,const struct nf_hook_ops *reg); +int nf_register_hooks (struct net *net,const struct nf_hook_ops *reg, +unsigned int n); +void nf_unregister_hooks (struct net *net,const struct nf_hook_ops *reg, +unsigned int n);/* Functions to register get/setsockopt ranges (non-inclusive). You need to check permissions yourself! */
include/net/netfilter/nf_queue.h +3 -1
@@ -5,13 +5,15 @@#include <linux/ipv6.h> #include <linux/jhash.h> +struct nf_hook_entry ; +/* Each queued (to userspace) skbuff has one of these. */ struct nf_queue_entry {struct list_head list;struct sk_buff *skb;unsigned int id; -struct nf_hook_ops *elem; +struct nf_hook_entry *elem;struct nf_hook_state state;u16 size;/* sizeof(entry) + saved route keys */
net/netfilter/core.c +57 -35
150 lines not on this page · raw message
net/netfilter/nf_internals.h +11 -2
@@ -13,11 +13,20 @@/* core.c */ +struct nf_hook_entry { +struct list_head list; +nf_hookfn *hook; +void *priv; +struct module *owner; +/* Hooks are ordered in ascending priority. */ +int priority; +}; +unsigned int nf_iterate (struct list_head *head,struct sk_buff *skb, -struct nf_hook_state *state,struct nf_hook_ops **elemp); +struct nf_hook_state *state,struct nf_hook_entry **elemp);/* nf_queue.c */ -int nf_queue (struct sk_buff *skb,struct nf_hook_ops *elem, +int nf_queue (struct sk_buff *skb,struct nf_hook_entry *elem,struct nf_hook_state *state,unsigned int queuenum);int __init netfilter_queue_init (void );
net/netfilter/nf_queue.c +3 -3
@@ -110,7 +110,7 @@ EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);* through nf_reinject(). */ int nf_queue (struct sk_buff *skb, -struct nf_hook_ops *elem, +struct nf_hook_entry *elem,struct nf_hook_state *state,unsigned int queuenum) {
@@ -172,7 +172,7 @@ err:void nf_reinject (struct nf_queue_entry *entry,unsigned int verdict) {struct sk_buff *skb = entry->skb; -struct nf_hook_ops *elem = entry->elem; +struct nf_hook_entry *elem = entry->elem;const struct nf_afinfo *afinfo;int err;
@@ -182,7 +182,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)/* Continue traversal iff userspace said ok... */ if (verdict ==NF_REPEAT ) { - elem = list_entry(elem->list.prev, struct nf_hook_ops, list); + elem = list_entry(elem->list.prev, struct nf_hook_entry, list); verdict =NF_ACCEPT ; }
Signature · 1 line
2.2.1
PATCH 26/43 netfitler: Remove spurios included of netfilter.h
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
While testing my netfilter changes I noticed several files where recompiling unncessarily because they unncessarily included netfilter.h.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- drivers/net/hamradio/bpqether.c | 1 - drivers/net/ppp/pptp.c | 2 -- drivers/net/wan/lapbether.c | 1 - net/ax25/af_ax25.c | 1 - net/ax25/ax25_in.c | 1 - net/ax25/ax25_ip.c | 1 - net/ax25/ax25_out.c | 1 - net/ax25/ax25_uid.c | 1 - net/netrom/nr_route.c | 1 - net/rose/rose_link.c | 1 - net/rose/rose_route.c | 1 - security/selinux/xfrm.c | 3 --- 12 files changed, 15 deletions(-)
drivers/net/hamradio/bpqether.c +0 -1
@@ -76,7 +76,6 @@#include <linux/proc_fs.h> #include <linux/seq_file.h> #include <linux/stat.h> -#include <linux/netfilter.h> #include <linux/module.h> #include <linux/init.h> #include <linux/rtnetlink.h>
drivers/net/ppp/pptp.c +0 -2
@@ -28,8 +28,6 @@#include <linux/file.h> #include <linux/in.h> #include <linux/ip.h> -#include <linux/netfilter.h> -#include <linux/netfilter_ipv4.h> #include <linux/rcupdate.h> #include <linux/spinlock.h>
drivers/net/wan/lapbether.c +0 -1
@@ -40,7 +40,6 @@#include <linux/interrupt.h> #include <linux/notifier.h> #include <linux/stat.h> -#include <linux/netfilter.h> #include <linux/module.h> #include <linux/lapb.h> #include <linux/init.h>
net/ax25/af_ax25.c +0 -1
@@ -40,7 +40,6 @@#include <linux/notifier.h> #include <linux/proc_fs.h> #include <linux/stat.h> -#include <linux/netfilter.h> #include <linux/sysctl.h> #include <linux/init.h> #include <linux/spinlock.h>
net/ax25/ax25_in.c +0 -1
@@ -23,7 +23,6 @@#include <linux/inet.h> #include <linux/netdevice.h> #include <linux/skbuff.h> -#include <linux/netfilter.h> #include <net/sock.h> #include <net/tcp_states.h> #include <asm/uaccess.h>
net/ax25/ax25_ip.c +0 -1
@@ -31,7 +31,6 @@#include <linux/notifier.h> #include <linux/proc_fs.h> #include <linux/stat.h> -#include <linux/netfilter.h> #include <linux/sysctl.h> #include <net/ip.h> #include <net/arp.h>
net/ax25/ax25_out.c +0 -1
@@ -24,7 +24,6 @@#include <linux/inet.h> #include <linux/netdevice.h> #include <linux/skbuff.h> -#include <linux/netfilter.h> #include <net/sock.h> #include <asm/uaccess.h> #include <linux/fcntl.h>
net/ax25/ax25_uid.c +0 -1
@@ -34,7 +34,6 @@#include <linux/proc_fs.h> #include <linux/seq_file.h> #include <linux/stat.h> -#include <linux/netfilter.h> #include <linux/sysctl.h> #include <linux/export.h> #include <net/ip.h>
net/netrom/nr_route.c +0 -1
@@ -31,7 +31,6 @@#include <linux/mm.h> #include <linux/interrupt.h> #include <linux/notifier.h> -#include <linux/netfilter.h> #include <linux/init.h> #include <linux/spinlock.h> #include <net/netrom.h>
net/rose/rose_link.c +0 -1
@@ -25,7 +25,6 @@#include <linux/fcntl.h> #include <linux/mm.h> #include <linux/interrupt.h> -#include <linux/netfilter.h> #include <net/rose.h> static void rose_ftimer_expiry (unsigned long );
net/rose/rose_route.c +0 -1
@@ -31,7 +31,6 @@#include <linux/mm.h> #include <linux/interrupt.h> #include <linux/notifier.h> -#include <linux/netfilter.h> #include <linux/init.h> #include <net/rose.h> #include <linux/seq_file.h>
security/selinux/xfrm.c +0 -3
@@ -35,9 +35,6 @@#include <linux/init.h> #include <linux/security.h> #include <linux/types.h> -#include <linux/netfilter.h> -#include <linux/netfilter_ipv4.h> -#include <linux/netfilter_ipv6.h> #include <linux/slab.h> #include <linux/ip.h> #include <linux/tcp.h>
Signature · 1 line
2.2.1
PATCH 27/43 x_tables: Add magical hook registration in the common case
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Add a new field fn to struct xt_table that will hold the standard hook function. If that field is set the hook function is automatically registered when as part of the table registration, and automatically unregisted as part of table unregistration.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter/x_tables.h | 8 +++++ net/ipv4/netfilter/arptable_filter.c | 2 +- net/netfilter/x_tables.c | 66 ++++++++++++++++++++++++++++++++++++ 3 files changed, 75 insertions(+), 1 deletion(-)
include/linux/netfilter/x_tables.h +8 -0
@@ -184,9 +184,14 @@ struct xt_target {unsigned short family; }; +struct nf_hook_state ; +typedef unsigned int xt_hookfn (void *priv, +struct sk_buff *skb, +const struct nf_hook_state *state);/* Furniture shopping... */ struct xt_table {struct list_head list; +struct net *net;/* What hooks you will enter on */ unsigned int valid_hooks;
@@ -200,6 +205,9 @@ struct xt_table {u_int8_t af;/* address/protocol family */ int priority;/* hook order */ +/* Default hook function */ +xt_hookfn *fn; +/* A unique name... */ const char name[XT_TABLE_MAXNAMELEN ]; };
net/ipv4/netfilter/arptable_filter.c +1 -1
@@ -38,7 +38,7 @@ static struct nf_hook_ops *arpfilter_ops __read_mostly;static int __net_init arptable_filter_net_init (struct net *net) {struct arpt_replace *repl; - + repl =arpt_alloc_initial_table (&packet_filter);if (repl ==NULL )return -ENOMEM ;
net/netfilter/x_tables.c +66 -0
91 lines not on this page · raw message
Signature · 1 line
2.2.1
PATCH 28/43 x_tables: Where possible convert to the new hook registration method
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/ipv4/netfilter/arptable_filter.c | 22 +++------------------- net/ipv4/netfilter/iptable_filter.c | 20 +++----------------- net/ipv4/netfilter/iptable_mangle.c | 20 +++----------------- net/ipv4/netfilter/iptable_raw.c | 20 +++----------------- net/ipv4/netfilter/iptable_security.c | 23 +++-------------------- net/ipv6/netfilter/ip6table_filter.c | 24 +++--------------------- net/ipv6/netfilter/ip6table_mangle.c | 23 +++-------------------- net/ipv6/netfilter/ip6table_raw.c | 24 +++--------------------- net/ipv6/netfilter/ip6table_security.c | 23 +++-------------------- 9 files changed, 27 insertions(+), 172 deletions(-)
net/ipv4/netfilter/arptable_filter.c +3 -19
@@ -17,12 +17,14 @@ MODULE_DESCRIPTION("arptables filter table");#define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \ (1 << NF_ARP_FORWARD)) +static xt_hookfn arptable_filter_hook;static const struct xt_table packet_filter = { .name ="filter" , .valid_hooks =FILTER_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_ARP , .priority =NF_IP_PRI_FILTER , + .fn = arptable_filter_hook, };/* The work comes in here from netfilter.c */
@@ -33,8 +35,6 @@ arptable_filter_hook(void *priv, struct sk_buff *skb,return arpt_do_table (skb, state, state->net->ipv4.arptable_filter); } -static struct nf_hook_ops *arpfilter_ops__read_mostly ; -static int __net_init arptable_filter_net_init (struct net *net) {struct arpt_replace *repl;
@@ -60,27 +60,11 @@ static struct pernet_operations arptable_filter_net_ops = {static int __init arptable_filter_init (void ) { -int ret; - - ret =register_pernet_subsys (&arptable_filter_net_ops); -if (ret <0 ) -return ret; - - arpfilter_ops =xt_hook_link (&packet_filter, arptable_filter_hook); -if (IS_ERR (arpfilter_ops)) { - ret =PTR_ERR (arpfilter_ops); - goto cleanup_table; - } -return ret; - -cleanup_table: -unregister_pernet_subsys (&arptable_filter_net_ops); -return ret; +return register_pernet_subsys (&arptable_filter_net_ops); } static void __exit arptable_filter_fini(void) { -xt_hook_unlink (&packet_filter, arpfilter_ops);unregister_pernet_subsys (&arptable_filter_net_ops); }
net/ipv4/netfilter/iptable_filter.c +3 -17
@@ -24,12 +24,14 @@ MODULE_DESCRIPTION("iptables filter table"); (1 << NF_INET_FORWARD) | \ (1 << NF_INET_LOCAL_OUT)) +static xt_hookfn iptable_filter_hook;static const struct xt_table packet_filter = { .name ="filter" , .valid_hooks =FILTER_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV4 , .priority =NF_IP_PRI_FILTER , + .fn = iptable_filter_hook, }; static unsigned int
@@ -45,8 +47,6 @@ iptable_filter_hook(void *priv, struct sk_buff *skb,return ipt_do_table (skb, state, state->net->ipv4.iptable_filter); } -static struct nf_hook_ops *filter_ops__read_mostly ; -/* Default to forward because I got too much mail already. */ static bool forward = true;module_param (forward, bool,0000 );
@@ -80,25 +80,11 @@ static struct pernet_operations iptable_filter_net_ops = {static int __init iptable_filter_init (void ) { -int ret; - - ret =register_pernet_subsys (&iptable_filter_net_ops); -if (ret <0 ) -return ret; - -/* Register hooks */ - filter_ops =xt_hook_link (&packet_filter, iptable_filter_hook); -if (IS_ERR (filter_ops)) { - ret =PTR_ERR (filter_ops); -unregister_pernet_subsys (&iptable_filter_net_ops); - } - -return ret; +return register_pernet_subsys (&iptable_filter_net_ops); } static void __exit iptable_filter_fini(void) { -xt_hook_unlink (&packet_filter, filter_ops);unregister_pernet_subsys (&iptable_filter_net_ops); }
net/ipv4/netfilter/iptable_mangle.c +3 -17
@@ -28,12 +28,14 @@ MODULE_DESCRIPTION("iptables mangle table"); (1 << NF_INET_LOCAL_OUT) | \ (1 << NF_INET_POST_ROUTING)) +static xt_hookfn iptable_mangle_hook;static const struct xt_table packet_mangler = { .name ="mangle" , .valid_hooks =MANGLE_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV4 , .priority =NF_IP_PRI_MANGLE , + .fn = iptable_mangle_hook, }; static unsigned int
@@ -91,8 +93,6 @@ iptable_mangle_hook(void *priv,return ipt_do_table (skb, state, state->net->ipv4.iptable_mangle); } -static struct nf_hook_ops *mangle_ops__read_mostly ; -static int __net_init iptable_mangle_net_init (struct net *net) {struct ipt_replace *repl;
@@ -118,25 +118,11 @@ static struct pernet_operations iptable_mangle_net_ops = {static int __init iptable_mangle_init (void ) { -int ret; - - ret =register_pernet_subsys (&iptable_mangle_net_ops); -if (ret <0 ) -return ret; - -/* Register hooks */ - mangle_ops =xt_hook_link (&packet_mangler, iptable_mangle_hook); -if (IS_ERR (mangle_ops)) { - ret =PTR_ERR (mangle_ops); -unregister_pernet_subsys (&iptable_mangle_net_ops); - } - -return ret; +return register_pernet_subsys (&iptable_mangle_net_ops); } static void __exit iptable_mangle_fini(void) { -xt_hook_unlink (&packet_mangler, mangle_ops);unregister_pernet_subsys (&iptable_mangle_net_ops); }
net/ipv4/netfilter/iptable_raw.c +3 -17
@@ -10,12 +10,14 @@#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT)) +static xt_hookfn iptable_raw_hook;static const struct xt_table packet_raw = { .name ="raw" , .valid_hooks =RAW_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV4 , .priority =NF_IP_PRI_RAW , + .fn = iptable_raw_hook, };/* The work comes in here from netfilter.c. */
@@ -32,8 +34,6 @@ iptable_raw_hook(void *priv, struct sk_buff *skb,return ipt_do_table (skb, state, state->net->ipv4.iptable_raw); } -static struct nf_hook_ops *rawtable_ops__read_mostly ; -static int __net_init iptable_raw_net_init (struct net *net) {struct ipt_replace *repl;
@@ -59,25 +59,11 @@ static struct pernet_operations iptable_raw_net_ops = {static int __init iptable_raw_init (void ) { -int ret; - - ret =register_pernet_subsys (&iptable_raw_net_ops); -if (ret <0 ) -return ret; - -/* Register hooks */ - rawtable_ops =xt_hook_link (&packet_raw, iptable_raw_hook); -if (IS_ERR (rawtable_ops)) { - ret =PTR_ERR (rawtable_ops); -unregister_pernet_subsys (&iptable_raw_net_ops); - } - -return ret; +return register_pernet_subsys (&iptable_raw_net_ops); } static void __exit iptable_raw_fini(void) { -xt_hook_unlink (&packet_raw, rawtable_ops);unregister_pernet_subsys (&iptable_raw_net_ops); }
net/ipv4/netfilter/iptable_security.c +3 -20
@@ -28,12 +28,14 @@ MODULE_DESCRIPTION("iptables security table, for MAC rules"); (1 <<NF_INET_FORWARD ) | \ (1 << NF_INET_LOCAL_OUT) +static xt_hookfn iptable_security_hook;static const struct xt_table security_table = { .name ="security" , .valid_hooks =SECURITY_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV4 , .priority =NF_IP_PRI_SECURITY , + .fn = iptable_security_hook, }; static unsigned int
@@ -49,8 +51,6 @@ iptable_security_hook(void *priv, struct sk_buff *skb,return ipt_do_table (skb, state, state->net->ipv4.iptable_security); } -static struct nf_hook_ops *sectbl_ops__read_mostly ; -static int __net_init iptable_security_net_init (struct net *net) {struct ipt_replace *repl;
@@ -76,28 +76,11 @@ static struct pernet_operations iptable_security_net_ops = {static int __init iptable_security_init (void ) { -int ret; - - ret =register_pernet_subsys (&iptable_security_net_ops); -if (ret <0 ) -return ret; - - sectbl_ops =xt_hook_link (&security_table, iptable_security_hook); -if (IS_ERR (sectbl_ops)) { - ret =PTR_ERR (sectbl_ops); - goto cleanup_table; - } - -return ret; - -cleanup_table: -unregister_pernet_subsys (&iptable_security_net_ops); -return ret; +return register_pernet_subsys (&iptable_security_net_ops); } static void __exit iptable_security_fini(void) { -xt_hook_unlink (&security_table, sectbl_ops);unregister_pernet_subsys (&iptable_security_net_ops); }
net/ipv6/netfilter/ip6table_filter.c +3 -21
@@ -22,12 +22,14 @@ MODULE_DESCRIPTION("ip6tables filter table"); (1 << NF_INET_FORWARD) | \ (1 << NF_INET_LOCAL_OUT)) +static xt_hookfn ip6table_filter_hook;static const struct xt_table packet_filter = { .name ="filter" , .valid_hooks =FILTER_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV6 , .priority =NF_IP6_PRI_FILTER , + .fn = ip6table_filter_hook, };/* The work comes in here from netfilter.c. */
@@ -38,8 +40,6 @@ ip6table_filter_hook(void *priv, struct sk_buff *skb,return ip6t_do_table (skb, state, state->net->ipv6.ip6table_filter); } -static struct nf_hook_ops *filter_ops__read_mostly ; -/* Default to forward because I got too much mail already. */ static bool forward = true;module_param (forward, bool,0000 );
@@ -73,29 +73,11 @@ static struct pernet_operations ip6table_filter_net_ops = {static int __init ip6table_filter_init (void ) { -int ret; - - ret =register_pernet_subsys (&ip6table_filter_net_ops); -if (ret <0 ) -return ret; - -/* Register hooks */ - filter_ops =xt_hook_link (&packet_filter, ip6table_filter_hook); -if (IS_ERR (filter_ops)) { - ret =PTR_ERR (filter_ops); - goto cleanup_table; - } - -return ret; - - cleanup_table: -unregister_pernet_subsys (&ip6table_filter_net_ops); -return ret; +return register_pernet_subsys (&ip6table_filter_net_ops); } static void __exit ip6table_filter_fini(void) { -xt_hook_unlink (&packet_filter, filter_ops);unregister_pernet_subsys (&ip6table_filter_net_ops); }
net/ipv6/netfilter/ip6table_mangle.c +3 -20
@@ -23,12 +23,14 @@ MODULE_DESCRIPTION("ip6tables mangle table"); (1 << NF_INET_LOCAL_OUT) | \ (1 << NF_INET_POST_ROUTING)) +static xt_hookfn ip6table_mangle_hook;static const struct xt_table packet_mangler = { .name ="mangle" , .valid_hooks =MANGLE_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV6 , .priority =NF_IP6_PRI_MANGLE , + .fn = ip6table_mangle_hook, }; static unsigned int
@@ -87,7 +89,6 @@ ip6table_mangle_hook(void *priv, struct sk_buff *skb,return ip6t_do_table (skb, state, state->net->ipv6.ip6table_mangle); } -static struct nf_hook_ops *mangle_ops__read_mostly ;static int __net_init ip6table_mangle_net_init (struct net *net) {struct ip6t_replace *repl;
@@ -113,29 +114,11 @@ static struct pernet_operations ip6table_mangle_net_ops = {static int __init ip6table_mangle_init (void ) { -int ret; - - ret =register_pernet_subsys (&ip6table_mangle_net_ops); -if (ret <0 ) -return ret; - -/* Register hooks */ - mangle_ops =xt_hook_link (&packet_mangler, ip6table_mangle_hook); -if (IS_ERR (mangle_ops)) { - ret =PTR_ERR (mangle_ops); - goto cleanup_table; - } - -return ret; - - cleanup_table: -unregister_pernet_subsys (&ip6table_mangle_net_ops); -return ret; +return register_pernet_subsys (&ip6table_mangle_net_ops); } static void __exit ip6table_mangle_fini(void) { -xt_hook_unlink (&packet_mangler, mangle_ops);unregister_pernet_subsys (&ip6table_mangle_net_ops); }
net/ipv6/netfilter/ip6table_raw.c +3 -21
@@ -9,12 +9,14 @@#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT)) +static xt_hookfn ip6table_raw_hook;static const struct xt_table packet_raw = { .name ="raw" , .valid_hooks =RAW_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV6 , .priority =NF_IP6_PRI_RAW , + .fn = ip6table_raw_hook, };/* The work comes in here from netfilter.c. */
@@ -25,8 +27,6 @@ ip6table_raw_hook(void *priv, struct sk_buff *skb,return ip6t_do_table (skb, state, state->net->ipv6.ip6table_raw); } -static struct nf_hook_ops *rawtable_ops__read_mostly ; -static int __net_init ip6table_raw_net_init (struct net *net) {struct ip6t_replace *repl;
@@ -52,29 +52,11 @@ static struct pernet_operations ip6table_raw_net_ops = {static int __init ip6table_raw_init (void ) { -int ret; - - ret =register_pernet_subsys (&ip6table_raw_net_ops); -if (ret <0 ) -return ret; - -/* Register hooks */ - rawtable_ops =xt_hook_link (&packet_raw, ip6table_raw_hook); -if (IS_ERR (rawtable_ops)) { - ret =PTR_ERR (rawtable_ops); - goto cleanup_table; - } - -return ret; - - cleanup_table: -unregister_pernet_subsys (&ip6table_raw_net_ops); -return ret; +return register_pernet_subsys (&ip6table_raw_net_ops); } static void __exit ip6table_raw_fini(void) { -xt_hook_unlink (&packet_raw, rawtable_ops);unregister_pernet_subsys (&ip6table_raw_net_ops); }
net/ipv6/netfilter/ip6table_security.c +3 -20
@@ -27,12 +27,14 @@ MODULE_DESCRIPTION("ip6tables security table, for MAC rules"); (1 <<NF_INET_FORWARD ) | \ (1 << NF_INET_LOCAL_OUT) +static xt_hookfn ip6table_security_hook;static const struct xt_table security_table = { .name ="security" , .valid_hooks =SECURITY_VALID_HOOKS , .me =THIS_MODULE , .af =NFPROTO_IPV6 , .priority =NF_IP6_PRI_SECURITY , + .fn = ip6table_security_hook, }; static unsigned int
@@ -42,8 +44,6 @@ ip6table_security_hook(void *priv, struct sk_buff *skb,return ip6t_do_table (skb, state, state->net->ipv6.ip6table_security); } -static struct nf_hook_ops *sectbl_ops__read_mostly ; -static int __net_init ip6table_security_net_init (struct net *net) {struct ip6t_replace *repl;
@@ -69,28 +69,11 @@ static struct pernet_operations ip6table_security_net_ops = {static int __init ip6table_security_init (void ) { -int ret; - - ret =register_pernet_subsys (&ip6table_security_net_ops); -if (ret <0 ) -return ret; - - sectbl_ops =xt_hook_link (&security_table, ip6table_security_hook); -if (IS_ERR (sectbl_ops)) { - ret =PTR_ERR (sectbl_ops); - goto cleanup_table; - } - -return ret; - -cleanup_table: -unregister_pernet_subsys (&ip6table_security_net_ops); -return ret; +return register_pernet_subsys (&ip6table_security_net_ops); } static void __exit ip6table_security_fini(void) { -xt_hook_unlink (&security_table, sectbl_ops);unregister_pernet_subsys (&ip6table_security_net_ops); }
Signature · 1 line
2.2.1
PATCH 29/43 x_tables: Kill xt_[un]hook_link
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
These functions have no more users, kill them.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- include/linux/netfilter/x_tables.h | 3 --- net/netfilter/x_tables.c | 54 -------------------------------------- 2 files changed, 57 deletions(-)
include/linux/netfilter/x_tables.h +0 -3
@@ -409,9 +409,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)return cnt; } -struct nf_hook_ops *xt_hook_link (const struct xt_table *,nf_hookfn *); -void xt_hook_unlink (const struct xt_table *,struct nf_hook_ops *); -#ifdef CONFIG_COMPAT #include <net/compat.h>
net/netfilter/x_tables.c +0 -54
60 lines not on this page · raw message
Signature · 1 line
2.2.1
PATCH 30/43 x_tables: Update ip?table_nat to register their hooks in all network namespaces
In reply to Eric W. BiedermanFrom: Eric W Biederman <[email protected]>
Unlike the rest of x_tables iptables_nat and ip6tables_nat call nf_register_hooks to register their x_tables hooks as they need to use different priorities for different hooks. Which resulted in these being the last two x_tables modules that have not been udpated to register in all network namespaces.
Therefore move the nf_register_hooks and nf_unregister_hooks calls into the per network namespace initialization functions so the hooks will be registered everywhere for everyone.
Signed-off-by "Eric W. Biederman" <[email protected]>
--- net/ipv4/netfilter/iptable_nat.c | 30 ++++++++++++------------------ net/ipv6/netfilter/ip6table_nat.c | 30 ++++++++++++------------------ 2 files changed, 24 insertions(+), 36 deletions(-)
net/ipv4/netfilter/iptable_nat.c +12 -18
@@ -102,17 +102,27 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {static int __net_init iptable_nat_net_init (struct net *net) {struct ipt_replace *repl; +int err; repl =ipt_alloc_initial_table (&nf_nat_ipv4_table);if (repl ==NULL )return -ENOMEM ; net->ipv4.nat_table =ipt_register_table (net, &nf_nat_ipv4_table, repl);kfree (repl); -return PTR_ERR_OR_ZERO (net->ipv4.nat_table); +if (IS_ERR (net->ipv4.nat_table)) +return PTR_ERR (net->ipv4.nat_table); + + err =nf_register_hooks (net, nf_nat_ipv4_ops, +ARRAY_SIZE (nf_nat_ipv4_ops)); +if (err) +ipt_unregister_table (net, net->ipv4.nat_table); + +return err; } static void __net_exit iptable_nat_net_exit(struct net *net) { +nf_unregister_hooks (net, nf_nat_ipv4_ops,ARRAY_SIZE (nf_nat_ipv4_ops));ipt_unregister_table (net, net->ipv4.nat_table); }
@@ -123,27 +133,11 @@ static struct pernet_operations iptable_nat_net_ops = {static int __init iptable_nat_init (void ) { -int err; - - err =register_pernet_subsys (&iptable_nat_net_ops); -if (err <0 ) - goto err1; - - err =nf_register_hooks (&init_net, nf_nat_ipv4_ops, -ARRAY_SIZE (nf_nat_ipv4_ops)); -if (err <0 ) - goto err2; -return 0 ; - -err2: -unregister_pernet_subsys (&iptable_nat_net_ops); -err1: -return err; +return register_pernet_subsys (&iptable_nat_net_ops); } static void __exit iptable_nat_exit(void) { -nf_unregister_hooks (&init_net, nf_nat_ipv4_ops,ARRAY_SIZE (nf_nat_ipv4_ops));unregister_pernet_subsys (&iptable_nat_net_ops); }
net/ipv6/netfilter/ip6table_nat.c +12 -18
@@ -104,17 +104,27 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {static int __net_init ip6table_nat_net_init (struct net *net) {struct ip6t_replace *repl; +int err; repl =ip6t_alloc_initial_table (&nf_nat_ipv6_table);if (repl ==NULL )return -ENOMEM ; net->ipv6.ip6table_nat =ip6t_register_table (net, &nf_nat_ipv6_table, repl);kfree (repl); -return PTR_ERR_OR_ZERO (net->ipv6.ip6table_nat); +if (IS_ERR (net->ipv6.ip6table_nat)) +return PTR_ERR (net->ipv6.ip6table_nat); + + err =nf_register_hooks (net, nf_nat_ipv6_ops, +ARRAY_SIZE (nf_nat_ipv6_ops)); +if (err) +ip6t_unregister_table (net, net->ipv6.ip6table_nat); + +return err; } static void __net_exit ip6table_nat_net_exit(struct net *net) { +nf_unregister_hooks (net, nf_nat_ipv6_ops,ARRAY_SIZE (nf_nat_ipv6_ops));ip6t_unregister_table (net, net->ipv6.ip6table_nat); }
@@ -125,27 +135,11 @@ static struct pernet_operations ip6table_nat_net_ops = {static int __init ip6table_nat_init (void ) { -int err; - - err =register_pernet_subsys (&ip6table_nat_net_ops); -if (err <0 ) - goto err1; - - err =nf_register_hooks (&init_net, nf_nat_ipv6_ops, -ARRAY_SIZE (nf_nat_ipv6_ops)); -if (err <0 ) - goto err2; -return 0 ; - -err2: -unregister_pernet_subsys (&ip6table_nat_net_ops); -err1: -return err; +return register_pernet_subsys (&ip6table_nat_net_ops); } static void __exit ip6table_nat_exit(void) { -nf_unregister_hooks (&init_net, nf_nat_ipv6_ops,ARRAY_SIZE (nf_nat_ipv6_ops));unregister_pernet_subsys (&ip6table_nat_net_ops); }
Signature · 1 line
2.2.1
PATCH 31/43 netfilter: nf_tables: adapt it to pernet hooks
In reply to Eric W. BiedermanFrom: Pablo Neira Ayuso <[email protected]>
Since pernet hooks, we need to register the hook for each netnamespace space.
Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Eric W Biederman <[email protected]>
--- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +6 -2
@@ -130,20 +130,24 @@ static void nft_trans_destroy(struct nft_trans *trans)int nft_register_basechain (struct nft_base_chain *basechain,unsigned int hook_nops) { +struct net *net =read_pnet (&basechain->pnet); +if (basechain->flags &NFT_BASECHAIN_DISABLED )return 0 ; -return nf_register_hooks (&init_net, basechain->ops, hook_nops); +return nf_register_hooks (net, basechain->ops, hook_nops); }EXPORT_SYMBOL_GPL (nft_register_basechain);void nft_unregister_basechain (struct nft_base_chain *basechain,unsigned int hook_nops) { +struct net *net =read_pnet (&basechain->pnet); +if (basechain->flags &NFT_BASECHAIN_DISABLED )return ; -nf_unregister_hooks (&init_net, basechain->ops, hook_nops); +nf_unregister_hooks (net, basechain->ops, hook_nops); }EXPORT_SYMBOL_GPL (nft_unregister_basechain);
Signature · 1 line
2.2.1
PATCH 32/43 netfilter: ipt_CLUSTERIP: adapt it to support pernet hooks
In reply to Eric W. BiedermanFrom: Pablo Neira Ayuso <[email protected]>
This target is deprecated, but let's adapt this so it doesn't break existing users.
Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Eric W Biederman <[email protected]>
--- net/ipv4/netfilter/ipt_CLUSTERIP.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/ipv4/netfilter/ipt_CLUSTERIP.c +7 -7
@@ -724,6 +724,7 @@ static const struct file_operations clusterip_proc_fops = {static int clusterip_net_init (struct net *net) {struct clusterip_net *cn =net_generic (net, clusterip_net_id); +int ret;INIT_LIST_HEAD (&cn->configs);
@@ -737,6 +738,11 @@ static int clusterip_net_init(struct net *net) }#endif /* CONFIG_PROC_FS */ + ret =nf_register_hook (net, &cip_arp_ops); +if (ret <0 ) { +proc_remove (cn->procdir); +return ret; + }return 0 ; }
@@ -746,6 +752,7 @@ static void clusterip_net_exit(struct net *net)struct clusterip_net *cn =net_generic (net, clusterip_net_id);proc_remove (cn->procdir);#endif +nf_unregister_hook (net, &cip_arp_ops); }static struct pernet_operations clusterip_net_ops = {
@@ -767,17 +774,11 @@ static int __init clusterip_tg_init(void)if (ret <0 ) goto cleanup_subsys; - ret =nf_register_hook (&init_net, &cip_arp_ops); -if (ret <0 ) - goto cleanup_target; -pr_info ("ClusterIP Version %s loaded successfully\n" ,CLUSTERIP_VERSION );return 0 ; -cleanup_target: -xt_unregister_target (&clusterip_tg_reg); cleanup_subsys:unregister_pernet_subsys (&clusterip_net_ops);return ret;
@@ -787,7 +788,6 @@ static void __exit clusterip_tg_exit(void) {pr_info ("ClusterIP Version %s unloading\n" ,CLUSTERIP_VERSION ); -nf_unregister_hook (&init_net, &cip_arp_ops);xt_unregister_target (&clusterip_tg_reg);unregister_pernet_subsys (&clusterip_net_ops);
Signature · 1 line
2.2.1