00/29 third try; git-format-patch|git-send-email sucks
Subsystems (6)
git@ cc'd for justice.
<rants>
* git-format-patch --stdout | git-send-email does not fly, files need to be exported first, it's a bit inconvenient
* git-send-email should really default to --no-chain
* git-send-email should stop if it cannot find the headers it is looking for (esp. Subject), even if I dared to forget --dry-run (point in case: git log -1 mycommit >x.diff; git-send-email x.diff)
</rants>
And now some apology to the mailbomb caused by that program.
PATCH 1/29 : xt_sctp: simplify xt_sctp.h
The use of xt_sctp.h flagged up -Wshadow warnings in userspace, which prompted me to look at it and clean it up. Basic operations have been directly replaced by library calls (memcpy, memset is both available in the kernel and userspace, and usually faster than a self-made loop). The is_set and is_clear functions now use a processing time shortcut, too.
Signed-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter/xt_sctp.h | 84 ++++++++++++----------------- 1 files changed, 35 insertions(+), 49 deletions(-)
include/linux/netfilter/xt_sctp.h +35 -49
@@ -37,68 +37,54 @@ struct xt_sctp_info {#define SCTP_CHUNKMAP_SET (chunkmap, type) \ do { \ - chunkmap[type / bytes(u_int32_t)] |= \ + (chunkmap)[type / bytes(u_int32_t)] |= \ 1 << (type % bytes(u_int32_t)); \ } while (0)#define SCTP_CHUNKMAP_CLEAR (chunkmap, type) \ do { \ - chunkmap[type / bytes(u_int32_t)] &= \ + (chunkmap)[type / bytes(u_int32_t)] &= \ ~(1 << (type % bytes(u_int32_t))); \ } while (0)#define SCTP_CHUNKMAP_IS_SET (chunkmap, type) \ ({ \ - (chunkmap[type / bytes (u_int32_t)] & \ + ((chunkmap)[type / bytes (u_int32_t)] & \ (1 << (type % bytes (u_int32_t)))) ? 1: 0; \ }) -#define SCTP_CHUNKMAP_RESET (chunkmap) \ - do { \ - int i; \ - for (i = 0; i < ARRAY_SIZE(chunkmap); i++) \ - chunkmap[i] = 0; \ - } while (0) - -#define SCTP_CHUNKMAP_SET_ALL (chunkmap) \ - do { \ - int i; \ - for (i = 0; i < ARRAY_SIZE(chunkmap); i++) \ - chunkmap[i] = ~0; \ - } while (0) - -#define SCTP_CHUNKMAP_COPY (destmap, srcmap) \ - do { \ - int i; \ - for (i = 0; i < ARRAY_SIZE(srcmap); i++) \ - destmap[i] = srcmap[i]; \ - } while (0) - -#define SCTP_CHUNKMAP_IS_CLEAR (chunkmap) \ -({ \ - int i; \ - int flag = 1; \ - for (i = 0; i < ARRAY_SIZE(chunkmap); i++) { \ - if (chunkmap[i]) { \ - flag = 0; \ - break; \ - } \ - } \ - flag; \ -}) - -#define SCTP_CHUNKMAP_IS_ALL_SET (chunkmap) \ -({ \ - int i; \ - int flag = 1; \ - for (i = 0; i < ARRAY_SIZE(chunkmap); i++) { \ - if (chunkmap[i] != ~0) { \ - flag = 0; \ - break; \ - } \ - } \ - flag; \ -}) +#define SCTP_CHUNKMAP_RESET (chunkmap) \ + memset((chunkmap), 0, sizeof(chunkmap)) + +#define SCTP_CHUNKMAP_SET_ALL (chunkmap) \ + memset((chunkmap), ~0U, sizeof(chunkmap)) + +#define SCTP_CHUNKMAP_COPY (destmap, srcmap) \ + memcpy((destmap), (srcmap), sizeof(srcmap)) + +#define SCTP_CHUNKMAP_IS_CLEAR (chunkmap) \ + __sctp_chunkmap_is_clear((chunkmap), ARRAY_SIZE(chunkmap)) +static inline bool +__sctp_chunkmap_is_clear (const u_int32_t *chunkmap,unsigned int n) +{ +unsigned int i; +for (i =0 ; i < n; ++i) +if (chunkmap[i]) +return false; +return true; +} + +#define SCTP_CHUNKMAP_IS_ALL_SET (chunkmap) \ + __sctp_chunkmap_is_all_set((chunkmap), ARRAY_SIZE(chunkmap)) +static inline bool +__sctp_chunkmap_is_all_set (const u_int32_t *chunkmap,unsigned int n) +{ +unsigned int i; +for (i =0 ; i < n; ++i) +if (chunkmap[i] != ~0U ) +return false; +return true; +}#endif /* _XT_SCTP_H_ */
Signature · 1 line
1.5.4.4
Re: [PATCH 01/29] : xt_sctp: simplify xt_sctp.h
include/linux/netfilter/xt_sctp.h struct xt_sctp_info { · line 40
Quoted 10 lines · Jan Engelhardt
include/linux/netfilter/xt_sctp.h +1
-1@@ -37,68 +37,54 @@ struct xt_sctp_info {#define SCTP_CHUNKMAP_SET (chunkmap, type) \ do { \ - chunkmap[type / bytes(u_int32_t)] |= \ + (chunkmap)[type / bytes(u_int32_t)] |= \
This "bytes()" stuff also deserves to die.
Anyways, applied.
PATCH 2/29 : annotate xtables targets with const and remove casts
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- net/ipv4/netfilter/ipt_CLUSTERIP.c | 12 ++++++------ net/ipv4/netfilter/ipt_ECN.c | 2 +- net/ipv4/netfilter/ipt_LOG.c | 3 ++- net/ipv4/netfilter/ipt_REJECT.c | 6 ++++-- net/ipv4/netfilter/ipt_recent.c | 6 +++--- net/ipv4/netfilter/nf_nat_rule.c | 4 ++-- net/ipv6/netfilter/ip6t_REJECT.c | 3 ++- net/ipv6/netfilter/ip6t_ipv6header.c | 3 ++- net/ipv6/netfilter/ip6t_rt.c | 3 ++- net/netfilter/xt_CONNSECMARK.c | 2 +- net/netfilter/xt_RATEEST.c | 2 +- net/netfilter/xt_connlimit.c | 6 +++--- net/netfilter/xt_dccp.c | 3 ++- net/netfilter/xt_esp.c | 3 ++- net/netfilter/xt_multiport.c | 6 ++++-- net/netfilter/xt_policy.c | 2 +- net/netfilter/xt_rateest.c | 4 ++-- net/netfilter/xt_sctp.c | 6 ++++-- net/netfilter/xt_tcpmss.c | 6 ++++-- net/netfilter/xt_tcpudp.c | 9 ++++++--- net/netfilter/xt_time.c | 2 +- 21 files changed, 55 insertions(+), 38 deletions(-)
net/ipv4/netfilter/ipt_CLUSTERIP.c +6 -6
@@ -142,7 +142,7 @@ clusterip_config_init_nodelist(struct clusterip_config *c, }static struct clusterip_config * -clusterip_config_init (struct ipt_clusterip_tgt_info *i,__be32 ip, +clusterip_config_init (const struct ipt_clusterip_tgt_info *i,__be32 ip,struct net_device *dev) {struct clusterip_config *c;
@@ -417,7 +417,7 @@ clusterip_tg_check(const char *tablename, const void *e_void,/* drop reference count of cluster config when rule is deleted */ static void clusterip_tg_destroy (const struct xt_target *target,void *targinfo) { -struct ipt_clusterip_tgt_info *cipinfo = targinfo; +const struct ipt_clusterip_tgt_info *cipinfo = targinfo;/* if no more entries are referencing the config, remove it * from the list and destroy the proc entry */
@@ -566,7 +566,7 @@ struct clusterip_seq_position {static void *clusterip_seq_start (struct seq_file *s,loff_t *pos) { -struct proc_dir_entry *pde = s->private; +const struct proc_dir_entry *pde = s->private;struct clusterip_config *c = pde->data;unsigned int weight;u_int32_t local_nodes;
@@ -593,7 +593,7 @@ static void *clusterip_seq_start(struct seq_file *s, loff_t *pos)static void *clusterip_seq_next (struct seq_file *s,void *v,loff_t *pos) { -struct clusterip_seq_position *idx = (struct clusterip_seq_position *)v; +struct clusterip_seq_position *idx = v; *pos = ++idx->pos;if (*pos >= idx->weight) {
@@ -612,7 +612,7 @@ static void clusterip_seq_stop(struct seq_file *s, void *v)static int clusterip_seq_show (struct seq_file *s,void *v) { -struct clusterip_seq_position *idx = (struct clusterip_seq_position *)v; +struct clusterip_seq_position *idx = v;if (idx->pos !=0 )seq_putc (s,',' );
@@ -668,7 +668,7 @@ static ssize_t clusterip_proc_write(struct file *file, const char __user *input, {#define PROC_WRITELEN 10char buffer[PROC_WRITELEN +1 ]; -struct proc_dir_entry *pde =PDE (file->f_path.dentry->d_inode); +const struct proc_dir_entry *pde =PDE (file->f_path.dentry->d_inode);struct clusterip_config *c = pde->data;unsigned long nodenum;
net/ipv4/netfilter/ipt_ECN.c +1 -1
@@ -100,7 +100,7 @@ ecn_tg_check(const char *tablename, const void *e_void, const struct xt_target *target, void *targinfo, unsigned int hook_mask) { - const struct ipt_ECN_info *einfo = (struct ipt_ECN_info *)targinfo; + const struct ipt_ECN_info *einfo = targinfo;const struct ipt_entry *e = e_void;if (einfo->operation &IPT_ECN_OP_MASK ) {
net/ipv4/netfilter/ipt_LOG.c +2 -1
@@ -76,7 +76,8 @@ static void dump_packet(const struct nf_loginfo *info,if ((logflags &IPT_LOG_IPOPT ) && ih->ihl *4 >sizeof (struct iphdr )) { -unsigned char _opt[4 *15 -sizeof (struct iphdr )], *op; +const unsigned char *op; +unsigned char _opt[4 *15 -sizeof (struct iphdr )];unsigned int i, optsize; optsize = ih->ihl *4 -sizeof (struct iphdr );
net/ipv4/netfilter/ipt_REJECT.c +4 -2
@@ -35,8 +35,10 @@ MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4");static void send_reset (struct sk_buff *oldskb,int hook) {struct sk_buff *nskb; -struct iphdr *oiph, *niph; -struct tcphdr _otcph, *oth, *tcph; +const struct iphdr *oiph; +struct iphdr *niph; +const struct tcphdr *oth; +struct tcphdr _otcph, *tcph;unsigned int addr_type;/* IP header checks: fragment. */
net/ipv4/netfilter/ipt_recent.c +3 -3
@@ -341,7 +341,7 @@ static void *recent_seq_start(struct seq_file *seq, loff_t *pos)static void *recent_seq_next (struct seq_file *seq,void *v,loff_t *pos) {struct recent_iter_state *st = seq->private; -struct recent_table *t = st->table; +const struct recent_table *t = st->table;struct recent_entry *e = v;struct list_head *head = e->list.next;
@@ -362,7 +362,7 @@ static void recent_seq_stop(struct seq_file *s, void *v)static int recent_seq_show (struct seq_file *seq,void *v) { -struct recent_entry *e = v; +const struct recent_entry *e = v;unsigned int i; i = (e->index -1 ) % ip_pkt_list_tot;
@@ -397,7 +397,7 @@ static int recent_seq_open(struct inode *inode, struct file *file)static ssize_t recent_proc_write (struct file *file,const char __user *input,size_t size,loff_t *loff) { -struct proc_dir_entry *pde =PDE (file->f_path.dentry->d_inode); +const struct proc_dir_entry *pde =PDE (file->f_path.dentry->d_inode);struct recent_table *t = pde->data;struct recent_entry *e;char buf[sizeof ("+255.255.255.255" )], *c = buf;
net/ipv4/netfilter/nf_nat_rule.c +2 -2
@@ -143,7 +143,7 @@ static bool ipt_snat_checkentry(const char *tablename,void *targinfo, unsigned int hook_mask) { - struct nf_nat_multi_range_compat *mr = targinfo; + const struct nf_nat_multi_range_compat *mr = targinfo;/* Must be a valid range */ if (mr->rangesize !=1 ) {
@@ -159,7 +159,7 @@ static bool ipt_dnat_checkentry(const char *tablename,void *targinfo, unsigned int hook_mask) { - struct nf_nat_multi_range_compat *mr = targinfo; + const struct nf_nat_multi_range_compat *mr = targinfo;/* Must be a valid range */ if (mr->rangesize !=1 ) {
net/ipv6/netfilter/ip6t_REJECT.c +2 -1
@@ -41,7 +41,8 @@ static void send_reset(struct sk_buff *oldskb)struct tcphdr otcph, *tcph;unsigned int otcplen, hh_len;int tcphoff, needs_ack; -struct ipv6hdr *oip6h =ipv6_hdr (oldskb), *ip6h; +const struct ipv6hdr *oip6h =ipv6_hdr (oldskb); +struct ipv6hdr *ip6h;struct dst_entry *dst =NULL ;u8 proto;struct flowi fl;
net/ipv6/netfilter/ip6t_ipv6header.c +2 -1
@@ -49,7 +49,8 @@ ipv6header_mt6(const struct sk_buff *skb, const struct net_device *in, temp =0 ;while (ip6t_ext_hdr (nexthdr)) { -struct ipv6_opt_hdr _hdr, *hp; +const struct ipv6_opt_hdr *hp; +struct ipv6_opt_hdr _hdr;int hdrlen;/* Is there enough space for the next ext header? */
net/ipv6/netfilter/ip6t_rt.c +2 -1
@@ -110,7 +110,8 @@ rt_mt6(const struct sk_buff *skb, const struct net_device *in, !!(rtinfo->invflags & IP6T_RT_INV_TYP)));if (ret && (rtinfo->flags &IP6T_RT_RES )) { -u_int32_t *rp, _reserved; +const u_int32_t *rp; +u_int32_t _reserved; rp = skb_header_pointer(skb, ptr + offsetof(struct rt0_hdr, reserved),
net/netfilter/xt_CONNSECMARK.c +1 -1
@@ -55,7 +55,7 @@ static void secmark_save(const struct sk_buff *skb)static void secmark_restore (struct sk_buff *skb) {if (!skb->secmark) { -struct nf_conn *ct; +const struct nf_conn *ct;enum ip_conntrack_info ctinfo; ct =nf_ct_get (skb, &ctinfo);
net/netfilter/xt_RATEEST.c +1 -1
@@ -96,7 +96,7 @@ xt_rateest_tg_checkentry(const char *tablename,void *targinfo, unsigned int hook_mask) { - struct xt_rateest_target_info *info = (void *)targinfo; + struct xt_rateest_target_info *info = targinfo;struct xt_rateest *est; struct { struct nlattr opt;
net/netfilter/xt_connlimit.c +3 -3
@@ -106,10 +106,10 @@ static int count_them(struct xt_connlimit_data *data,const union nf_inet_addr *mask, const struct xt_match *match) { - struct nf_conntrack_tuple_hash *found; + const struct nf_conntrack_tuple_hash *found;struct xt_connlimit_conn *conn;struct xt_connlimit_conn *tmp; -struct nf_conn *found_ct; +const struct nf_conn *found_ct;struct list_head *hash;bool addit = true;int matches =0 ;
@@ -256,7 +256,7 @@ connlimit_mt_check(const char *tablename, const void *ip,static void connlimit_mt_destroy (const struct xt_match *match,void *matchinfo) { -struct xt_connlimit_info *info = matchinfo; +const struct xt_connlimit_info *info = matchinfo;struct xt_connlimit_conn *conn;struct xt_connlimit_conn *tmp;struct list_head *hash = info->data->iphash;
net/netfilter/xt_dccp.c +2 -1
@@ -98,7 +98,8 @@ dccp_mt(const struct sk_buff *skb, const struct net_device *in, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { const struct xt_dccp_info *info = matchinfo; -struct dccp_hdr _dh, *dh; +const struct dccp_hdr *dh; +struct dccp_hdr _dh;if (offset)return false;
net/netfilter/xt_esp.c +2 -1
@@ -47,7 +47,8 @@ esp_mt(const struct sk_buff *skb, const struct net_device *in, const struct net_device *out, const struct xt_match *match, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { - struct ip_esp_hdr _esp, *eh; + const struct ip_esp_hdr *eh; +struct ip_esp_hdr _esp;const struct xt_esp *espinfo = matchinfo;/* Must not be a fragment. */
net/netfilter/xt_multiport.c +4 -2
@@ -100,7 +100,8 @@ multiport_mt_v0(const struct sk_buff *skb, const struct net_device *in, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { - __be16 _ports[2], *pptr; + const __be16 *pptr; +__be16 _ports[2 ];const struct xt_multiport *multiinfo = matchinfo;if (offset)
@@ -126,7 +127,8 @@ multiport_mt(const struct sk_buff *skb, const struct net_device *in, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { - __be16 _ports[2], *pptr; + const __be16 *pptr; +__be16 _ports[2 ];const struct xt_multiport_v1 *multiinfo = matchinfo;if (offset)
net/netfilter/xt_policy.c +1 -1
@@ -136,7 +136,7 @@ policy_mt_check(const char *tablename, const void *ip_void, const struct xt_match *match, void *matchinfo, unsigned int hook_mask) { - struct xt_policy_info *info = matchinfo; + const struct xt_policy_info *info = matchinfo;if (!(info->flags & (XT_POLICY_MATCH_IN |XT_POLICY_MATCH_OUT ))) { printk(KERN_ERR "xt_policy: neither incoming nor "
net/netfilter/xt_rateest.c +2 -2
@@ -86,7 +86,7 @@ static bool xt_rateest_mt_checkentry(const char *tablename,void *matchinfo, unsigned int hook_mask) { - struct xt_rateest_match_info *info = (void *)matchinfo; + struct xt_rateest_match_info *info = matchinfo;struct xt_rateest *est1, *est2; if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS |
@@ -130,7 +130,7 @@ err1:static void xt_rateest_mt_destroy (const struct xt_match *match,void *matchinfo) { -struct xt_rateest_match_info *info = (void *)matchinfo; +struct xt_rateest_match_info *info = matchinfo;xt_rateest_put (info->est1);if (info->est2)
net/netfilter/xt_sctp.c +4 -2
@@ -46,7 +46,8 @@ match_packet(const struct sk_buff *skb, bool *hotdrop) {u_int32_t chunkmapcopy[256 /sizeof (u_int32_t)]; -sctp_chunkhdr_t _sch, *sch; +const sctp_chunkhdr_t *sch; +sctp_chunkhdr_t _sch;int chunk_match_type = info->chunk_match_type;const struct xt_sctp_flag_info *flag_info = info->flag_info;int flag_count = info->flag_count;
@@ -121,7 +122,8 @@ sctp_mt(const struct sk_buff *skb, const struct net_device *in, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { const struct xt_sctp_info *info = matchinfo; -sctp_sctphdr_t _sh, *sh; +const sctp_sctphdr_t *sh; +sctp_sctphdr_t _sh;if (offset) {duprintf ("Dropping non-first fragment.. FIXME\n" );
net/netfilter/xt_tcpmss.c +4 -2
@@ -31,9 +31,11 @@ tcpmss_mt(const struct sk_buff *skb, const struct net_device *in, bool *hotdrop) {const struct xt_tcpmss_match_info *info = matchinfo; -struct tcphdr _tcph, *th; +const struct tcphdr *th; +struct tcphdr _tcph;/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */ -u8 _opt[15 *4 -sizeof (_tcph)], *op; +const u_int8_t *op; +u8 _opt[15 *4 -sizeof (_tcph)];unsigned int i, optlen;/* If we don't have the whole header, drop packet. */
net/netfilter/xt_tcpudp.c +6 -3
@@ -42,7 +42,8 @@ tcp_find_option(u_int8_t option, bool *hotdrop) {/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */ -u_int8_t _opt[60 -sizeof (struct tcphdr )], *op; +const u_int8_t *op; +u_int8_t _opt[60 -sizeof (struct tcphdr )];unsigned int i;duprintf ("tcp_match: finding option\n" );
@@ -72,7 +73,8 @@ tcp_mt(const struct sk_buff *skb, const struct net_device *in, const struct net_device *out, const struct xt_match *match, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { - struct tcphdr _tcph, *th; + const struct tcphdr *th; +struct tcphdr _tcph;const struct xt_tcp *tcpinfo = matchinfo;if (offset) {
@@ -144,7 +146,8 @@ udp_mt(const struct sk_buff *skb, const struct net_device *in, const struct net_device *out, const struct xt_match *match, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { - struct udphdr _udph, *uh; + const struct udphdr *uh; +struct udphdr _udph;const struct xt_udp *udpinfo = matchinfo;/* Must not be a fragment. */
net/netfilter/xt_time.c +1 -1
@@ -223,7 +223,7 @@ time_mt_check(const char *tablename, const void *ip, const struct xt_match *match, void *matchinfo, unsigned int hook_mask) { - struct xt_time_info *info = matchinfo; + const struct xt_time_info *info = matchinfo;if (info->daytime_start >XT_TIME_MAX_DAYTIME || info->daytime_stop >XT_TIME_MAX_DAYTIME ) {
Signature · 1 line
1.5.4.4
Patrick McHardy
AppliedRe: [PATCH 02/29] : annotate xtables targets with const and remove casts
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>
Applied, thanks.
PATCH 3/29 : annotate {arp,ip,ip6,x}tables with const
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter/x_tables.h | 4 +- net/ipv4/netfilter/arp_tables.c | 33 ++++++++++++++------------- net/ipv4/netfilter/arpt_mangle.c | 2 +- net/ipv4/netfilter/ip_tables.c | 31 +++++++++++++------------ net/ipv6/netfilter/ip6_tables.c | 29 ++++++++++++----------- net/netfilter/x_tables.c | 18 +++++++------- 6 files changed, 60 insertions(+), 57 deletions(-)
include/linux/netfilter/x_tables.h +2 -2
@@ -430,13 +430,13 @@ extern int xt_compat_add_offset(int af, unsigned int offset, short delta);extern void xt_compat_flush_offsets (int af);extern short xt_compat_calc_jump (int af,unsigned int offset); -extern int xt_compat_match_offset (struct xt_match *match); +extern int xt_compat_match_offset (const struct xt_match *match);extern int xt_compat_match_from_user (struct xt_entry_match *m,void **dstptr,unsigned int *size);extern int xt_compat_match_to_user (struct xt_entry_match *m,void __user **dstptr,unsigned int *size); -extern int xt_compat_target_offset (struct xt_target *target); +extern int xt_compat_target_offset (const struct xt_target *target);extern void xt_compat_target_from_user (struct xt_entry_target *t,void **dstptr,unsigned int *size); extern int xt_compat_target_to_user(struct xt_entry_target *t,
net/ipv4/netfilter/arp_tables.c +17 -16
@@ -59,7 +59,7 @@ do { \#endif static inline int arp_devaddr_compare (const struct arpt_devaddr_info *ap, -char *hdr_addr,int len) +const char *hdr_addr,int len) {int i, ret;
@@ -80,8 +80,8 @@ static inline int arp_packet_match(const struct arphdr *arphdr,const char *outdev, const struct arpt_arp *arpinfo) { - char *arpptr = (char *)(arphdr + 1); -char *src_devaddr, *tgt_devaddr; + const char *arpptr = (char *)(arphdr + 1); +const char *src_devaddr, *tgt_devaddr;__be32 src_ipaddr, tgt_ipaddr;int i, ret;
@@ -226,12 +226,12 @@ unsigned int arpt_do_table(struct sk_buff *skb, {static const char nulldevname[IFNAMSIZ ];unsigned int verdict =NF_DROP ; -struct arphdr *arp; +const struct arphdr *arp;bool hotdrop = false;struct arpt_entry *e, *back; -const char *indev, *outdev; +const const char *indev, *outdev;void *table_base; -struct xt_table_info *private; +const struct xt_table_info *private;if (!pskb_may_pull (skb,arp_hdr_len (skb->dev)))return NF_DROP ;
@@ -352,7 +352,7 @@ static int mark_source_chains(struct xt_table_info *newinfo, e->counters.pcnt = pos;for (;;) { -struct arpt_standard_target *t +const struct arpt_standard_target *t = (void *)arpt_get_target (e);int visited = e->comefrom & (1 << hook);
@@ -437,7 +437,7 @@ static int mark_source_chains(struct xt_table_info *newinfo,static inline int check_entry (struct arpt_entry *e,const char *name) { -struct arpt_entry_target *t; +const struct arpt_entry_target *t;if (!arp_checkentry (&e->arp)) {duprintf ("arp_tables: arp check failed %p %s.\n" , e, name);
@@ -710,7 +710,7 @@ static inline struct xt_counters *alloc_counters(struct arpt_table *table) {unsigned int countersize;struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;/* We need atomic snapshot of counters: rest doesn't change * (other than comefrom, which userspace doesn't care
@@ -737,7 +737,7 @@ static int copy_entries_to_user(unsigned int total_size,unsigned int off, num;struct arpt_entry *e;struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;int ret =0 ;void *loc_cpu_entry;
@@ -872,7 +872,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat) "arptable_%s", name);if (t && !IS_ERR (t)) {struct arpt_getinfo info; -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private;#ifdef CONFIG_COMPAT if (compat) {
@@ -927,7 +927,8 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, t =xt_find_table_lock (net,NF_ARP , get.name);if (t && !IS_ERR (t)) { -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private; +duprintf ("t->private->number = %u\n" , private->number);if (get.size == private->size)
@@ -1087,11 +1088,11 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,struct xt_counters_info tmp;struct xt_counters *paddc;unsigned int num_counters; -char *name; +const char *name;int size;void *ptmp;struct arpt_table *t; -struct xt_table_info *private; +const struct xt_table_info *private;int ret =0 ;void *loc_cpu_entry;#ifdef CONFIG_COMPAT
@@ -1558,7 +1559,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, void __user *userptr) {struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;void __user *pos;unsigned int size;int ret =0 ;
@@ -1609,7 +1610,7 @@ static int compat_get_entries(struct net *net,xt_compat_lock (NF_ARP ); t =xt_find_table_lock (net,NF_ARP , get.name);if (t && !IS_ERR (t)) { -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private;struct xt_table_info info;duprintf ("t->private->number = %u\n" , private->number);
net/ipv4/netfilter/arpt_mangle.c +1 -1
@@ -15,7 +15,7 @@ target(struct sk_buff *skb, const void *targinfo) {const struct arpt_mangle *mangle = targinfo; -struct arphdr *arp; +const struct arphdr *arp;unsigned char *arpptr;int pln, hln;
net/ipv4/netfilter/ip_tables.c +16 -15
@@ -296,7 +296,7 @@ static void trace_packet(struct sk_buff *skb, struct ipt_entry *e) {void *table_base; -struct ipt_entry *root; +const struct ipt_entry *root;char *hookname, *chainname, *comment;unsigned int rulenum =0 ;
@@ -327,7 +327,7 @@ ipt_do_table(struct sk_buff *skb, { static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));u_int16_t offset; -struct iphdr *ip; +const struct iphdr *ip;u_int16_t datalen;bool hotdrop = false;/* Initializing verdict to NF_DROP keeps gcc happy. */
@@ -926,7 +926,7 @@ static struct xt_counters * alloc_counters(struct xt_table *table) {unsigned int countersize;struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;/* We need atomic snapshot of counters: rest doesn't change (other than comefrom, which userspace doesn't care
@@ -953,9 +953,9 @@ copy_entries_to_user(unsigned int total_size,unsigned int off, num;struct ipt_entry *e;struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;int ret =0 ; -void *loc_cpu_entry; +const void *loc_cpu_entry; counters =alloc_counters (table);if (IS_ERR (counters))
@@ -975,8 +975,8 @@ copy_entries_to_user(unsigned int total_size,/* ... then go back and fix counters and names */ for (off =0 , num =0 ; off < total_size; off += e->next_offset, num++){unsigned int i; -struct ipt_entry_match *m; -struct ipt_entry_target *t; +const struct ipt_entry_match *m; +const struct ipt_entry_target *t; e = (struct ipt_entry *)(loc_cpu_entry + off); if (copy_to_user(userptr + off
@@ -1116,7 +1116,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat) "iptable_%s", name);if (t && !IS_ERR (t)) {struct ipt_getinfo info; -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private;#ifdef CONFIG_COMPAT if (compat) {
@@ -1172,7 +1172,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len) t =xt_find_table_lock (net,AF_INET , get.name);if (t && !IS_ERR (t)) { -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private;duprintf ("t->private->number = %u\n" , private->number);if (get.size == private->size) ret = copy_entries_to_user(private->size,
@@ -1337,11 +1337,11 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compatstruct xt_counters_info tmp;struct xt_counters *paddc;unsigned int num_counters; -char *name; +const char *name;int size;void *ptmp;struct xt_table *t; -struct xt_table_info *private; +const struct xt_table_info *private;int ret =0 ;void *loc_cpu_entry;#ifdef CONFIG_COMPAT
@@ -1878,11 +1878,11 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, void __user *userptr) {struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;void __user *pos;unsigned int size;int ret =0 ; -void *loc_cpu_entry; +const void *loc_cpu_entry;unsigned int i =0 ; counters =alloc_counters (table);
@@ -1929,7 +1929,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,xt_compat_lock (AF_INET ); t =xt_find_table_lock (net,AF_INET , get.name);if (t && !IS_ERR (t)) { -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private;struct xt_table_info info;duprintf ("t->private->number = %u\n" , private->number); ret =compat_table_info (private, &info);
@@ -2130,7 +2130,8 @@ icmp_match(const struct sk_buff *skb,unsigned int protoff, bool *hotdrop) { - struct icmphdr _icmph, *ic; + const struct icmphdr *ic; +struct icmphdr _icmph;const struct ipt_icmp *icmpinfo = matchinfo;/* Must not be a fragment. */
net/ipv6/netfilter/ip6_tables.c +15 -14
@@ -325,7 +325,7 @@ static void trace_packet(struct sk_buff *skb, struct ip6t_entry *e) {void *table_base; -struct ip6t_entry *root; +const struct ip6t_entry *root;char *hookname, *chainname, *comment;unsigned int rulenum =0 ;
@@ -952,7 +952,7 @@ static struct xt_counters *alloc_counters(struct xt_table *table) {unsigned int countersize;struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;/* We need atomic snapshot of counters: rest doesn't change (other than comefrom, which userspace doesn't care
@@ -979,9 +979,9 @@ copy_entries_to_user(unsigned int total_size,unsigned int off, num;struct ip6t_entry *e;struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;int ret =0 ; -void *loc_cpu_entry; +const void *loc_cpu_entry; counters =alloc_counters (table);if (IS_ERR (counters))
@@ -1001,8 +1001,8 @@ copy_entries_to_user(unsigned int total_size,/* ... then go back and fix counters and names */ for (off =0 , num =0 ; off < total_size; off += e->next_offset, num++){unsigned int i; -struct ip6t_entry_match *m; -struct ip6t_entry_target *t; +const struct ip6t_entry_match *m; +const struct ip6t_entry_target *t; e = (struct ip6t_entry *)(loc_cpu_entry + off); if (copy_to_user(userptr + off
@@ -1142,7 +1142,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat) "ip6table_%s", name);if (t && !IS_ERR (t)) {struct ip6t_getinfo info; -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private;#ifdef CONFIG_COMPAT if (compat) {
@@ -1225,7 +1225,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,struct xt_table *t;struct xt_table_info *oldinfo;struct xt_counters *counters; -void *loc_cpu_old_entry; +const void *loc_cpu_old_entry; ret =0 ; counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
@@ -1369,9 +1369,9 @@ do_add_counters(struct net *net, void __user *user, unsigned int len,int size;void *ptmp;struct xt_table *t; -struct xt_table_info *private; +const struct xt_table_info *private;int ret =0 ; -void *loc_cpu_entry; +const void *loc_cpu_entry;#ifdef CONFIG_COMPAT struct compat_xt_counters_info compat_tmp;
@@ -1905,11 +1905,11 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, void __user *userptr) {struct xt_counters *counters; -struct xt_table_info *private = table->private; +const struct xt_table_info *private = table->private;void __user *pos;unsigned int size;int ret =0 ; -void *loc_cpu_entry; +const void *loc_cpu_entry;unsigned int i =0 ; counters =alloc_counters (table);
@@ -1956,7 +1956,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,xt_compat_lock (AF_INET6 ); t =xt_find_table_lock (net,AF_INET6 , get.name);if (t && !IS_ERR (t)) { -struct xt_table_info *private = t->private; +const struct xt_table_info *private = t->private;struct xt_table_info info;duprintf ("t->private->number = %u\n" , private->number); ret =compat_table_info (private, &info);
@@ -2155,7 +2155,8 @@ icmp6_match(const struct sk_buff *skb,unsigned int protoff, bool *hotdrop) { - struct icmp6hdr _icmph, *ic; + const struct icmp6hdr *ic; +struct icmp6hdr _icmph;const struct ip6t_icmp *icmpinfo = matchinfo;/* Must not be a fragment. */
net/netfilter/x_tables.c +9 -9
@@ -58,7 +58,7 @@ static struct xt_af *xt; #define duprintf(format, args...)#endif -static const char *xt_prefix[NPROTO ] = { +static const char *const xt_prefix[NPROTO ] = { [AF_INET ] ="ip" , [AF_INET6 ] ="ip6" , [NF_ARP ] ="arp" ,
@@ -248,7 +248,7 @@ EXPORT_SYMBOL_GPL(xt_request_find_target);static int match_revfn (int af,const char *name,u8 revision,int *bestp) { -struct xt_match *m; +const struct xt_match *m;int have_rev =0 ;list_for_each_entry (m, &xt[af].match, list) {
@@ -264,7 +264,7 @@ static int match_revfn(int af, const char *name, u8 revision, int *bestp)static int target_revfn (int af,const char *name,u8 revision,int *bestp) { -struct xt_target *t; +const struct xt_target *t;int have_rev =0 ;list_for_each_entry (t, &xt[af].target, list) {
@@ -385,7 +385,7 @@ short xt_compat_calc_jump(int af, unsigned int offset) }EXPORT_SYMBOL_GPL (xt_compat_calc_jump); -int xt_compat_match_offset (struct xt_match *match) +int xt_compat_match_offset (const struct xt_match *match) {u_int16_t csize = match->compatsize ? : match->matchsize;return XT_ALIGN (match->matchsize) -COMPAT_XT_ALIGN (csize);
@@ -395,7 +395,7 @@ EXPORT_SYMBOL_GPL(xt_compat_match_offset);int xt_compat_match_from_user (struct xt_entry_match *m,void **dstptr,unsigned int *size) { -struct xt_match *match = m->u.kernel.match; +const struct xt_match *match = m->u.kernel.match;struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;int pad, off =xt_compat_match_offset (match);u_int16_t msize = cm->u.user.match_size;
@@ -422,7 +422,7 @@ EXPORT_SYMBOL_GPL(xt_compat_match_from_user);int xt_compat_match_to_user (struct xt_entry_match *m,void __user **dstptr,unsigned int *size) { -struct xt_match *match = m->u.kernel.match; +const struct xt_match *match = m->u.kernel.match;struct compat_xt_entry_match __user *cm = *dstptr;int off =xt_compat_match_offset (match);u_int16_t msize = m->u.user.match_size - off;
@@ -479,7 +479,7 @@ int xt_check_target(const struct xt_target *target, unsigned short family,EXPORT_SYMBOL_GPL (xt_check_target);#ifdef CONFIG_COMPAT -int xt_compat_target_offset (struct xt_target *target) +int xt_compat_target_offset (const struct xt_target *target) {u_int16_t csize = target->compatsize ? : target->targetsize;return XT_ALIGN (target->targetsize) -COMPAT_XT_ALIGN (csize);
@@ -489,7 +489,7 @@ EXPORT_SYMBOL_GPL(xt_compat_target_offset);void xt_compat_target_from_user (struct xt_entry_target *t,void **dstptr,unsigned int *size) { -struct xt_target *target = t->u.kernel.target; +const struct xt_target *target = t->u.kernel.target;struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;int pad, off =xt_compat_target_offset (target);u_int16_t tsize = ct->u.user.target_size;
@@ -515,7 +515,7 @@ EXPORT_SYMBOL_GPL(xt_compat_target_from_user);int xt_compat_target_to_user (struct xt_entry_target *t,void __user **dstptr,unsigned int *size) { -struct xt_target *target = t->u.kernel.target; +const struct xt_target *target = t->u.kernel.target;struct compat_xt_entry_target __user *ct = *dstptr;int off =xt_compat_target_offset (target);u_int16_t tsize = t->u.user.target_size - off;
Signature · 1 line
1.5.4.4
Patrick McHardy
AppliedRe: [PATCH 03/29] [NETFILTER]: annotate {arp,ip,ip6,x}tables with const
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>
Applied, thanks.
PATCH 4/29 : annotate rest of nf_conntrack_* with const
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- net/ipv6/netfilter/nf_conntrack_reasm.c | 8 ++++---- net/netfilter/nf_conntrack_amanda.c | 2 +- net/netfilter/nf_conntrack_ftp.c | 5 +++-- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_irc.c | 14 ++++++++------ 5 files changed, 17 insertions(+), 14 deletions(-)
net/ipv6/netfilter/nf_conntrack_reasm.c +4 -4
@@ -103,8 +103,8 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = { };#endif -static unsigned int ip6qhashfn (__be32 id,struct in6_addr *saddr, -struct in6_addr *daddr) +static unsigned int ip6qhashfn (__be32 id,const struct in6_addr *saddr, +const struct in6_addr *daddr) {u32 a, b, c;
@@ -132,7 +132,7 @@ static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,static unsigned int nf_hashfn (struct inet_frag_queue *q) { -struct nf_ct_frag6_queue *nq; +const struct nf_ct_frag6_queue *nq; nq = container_of(q, struct nf_ct_frag6_queue, q);return ip6qhashfn (nq->id, &nq->saddr, &nq->daddr);
@@ -220,7 +220,7 @@ oom:static int nf_ct_frag6_queue (struct nf_ct_frag6_queue *fq,struct sk_buff *skb, -struct frag_hdr *fhdr,int nhoff) +const struct frag_hdr *fhdr,int nhoff) {struct sk_buff *prev, *next;int offset, end;
net/netfilter/nf_conntrack_amanda.c +1 -1
@@ -53,7 +53,7 @@ enum amanda_strings { };static struct { -char *string; +const char *string;size_t len;struct ts_config *ts; } search[]__read_mostly = {
net/netfilter/nf_conntrack_ftp.c +3 -2
@@ -350,8 +350,9 @@ static int help(struct sk_buff *skb, enum ip_conntrack_info ctinfo) {unsigned int dataoff, datalen; -struct tcphdr _tcph, *th; -char *fb_ptr; +const struct tcphdr *th; +struct tcphdr _tcph; +const char *fb_ptr;int ret;u32 seq;int dir =CTINFO2DIR (ctinfo);
net/netfilter/nf_conntrack_helper.c +1 -1
@@ -126,7 +126,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) {struct nf_conntrack_tuple_hash *h;struct nf_conntrack_expect *exp; -struct hlist_node *n, *next; +const struct hlist_node *n, *next;unsigned int i;mutex_lock (&nf_ct_helper_mutex);
net/netfilter/nf_conntrack_irc.c +8 -6
@@ -50,7 +50,7 @@ MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "module_param (dcc_timeout, uint,0400 );MODULE_PARM_DESC (dcc_timeout,"timeout on for unestablished DCC channels" ); -static const char *dccprotos[] = { +static const char *const dccprotos[] = {"SEND " ,"CHAT " ,"MOVE " ,"TSEND " ,"SCHAT " };
@@ -65,7 +65,7 @@ static const char *dccprotos[] = {* ad_beg_p returns pointer to first byte of addr data * ad_end_p returns pointer to last byte of addr data */ -static int parse_dcc (char *data,char *data_end,u_int32_t *ip, +static int parse_dcc (char *data,const char *data_end,u_int32_t *ip,u_int16_t *port,char **ad_beg_p,char **ad_end_p) {/* at least 12: "AAAAAAAA P\1\n" */
@@ -93,9 +93,11 @@ static int help(struct sk_buff *skb, unsigned int protoff, struct nf_conn *ct, enum ip_conntrack_info ctinfo) { unsigned int dataoff; -struct iphdr *iph; -struct tcphdr _tcph, *th; -char *data, *data_limit, *ib_ptr; +const struct iphdr *iph; +const struct tcphdr *th; +struct tcphdr _tcph; +const char *data_limit; +char *data, *ib_ptr;int dir =CTINFO2DIR (ctinfo);struct nf_conntrack_expect *exp;struct nf_conntrack_tuple *tuple;
@@ -159,7 +161,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,/* we have at least * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid * data left (== 14/13 bytes) */ -if (parse_dcc ((char *)data, data_limit, &dcc_ip, +if (parse_dcc (data, data_limit, &dcc_ip, &dcc_port, &addr_beg_p, &addr_end_p)) {pr_debug ("unable to parse dcc command\n" );continue ;
Signature · 1 line
1.5.4.4
Patrick McHardy
AppliedRe: [PATCH 04/29] : annotate rest of nf_conntrack_* with const
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>
Applied.
PATCH 5/29 : annotate rest of nf_nat_* with const
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- net/ipv4/netfilter/nf_nat_core.c | 8 ++++---- net/ipv4/netfilter/nf_nat_snmp_basic.c | 17 ++++++++--------- net/ipv4/netfilter/nf_nat_standalone.c | 8 ++++---- 3 files changed, 16 insertions(+), 17 deletions(-)
net/ipv4/netfilter/nf_nat_core.c +4 -4
@@ -150,9 +150,9 @@ find_appropriate_src(const struct nf_conntrack_tuple *tuple, const struct nf_nat_range *range) {unsigned int h =hash_by_src (tuple); -struct nf_conn_nat *nat; -struct nf_conn *ct; -struct hlist_node *n; +const struct nf_conn_nat *nat; +const struct nf_conn *ct; +const struct hlist_node *n;rcu_read_lock ();hlist_for_each_entry_rcu (nat, n, &bysource[h], bysource) {
@@ -426,7 +426,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,struct icmphdr icmp;struct iphdr ip; } *inside; -struct nf_conntrack_l4proto *l4proto; +const struct nf_conntrack_l4proto *l4proto;struct nf_conntrack_tuple inner, target;int hdrlen =ip_hdrlen (skb);enum ip_conntrack_dir dir =CTINFO2DIR (ctinfo);
net/ipv4/netfilter/nf_nat_snmp_basic.c +8 -9
@@ -220,7 +220,7 @@ static unsigned char asn1_length_decode(struct asn1_ctx *ctx,if (ch <0x80 ) *len = ch;else { - cnt = (unsigned char ) (ch &0x7F ); + cnt = ch &0x7F ; *len =0 ;while (cnt >0 ) {
@@ -618,8 +618,7 @@ struct snmp_cnvint syntax; }; -static struct snmp_cnv snmp_conv [] = -{ +static const struct snmp_cnv snmp_conv[] = { {ASN1_UNI ,ASN1_NUL ,SNMP_NULL }, {ASN1_UNI ,ASN1_INT ,SNMP_INTEGER }, {ASN1_UNI ,ASN1_OTS ,SNMP_OCTETSTR },
@@ -644,7 +643,7 @@ static unsigned char snmp_tag_cls2syntax(unsigned int tag,unsigned int cls, unsigned short *syntax) { - struct snmp_cnv *cnv; + const struct snmp_cnv *cnv; cnv = snmp_conv;
@@ -904,7 +903,7 @@ static inline void mangle_address(unsigned char *begin,u_int32_t old;if (debug) -memcpy (&old, (unsigned char *)addr,sizeof (old)); +memcpy (&old, addr,sizeof (old)); *addr = map->to;
@@ -999,7 +998,7 @@ err_id_free:* *****************************************************************************/ -static void hex_dump (unsigned char *buf,size_t len) +static void hex_dump (const unsigned char *buf,size_t len) {size_t i;
@@ -1080,7 +1079,7 @@ static int snmp_parse_mangle(unsigned char *msg,if (cls !=ASN1_CTX || con !=ASN1_CON )return 0 ;if (debug >1 ) { -unsigned char *pdus[] = { +static const unsigned char *const pdus[] = { [SNMP_PDU_GET ] ="get" , [SNMP_PDU_NEXT ] ="get-next" , [SNMP_PDU_RESPONSE ] ="response" ,
@@ -1232,8 +1231,8 @@ static int help(struct sk_buff *skb, unsigned int protoff, {int dir =CTINFO2DIR (ctinfo);unsigned int ret; -struct iphdr *iph =ip_hdr (skb); -struct udphdr *udph = (struct udphdr *)((u_int32_t *)iph + iph->ihl); +const struct iphdr *iph =ip_hdr (skb); +const struct udphdr *udph = (struct udphdr *)((__be32 *)iph + iph->ihl);/* SNMP replies and originating SNMP traps get mangled */ if (udph->source ==htons (SNMP_PORT ) && dir !=IP_CT_DIR_REPLY )
net/ipv4/netfilter/nf_nat_standalone.c +4 -4
@@ -30,8 +30,8 @@#ifdef CONFIG_XFRM static void nat_decode_session (struct sk_buff *skb,struct flowi *fl) { -struct nf_conn *ct; -struct nf_conntrack_tuple *t; +const struct nf_conn *ct; +const struct nf_conntrack_tuple *t;enum ip_conntrack_info ctinfo;enum ip_conntrack_dir dir;unsigned long statusbit;
@@ -189,7 +189,7 @@ nf_nat_out(unsigned int hooknum, int (*okfn)(struct sk_buff *)) {#ifdef CONFIG_XFRM -struct nf_conn *ct; +const struct nf_conn *ct;enum ip_conntrack_info ctinfo;#endif unsigned int ret;
@@ -223,7 +223,7 @@ nf_nat_local_fn(unsigned int hooknum,const struct net_device *out, int (*okfn)(struct sk_buff *)) { - struct nf_conn *ct; + const struct nf_conn *ct;enum ip_conntrack_info ctinfo;unsigned int ret;
Signature · 1 line
1.5.4.4
Re: [PATCH 05/29] [NETFILTER]: annotate rest of nf_nat_* with const
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>
Also applied. In the future I guess I'd prefer a single large patch for simple stuff like this.
PATCH 6/29 : Use unsigned types for hooknum and pf vars
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter.h | 54 ++++++++------- include/linux/netfilter/x_tables.h | 33 +++++---- include/net/netfilter/nf_conntrack_core.h | 2 +- include/net/netfilter/nf_conntrack_expect.h | 2 +- include/net/netfilter/nf_conntrack_l4proto.h | 4 +- include/net/netfilter/nf_log.h | 6 +- include/net/netfilter/nf_queue.h | 6 +- net/bridge/br_netfilter.c | 4 +- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 5 +- net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 5 +- net/netfilter/core.c | 4 +- net/netfilter/nf_conntrack_amanda.c | 2 +- net/netfilter/nf_conntrack_core.c | 2 +- net/netfilter/nf_conntrack_expect.c | 2 +- net/netfilter/nf_conntrack_h323_main.c | 7 +- net/netfilter/nf_conntrack_proto_generic.c | 2 +- net/netfilter/nf_conntrack_proto_gre.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 6 +- net/netfilter/nf_conntrack_proto_udp.c | 4 +- net/netfilter/nf_conntrack_proto_udplite.c | 4 +- net/netfilter/nf_conntrack_sane.c | 2 +- net/netfilter/nf_conntrack_sip.c | 8 +- net/netfilter/nf_conntrack_tftp.c | 2 +- net/netfilter/nf_internals.h | 4 +- net/netfilter/nf_log.c | 6 +- net/netfilter/nf_queue.c | 12 ++-- net/netfilter/nf_sockopt.c | 15 ++-- net/netfilter/x_tables.c | 52 ++++++++------- 29 files changed, 139 insertions(+), 120 deletions(-)
include/linux/netfilter.h +29 -25
@@ -91,8 +91,8 @@ struct nf_hook_ops/* User fills in from here down. */ nf_hookfn *hook;struct module *owner; -int pf; -int hooknum; +unsigned int pf; +unsigned int hooknum;/* Hooks are ordered in ascending priority. */ int priority; };
@@ -101,7 +101,7 @@ struct nf_sockopt_ops {struct list_head list; -int pf; +unsigned int pf;/* Non-inclusive ranges: use 0/0/NULL to never get called. */ int set_optmin;
@@ -139,7 +139,7 @@ extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[];extern struct list_head nf_hooks[NPROTO ][NF_MAX_HOOKS ]; -int nf_hook_slow (int pf,unsigned int hook,struct sk_buff *skb, +int nf_hook_slow (unsigned int pf,unsigned int hook,struct sk_buff *skb,struct net_device *indev,struct net_device *outdev,int (*okfn)(struct sk_buff *),int thresh);
@@ -150,12 +150,10 @@ int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,* okfn must be invoked by the caller in this case. Any other return * value indicates the packet has been consumed by the hook. */ -static inline int nf_hook_thresh (int pf,unsigned int hook, -struct sk_buff *skb, -struct net_device *indev, -struct net_device *outdev, -int (*okfn)(struct sk_buff *),int thresh, -int cond) +static inline int +nf_hook_thresh (unsigned int pf,unsigned int hook,struct sk_buff *skb, +struct net_device *indev,struct net_device *outdev, +int (*okfn)(struct sk_buff *),int thresh,int cond) {if (!cond)return 1 ;
@@ -166,9 +164,10 @@ static inline int nf_hook_thresh(int pf, unsigned int hook,return nf_hook_slow (pf, hook, skb, indev, outdev, okfn, thresh); } -static inline int nf_hook (int pf,unsigned int hook,struct sk_buff *skb, -struct net_device *indev,struct net_device *outdev, -int (*okfn)(struct sk_buff *)) +static inline int +nf_hook (unsigned int pf,unsigned int hook,struct sk_buff *skb, +struct net_device *indev,struct net_device *outdev, +int (*okfn)(struct sk_buff *)) {return nf_hook_thresh (pf, hook, skb, indev, outdev, okfn,INT_MIN ,1 ); }
@@ -211,14 +210,14 @@ __ret;})NF_HOOK_THRESH (pf, hook, skb, indev, outdev, okfn,INT_MIN ) /* Call setsockopt() */ -int nf_setsockopt (struct sock *sk,int pf,int optval,char __user *opt, -int len); -int nf_getsockopt (struct sock *sk,int pf,int optval,char __user *opt, -int *len); +int nf_setsockopt (struct sock *sk,unsigned int pf,int optval, +char __user *opt,int len); +int nf_getsockopt (struct sock *sk,unsigned int pf,int optval, +char __user *opt,int *len); -int compat_nf_setsockopt (struct sock *sk,int pf,int optval, +int compat_nf_setsockopt (struct sock *sk,unsigned int pf,int optval,char __user *opt,int len); -int compat_nf_getsockopt (struct sock *sk,int pf,int optval, +int compat_nf_getsockopt (struct sock *sk,unsigned int pf,int optval,char __user *opt,int *len);/* Call this before modifying an existing packet: ensures it is
@@ -269,7 +268,8 @@ extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);extern void (*ip_nat_decode_session)(struct sk_buff *,struct flowi *);static inline void -nf_nat_decode_session (struct sk_buff *skb,struct flowi *fl,int family) +nf_nat_decode_session (struct sk_buff *skb,struct flowi *fl, +unsigned int family) {#ifdef CONFIG_NF_NAT_NEEDED void (*decodefn)(struct sk_buff *,struct flowi *);
@@ -292,7 +292,7 @@ extern struct proc_dir_entry *proc_net_netfilter;#else /* !CONFIG_NETFILTER */ #define NF_HOOK (pf, hook, skb, indev, outdev, okfn) (okfn)(skb)#define NF_HOOK_COND (pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb) -static inline int nf_hook_thresh(int pf, unsigned int hook, +static inline int nf_hook_thresh(unsigned int pf, unsigned int hook, struct sk_buff *skb, struct net_device *indev, struct net_device *outdev,
@@ -301,15 +301,19 @@ static inline int nf_hook_thresh(int pf, unsigned int hook, {return okfn (skb); } -static inline int nf_hook (int pf,unsigned int hook,struct sk_buff *skb, -struct net_device *indev,struct net_device *outdev, -int (*okfn)(struct sk_buff *)) +static inline int +nf_hook (unsigned int pf,unsigned int hook,struct sk_buff *skb, +struct net_device *indev,struct net_device *outdev, +int (*okfn)(struct sk_buff *)) {return 1 ; }struct flowi ;static inline void -nf_nat_decode_session (struct sk_buff *skb,struct flowi *fl,int family) {} +nf_nat_decode_session (struct sk_buff *skb,struct flowi *fl, +unsigned int family) +{ +}#endif /*CONFIG_NETFILTER*/ #if defined(CONFIG_NF_CONNTRACK ) || defined(CONFIG_NF_CONNTRACK_MODULE )
include/linux/netfilter/x_tables.h +18 -15
@@ -292,7 +292,7 @@ struct xt_table/* Set this to THIS_MODULE if you are a module, otherwise NULL */ struct module *me; -int af;/* address/protocol family */ +unsigned int af;/* address/protocol family */ };#include <linux/netfilter_ipv4.h>
@@ -346,19 +346,21 @@ extern struct xt_table_info *xt_replace_table(struct xt_table *table,struct xt_table_info *newinfo, int *error); -extern struct xt_match *xt_find_match (int af,const char *name,u8 revision); -extern struct xt_target *xt_find_target (int af,const char *name,u8 revision); -extern struct xt_target *xt_request_find_target (int af,const char *name, -u8 revision); -extern int xt_find_revision (int af,const char *name,u8 revision,int target, -int *err); +extern struct xt_match * +xt_find_match (unsigned int af,const char *name,u8 revision); +extern struct xt_target * +xt_find_target (unsigned int af,const char *name,u8 revision); +extern struct xt_target * +xt_request_find_target (unsigned int af,const char *name,u8 revision); +extern int xt_find_revision (unsigned int af,const char *name,u8 revision, +int target,int *err); -extern struct xt_table *xt_find_table_lock (struct net *net,int af, +extern struct xt_table *xt_find_table_lock (struct net *net,unsigned int af,const char *name);extern void xt_table_unlock (struct xt_table *t); -extern int xt_proto_init (struct net *net,int af); -extern void xt_proto_fini (struct net *net,int af); +extern int xt_proto_init (struct net *net,unsigned int af); +extern void xt_proto_fini (struct net *net,unsigned int af);extern struct xt_table_info *xt_alloc_table_info (unsigned int size);extern void xt_free_table_info (struct xt_table_info *info);
@@ -423,12 +425,13 @@ struct compat_xt_counters_info#define COMPAT_XT_ALIGN (s) (((s) + (__alignof__(struct compat_xt_counters)-1)) \ & ~(__alignof__(struct compat_xt_counters)-1)) -extern void xt_compat_lock (int af); -extern void xt_compat_unlock (int af); +extern void xt_compat_lock (unsigned int af); +extern void xt_compat_unlock (unsigned int af); -extern int xt_compat_add_offset (int af,unsigned int offset,short delta); -extern void xt_compat_flush_offsets (int af); -extern short xt_compat_calc_jump (int af,unsigned int offset); +extern int xt_compat_add_offset (unsigned int af,unsigned int offset, +short delta); +extern void xt_compat_flush_offsets (unsigned int af); +extern short xt_compat_calc_jump (unsigned int af,unsigned int offset);extern int xt_compat_match_offset (const struct xt_match *match); extern int xt_compat_match_from_user(struct xt_entry_match *m,
include/net/netfilter/nf_conntrack_core.h +1 -1
@@ -20,7 +20,7 @@/* This header is used to share core functionality between the standalone connection tracking module, and the compatibility layer's use of connection tracking. */ -extern unsigned int nf_conntrack_in (int pf, +extern unsigned int nf_conntrack_in (unsigned int pf,unsigned int hooknum,struct sk_buff *skb);
include/net/netfilter/nf_conntrack_expect.h +1 -1
@@ -86,7 +86,7 @@ void nf_ct_unexpect_related(struct nf_conntrack_expect *exp);/* Allocate space for an expectation: this is mandatory before calling nf_ct_expect_related. You will have to call put afterwards. */ struct nf_conntrack_expect *nf_ct_expect_alloc (struct nf_conn *me); -void nf_ct_expect_init (struct nf_conntrack_expect *,unsigned int ,int , +void nf_ct_expect_init (struct nf_conntrack_expect *,unsigned int ,unsigned int ,const union nf_inet_addr *,const union nf_inet_addr *,u_int8_t ,const __be16 *,const __be16 *);
include/net/netfilter/nf_conntrack_l4proto.h +2 -2
@@ -40,7 +40,7 @@ struct nf_conntrack_l4protoconst struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum);/* Called when a new connection for this protocol found;
@@ -53,7 +53,7 @@ struct nf_conntrack_l4protoint (*error)(struct sk_buff *skb,unsigned int dataoff,enum ip_conntrack_info *ctinfo, -int pf,unsigned int hooknum); +unsigned int pf,unsigned int hooknum);/* Print out the per-protocol part of the tuple. Return like seq_* */ int (*print_tuple)(struct seq_file *s,
include/net/netfilter/nf_log.h +3 -3
@@ -43,12 +43,12 @@ struct nf_logger { };/* Function to register/unregister log function. */ -int nf_log_register (int pf,const struct nf_logger *logger); +int nf_log_register (unsigned int pf,const struct nf_logger *logger);void nf_log_unregister (const struct nf_logger *logger); -void nf_log_unregister_pf (int pf); +void nf_log_unregister_pf (unsigned int pf);/* Calls the registered backend logging function */ -void nf_log_packet(int pf, +void nf_log_packet(unsigned int pf, unsigned int hooknum, const struct sk_buff *skb, const struct net_device *in,
include/net/netfilter/nf_queue.h +3 -3
@@ -8,7 +8,7 @@ struct nf_queue_entry {unsigned int id;struct nf_hook_ops *elem; -int pf; +unsigned int pf;unsigned int hook;struct net_device *indev;struct net_device *outdev;
@@ -24,9 +24,9 @@ struct nf_queue_handler {char *name; }; -extern int nf_register_queue_handler (int pf, +extern int nf_register_queue_handler (unsigned int pf,const struct nf_queue_handler *qh); -extern int nf_unregister_queue_handler (int pf, +extern int nf_unregister_queue_handler (unsigned int pf,const struct nf_queue_handler *qh);extern void nf_unregister_queue_handlers (const struct nf_queue_handler *qh);extern void nf_reinject (struct nf_queue_entry *entry,unsigned int verdict);
net/bridge/br_netfilter.c +2 -2
@@ -649,7 +649,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb, {struct nf_bridge_info *nf_bridge;struct net_device *parent; -int pf; +unsigned int pf;if (!skb->nf_bridge)return NF_ACCEPT ;
@@ -783,7 +783,7 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb, {struct nf_bridge_info *nf_bridge = skb->nf_bridge;struct net_device *realoutdev =bridge_parent (skb->dev); -int pf; +unsigned int pf;#ifdef CONFIG_NETFILTER_DEBUG /* Be very paranoid. This probably won't happen anymore, but let's
net/ipv4/netfilter/nf_conntrack_proto_icmp.c +3 -2
@@ -80,7 +80,7 @@ static int icmp_packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) {/* Try to delete connection immediately after all replies:
@@ -175,7 +175,8 @@ icmp_error_message(struct sk_buff *skb,/* Small and modified version of icmp_rcv */ static int icmp_error (struct sk_buff *skb,unsigned int dataoff, -enum ip_conntrack_info *ctinfo,int pf,unsigned int hooknum) +enum ip_conntrack_info *ctinfo,unsigned int pf, +unsigned int hooknum) {const struct icmphdr *icmph;struct icmphdr _ih;
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +3 -2
@@ -81,7 +81,7 @@ static int icmpv6_packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) {/* Try to delete connection immediately after all replies:
@@ -175,7 +175,8 @@ icmpv6_error_message(struct sk_buff *skb,static int icmpv6_error (struct sk_buff *skb,unsigned int dataoff, -enum ip_conntrack_info *ctinfo,int pf,unsigned int hooknum) +enum ip_conntrack_info *ctinfo,unsigned int pf, +unsigned int hooknum) {const struct icmp6hdr *icmp6h;struct icmp6hdr _ih;
net/netfilter/core.c +2 -2
@@ -113,7 +113,7 @@ EXPORT_SYMBOL(nf_unregister_hooks); unsigned int nf_iterate(struct list_head *head, struct sk_buff *skb, - int hook, + unsigned int hook, const struct net_device *indev, const struct net_device *outdev, struct list_head **i,
@@ -155,7 +155,7 @@ unsigned int nf_iterate(struct list_head *head,/* Returns 1 if okfn() needs to be executed by the caller, * -EPERM for NF_DROP, 0 otherwise. */ -int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb, +int nf_hook_slow(unsigned int pf, unsigned int hook, struct sk_buff *skb, struct net_device *indev, struct net_device *outdev, int (*okfn)(struct sk_buff *),
net/netfilter/nf_conntrack_amanda.c +1 -1
@@ -91,7 +91,7 @@ static int amanda_help(struct sk_buff *skb,char pbuf[sizeof ("65535" )], *tmp;u_int16_t len;__be16 port; -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num;int ret =NF_ACCEPT ;typeof (nf_nat_amanda_hook) nf_nat_amanda;
net/netfilter/nf_conntrack_core.c +1 -1
@@ -665,7 +665,7 @@ resolve_normal_ct(struct sk_buff *skb, }unsigned int -nf_conntrack_in (int pf,unsigned int hooknum,struct sk_buff *skb) +nf_conntrack_in (unsigned int pf,unsigned int hooknum,struct sk_buff *skb) {struct nf_conn *ct;enum ip_conntrack_info ctinfo;
net/netfilter/nf_conntrack_expect.c +1 -1
@@ -241,7 +241,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)EXPORT_SYMBOL_GPL (nf_ct_expect_alloc);void nf_ct_expect_init (struct nf_conntrack_expect *exp,unsigned int class, -int family, +unsigned int family,const union nf_inet_addr *saddr,const union nf_inet_addr *daddr,u_int8_t proto,const __be16 *src,const __be16 *dst)
net/netfilter/nf_conntrack_h323_main.c +4 -3
@@ -218,7 +218,7 @@ static int get_h245_addr(struct nf_conn *ct, const unsigned char *data, union nf_inet_addr *addr, __be16 *port) {const unsigned char *p; -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num;int len;if (taddr->choice != eH245_TransportAddress_unicastAddress)
@@ -634,7 +634,7 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data, union nf_inet_addr *addr, __be16 *port) {const unsigned char *p; -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num;int len;switch (taddr->choice) {
@@ -714,7 +714,8 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,/* If the calling party is on the same side of the forward-to party, * we don't need to track the second call */ static int callforward_do_filter (const union nf_inet_addr *src, -const union nf_inet_addr *dst,int family) +const union nf_inet_addr *dst, +unsigned int family) {const struct nf_afinfo *afinfo;struct flowi fl1, fl2;
net/netfilter/nf_conntrack_proto_generic.c +1 -1
@@ -45,7 +45,7 @@ static int packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) {nf_ct_refresh_acct (ct ,ctinfo ,skb ,nf_ct_generic_timeout );
net/netfilter/nf_conntrack_proto_gre.c +1 -1
@@ -216,7 +216,7 @@ static int gre_packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) {/* If we've seen traffic both ways, this is a GRE connection.
net/netfilter/nf_conntrack_proto_sctp.c +1 -1
@@ -287,7 +287,7 @@ static int sctp_packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) { enum sctp_conntrack new_state, old_state;
net/netfilter/nf_conntrack_proto_tcp.c +3 -3
@@ -485,7 +485,7 @@ static int tcp_in_window(const struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, const struct tcphdr *tcph, - int pf) + unsigned int pf) { struct ip_ct_tcp_state *sender = &state->seen[dir];struct ip_ct_tcp_state *receiver = &state->seen[!dir];
@@ -744,7 +744,7 @@ static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =static int tcp_error (struct sk_buff *skb,unsigned int dataoff,enum ip_conntrack_info *ctinfo, -int pf, +unsigned int pf,unsigned int hooknum) {const struct tcphdr *th;
@@ -799,7 +799,7 @@ static int tcp_packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) { struct nf_conntrack_tuple *tuple;
net/netfilter/nf_conntrack_proto_udp.c +2 -2
@@ -66,7 +66,7 @@ static int udp_packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) {/* If we've seen traffic both ways, this is some kind of UDP
@@ -91,7 +91,7 @@ static int udp_new(struct nf_conn *ct, const struct sk_buff *skb,static int udp_error (struct sk_buff *skb,unsigned int dataoff,enum ip_conntrack_info *ctinfo, -int pf, +unsigned int pf,unsigned int hooknum) {unsigned int udplen = skb->len - dataoff;
net/netfilter/nf_conntrack_proto_udplite.c +2 -2
@@ -65,7 +65,7 @@ static int udplite_packet(struct nf_conn *ct,const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, - int pf, + unsigned int pf, unsigned int hooknum) {/* If we've seen traffic both ways, this is some kind of UDP
@@ -91,7 +91,7 @@ static int udplite_new(struct nf_conn *ct, const struct sk_buff *skb,static int udplite_error (struct sk_buff *skb,unsigned int dataoff,enum ip_conntrack_info *ctinfo, -int pf, +unsigned int pf,unsigned int hooknum) {unsigned int udplen = skb->len - dataoff;
net/netfilter/nf_conntrack_sane.c +1 -1
@@ -72,7 +72,7 @@ static int help(struct sk_buff *skb,struct nf_conntrack_tuple *tuple;struct sane_request *req;struct sane_reply_net_start *reply; -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; ct_sane_info = &nfct_help (ct)->help.ct_sane_info;/* Until there's been traffic both ways, don't look in packets. */
net/netfilter/nf_conntrack_sip.c +4 -4
@@ -142,7 +142,7 @@ static int parse_addr(const struct nf_conn *ct, const char *cp, const char *limit) {const char *end; -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num;int ret =0 ;switch (family) {
@@ -739,7 +739,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,enum ip_conntrack_dir dir =CTINFO2DIR (ctinfo);union nf_inet_addr *saddr;struct nf_conntrack_tuple tuple; -int family = ct->tuplehash[!dir].tuple.src.l3num; +unsigned int family = ct->tuplehash[!dir].tuple.src.l3num;int direct_rtp =0 , skip_expect =0 , ret =NF_DROP ;u_int16_t base_port;__be16 rtp_port, rtcp_port;
@@ -870,7 +870,7 @@ static int process_sdp(struct sk_buff *skb, {enum ip_conntrack_info ctinfo;struct nf_conn *ct =nf_ct_get (skb, &ctinfo); -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num;unsigned int matchoff, matchlen;unsigned int mediaoff, medialen;unsigned int sdpoff;
@@ -1033,7 +1033,7 @@ static int process_register_request(struct sk_buff *skb,struct nf_conn *ct =nf_ct_get (skb, &ctinfo);struct nf_conn_help *help =nfct_help (ct);enum ip_conntrack_dir dir =CTINFO2DIR (ctinfo); -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num;unsigned int matchoff, matchlen;struct nf_conntrack_expect *exp;union nf_inet_addr *saddr, daddr;
net/netfilter/nf_conntrack_tftp.c +1 -1
@@ -44,7 +44,7 @@ static int tftp_help(struct sk_buff *skb,struct nf_conntrack_expect *exp;struct nf_conntrack_tuple *tuple;unsigned int ret =NF_ACCEPT ; -int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num; +unsigned int family = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.l3num;typeof (nf_nat_tftp_hook) nf_nat_tftp; tfh = skb_header_pointer(skb, protoff + sizeof(struct udphdr),
net/netfilter/nf_internals.h +2 -2
@@ -15,7 +15,7 @@/* core.c */ extern unsigned int nf_iterate(struct list_head *head, struct sk_buff *skb, - int hook, + unsigned int hook, const struct net_device *indev, const struct net_device *outdev, struct list_head **i,
@@ -25,7 +25,7 @@ extern unsigned int nf_iterate(struct list_head *head,/* nf_queue.c */ extern int nf_queue(struct sk_buff *skb, struct list_head *elem, - int pf, unsigned int hook, + unsigned int pf, unsigned int hook, struct net_device *indev, struct net_device *outdev, int (*okfn)(struct sk_buff *),
net/netfilter/nf_log.c +3 -3
@@ -20,7 +20,7 @@ static DEFINE_MUTEX(nf_log_mutex);/* return EBUSY if somebody else is registered, EEXIST if the same logger * is registred, 0 on success. */ -int nf_log_register (int pf,const struct nf_logger *logger) +int nf_log_register (unsigned int pf,const struct nf_logger *logger) {int ret;
@@ -45,7 +45,7 @@ int nf_log_register(int pf, const struct nf_logger *logger) }EXPORT_SYMBOL (nf_log_register); -void nf_log_unregister_pf (int pf) +void nf_log_unregister_pf (unsigned int pf) {if (pf >=NPROTO )return ;
@@ -73,7 +73,7 @@ void nf_log_unregister(const struct nf_logger *logger) }EXPORT_SYMBOL (nf_log_unregister); -void nf_log_packet(int pf, +void nf_log_packet(unsigned int pf, unsigned int hooknum, const struct sk_buff *skb, const struct net_device *in,
net/netfilter/nf_queue.c +7 -5
@@ -22,7 +22,8 @@ static DEFINE_MUTEX(queue_handler_mutex);/* return EBUSY when somebody else is registered, return EEXIST if the * same handler is registered, return 0 in case of success. */ -int nf_register_queue_handler (int pf,const struct nf_queue_handler *qh) +int nf_register_queue_handler (unsigned int pf, +const struct nf_queue_handler *qh) {int ret;
@@ -45,7 +46,8 @@ int nf_register_queue_handler(int pf, const struct nf_queue_handler *qh)EXPORT_SYMBOL (nf_register_queue_handler);/* The caller must flush their queue before this */ -int nf_unregister_queue_handler (int pf,const struct nf_queue_handler *qh) +int nf_unregister_queue_handler (unsigned int pf, +const struct nf_queue_handler *qh) {if (pf >=NPROTO )return -EINVAL ;
@@ -67,7 +69,7 @@ EXPORT_SYMBOL(nf_unregister_queue_handler);void nf_unregister_queue_handlers (const struct nf_queue_handler *qh) { -int pf; +unsigned int pf;mutex_lock (&queue_handler_mutex);for (pf =0 ; pf <NPROTO ; pf++) {
@@ -107,7 +109,7 @@ static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)*/ static int __nf_queue(struct sk_buff *skb, struct list_head *elem, - int pf, unsigned int hook, + unsigned int pf, unsigned int hook, struct net_device *indev, struct net_device *outdev, int (*okfn)(struct sk_buff *),
@@ -191,7 +193,7 @@ err: int nf_queue(struct sk_buff *skb, struct list_head *elem, - int pf, unsigned int hook, + unsigned int pf, unsigned int hook, struct net_device *indev, struct net_device *outdev, int (*okfn)(struct sk_buff *),
net/netfilter/nf_sockopt.c +8 -7
@@ -60,7 +60,7 @@ void nf_unregister_sockopt(struct nf_sockopt_ops *reg) }EXPORT_SYMBOL (nf_unregister_sockopt); -static struct nf_sockopt_ops *nf_sockopt_find (struct sock *sk,int pf, +static struct nf_sockopt_ops *nf_sockopt_find (struct sock *sk,unsigned int pf,int val,int get) {struct nf_sockopt_ops *ops;
@@ -96,7 +96,7 @@ out: }/* Call get/setsockopt() */ -static int nf_sockopt (struct sock *sk,int pf,int val, +static int nf_sockopt (struct sock *sk,unsigned int pf,int val,char __user *opt,int *len,int get) {struct nf_sockopt_ops *ops;
@@ -115,21 +115,22 @@ static int nf_sockopt(struct sock *sk, int pf, int val,return ret; } -int nf_setsockopt (struct sock *sk,int pf,int val,char __user *opt, +int nf_setsockopt (struct sock *sk,unsigned int pf,int val,char __user *opt,int len) {return nf_sockopt (sk, pf, val, opt, &len,0 ); }EXPORT_SYMBOL (nf_setsockopt); -int nf_getsockopt (struct sock *sk,int pf,int val,char __user *opt,int *len) +int nf_getsockopt (struct sock *sk,unsigned int pf,int val, +char __user *opt,int *len) {return nf_sockopt (sk, pf, val, opt, len,1 ); }EXPORT_SYMBOL (nf_getsockopt);#ifdef CONFIG_COMPAT -static int compat_nf_sockopt (struct sock *sk,int pf,int val, +static int compat_nf_sockopt (struct sock *sk,unsigned int pf,int val,char __user *opt,int *len,int get) {struct nf_sockopt_ops *ops;
@@ -155,14 +156,14 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val,return ret; } -int compat_nf_setsockopt (struct sock *sk,int pf, +int compat_nf_setsockopt (struct sock *sk,unsigned int pf,int val,char __user *opt,int len) {return compat_nf_sockopt (sk, pf, val, opt, &len,0 ); }EXPORT_SYMBOL (compat_nf_setsockopt); -int compat_nf_getsockopt (struct sock *sk,int pf, +int compat_nf_getsockopt (struct sock *sk,unsigned int pf,int val,char __user *opt,int *len) {return compat_nf_sockopt (sk, pf, val, opt, len,1 );
net/netfilter/x_tables.c +29 -23
182 lines not on this page · raw message
Signature · 1 line
1.5.4.4
Re: [PATCH 06/29] [NETFILTER]: Use unsigned types for hooknum and pf vars
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>
Using u16 or something similar sizes would have made more sense for the families, but it removes some inconstencies, so I've applied it.
Re: [PATCH 06/29] [NETFILTER]: Use unsigned types for hooknum and pf vars
Quoted 6 lines · Patrick McHardy
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>Using u16 or something similar sizes would have made more sense for the families, but it removes some inconstencies, so I've applied it.
Dropped again:
sERROR: use tabs not spaces
#55: FILE: include/linux/netfilter.h:156:
+ struct net_device *indev, struct net_device *outdev,$
...
total: 25 errors, 0 warnings, 801 lines checked
PATCH 7/29 : remove arpt_table indirection macro
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 11 ++++----- net/ipv4/netfilter/arp_tables.c | 25 ++++++++++----------- net/ipv4/netfilter/arptable_filter.c | 2 +- 3 files changed, 18 insertions(+), 20 deletions(-)
include/linux/netfilter_arp/arp_tables.h +5 -6
@@ -24,7 +24,6 @@#define ARPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN#define ARPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN#define arpt_target xt_target -#define arpt_table xt_table#define ARPT_DEV_ADDR_LEN_MAX 16
@@ -271,15 +270,15 @@ struct arpt_error xt_register_target(tgt); })#define arpt_unregister_target (tgt) xt_unregister_target(tgt) -extern struct arpt_table *arpt_register_table (struct net *net, -struct arpt_table *table, -const struct arpt_replace *repl); -extern void arpt_unregister_table (struct arpt_table *table); +extern struct xt_table * +arpt_register_table (struct net *net,struct xt_table *table, +const struct arpt_replace *repl); +extern void arpt_unregister_table (struct xt_table *table);extern unsigned int arpt_do_table (struct sk_buff *skb,unsigned int hook,const struct net_device *in,const struct net_device *out, -struct arpt_table *table); +struct xt_table *table);#define ARPT_ALIGN (s) XT_ALIGN(s)
net/ipv4/netfilter/arp_tables.c +12 -13
@@ -222,7 +222,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,unsigned int hook, const struct net_device *in, const struct net_device *out, - struct arpt_table *table) + struct xt_table *table) { static const char nulldevname[IFNAMSIZ];unsigned int verdict =NF_DROP ;
@@ -706,7 +706,7 @@ static void get_counters(const struct xt_table_info *t, } } -static inline struct xt_counters *alloc_counters (struct arpt_table *table) +static inline struct xt_counters *alloc_counters (struct xt_table *table) {unsigned int countersize;struct xt_counters *counters;
@@ -731,7 +731,7 @@ static inline struct xt_counters *alloc_counters(struct arpt_table *table) }static int copy_entries_to_user (unsigned int total_size, -struct arpt_table *table, +struct xt_table *table,void __user *userptr) {unsigned int off, num;
@@ -851,7 +851,7 @@ static int compat_table_info(const struct xt_table_info *info,static int get_info (struct net *net,void __user *user,int *len,int compat) {char name[ARPT_TABLE_MAXNAMELEN ]; -struct arpt_table *t; +struct xt_table *t;int ret;if (*len !=sizeof (struct arpt_getinfo )) {
@@ -911,7 +911,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, {int ret;struct arpt_get_entries get; -struct arpt_table *t; +struct xt_table *t;if (*len <sizeof (get)) {duprintf ("get_entries: %u < %Zu\n" , *len,sizeof (get));
@@ -954,7 +954,7 @@ static int __do_replace(struct net *net, const char *name, void __user *counters_ptr) {int ret; -struct arpt_table *t; +struct xt_table *t;struct xt_table_info *oldinfo;struct xt_counters *counters;void *loc_cpu_old_entry;
@@ -1091,7 +1091,7 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,const char *name;int size;void *ptmp; -struct arpt_table *t; +struct xt_table *t;const struct xt_table_info *private;int ret =0 ;void *loc_cpu_entry;
@@ -1555,7 +1555,7 @@ out: }static int compat_copy_entries_to_user (unsigned int total_size, -struct arpt_table *table, +const struct xt_table *table,void __user *userptr) {struct xt_counters *counters;
@@ -1593,7 +1593,7 @@ static int compat_get_entries(struct net *net, {int ret;struct compat_arpt_get_entries get; -struct arpt_table *t; +const struct xt_table *t;if (*len <sizeof (get)) {duprintf ("compat_get_entries: %u < %zu\n" , *len,sizeof (get));
@@ -1723,9 +1723,8 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *lenreturn ret; } -struct arpt_table *arpt_register_table (struct net *net, -struct arpt_table *table, -const struct arpt_replace *repl) +struct xt_table *arpt_register_table (struct net *net,struct xt_table *table, +const struct arpt_replace *repl) {int ret;struct xt_table_info *newinfo;
@@ -1767,7 +1766,7 @@ out:return ERR_PTR (ret); } -void arpt_unregister_table (struct arpt_table *table) +void arpt_unregister_table (struct xt_table *table) {struct xt_table_info *private;void *loc_cpu_entry;
net/ipv4/netfilter/arptable_filter.c +1 -1
@@ -45,7 +45,7 @@ static struct .term = ARPT_ERROR_INIT, }; -static struct arpt_table packet_filter = { +static struct xt_table packet_filter = { .name ="filter" , .valid_hooks =FILTER_VALID_HOOKS , .lock =RW_LOCK_UNLOCKED ,
Signature · 1 line
1.5.4.4
Patrick McHardy
AppliedRe: [PATCH 07/29] [NETFILTER]: remove arpt_table indirection macro
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>
Applied, but this triggered some warnings caused by the constification patches I missed earlier:
net/ipv4/netfilter/arp_tables.c: In function 'compat_copy_entries_to_user':net/ipv4/netfilter/arp_tables.c:1569: warning: passing argument 1 of 'alloc_counters' discards qualifiers from pointer target type net/ipv4/netfilter/arp_tables.c: In function 'compat_get_entries':net/ipv4/netfilter/arp_tables.c:1628: warning: passing argument 1 of 'xt_table_unlock' discards qualifiers from pointer target type net/ipv4/netfilter/arp_tables.c: In function 'compat_copy_entries_to_user':net/ipv4/netfilter/arp_tables.c:1569: warning: passing argument 1 of 'alloc_counters' discards
Again, please test with CONFIG_COMPAT if you touch this code. I'm leaving for tonight, please send me a patch on top of the faulty one to fold in for fixing this.
Re: [PATCH 07/29] [NETFILTER]: remove arpt_table indirection macro
Quoted 13 lines · Patrick McHardy
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>Applied, but this triggered some warnings caused by the constification patches I missed earlier:
net/ipv4/netfilter/arp_tables.c: In function 'compat_copy_entries_to_user':net/ipv4/netfilter/arp_tables.c:1569: warning: passing argument 1 of 'alloc_counters' discards qualifiers from pointer target typenet/ipv4/netfilter/arp_tables.c: In function 'compat_get_entries':net/ipv4/netfilter/arp_tables.c:1628: warning: passing argument 1 of 'xt_table_unlock' discards qualifiers from pointer target typenet/ipv4/netfilter/arp_tables.c: In function 'compat_copy_entries_to_user':net/ipv4/netfilter/arp_tables.c:1569: warning: passing argument 1 of 'alloc_counters' discards
Quoted 3 lines
Again, please test with
CONFIG_COMPATif you touch this code. I'm leaving for tonight, please send me a patch on top of the faulty one to fold in for fixing this.
Right...
===
Signed-off-by Jan Engelhardt <[email protected]>
net/ipv4/netfilter/arp_tables.c +3 -3
@@ -737,7 +737,7 @@ static int copy_entries_to_user(unsigned int total_size,unsigned int off, num;struct arpt_entry *e;struct xt_counters *counters; -const struct xt_table_info *private = table->private; +struct xt_table_info *private = table->private;int ret =0 ;void *loc_cpu_entry;
@@ -1555,7 +1555,7 @@ out: }static int compat_copy_entries_to_user (unsigned int total_size, -const struct xt_table *table, +struct xt_table *table,void __user *userptr) {struct xt_counters *counters;
@@ -1593,7 +1593,7 @@ static int compat_get_entries(struct net *net, {int ret;struct compat_arpt_get_entries get; -const struct xt_table *t; +struct xt_table *t;if (*len <sizeof (get)) {duprintf ("compat_get_entries: %u < %zu\n" , *len,sizeof (get));
Re: [PATCH 07/29] [NETFILTER]: remove arpt_table indirection macro
Quoted 15 lines · Jan Engelhardt
Quoted 13 lines · Patrick McHardy
Quoted 1 line · Jan Engelhardt
Signed-off-by Jan Engelhardt <[email protected]>Applied, but this triggered some warnings caused by the constification patches I missed earlier:
net/ipv4/netfilter/arp_tables.c: In function 'compat_copy_entries_to_user':net/ipv4/netfilter/arp_tables.c:1569: warning: passing argument 1 of 'alloc_counters' discards qualifiers from pointer target typenet/ipv4/netfilter/arp_tables.c: In function 'compat_get_entries':net/ipv4/netfilter/arp_tables.c:1628: warning: passing argument 1 of 'xt_table_unlock' discards qualifiers from pointer target typenet/ipv4/netfilter/arp_tables.c: In function 'compat_copy_entries_to_user':net/ipv4/netfilter/arp_tables.c:1569: warning: passing argument 1 of 'alloc_counters' discards
Quoted 5 lines
Quoted 3 lines
Again, please test with
CONFIG_COMPATif you touch this code. I'm leaving for tonight, please send me a patch on top of the faulty one to fold in for fixing this.Right...
Does not apply on top of 7/29:
patching file net/ipv4/netfilter/arp_tables.c
Hunk #1 FAILED at 737.
Hunk #2 FAILED at 1555.
Hunk #3 FAILED at 1593.
3 out of 3 hunks FAILED -- saving rejects to file net/ipv4/netfilter/arp_tables.c.rej
Re: [PATCH 07/29] [NETFILTER]: remove arpt_table indirection macro
Quoted 3 lines · Patrick McHardy
Does not apply on top of 7/29:
That is strange, I used git checkout -b arpfixup d77e5bac to create it, and verifying it with doing the same and git-apply arpfixup.diff comes out without any rejects. The tree is even based on yours.
...
49de6a3... [NETFILTER]: remove ARPT_{STANDARD,ERROR}_TARGET indirection macro 9091e49... [NETFILTER]: remove arpt_target indirection macro
-> d77e5ba... [NETFILTER]: remove arpt_table indirection macro
af437bf... [NETFILTER]: Use unsigned types for hooknum and pf vars 28d915e... [NETFILTER]: annotate rest of nf_nat_* with const ff0e677... [NETFILTER]: annotate rest of nf_conntrack_* with const 38d2cb1... [NETFILTER]: annotate {arp,ip,ip6,x}tables with const 4a129f3... [NETFILTER]: annotate xtables targets with const and remove casts 720350a... [NETFILTER]: xt_sctp: simplify xt_sctp.h
5ada5a1... [NETFILTER]: nf_conntrack_sip: update copyright
...
Quoted 6 lines
patching file
net/ipv4/netfilter/arp_tables.c
Hunk #1 FAILED at 737.
Hunk #2 FAILED at 1555.
Hunk #3 FAILED at 1593.
3 out of 3 hunks FAILED -- saving rejects to filenet/ipv4/netfilter/arp_tables.c.rej
PATCH 8/29 : remove arpt_target indirection macro
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 1 - net/ipv4/netfilter/arp_tables.c | 8 ++++---- net/ipv4/netfilter/arpt_mangle.c | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-)
include/linux/netfilter_arp/arp_tables.h +0 -1
@@ -23,7 +23,6 @@#define ARPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN#define ARPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN -#define arpt_target xt_target#define ARPT_DEV_ADDR_LEN_MAX 16
net/ipv4/netfilter/arp_tables.c +4 -4
@@ -457,7 +457,7 @@ static inline int check_entry(struct arpt_entry *e, const char *name)static inline int check_target (struct arpt_entry *e,const char *name) {struct arpt_entry_target *t; -struct arpt_target *target; +struct xt_target *target;int ret; t =arpt_get_target (e);
@@ -480,7 +480,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, unsigned int *i) {struct arpt_entry_target *t; -struct arpt_target *target; +struct xt_target *target;int ret; ret =check_entry (e, name);
@@ -1784,7 +1784,7 @@ void arpt_unregister_table(struct xt_table *table) }/* The built-in targets: standard (NULL) and error. */ -static struct arpt_target arpt_standard_target__read_mostly = { +static struct xt_target arpt_standard_target__read_mostly = { .name =ARPT_STANDARD_TARGET , .targetsize =sizeof (int ), .family =NF_ARP ,
@@ -1795,7 +1795,7 @@ static struct arpt_target arpt_standard_target __read_mostly = {#endif }; -static struct arpt_target arpt_error_target__read_mostly = { +static struct xt_target arpt_error_target__read_mostly = { .name =ARPT_ERROR_TARGET , .target = arpt_error, .targetsize =ARPT_FUNCTION_MAXNAMELEN ,
net/ipv4/netfilter/arpt_mangle.c +1 -1
@@ -73,7 +73,7 @@ checkentry(const char *tablename, const void *e, const struct xt_target *target,return true; } -static struct arpt_target arpt_mangle_reg__read_mostly = { +static struct xt_target arpt_mangle_reg__read_mostly = { .name ="mangle" , .target = target, .targetsize =sizeof (struct arpt_mangle ),
Signature · 1 line
1.5.4.4
PATCH 9/29 : remove ARPT_{STANDARD,ERROR}_TARGET indirection macro
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 9 ++------- net/ipv4/netfilter/arp_tables.c | 8 ++++---- 2 files changed, 6 insertions(+), 11 deletions(-)
include/linux/netfilter_arp/arp_tables.h +2 -7
@@ -203,11 +203,6 @@ struct arpt_get_entriesstruct arpt_entry entrytable[0 ]; }; -/* Standard return verdict, or do jump. */ -#define ARPT_STANDARD_TARGET XT_STANDARD_TARGET -/* Error verdict. */ -#define ARPT_ERROR_TARGET XT_ERROR_TARGET -/* Helper functions */ static __inline__struct arpt_entry_target *arpt_get_target (struct arpt_entry *e) {
@@ -251,7 +246,7 @@ struct arpt_error#define ARPT_STANDARD_INIT (__verdict) \ { \ .entry = ARPT_ENTRY_INIT(sizeof(struct arpt_standard)), \ - .target = XT_TARGET_INIT(ARPT_STANDARD_TARGET, \ + .target = XT_TARGET_INIT(XT_STANDARD_TARGET, \ sizeof(struct arpt_standard_target)), \ .target.verdict = -(__verdict) - 1, \ }
@@ -259,7 +254,7 @@ struct arpt_error#define ARPT_ERROR_INIT \ { \ .entry = ARPT_ENTRY_INIT(sizeof(struct arpt_error)), \ - .target = XT_TARGET_INIT(ARPT_ERROR_TARGET, \ + .target = XT_TARGET_INIT(XT_ERROR_TARGET, \ sizeof(struct arpt_error_target)), \ .target.errorname = "ERROR", \ }
net/ipv4/netfilter/arp_tables.c +4 -4
@@ -367,7 +367,7 @@ static int mark_source_chains(struct xt_table_info *newinfo,/* Unconditional return/END. */ if ((e->target_offset ==sizeof (struct arpt_entry ) && (strcmp (t->target.u.user.name, -ARPT_STANDARD_TARGET ) ==0 ) +XT_STANDARD_TARGET ) ==0 ) && t->verdict <0 &&unconditional (&e->arp)) || visited) {unsigned int oldpos, size;
@@ -406,7 +406,7 @@ static int mark_source_chains(struct xt_table_info *newinfo,int newpos = t->verdict;if (strcmp (t->target.u.user.name, -ARPT_STANDARD_TARGET ) ==0 +XT_STANDARD_TARGET ) ==0 && newpos >=0 ) {if (newpos > newinfo->size -sizeof (struct arpt_entry )) {
@@ -1785,7 +1785,7 @@ void arpt_unregister_table(struct xt_table *table)/* The built-in targets: standard (NULL) and error. */ static struct xt_target arpt_standard_target__read_mostly = { - .name =ARPT_STANDARD_TARGET , + .name =XT_STANDARD_TARGET , .targetsize =sizeof (int ), .family =NF_ARP , #ifdef CONFIG_COMPAT
@@ -1796,7 +1796,7 @@ static struct xt_target arpt_standard_target __read_mostly = { };static struct xt_target arpt_error_target__read_mostly = { - .name =ARPT_ERROR_TARGET , + .name =XT_ERROR_TARGET , .target = arpt_error, .targetsize =ARPT_FUNCTION_MAXNAMELEN , .family =NF_ARP ,
Signature · 1 line
1.5.4.4
PATCH 10/29 : remove unused ARPT_ALIGN indirection macros
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-)
include/linux/netfilter_arp/arp_tables.h +0 -4
@@ -274,8 +274,6 @@ extern unsigned int arpt_do_table(struct sk_buff *skb,const struct net_device *out, struct xt_table *table); -#define ARPT_ALIGN (s) XT_ALIGN(s) -#ifdef CONFIG_COMPAT #include <net/compat.h>
@@ -295,8 +293,6 @@ compat_arpt_get_target(struct compat_arpt_entry *e)return (void *)e + e->target_offset; } -#define COMPAT_ARPT_ALIGN (s) COMPAT_XT_ALIGN(s) -/* fn returns 0 to continue iteration */ #define COMPAT_ARPT_ENTRY_ITERATE(entries, size, fn, args...) \ XT_ENTRY_ITERATE(struct compat_arpt_entry, entries, size, fn, ## args)
Signature · 1 line
1.5.4.4
PATCH 11/29 : remove arpt_(un)register_target indirection macros
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 5 ----- net/ipv4/netfilter/arpt_mangle.c | 8 +++----- 2 files changed, 3 insertions(+), 10 deletions(-)
include/linux/netfilter_arp/arp_tables.h +0 -5
@@ -259,11 +259,6 @@ struct arpt_error .target.errorname = "ERROR", \ } -#define arpt_register_target (tgt) \ -({ (tgt)->family = NF_ARP; \ - xt_register_target(tgt); }) -#define arpt_unregister_target (tgt) xt_unregister_target(tgt) -extern struct xt_table *arpt_register_table (struct net *net,struct xt_table *table,const struct arpt_replace *repl);
net/ipv4/netfilter/arpt_mangle.c +3 -5
@@ -75,6 +75,7 @@ checkentry(const char *tablename, const void *e, const struct xt_target *target,static struct xt_target arpt_mangle_reg__read_mostly = { .name ="mangle" , + .family =NF_ARP , .target = target, .targetsize =sizeof (struct arpt_mangle ), .checkentry = checkentry,
@@ -83,15 +84,12 @@ static struct xt_target arpt_mangle_reg __read_mostly = {static int __init arpt_mangle_init (void ) { -if (arpt_register_target (&arpt_mangle_reg)) -return -EINVAL ; - -return 0 ; +return xt_register_target (&arpt_mangle_reg); } static void __exit arpt_mangle_fini(void) { -arpt_unregister_target (&arpt_mangle_reg); +xt_unregister_target (&arpt_mangle_reg); }module_init (arpt_mangle_init);
Signature · 1 line
1.5.4.4
PATCH 12/29 : remove ARPT_{CONTINUE,RETURN} indirection macros
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 6 ------ net/ipv4/netfilter/arp_tables.c | 6 +++--- net/ipv4/netfilter/arpt_mangle.c | 2 +- 3 files changed, 4 insertions(+), 10 deletions(-)
include/linux/netfilter_arp/arp_tables.h +0 -6
@@ -125,12 +125,6 @@ struct arpt_entry#define ARPT_SO_GET_REVISION_TARGET (ARPT_BASE_CTL + 3)#define ARPT_SO_GET_MAX (ARPT_SO_GET_REVISION_TARGET) -/* CONTINUE verdict for targets */ -#define ARPT_CONTINUE XT_CONTINUE - -/* For standard target */ -#define ARPT_RETURN XT_RETURN -/* The argument to ARPT_SO_GET_INFO */ struct arpt_getinfo {
net/ipv4/netfilter/arp_tables.c +3 -3
@@ -264,7 +264,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, v = ((struct arpt_standard_target *)t)->verdict;if (v <0 ) {/* Pop from stack? */ -if (v !=ARPT_RETURN ) { +if (v !=XT_RETURN ) { verdict = (unsigned )(-v) -1 ;break ; }
@@ -299,7 +299,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,/* Target might have changed stuff. */ arp =arp_hdr (skb); -if (verdict ==ARPT_CONTINUE ) +if (verdict ==XT_CONTINUE ) e = (void *)e + e->next_offset;else /* Verdict */
@@ -542,7 +542,7 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, }/* FIXME: underflows must be unconditional, standard verdicts -< 0 (not ARPT_RETURN). --RR */ +< 0 (not XT_RETURN). --RR */ /* Clear counters and comefrom */ e->counters = ((struct xt_counters ) {0 ,0 });
net/ipv4/netfilter/arpt_mangle.c +1 -1
@@ -68,7 +68,7 @@ checkentry(const char *tablename, const void *e, const struct xt_target *target,return false;if (mangle->target !=NF_DROP && mangle->target !=NF_ACCEPT && - mangle->target !=ARPT_CONTINUE ) + mangle->target !=XT_CONTINUE )return false;return true; }
Signature · 1 line
1.5.4.4
PATCH 13/29 : remove ARPT_{CONTINUE,RETURN} indirection macros
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp/arp_tables.h | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-)
include/linux/netfilter_arp/arp_tables.h +0 -4
@@ -180,10 +180,6 @@ struct arpt_replacestruct arpt_entry entries[0 ]; }; -/* The argument to ARPT_SO_ADD_COUNTERS. */ -#define arpt_counters_info xt_counters_info -#define arpt_counters xt_counters -/* The argument to ARPT_SO_GET_ENTRIES. */ struct arpt_get_entries {
Signature · 1 line
1.5.4.4
PATCH 14/29 : rename NF_ARP to AF_ARP and assign a non-clashing value
In reply to Jan EngelhardtFor coming Xtables patches, we want to use AF_UNSPEC, but NF_ARP currently evaluates to the same value so it gets changed.
Signed-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_arp.h | 3 - include/linux/socket.h | 1 + net/bridge/br_netfilter.c | 2 +- net/ipv4/arp.c | 4 +- net/ipv4/netfilter/arp_tables.c | 56 +++++++++++++------------- net/ipv4/netfilter/arpt_mangle.c | 2 +- net/ipv4/netfilter/arptable_filter.c | 8 ++-- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/netfilter/x_tables.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- 10 files changed, 40 insertions(+), 42 deletions(-)
include/linux/netfilter_arp.h +0 -3
@@ -7,9 +7,6 @@#include <linux/netfilter.h> -/* There is no PF_ARP. */ -#define NF_ARP 0 -/* ARP Hooks */ #define NF_ARP_IN 0#define NF_ARP_OUT 1
include/linux/socket.h +1 -0
@@ -179,6 +179,7 @@ struct ucred {#define AF_ASH 18/* Ash */ #define AF_ECONET 19/* Acorn Econet */ #define AF_ATMSVC 20/* ATM SVCs */ +#define AF_ARP 21/* Address Resolution for IPv4 */ #define AF_SNA 22/* Linux SNA Project (nutters!) */ #define AF_IRDA 23/* IRDA sockets */ #define AF_PPPOX 24/* PPPoX sockets */
net/bridge/br_netfilter.c +1 -1
@@ -711,7 +711,7 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,return NF_ACCEPT ; } *d = (struct net_device *)in; -NF_HOOK (NF_ARP ,NF_ARP_FORWARD , skb, (struct net_device *)in, +NF_HOOK (AF_ARP ,NF_ARP_FORWARD , skb, (struct net_device *)in, (struct net_device *)out, br_nf_forward_finish);return NF_STOLEN ;
net/ipv4/arp.c +2 -2
@@ -664,7 +664,7 @@ out:void arp_xmit (struct sk_buff *skb) {/* Send it off, maybe filter it using firewalling first. */ -NF_HOOK (NF_ARP ,NF_ARP_OUT , skb,NULL , skb->dev, dev_queue_xmit); +NF_HOOK (AF_ARP ,NF_ARP_OUT , skb,NULL , skb->dev, dev_queue_xmit); }/*
@@ -929,7 +929,7 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,memset (NEIGH_CB (skb),0 ,sizeof (struct neighbour_cb )); -return NF_HOOK (NF_ARP ,NF_ARP_IN , skb, dev,NULL , arp_process); +return NF_HOOK (AF_ARP ,NF_ARP_IN , skb, dev,NULL , arp_process); freeskb:kfree_skb (skb);
net/ipv4/netfilter/arp_tables.c +28 -28
198 lines not on this page · raw message
net/ipv4/netfilter/arpt_mangle.c +1 -1
@@ -75,7 +75,7 @@ checkentry(const char *tablename, const void *e, const struct xt_target *target,static struct xt_target arpt_mangle_reg__read_mostly = { .name ="mangle" , - .family =NF_ARP , + .family =AF_ARP , .target = target, .targetsize =sizeof (struct arpt_mangle ), .checkentry = checkentry,
net/ipv4/netfilter/arptable_filter.c +4 -4
@@ -51,7 +51,7 @@ static struct xt_table packet_filter = { .lock = RW_LOCK_UNLOCKED, .private = NULL, .me = THIS_MODULE, - .af = NF_ARP, + .af = AF_ARP, };/* The work comes in here from netfilter.c */
@@ -68,19 +68,19 @@ static struct nf_hook_ops arpt_ops[] __read_mostly = { { .hook = arpt_hook, .owner = THIS_MODULE, - .pf = NF_ARP, + .pf = AF_ARP, .hooknum = NF_ARP_IN, }, { .hook = arpt_hook, .owner = THIS_MODULE, - .pf = NF_ARP, + .pf = AF_ARP, .hooknum = NF_ARP_OUT, }, { .hook = arpt_hook, .owner = THIS_MODULE, - .pf = NF_ARP, + .pf = AF_ARP, .hooknum = NF_ARP_FORWARD, }, };
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
@@ -546,7 +546,7 @@ arp_mangle(unsigned int hook,static struct nf_hook_ops cip_arp_ops__read_mostly = { .hook = arp_mangle, - .pf =NF_ARP , + .pf =AF_ARP , .hooknum =NF_ARP_OUT , .priority =-1 };
net/netfilter/x_tables.c +1 -1
@@ -61,7 +61,7 @@ static struct xt_af *xt;static const char *const xt_prefix[NPROTO ] = { [AF_INET ] ="ip" , [AF_INET6 ] ="ip6" , - [NF_ARP ] ="arp" , + [AF_ARP ] ="arp" , };/* Registration hooks for targets. */
net/netfilter/xt_NFQUEUE.c +1 -1
@@ -50,7 +50,7 @@ static struct xt_target nfqueue_tg_reg[] __read_mostly = { }, { .name = "NFQUEUE", - .family = NF_ARP, + .family = AF_ARP, .target = nfqueue_tg, .targetsize = sizeof(struct xt_NFQ_info), .me = THIS_MODULE,
Signature · 1 line
1.5.4.4
PATCH 15/29 : Implement AF_UNSPEC as a wildcard for extensions
In reply to Jan EngelhardtWhen a match or target is looked up using xt_find_{match,target}, Xtables will also search the AF_UNSPEC module list. This allows for extensions to be reused from other components (e.g. arptables, ebtables).
Extensions that take different codepaths depending on match->family or target->family of course cannot use AF_UNSPEC within the registration structure (e.g. xt_pkttype).
Signed-off-by Jan Engelhardt <[email protected]>
--- net/netfilter/x_tables.c | 11 +++++++++ net/netfilter/xt_CLASSIFY.c | 38 ++++++++++---------------------- net/netfilter/xt_MARK.c | 10 +------- net/netfilter/xt_RATEEST.c | 33 +++++++++------------------ net/netfilter/xt_SECMARK.c | 35 ++++++++++------------------- net/netfilter/xt_TRACE.c | 27 ++++++++-------------- net/netfilter/xt_limit.c | 40 +++++++++++----------------------- net/netfilter/xt_mark.c | 26 +-------------------- net/netfilter/xt_quota.c | 29 ++++++++---------------- net/netfilter/xt_rateest.c | 33 +++++++++------------------ net/netfilter/xt_statistic.c | 31 ++++++++----------------- net/netfilter/xt_string.c | 32 +++++++++----------------- net/netfilter/xt_time.c | 28 +++++++---------------- net/netfilter/xt_u32.c | 26 +++++++-------------- 14 files changed, 132 insertions(+), 267 deletions(-)
net/netfilter/x_tables.c +11 -0
@@ -59,6 +59,7 @@ static struct xt_af *xt;#endif static const char *const xt_prefix[NPROTO ] = { + [AF_UNSPEC ] ="x" , [AF_INET ] ="ip" , [AF_INET6 ] ="ip6" , [AF_ARP ] ="arp" ,
@@ -207,6 +208,11 @@ struct xt_match *xt_find_match(unsigned int af, const char *name, u8 revision) } }mutex_unlock (&xt[af].mutex); + +if (af !=AF_UNSPEC ) +/* Try searching again in the family-independent list */ +return xt_find_match (AF_UNSPEC , name, revision); +return ERR_PTR (err); }EXPORT_SYMBOL (xt_find_match);
@@ -232,6 +238,11 @@ struct xt_target *xt_find_target(unsigned int af, const char *name, u8 revision) } }mutex_unlock (&xt[af].mutex); + +if (af !=AF_UNSPEC ) +/* Try searching again in the family-independent list */ +return xt_find_target (AF_UNSPEC , name, revision); +return ERR_PTR (err); }EXPORT_SYMBOL (xt_find_target);
net/netfilter/xt_CLASSIFY.c +12 -26
@@ -37,40 +37,26 @@ classify_tg(struct sk_buff *skb, const struct net_device *in,return XT_CONTINUE ; } -static struct xt_target classify_tg_reg[]__read_mostly = { - { - .family =AF_INET , - .name ="CLASSIFY" , - .target = classify_tg, - .targetsize =sizeof (struct xt_classify_target_info ), - .table ="mangle" , - .hooks = (1 <<NF_INET_LOCAL_OUT ) | - (1 <<NF_INET_FORWARD ) | - (1 <<NF_INET_POST_ROUTING ), - .me =THIS_MODULE , - }, - { - .name ="CLASSIFY" , - .family =AF_INET6 , - .target = classify_tg, - .targetsize =sizeof (struct xt_classify_target_info ), - .table ="mangle" , - .hooks = (1 <<NF_INET_LOCAL_OUT ) | - (1 <<NF_INET_FORWARD ) | - (1 <<NF_INET_POST_ROUTING ), - .me =THIS_MODULE , - }, +static struct xt_target classify_tg_reg__read_mostly = { + .name ="CLASSIFY" , + .revision =0 , + .family =AF_UNSPEC , + .table ="mangle" , + .hooks = (1 <<NF_INET_LOCAL_OUT ) | (1 <<NF_INET_FORWARD ) | + (1 <<NF_INET_POST_ROUTING ), + .target = classify_tg, + .targetsize =sizeof (struct xt_classify_target_info ), + .me =THIS_MODULE , };static int __init classify_tg_init (void ) { -return xt_register_targets (classify_tg_reg, -ARRAY_SIZE (classify_tg_reg)); +return xt_register_target (&classify_tg_reg); } static void __exit classify_tg_exit(void) { -xt_unregister_targets (classify_tg_reg,ARRAY_SIZE (classify_tg_reg)); +xt_unregister_target (&classify_tg_reg); }module_init (classify_tg_init);
net/netfilter/xt_MARK.c +1 -9
@@ -222,15 +222,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = { { .name = "MARK", .revision = 2, - .family = AF_INET, - .target = mark_tg, - .targetsize = sizeof(struct xt_mark_tginfo2), - .me = THIS_MODULE, - }, - { - .name = "MARK", - .revision = 2, - .family = AF_INET6, + .family = AF_UNSPEC, .target = mark_tg, .targetsize = sizeof(struct xt_mark_tginfo2), .me = THIS_MODULE,
net/netfilter/xt_RATEEST.c +11 -22
@@ -157,25 +157,15 @@ static void xt_rateest_tg_destroy(const struct xt_target *target,xt_rateest_put (info->est); } -static struct xt_target xt_rateest_target[]__read_mostly = { - { - .family =AF_INET , - .name ="RATEEST" , - .target = xt_rateest_tg, - .checkentry = xt_rateest_tg_checkentry, - .destroy = xt_rateest_tg_destroy, - .targetsize =sizeof (struct xt_rateest_target_info ), - .me =THIS_MODULE , - }, - { - .family =AF_INET6 , - .name ="RATEEST" , - .target = xt_rateest_tg, - .checkentry = xt_rateest_tg_checkentry, - .destroy = xt_rateest_tg_destroy, - .targetsize =sizeof (struct xt_rateest_target_info ), - .me =THIS_MODULE , - }, +static struct xt_target xt_rateest_tg_reg__read_mostly = { + .name ="RATEEST" , + .revision =0 , + .family =AF_UNSPEC , + .target = xt_rateest_tg, + .checkentry = xt_rateest_tg_checkentry, + .destroy = xt_rateest_tg_destroy, + .targetsize =sizeof (struct xt_rateest_target_info ), + .me =THIS_MODULE , };static int __init xt_rateest_tg_init (void )
@@ -186,13 +176,12 @@ static int __init xt_rateest_tg_init(void)INIT_HLIST_HEAD (&rateest_hash[i]);get_random_bytes (&jhash_rnd,sizeof (jhash_rnd)); -return xt_register_targets (xt_rateest_target, -ARRAY_SIZE (xt_rateest_target)); +return xt_register_target (&xt_rateest_tg_reg); } static void __exit xt_rateest_tg_fini(void) { -xt_unregister_targets (xt_rateest_target,ARRAY_SIZE (xt_rateest_target)); +xt_unregister_target (&xt_rateest_tg_reg); }
net/netfilter/xt_SECMARK.c +12 -23
@@ -119,37 +119,26 @@ static void secmark_tg_destroy(const struct xt_target *target, void *targinfo) } } -static struct xt_target secmark_tg_reg[]__read_mostly = { - { - .name ="SECMARK" , - .family =AF_INET , - .checkentry = secmark_tg_check, - .destroy = secmark_tg_destroy, - .target = secmark_tg, - .targetsize =sizeof (struct xt_secmark_target_info ), - .table ="mangle" , - .me =THIS_MODULE , - }, - { - .name ="SECMARK" , - .family =AF_INET6 , - .checkentry = secmark_tg_check, - .destroy = secmark_tg_destroy, - .target = secmark_tg, - .targetsize =sizeof (struct xt_secmark_target_info ), - .table ="mangle" , - .me =THIS_MODULE , - }, +static struct xt_target secmark_tg_reg__read_mostly = { + .name ="SECMARK" , + .revision =0 , + .family =AF_UNSPEC , + .table ="mangle" , + .target = secmark_tg, + .checkentry = secmark_tg_check, + .destroy = secmark_tg_destroy, + .targetsize =sizeof (struct xt_secmark_target_info ), + .me =THIS_MODULE , };static int __init secmark_tg_init (void ) { -return xt_register_targets (secmark_tg_reg,ARRAY_SIZE (secmark_tg_reg)); +return xt_register_target (&secmark_tg_reg); } static void __exit secmark_tg_exit(void) { -xt_unregister_targets (secmark_tg_reg,ARRAY_SIZE (secmark_tg_reg)); +xt_unregister_target (&secmark_tg_reg); }module_init (secmark_tg_init);
net/netfilter/xt_TRACE.c +10 -17
@@ -19,31 +19,24 @@ trace_tg(struct sk_buff *skb, const struct net_device *in,return XT_CONTINUE ; } -static struct xt_target trace_tg_reg[]__read_mostly = { - { - .name ="TRACE" , - .family =AF_INET , - .target = trace_tg, - .table ="raw" , - .me =THIS_MODULE , - }, - { - .name ="TRACE" , - .family =AF_INET6 , - .target = trace_tg, - .table ="raw" , - .me =THIS_MODULE , - }, +static struct xt_target trace_tg_reg__read_mostly = { + .name ="TRACE" , + .revision =0 , + .family =AF_UNSPEC , + .table ="raw" , + .target = trace_tg, + .targetsize =XT_ALIGN (0 ), + .me =THIS_MODULE , };static int __init trace_tg_init (void ) { -return xt_register_targets (trace_tg_reg,ARRAY_SIZE (trace_tg_reg)); +return xt_register_target (&trace_tg_reg); } static void __exit trace_tg_exit(void) { -xt_unregister_targets (trace_tg_reg,ARRAY_SIZE (trace_tg_reg)); +xt_unregister_target (&trace_tg_reg); }module_init (trace_tg_init);
net/netfilter/xt_limit.c +13 -27
@@ -167,43 +167,29 @@ static int limit_mt_compat_to_user(void __user *dst, void *src) }#endif /* CONFIG_COMPAT */ -static struct xt_match limit_mt_reg[]__read_mostly = { - { - .name ="limit" , - .family =AF_INET , - .checkentry = limit_mt_check, - .match = limit_mt, - .matchsize =sizeof (struct xt_rateinfo ), +static struct xt_match limit_mt_reg__read_mostly = { + .name ="limit" , + .revision =0 , + .family =AF_UNSPEC , + .match = limit_mt, + .checkentry = limit_mt_check, + .matchsize =sizeof (struct xt_rateinfo ), #ifdef CONFIG_COMPAT - .compatsize =sizeof (struct compat_xt_rateinfo ), - .compat_from_user = limit_mt_compat_from_user, - .compat_to_user = limit_mt_compat_to_user, + .compatsize =sizeof (struct compat_xt_rateinfo ), + .compat_from_user = limit_mt_compat_from_user, + .compat_to_user = limit_mt_compat_to_user, #endif - .me =THIS_MODULE , - }, - { - .name ="limit" , - .family =AF_INET6 , - .checkentry = limit_mt_check, - .match = limit_mt, - .matchsize =sizeof (struct xt_rateinfo ), -#ifdef CONFIG_COMPAT - .compatsize =sizeof (struct compat_xt_rateinfo ), - .compat_from_user = limit_mt_compat_from_user, - .compat_to_user = limit_mt_compat_to_user, -#endif - .me =THIS_MODULE , - }, + .me =THIS_MODULE , };static int __init limit_mt_init (void ) { -return xt_register_matches (limit_mt_reg,ARRAY_SIZE (limit_mt_reg)); +return xt_register_match (&limit_mt_reg); } static void __exit limit_mt_exit(void) { -xt_unregister_matches (limit_mt_reg,ARRAY_SIZE (limit_mt_reg)); +xt_unregister_match (&limit_mt_reg); }module_init (limit_mt_init);
net/netfilter/xt_mark.c +2 -24
@@ -92,7 +92,7 @@ static struct xt_match mark_mt_reg[] __read_mostly = { { .name = "mark", .revision = 0, - .family = AF_INET, + .family = AF_UNSPEC, .checkentry = mark_mt_check_v0, .match = mark_mt_v0, .matchsize = sizeof(struct xt_mark_info),
@@ -104,31 +104,9 @@ static struct xt_match mark_mt_reg[] __read_mostly = { .me = THIS_MODULE, }, { - .name = "mark", - .revision = 0, - .family = AF_INET6, - .checkentry = mark_mt_check_v0, - .match = mark_mt_v0, - .matchsize =sizeof (struct xt_mark_info ), -#ifdef CONFIG_COMPAT - .compatsize =sizeof (struct compat_xt_mark_info ), - .compat_from_user = mark_mt_compat_from_user_v0, - .compat_to_user = mark_mt_compat_to_user_v0, -#endif - .me = THIS_MODULE, - }, - { - .name ="mark" , - .revision = 1, - .family = AF_INET, - .match = mark_mt, - .matchsize = sizeof(struct xt_mark_mtinfo1), - .me = THIS_MODULE, - }, - { .name = "mark", .revision = 1, - .family = AF_INET6, + .family = AF_UNSPEC, .match = mark_mt, .matchsize = sizeof(struct xt_mark_mtinfo1), .me = THIS_MODULE,
net/netfilter/xt_quota.c +10 -19
@@ -54,33 +54,24 @@ quota_mt_check(const char *tablename, const void *entry,return true; } -static struct xt_match quota_mt_reg[]__read_mostly = { - { - .name ="quota" , - .family =AF_INET , - .checkentry = quota_mt_check, - .match = quota_mt, - .matchsize =sizeof (struct xt_quota_info ), - .me =THIS_MODULE - }, - { - .name ="quota" , - .family =AF_INET6 , - .checkentry = quota_mt_check, - .match = quota_mt, - .matchsize =sizeof (struct xt_quota_info ), - .me =THIS_MODULE - }, +static struct xt_match quota_mt_reg__read_mostly = { + .name ="quota" , + .revision =0 , + .family =AF_UNSPEC , + .match = quota_mt, + .checkentry = quota_mt_check, + .matchsize =sizeof (struct xt_quota_info ), + .me =THIS_MODULE , };static int __init quota_mt_init (void ) { -return xt_register_matches (quota_mt_reg,ARRAY_SIZE (quota_mt_reg)); +return xt_register_match ("a_mt_reg); } static void __exit quota_mt_exit(void) { -xt_unregister_matches (quota_mt_reg,ARRAY_SIZE (quota_mt_reg)); +xt_unregister_match ("a_mt_reg); }module_init (quota_mt_init);
net/netfilter/xt_rateest.c +11 -22
@@ -137,36 +137,25 @@ static void xt_rateest_mt_destroy(const struct xt_match *match,xt_rateest_put (info->est2); } -static struct xt_match xt_rateest_match[]__read_mostly = { - { - .family =AF_INET , - .name ="rateest" , - .match = xt_rateest_mt, - .checkentry = xt_rateest_mt_checkentry, - .destroy = xt_rateest_mt_destroy, - .matchsize =sizeof (struct xt_rateest_match_info ), - .me =THIS_MODULE , - }, - { - .family =AF_INET6 , - .name ="rateest" , - .match = xt_rateest_mt, - .checkentry = xt_rateest_mt_checkentry, - .destroy = xt_rateest_mt_destroy, - .matchsize =sizeof (struct xt_rateest_match_info ), - .me =THIS_MODULE , - }, +static struct xt_match xt_rateest_mt_reg__read_mostly = { + .name ="rateest" , + .revision =0 , + .family =AF_UNSPEC , + .match = xt_rateest_mt, + .checkentry = xt_rateest_mt_checkentry, + .destroy = xt_rateest_mt_destroy, + .matchsize =sizeof (struct xt_rateest_match_info ), + .me =THIS_MODULE , };static int __init xt_rateest_mt_init (void ) { -return xt_register_matches (xt_rateest_match, -ARRAY_SIZE (xt_rateest_match)); +return xt_register_match (&xt_rateest_mt_reg); } static void __exit xt_rateest_mt_fini(void) { -xt_unregister_matches (xt_rateest_match,ARRAY_SIZE (xt_rateest_match)); +xt_unregister_match (&xt_rateest_mt_reg); }MODULE_AUTHOR ("Patrick McHardy <[email protected]>" );
net/netfilter/xt_statistic.c +10 -21
@@ -66,35 +66,24 @@ statistic_mt_check(const char *tablename, const void *entry,return true; } -static struct xt_match statistic_mt_reg[]__read_mostly = { - { - .name ="statistic" , - .family =AF_INET , - .checkentry = statistic_mt_check, - .match = statistic_mt, - .matchsize =sizeof (struct xt_statistic_info ), - .me =THIS_MODULE , - }, - { - .name ="statistic" , - .family =AF_INET6 , - .checkentry = statistic_mt_check, - .match = statistic_mt, - .matchsize =sizeof (struct xt_statistic_info ), - .me =THIS_MODULE , - }, +static struct xt_match xt_statistic_mt_reg__read_mostly = { + .name ="statistic" , + .revision =0 , + .family =AF_UNSPEC , + .match = statistic_mt, + .checkentry = statistic_mt_check, + .matchsize =sizeof (struct xt_statistic_info ), + .me =THIS_MODULE , };static int __init statistic_mt_init (void ) { -return xt_register_matches (statistic_mt_reg, -ARRAY_SIZE (statistic_mt_reg)); +return xt_register_match (&xt_statistic_mt_reg); } static void __exit statistic_mt_exit(void) { -xt_unregister_matches (statistic_mt_reg, -ARRAY_SIZE (statistic_mt_reg)); +xt_unregister_match (&xt_statistic_mt_reg); }module_init (statistic_mt_init);
net/netfilter/xt_string.c +11 -21
@@ -69,35 +69,25 @@ static void string_mt_destroy(const struct xt_match *match, void *matchinfo)textsearch_destroy (STRING_TEXT_PRIV (matchinfo)->config); } -static struct xt_match string_mt_reg[]__read_mostly = { - { - .name ="string" , - .family =AF_INET , - .checkentry = string_mt_check, - .match = string_mt, - .destroy = string_mt_destroy, - .matchsize =sizeof (struct xt_string_info ), - .me =THIS_MODULE - }, - { - .name ="string" , - .family =AF_INET6 , - .checkentry = string_mt_check, - .match = string_mt, - .destroy = string_mt_destroy, - .matchsize =sizeof (struct xt_string_info ), - .me =THIS_MODULE - }, +static struct xt_match xt_string_mt_reg__read_mostly = { + .name ="string" , + .revision =0 , + .family =AF_UNSPEC , + .match = string_mt, + .checkentry = string_mt_check, + .destroy = string_mt_destroy, + .matchsize =sizeof (struct xt_string_info ), + .me =THIS_MODULE , };static int __init string_mt_init (void ) { -return xt_register_matches (string_mt_reg,ARRAY_SIZE (string_mt_reg)); +return xt_register_match (&xt_string_mt_reg); } static void __exit string_mt_exit(void) { -xt_unregister_matches (string_mt_reg,ARRAY_SIZE (string_mt_reg)); +xt_unregister_match (&xt_string_mt_reg); }module_init (string_mt_init);
net/netfilter/xt_time.c +9 -19
@@ -235,33 +235,23 @@ time_mt_check(const char *tablename, const void *ip,return true; } -static struct xt_match time_mt_reg[]__read_mostly = { - { - .name ="time" , - .family =AF_INET , - .match = time_mt, - .matchsize =sizeof (struct xt_time_info ), - .checkentry = time_mt_check, - .me =THIS_MODULE , - }, - { - .name ="time" , - .family =AF_INET6 , - .match = time_mt, - .matchsize =sizeof (struct xt_time_info ), - .checkentry = time_mt_check, - .me =THIS_MODULE , - }, +static struct xt_match xt_time_mt_reg__read_mostly = { + .name ="time" , + .family =AF_UNSPEC , + .match = time_mt, + .checkentry = time_mt_check, + .matchsize =sizeof (struct xt_time_info ), + .me =THIS_MODULE , };static int __init time_mt_init (void ) { -return xt_register_matches (time_mt_reg,ARRAY_SIZE (time_mt_reg)); +return xt_register_match (&xt_time_mt_reg); } static void __exit time_mt_exit(void) { -xt_unregister_matches (time_mt_reg,ARRAY_SIZE (time_mt_reg)); +xt_unregister_match (&xt_time_mt_reg); }module_init (time_mt_init);
net/netfilter/xt_u32.c +9 -17
@@ -99,31 +99,23 @@ u32_mt(const struct sk_buff *skb, const struct net_device *in,return ret ^ data->invert; } -static struct xt_match u32_mt_reg[]__read_mostly = { - { - .name ="u32" , - .family =AF_INET , - .match = u32_mt, - .matchsize =sizeof (struct xt_u32 ), - .me =THIS_MODULE , - }, - { - .name ="u32" , - .family =AF_INET6 , - .match = u32_mt, - .matchsize =sizeof (struct xt_u32 ), - .me =THIS_MODULE , - }, +static struct xt_match xt_u32_mt_reg__read_mostly = { + .name ="u32" , + .revision =0 , + .family =AF_UNSPEC , + .match = u32_mt, + .matchsize =sizeof (struct xt_u32 ), + .me =THIS_MODULE , };static int __init u32_mt_init (void ) { -return xt_register_matches (u32_mt_reg,ARRAY_SIZE (u32_mt_reg)); +return xt_register_match (&xt_u32_mt_reg); } static void __exit u32_mt_exit(void) { -xt_unregister_matches (u32_mt_reg,ARRAY_SIZE (u32_mt_reg)); +xt_unregister_match (&xt_u32_mt_reg); }module_init (u32_mt_init);
Signature · 1 line
1.5.4.4
PATCH 16/29 : Explicitly initialize .priority in arptable_filter
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- net/ipv4/netfilter/arptable_filter.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
net/ipv4/netfilter/arptable_filter.c +3 -0
@@ -70,18 +70,21 @@ static struct nf_hook_ops arpt_ops[] __read_mostly = { .owner = THIS_MODULE, .pf = AF_ARP, .hooknum = NF_ARP_IN, + .priority = NF_IP_PRI_FILTER, }, { .hook = arpt_hook, .owner = THIS_MODULE, .pf = AF_ARP, .hooknum = NF_ARP_OUT, + .priority = NF_IP_PRI_FILTER, }, { .hook = arpt_hook, .owner = THIS_MODULE, .pf = AF_ARP, .hooknum = NF_ARP_FORWARD, + .priority = NF_IP_PRI_FILTER, }, };
Signature · 1 line
1.5.4.4
PATCH 17/29 : Rename ipt_recent to xt_recent
In reply to Jan EngelhardtLike with other modules (such as ipt_state), ipt_recent.h is changed to forward definitions to (IOW include) xt_recent.h, and xt_recent.c is changed to use the new constant names.
Signed-off-by Jan Engelhardt <[email protected]>
---
include/linux/netfilter/xt_recent.h | 26 ++++++++
include/linux/netfilter_ipv4/ipt_recent.h | 28 ++++-----
net/ipv4/netfilter/Kconfig | 13 ----
net/ipv4/netfilter/Makefile | 1 -
net/netfilter/Kconfig | 11 ++++
net/netfilter/Makefile | 1 +
.../ipt_recent.c => netfilter/xt_recent.c} | 37 ++++++------
7 files changed, 68 insertions(+), 49 deletions(-)
create mode 100644 include/linux/netfilter/xt_recent.h
rename net/{ipv4/netfilter/ipt_recent.c => netfilter/xt_recent.c} (92%)include/linux/netfilter/xt_recent.h new file +26 -0
@@ -0,0 +1,26 @@ +#ifndef _LINUX_NETFILTER_XT_RECENT_H +#define _LINUX_NETFILTER_XT_RECENT_H 1 + +enum { +XT_RECENT_CHECK =1 <<0 , +XT_RECENT_SET =1 <<1 , +XT_RECENT_UPDATE =1 <<2 , +XT_RECENT_REMOVE =1 <<3 , +XT_RECENT_TTL =1 <<4 , + +XT_RECENT_SOURCE =0 , +XT_RECENT_DEST =1 , + +XT_RECENT_NAME_LEN =200 , +}; + +struct xt_recent_mtinfo { +u_int32_t seconds; +u_int32_t hit_count; +u_int8_t check_set; +u_int8_t invert; +char name[XT_RECENT_NAME_LEN ]; +u_int8_t side; +}; + +#endif /* _LINUX_NETFILTER_XT_RECENT_H */
include/linux/netfilter_ipv4/ipt_recent.h +11 -17
@@ -1,27 +1,21 @@#ifndef _IPT_RECENT_H#define _IPT_RECENT_H -#define RECENT_NAME "ipt_recent" -#define RECENT_VER "v0.3.1" +#include <linux/netfilter/xt_recent.h> -#define IPT_RECENT_CHECK 1 -#define IPT_RECENT_SET 2 -#define IPT_RECENT_UPDATE 4 -#define IPT_RECENT_REMOVE 8 -#define IPT_RECENT_TTL 16 +#define ipt_recent_info xt_recent_mtinfo -#define IPT_RECENT_SOURCE 0 -#define IPT_RECENT_DEST 1 +enum { +IPT_RECENT_CHECK =XT_RECENT_CHECK , +IPT_RECENT_SET =XT_RECENT_SET , +IPT_RECENT_UPDATE =XT_RECENT_UPDATE , +IPT_RECENT_REMOVE =XT_RECENT_REMOVE , +IPT_RECENT_TTL =XT_RECENT_TTL , -#define IPT_RECENT_NAME_LEN 200 +IPT_RECENT_SOURCE =XT_RECENT_SOURCE , +IPT_RECENT_DEST =XT_RECENT_DEST , -struct ipt_recent_info { -u_int32_t seconds; -u_int32_t hit_count; -u_int8_t check_set; -u_int8_t invert; -char name[IPT_RECENT_NAME_LEN ]; -u_int8_t side; +IPT_RECENT_NAME_LEN =XT_RECENT_NAME_LEN , };#endif /*_IPT_RECENT_H*/
net/ipv4/netfilter/Kconfig +0 -13
@@ -57,19 +57,6 @@ config IP_NF_IPTABLES To compile it as a module, choose M here. If unsure, say N. # The matches. -config IP_NF_MATCH_RECENT - tristate '"recent" match support' - depends on IP_NF_IPTABLES - depends on NETFILTER_ADVANCED - help - This match is used for creating one or many lists of recently - used addresses and then matching against that/those list(s). - - Short options are available by using 'iptables -m recent -h' - Official Website: <http://snowman.net/projects/ipt_recent/> - - To compile it as a module, choose M here. If unsure, say N. - config IP_NF_MATCH_ECN tristate '"ecn" match support' depends on IP_NF_IPTABLES
net/ipv4/netfilter/Makefile +0 -1
@@ -44,7 +44,6 @@ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o -obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o # targets
net/netfilter/Kconfig +11 -0
@@ -711,6 +711,17 @@ config NETFILTER_XT_MATCH_REALM If you want to compile it as a module, say M here and read <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. +config NETFILTER_XT_MATCH_RECENT + tristate '"recent" match support' + depends on NETFILTER_XTABLES + depends on NETFILTER_ADVANCED + ---help--- + This match is used for creating one or many lists of recently + used addresses and then matching against that/those list(s). + + Short options are available by using 'iptables -m recent -h' + Official Website: <http://snowman.net/projects/ipt_recent/> + config NETFILTER_XT_MATCH_SCTP tristate '"sctp" protocol match support (EXPERIMENTAL)' depends on NETFILTER_XTABLES && EXPERIMENTAL
net/netfilter/Makefile +1 -0
@@ -75,6 +75,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o +obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT) += xt_recent.o obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o
net/netfilter/xt_recent.c renamed from net/ipv4/netfilter/ipt_recent.c +19 -18
@@ -27,11 +27,12 @@#include <net/net_namespace.h> #include <linux/netfilter/x_tables.h> -#include <linux/netfilter_ipv4/ipt_recent.h> +#include <linux/netfilter/xt_recent.h> MODULE_AUTHOR ("Patrick McHardy <[email protected]>" );MODULE_DESCRIPTION ("Xtables: \"recently-seen\" host matching for IPv4" );MODULE_LICENSE ("GPL" ); +MODULE_ALIAS ("ipt_recent" );static unsigned int ip_list_tot =100 ;static unsigned int ip_pkt_list_tot =20 ;
@@ -64,7 +65,7 @@ struct recent_entry {struct recent_table {struct list_head list; -char name[IPT_RECENT_NAME_LEN ]; +char name[XT_RECENT_NAME_LEN ];#ifdef CONFIG_PROC_FS struct proc_dir_entry *proc;#endif
@@ -175,14 +176,14 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in, const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop) { - const struct ipt_recent_info *info = matchinfo; + const struct xt_recent_mtinfo *info = matchinfo;struct recent_table *t;struct recent_entry *e;__be32 addr;u_int8_t ttl;bool ret = info->invert; -if (info->side ==IPT_RECENT_DEST ) +if (info->side ==XT_RECENT_DEST ) addr =ip_hdr (skb)->daddr;else addr =ip_hdr (skb)->saddr;
@@ -195,9 +196,9 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in,spin_lock_bh (&recent_lock); t =recent_table_lookup (info->name); e =recent_entry_lookup (t, addr, - info->check_set &IPT_RECENT_TTL ? ttl :0 ); + info->check_set &XT_RECENT_TTL ? ttl :0 );if (e ==NULL ) { -if (!(info->check_set &IPT_RECENT_SET )) +if (!(info->check_set &XT_RECENT_SET )) goto out; e =recent_entry_init (t, addr, ttl);if (e ==NULL )
@@ -206,12 +207,12 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in, goto out; } -if (info->check_set &IPT_RECENT_SET ) +if (info->check_set &XT_RECENT_SET ) ret = !ret; -else if (info->check_set &IPT_RECENT_REMOVE ) { +else if (info->check_set &XT_RECENT_REMOVE ) {recent_entry_remove (t, e); ret = !ret; - }else if (info->check_set & (IPT_RECENT_CHECK |IPT_RECENT_UPDATE )) { + }else if (info->check_set & (XT_RECENT_CHECK |XT_RECENT_UPDATE )) {unsigned long time = jiffies - info->seconds *HZ ;unsigned int i, hits =0 ;
@@ -225,8 +226,8 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in, } } -if (info->check_set &IPT_RECENT_SET || - (info->check_set &IPT_RECENT_UPDATE && ret)) { +if (info->check_set &XT_RECENT_SET || + (info->check_set &XT_RECENT_UPDATE && ret)) {recent_entry_update (t, e); e->ttl = ttl; }
@@ -240,22 +241,22 @@ recent_mt_check(const char *tablename, const void *ip, const struct xt_match *match, void *matchinfo, unsigned int hook_mask) { - const struct ipt_recent_info *info = matchinfo; + const struct xt_recent_mtinfo *info = matchinfo;struct recent_table *t;unsigned i;bool ret = false;if (hweight8 (info->check_set & - (IPT_RECENT_SET |IPT_RECENT_REMOVE | -IPT_RECENT_CHECK |IPT_RECENT_UPDATE )) !=1 ) + (XT_RECENT_SET |XT_RECENT_REMOVE | +XT_RECENT_CHECK |XT_RECENT_UPDATE )) !=1 )return false; -if ((info->check_set & (IPT_RECENT_SET |IPT_RECENT_REMOVE )) && +if ((info->check_set & (XT_RECENT_SET |XT_RECENT_REMOVE )) && (info->seconds || info->hit_count))return false;if (info->hit_count > ip_pkt_list_tot)return false;if (info->name[0 ] =='\0' || -strnlen (info->name,IPT_RECENT_NAME_LEN ) ==IPT_RECENT_NAME_LEN ) +strnlen (info->name,XT_RECENT_NAME_LEN ) ==XT_RECENT_NAME_LEN )return false;mutex_lock (&recent_mutex);
@@ -297,7 +298,7 @@ out:static void recent_mt_destroy (const struct xt_match *match,void *matchinfo) { -const struct ipt_recent_info *info = matchinfo; +const struct xt_recent_mtinfo *info = matchinfo;struct recent_table *t;mutex_lock (&recent_mutex);
@@ -462,7 +463,7 @@ static struct xt_match recent_mt_reg __read_mostly = { .name = "recent", .family = AF_INET, .match = recent_mt, - .matchsize = sizeof(struct ipt_recent_info), + .matchsize = sizeof(struct xt_recent_mtinfo), .checkentry = recent_mt_check, .destroy = recent_mt_destroy, .me = THIS_MODULE,
Signature · 1 line
1.5.4.4
PATCH 18/29 : xt_recent: IPv6 support
In reply to Jan EngelhardtThis updates xt_recent to support IPv6 handling. It is sort of a flag day, as the new control directory is /proc/net/xt_recent with a new, more strict protocol (the string you ought to write into /proc/net/xt_recent/LIST). But on the other hand, I kept the binary interface towards iptables (which is quite memory consuming I must say) to keep the patch small.
Signed-off-by Jan Engelhardt <[email protected]>
--- net/netfilter/xt_recent.c | 207 +++++++++++++++++++++++++------------ 1 files changed, 143 insertions(+), 64 deletions(-)
net/netfilter/xt_recent.c +143 -64
@@ -1,5 +1,6 @@/* * Copyright (c) 2006 Patrick McHardy <[email protected]> +* Copyright © CC Computer Consultants GmbH, 2007 - 2008 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as
@@ -13,6 +14,8 @@*/ #include <linux/init.h> #include <linux/ip.h> +#include <linux/ipv6.h> +#include <linux/module.h> #include <linux/moduleparam.h> #include <linux/proc_fs.h> #include <linux/seq_file.h>
@@ -30,9 +33,11 @@#include <linux/netfilter/xt_recent.h> MODULE_AUTHOR ("Patrick McHardy <[email protected]>" ); +MODULE_AUTHOR ("Jan Engelhardt <[email protected]>" );MODULE_DESCRIPTION ("Xtables: \"recently-seen\" host matching for IPv4" );MODULE_LICENSE ("GPL" );MODULE_ALIAS ("ipt_recent" ); +MODULE_ALIAS ("ip6t_recent" );static unsigned int ip_list_tot =100 ;static unsigned int ip_pkt_list_tot =20 ;
@@ -49,14 +54,15 @@ module_param(ip_list_gid, uint, 0400);MODULE_PARM_DESC (ip_list_tot,"number of IPs to remember per list" );MODULE_PARM_DESC (ip_pkt_list_tot,"number of packets per IP to remember (max. 255)" );MODULE_PARM_DESC (ip_list_hash_size,"size of hash table used to look up IPs" ); -MODULE_PARM_DESC (ip_list_perms,"permissions on /proc/net/ipt_recent/* files" ); -MODULE_PARM_DESC (ip_list_uid,"owner of /proc/net/ipt_recent/* files" ); -MODULE_PARM_DESC (ip_list_gid,"owning group of /proc/net/ipt_recent/* files" ); +MODULE_PARM_DESC (ip_list_perms,"permissions on /proc/net/xt_recent/* files" ); +MODULE_PARM_DESC (ip_list_uid,"owner of /proc/net/xt_recent/* files" ); +MODULE_PARM_DESC (ip_list_gid,"owning group of /proc/net/xt_recent/* files" );struct recent_entry {struct list_head list;struct list_head lru_list; -__be32 addr; +union nf_inet_addr addr; +u_int16_t family;u_int8_t ttl;u_int8_t index;u_int16_t nstamps;
@@ -87,24 +93,43 @@ static const struct file_operations recent_fops;static u_int32_t hash_rnd;static int hash_rnd_initted; -static unsigned int recent_entry_hash (__be32 addr) +static unsigned int recent_entry_hash4 (const union nf_inet_addr *addr) {if (!hash_rnd_initted) { -get_random_bytes (&hash_rnd,4 ); +get_random_bytes (&hash_rnd,sizeof (hash_rnd)); hash_rnd_initted =1 ; } -return jhash_1word ((__force u32 )addr, hash_rnd) & (ip_list_hash_size -1 ); +return jhash_1word ((__force u32 )addr->ip, hash_rnd) & + (ip_list_hash_size -1 ); +} + +static unsigned int recent_entry_hash6 (const union nf_inet_addr *addr) +{ +if (!hash_rnd_initted) { +get_random_bytes (&hash_rnd,sizeof (hash_rnd)); + hash_rnd_initted =1 ; + } +return jhash2 ((u32 *)addr->ip6,ARRAY_SIZE (addr->ip6), hash_rnd) & + (ip_list_hash_size -1 ); }static struct recent_entry * -recent_entry_lookup (const struct recent_table *table,__be32 addr,u_int8_t ttl) +recent_entry_lookup (const struct recent_table *table, +const union nf_inet_addr *addrp,u_int16_t family, +u_int8_t ttl) {struct recent_entry *e;unsigned int h; - h =recent_entry_hash (addr); +if (family ==AF_INET ) + h =recent_entry_hash4 (addrp); +else + h =recent_entry_hash6 (addrp); +list_for_each_entry (e, &table->iphash[h], list) -if (e->addr == addr && (ttl == e->ttl || !ttl || !e->ttl)) +if (e->family == family && +memcmp (&e->addr, addrp,sizeof (e->addr)) ==0 && + (ttl == e->ttl || ttl ==0 || e->ttl ==0 ))return e;return NULL ; }
@@ -118,7 +143,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e) }static struct recent_entry * -recent_entry_init (struct recent_table *t,__be32 addr,u_int8_t ttl) +recent_entry_init (struct recent_table *t,const union nf_inet_addr *addr, +u_int16_t family,u_int8_t ttl) {struct recent_entry *e;
@@ -130,12 +156,16 @@ recent_entry_init(struct recent_table *t, __be32 addr, u_int8_t ttl) GFP_ATOMIC);if (e ==NULL )return NULL ; - e->addr = addr; +memcpy (&e->addr, addr,sizeof (e->addr)); e->ttl = ttl; e->stamps[0 ] = jiffies; e->nstamps =1 ; e->index =1 ; -list_add_tail (&e->list, &t->iphash[recent_entry_hash (addr)]); + e->family = family; +if (family ==AF_INET ) +list_add_tail (&e->list, &t->iphash[recent_entry_hash4 (addr)]); +else +list_add_tail (&e->list, &t->iphash[recent_entry_hash6 (addr)]);list_add_tail (&e->lru_list, &t->lru_list); t->entries++;return e;
@@ -179,28 +209,42 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in,const struct xt_recent_mtinfo *info = matchinfo;struct recent_table *t;struct recent_entry *e; -__be32 addr; +union nf_inet_addr addr;u_int8_t ttl;bool ret = info->invert; -if (info->side ==XT_RECENT_DEST ) - addr =ip_hdr (skb)->daddr; -else - addr =ip_hdr (skb)->saddr; +if (match->family ==AF_INET ) { +const struct iphdr *iph =ip_hdr (skb); + +if (info->side ==XT_RECENT_DEST ) + addr.ip = iph->daddr; +else + addr.ip = iph->saddr; + + ttl = iph->ttl; + }else { +const struct ipv6hdr *iph =ipv6_hdr (skb); + +if (info->side ==XT_RECENT_DEST ) +memcpy (&addr.in6, &iph->daddr,sizeof (addr.in6)); +else +memcpy (&addr.in6, &iph->saddr,sizeof (addr.in6)); + + ttl = iph->hop_limit; + } - ttl =ip_hdr (skb)->ttl;/* use TTL as seen before forwarding */ if (out && !skb->sk) ttl++;spin_lock_bh (&recent_lock); t =recent_table_lookup (info->name); - e =recent_entry_lookup (t, addr, + e =recent_entry_lookup (t, &addr, match->family, info->check_set &XT_RECENT_TTL ? ttl :0 );if (e ==NULL ) {if (!(info->check_set &XT_RECENT_SET )) goto out; - e =recent_entry_init (t, addr, ttl); + e =recent_entry_init (t, &addr, match->family, ttl);if (e ==NULL ) *hotdrop = true; ret = !ret;
@@ -318,7 +362,7 @@ static void recent_mt_destroy(const struct xt_match *match, void *matchinfo)#ifdef CONFIG_PROC_FS struct recent_iter_state { -struct recent_table *table; +const struct recent_table *table;unsigned int bucket; };
@@ -343,8 +387,8 @@ static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos) {struct recent_iter_state *st = seq->private;const struct recent_table *t = st->table; -struct recent_entry *e = v; -struct list_head *head = e->list.next; +const struct recent_entry *e = v; +const struct list_head *head = e->list.next;while (head == &t->iphash[st->bucket]) {if (++st->bucket >= ip_list_hash_size)
@@ -367,8 +411,14 @@ static int recent_seq_show(struct seq_file *seq, void *v)unsigned int i; i = (e->index -1 ) % ip_pkt_list_tot; -seq_printf (seq,"src=%u.%u.%u.%u ttl: %u last_seen: %lu oldest_pkt: %u" , -NIPQUAD (e->addr), e->ttl, e->stamps[i], e->index); +if (e->family ==AF_INET ) +seq_printf (seq,"src=" NIPQUAD_FMT " ttl: %u last_seen: %lu " +"oldest_pkt: %u" ,NIPQUAD (e->addr.ip), e->ttl, + e->stamps[i], e->index); +else +seq_printf (seq,"src=" NIP6_FMT " ttl: %u last_seen: %lu " +"oldest_pkt: %u" ,NIP6 (e->addr.in6), e->ttl, + e->stamps[i], e->index);for (i =0 ; i < e->nstamps; i++)seq_printf (seq,"%s %lu" , i ?"," :"" , e->stamps[i]);seq_printf (seq,"\n" );
@@ -401,45 +451,59 @@ static ssize_t recent_proc_write(struct file *file, const char __user *input,const struct proc_dir_entry *pde =PDE (file->f_path.dentry->d_inode);struct recent_table *t = pde->data;struct recent_entry *e; -char buf[sizeof ("+255.255.255.255" )], *c = buf; -__be32 addr; -int add; +char buf[sizeof ("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de" )], *c = buf; +union nf_inet_addr addr; +u_int16_t family; +bool add, succ; +if (size ==0 ) +return 0 ;if (size >sizeof (buf)) size =sizeof (buf); -if (copy_from_user (buf, input, size)) +if (copy_from_user (buf, input, size) !=0 )return -EFAULT ; -while (isspace (*c)) - c++; -if (size - (c - buf) <5 ) -return c - buf; -if (!strncmp (c,"clear" ,5 )) { - c +=5 ; +/* Strict protocol! */ +if (*loff !=0 ) +return -ESPIPE ; +switch (*c) { +case '/' :/* flush table */ spin_lock_bh (&recent_lock);recent_table_flush (t);spin_unlock_bh (&recent_lock); -return c - buf; - } - -switch (*c) { -case '-' : - add =0 ; - c++; +return size; +case '-' :/* remove address */ + add = false;break ; -case '+' : - c++; -default : - add =1 ; +case '+' :/* add address */ + add = true;break ; +default : + printk(KERN_INFO KBUILD_MODNAME ": Need +ip, -ip or /\n"); +return -EINVAL ; + } + + ++c; + --size; +if (strnchr (c, size,':' ) !=NULL ) { + family =AF_INET6 ; + succ =in6_pton (c, size, (void *)&addr,'\n' ,NULL ); + }else { + family =AF_INET ; + succ =in4_pton (c, size, (void *)&addr,'\n' ,NULL ); + } + +if (!succ) { + printk(KERN_INFO KBUILD_MODNAME ": illegal address written " + "to procfs\n"); +return -EINVAL ; } - addr =in_aton (c);spin_lock_bh (&recent_lock); - e =recent_entry_lookup (t, addr,0 ); + e =recent_entry_lookup (t, &addr, family,0 );if (e ==NULL ) {if (add) -recent_entry_init (t, addr,0 ); +recent_entry_init (t, &addr, family,0 ); }else {if (add)recent_entry_update (t, e);
@@ -447,7 +511,9 @@ static ssize_t recent_proc_write(struct file *file, const char __user *input,recent_entry_remove (t, e); }spin_unlock_bh (&recent_lock); -return size; +/* Note we removed one above */ + *loff += size +1 ; +return size +1 ; }static const struct file_operations recent_fops = {
@@ -459,14 +525,27 @@ static const struct file_operations recent_fops = { };#endif /* CONFIG_PROC_FS */ -static struct xt_match recent_mt_reg__read_mostly = { - .name ="recent" , - .family =AF_INET , - .match = recent_mt, - .matchsize =sizeof (struct xt_recent_mtinfo ), - .checkentry = recent_mt_check, - .destroy = recent_mt_destroy, - .me =THIS_MODULE , +static struct xt_match recent_mt_reg[]__read_mostly = { + { + .name ="recent" , + .revision =0 , + .family =AF_INET , + .match = recent_mt, + .matchsize =sizeof (struct xt_recent_mtinfo ), + .checkentry = recent_mt_check, + .destroy = recent_mt_destroy, + .me =THIS_MODULE , + }, + { + .name ="recent" , + .revision =0 , + .family =AF_INET6 , + .match = recent_mt, + .matchsize =sizeof (struct xt_recent_mtinfo ), + .checkentry = recent_mt_check, + .destroy = recent_mt_destroy, + .me =THIS_MODULE , + }, };static int __init recent_mt_init (void )
@@ -477,13 +556,13 @@ static int __init recent_mt_init(void)return -EINVAL ; ip_list_hash_size =1 <<fls (ip_list_tot); - err =xt_register_match (&recent_mt_reg); + err =xt_register_matches (recent_mt_reg,ARRAY_SIZE (recent_mt_reg));#ifdef CONFIG_PROC_FS if (err)return err; - proc_dir =proc_mkdir ("ipt_recent" , init_net.proc_net); + proc_dir =proc_mkdir ("xt_recent" , init_net.proc_net);if (proc_dir ==NULL ) { -xt_unregister_match (&recent_mt_reg); +xt_unregister_matches (recent_mt_reg,ARRAY_SIZE (recent_mt_reg)); err = -ENOMEM ; }#endif
@@ -493,9 +572,9 @@ static int __init recent_mt_init(void) static void __exit recent_mt_exit(void) {BUG_ON (!list_empty (&tables)); -xt_unregister_match (&recent_mt_reg); +xt_unregister_matches (recent_mt_reg,ARRAY_SIZE (recent_mt_reg));#ifdef CONFIG_PROC_FS -remove_proc_entry ("ipt_recent" , init_net.proc_net); +remove_proc_entry ("xt_recent" , init_net.proc_net);#endif }
Signature · 1 line
1.5.4.4
PATCH 19/29 : nf_nat: autoload IPv4 connection tracking
In reply to Jan EngelhardtWithout this patch, the generic L3 tracker would kick in if nf_conntrack_ipv4 was not loaded before nf_nat, which would lead to translation problems with ICMP errors.
NAT does not make sense without IPv4 connection tracking anyway, so just add a call to need_ipv4_conntrack().
Signed-off-by Jan Engelhardt <[email protected]>
--- net/ipv4/netfilter/nf_nat_core.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
net/ipv4/netfilter/nf_nat_core.c +2 -0
@@ -629,6 +629,8 @@ static int __init nf_nat_init(void)size_t i;int ret; +need_ipv4_conntrack (); + ret =nf_ct_extend_register (&nat_extend);if (ret <0 ) {printk (KERN_ERR "nf_nat_core: Unable to register extension\n" );
Signature · 1 line
1.5.4.4
PATCH 20/29 : Use bool in nf_conntrack_l4proto
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/net/netfilter/nf_conntrack_l4proto.h | 13 ++-- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 25 ++++---- net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 27 ++++----- net/netfilter/nf_conntrack_proto_generic.c | 20 +++--- net/netfilter/nf_conntrack_proto_gre.c | 25 ++++---- net/netfilter/nf_conntrack_proto_sctp.c | 33 +++++------ net/netfilter/nf_conntrack_proto_tcp.c | 48 +++++++--------- net/netfilter/nf_conntrack_proto_udp.c | 21 +++---- net/netfilter/nf_conntrack_proto_udplite.c | 22 ++++---- 9 files changed, 111 insertions(+), 123 deletions(-)
include/net/netfilter/nf_conntrack_l4proto.h +6 -7
@@ -25,15 +25,14 @@ struct nf_conntrack_l4proto/* Try to fill in the third arg: dataoff is offset past network protocol hdr. Return true if possible. */ -int (*pkt_to_tuple)(const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple); +bool (*pkt_to_tuple)(const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple);/* Invert the per-proto part of the tuple: ie. turn xmit into reply. * Some packets can't be inverted: return 0 in that case. */ -int (*invert_tuple)(struct nf_conntrack_tuple *inverse, -const struct nf_conntrack_tuple *orig); +bool (*invert_tuple)(struct nf_conntrack_tuple *inverse, +const struct nf_conntrack_tuple *orig);/* Returns verdict for packet, or -1 for invalid. */ int (*packet)(struct nf_conn *ct,
@@ -45,8 +44,8 @@ struct nf_conntrack_l4proto/* Called when a new connection for this protocol found; * returns TRUE if it's OK. If so, packet() called next. */ -int (*new)(struct nf_conn *ct,const struct sk_buff *skb, -unsigned int dataoff); +bool (*new)(struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff);/* Called when a conntrack entry is destroyed */ void (*destroy)(struct nf_conn *ct);
net/ipv4/netfilter/nf_conntrack_proto_icmp.c +12 -13
@@ -22,22 +22,21 @@static unsigned long nf_ct_icmp_timeout__read_mostly =30 *HZ ; -static int icmp_pkt_to_tuple (const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +static bool icmp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple) {const struct icmphdr *hp;struct icmphdr _hdr; hp =skb_header_pointer (skb, dataoff,sizeof (_hdr), &_hdr);if (hp ==NULL ) -return 0 ; +return false; tuple->dst.u.icmp.type = hp->type; tuple->src.u.icmp.id = hp->un.echo.id; tuple->dst.u.icmp.code = hp->code; -return 1 ; +return true; }/* Add 1; spaces filled with 0. */
@@ -52,17 +51,17 @@ static const u_int8_t invmap[] = { [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1 }; -static int icmp_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool icmp_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) {if (orig->dst.u.icmp.type >=sizeof (invmap) || !invmap[orig->dst.u.icmp.type]) -return 0 ; +return false; tuple->src.u.icmp.id = orig->src.u.icmp.id; tuple->dst.u.icmp.type = invmap[orig->dst.u.icmp.type] -1 ; tuple->dst.u.icmp.code = orig->dst.u.icmp.code; -return 1 ; +return true; }/* Print out the per-protocol part of the tuple. */
@@ -101,8 +100,8 @@ static int icmp_packet(struct nf_conn *ct, }/* Called when a new connection for this protocol found. */ -static int icmp_new (struct nf_conn *ct, -const struct sk_buff *skb,unsigned int dataoff) +static bool icmp_new (struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff) {static const u_int8_t valid_new[] = { [ICMP_ECHO ] =1 ,
@@ -117,10 +116,10 @@ static int icmp_new(struct nf_conn *ct,pr_debug ("icmp: can't create new conn with type %u\n" , ct->tuplehash[0 ].tuple.dst.u.icmp.type);NF_CT_DUMP_TUPLE (&ct->tuplehash[0 ].tuple); -return 0 ; +return false; }atomic_set (&ct->proto.icmp.count,0 ); -return 1 ; +return true; }/* Returns conntrack if it dealt with ICMP, and filled in skb fields */
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +13 -14
@@ -28,21 +28,21 @@static unsigned long nf_ct_icmpv6_timeout__read_mostly =30 *HZ ; -static int icmpv6_pkt_to_tuple (const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +static bool +icmpv6_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple) {const struct icmp6hdr *hp;struct icmp6hdr _hdr; hp =skb_header_pointer (skb, dataoff,sizeof (_hdr), &_hdr);if (hp ==NULL ) -return 0 ; +return false; tuple->dst.u.icmp.type = hp->icmp6_type; tuple->src.u.icmp.id = hp->icmp6_identifier; tuple->dst.u.icmp.code = hp->icmp6_code; -return 1 ; +return true; }/* Add 1; spaces filled with 0. */
@@ -53,17 +53,17 @@ static const u_int8_t invmap[] = { [ICMPV6_NI_REPLY - 128] = ICMPV6_NI_REPLY +1 }; -static int icmpv6_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool icmpv6_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) {int type = orig->dst.u.icmp.type -128 ;if (type <0 || type >=sizeof (invmap) || !invmap[type]) -return 0 ; +return false; tuple->src.u.icmp.id = orig->src.u.icmp.id; tuple->dst.u.icmp.type = invmap[type] -1 ; tuple->dst.u.icmp.code = orig->dst.u.icmp.code; -return 1 ; +return true; }/* Print out the per-protocol part of the tuple. */
@@ -102,9 +102,8 @@ static int icmpv6_packet(struct nf_conn *ct, }/* Called when a new connection for this protocol found. */ -static int icmpv6_new (struct nf_conn *ct, -const struct sk_buff *skb, -unsigned int dataoff) +static bool icmpv6_new (struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff) {static const u_int8_t valid_new[] = { [ICMPV6_ECHO_REQUEST -128 ] =1 ,
@@ -117,10 +116,10 @@ static int icmpv6_new(struct nf_conn *ct,pr_debug ("icmpv6: can't create new conn with type %u\n" , type +128 );NF_CT_DUMP_TUPLE (&ct->tuplehash[0 ].tuple); -return 0 ; +return false; }atomic_set (&ct->proto.icmp.count,0 ); -return 1 ; +return true; } static int
net/netfilter/nf_conntrack_proto_generic.c +10 -10
@@ -14,23 +14,23 @@static unsigned int nf_ct_generic_timeout__read_mostly =600 *HZ ; -static int generic_pkt_to_tuple (const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +static bool +generic_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple) { tuple->src.u.all =0 ; tuple->dst.u.all =0 ; -return 1 ; +return true; } -static int generic_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool generic_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) { tuple->src.u.all =0 ; tuple->dst.u.all =0 ; -return 1 ; +return true; }/* Print out the per-protocol part of the tuple. */
@@ -53,10 +53,10 @@ static int packet(struct nf_conn *ct, }/* Called when a new connection for this protocol found. */ -static int new (struct nf_conn *ct,const struct sk_buff *skb, -unsigned int dataoff) +static bool new (struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff) { -return 1 ; +return true; }#ifdef CONFIG_SYSCTL
net/netfilter/nf_conntrack_proto_gre.c +12 -13
@@ -148,18 +148,17 @@ EXPORT_SYMBOL_GPL(nf_ct_gre_keymap_destroy);/* PUBLIC CONNTRACK PROTO HELPER FUNCTIONS */ /* invert gre part of tuple */ -static int gre_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool gre_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) { tuple->dst.u.gre.key = orig->src.u.gre.key; tuple->src.u.gre.key = orig->dst.u.gre.key; -return 1 ; +return true; }/* gre hdr info to tuple */ -static int gre_pkt_to_tuple (const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +static bool gre_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple) {const struct gre_hdr_pptp *pgrehdr;struct gre_hdr_pptp _pgrehdr;
@@ -173,24 +172,24 @@ static int gre_pkt_to_tuple(const struct sk_buff *skb,/* try to behave like "nf_conntrack_proto_generic" */ tuple->src.u.all =0 ; tuple->dst.u.all =0 ; -return 1 ; +return true; }/* PPTP header is variable length, only need up to the call_id field */ pgrehdr =skb_header_pointer (skb, dataoff,8 , &_pgrehdr);if (!pgrehdr) -return 1 ; +return true;if (ntohs (grehdr->protocol) !=GRE_PROTOCOL_PPTP ) {pr_debug ("GRE_VERSION_PPTP but unknown proto\n" ); -return 0 ; +return false; } tuple->dst.u.gre.key = pgrehdr->call_id; srckey =gre_keymap_lookup (tuple); tuple->src.u.gre.key = srckey; -return 1 ; +return true; }/* print gre part of tuple */
@@ -235,8 +234,8 @@ static int gre_packet(struct nf_conn *ct, }/* Called when a new connection for this protocol found. */ -static int gre_new (struct nf_conn *ct,const struct sk_buff *skb, -unsigned int dataoff) +static bool gre_new (struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff) {pr_debug (": " );NF_CT_DUMP_TUPLE (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple);
@@ -246,7 +245,7 @@ static int gre_new(struct nf_conn *ct, const struct sk_buff *skb, ct->proto.gre.stream_timeout =GRE_STREAM_TIMEOUT ; ct->proto.gre.timeout =GRE_TIMEOUT ; -return 1 ; +return true; }/* Called when a conntrack entry has already been removed from the hashes
net/netfilter/nf_conntrack_proto_sctp.c +16 -17
@@ -130,28 +130,27 @@ static const u8 sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = { } }; -static int sctp_pkt_to_tuple (const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +static bool sctp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple) {sctp_sctphdr_t _hdr, *hp;/* Actually only need first 8 bytes. */ hp =skb_header_pointer (skb, dataoff,8 , &_hdr);if (hp ==NULL ) -return 0 ; +return false; tuple->src.u.sctp.port = hp->source; tuple->dst.u.sctp.port = hp->dest; -return 1 ; +return true; } -static int sctp_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool sctp_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) { tuple->src.u.sctp.port = orig->dst.u.sctp.port; tuple->dst.u.sctp.port = orig->src.u.sctp.port; -return 1 ; +return true; }/* Print out the per-protocol part of the tuple. */
@@ -390,8 +389,8 @@ out: }/* Called when a new connection for this protocol found. */ -static int sctp_new (struct nf_conn *ct,const struct sk_buff *skb, -unsigned int dataoff) +static bool sctp_new (struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff) {enum sctp_conntrack new_state;sctp_sctphdr_t _sctph, *sh;
@@ -401,16 +400,16 @@ static int sctp_new(struct nf_conn *ct, const struct sk_buff *skb, sh =skb_header_pointer (skb, dataoff,sizeof (_sctph), &_sctph);if (sh ==NULL ) -return 0 ; +return false;if (do_basic_checks (ct, skb, dataoff, map) !=0 ) -return 0 ; +return false;/* If an OOTB packet has any of these chunks discard (Sec 8.4) */ if (test_bit (SCTP_CID_ABORT , map) ||test_bit (SCTP_CID_SHUTDOWN_COMPLETE , map) ||test_bit (SCTP_CID_COOKIE_ACK , map)) -return 0 ; +return false; new_state =SCTP_CONNTRACK_MAX ; for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
@@ -422,7 +421,7 @@ static int sctp_new(struct nf_conn *ct, const struct sk_buff *skb,if (new_state ==SCTP_CONNTRACK_NONE || new_state ==SCTP_CONNTRACK_MAX ) {pr_debug ("nf_conntrack_sctp: invalid new deleting.\n" ); -return 0 ; +return false; }/* Copy the vtag into the state info */
@@ -433,7 +432,7 @@ static int sctp_new(struct nf_conn *ct, const struct sk_buff *skb, ih =skb_header_pointer (skb, offset +sizeof (sctp_chunkhdr_t),sizeof (_inithdr), &_inithdr);if (ih ==NULL ) -return 0 ; +return false;pr_debug ("Setting vtag %x for new conn\n" , ih->init_tag);
@@ -442,7 +441,7 @@ static int sctp_new(struct nf_conn *ct, const struct sk_buff *skb, ih->init_tag; }else {/* Sec 8.5.1 (A) */ -return 0 ; +return false; } }/* If it is a shutdown ack OOTB packet, we expect a return
@@ -456,7 +455,7 @@ static int sctp_new(struct nf_conn *ct, const struct sk_buff *skb, ct->proto.sctp.state = new_state; } -return 1 ; +return true; }#ifdef CONFIG_SYSCTL
net/netfilter/nf_conntrack_proto_tcp.c +21 -27
119 lines not on this page · raw message
net/netfilter/nf_conntrack_proto_udp.c +10 -11
@@ -26,9 +26,8 @@static unsigned int nf_ct_udp_timeout__read_mostly =30 *HZ ;static unsigned int nf_ct_udp_timeout_stream__read_mostly =180 *HZ ; -static int udp_pkt_to_tuple (const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +static bool udp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple) {const struct udphdr *hp;struct udphdr _hdr;
@@ -36,20 +35,20 @@ static int udp_pkt_to_tuple(const struct sk_buff *skb,/* Actually only need first 8 bytes. */ hp =skb_header_pointer (skb, dataoff,sizeof (_hdr), &_hdr);if (hp ==NULL ) -return 0 ; +return false; tuple->src.u.udp.port = hp->source; tuple->dst.u.udp.port = hp->dest; -return 1 ; +return true; } -static int udp_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool udp_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) { tuple->src.u.udp.port = orig->dst.u.udp.port; tuple->dst.u.udp.port = orig->src.u.udp.port; -return 1 ; +return true; }/* Print out the per-protocol part of the tuple. */
@@ -83,10 +82,10 @@ static int udp_packet(struct nf_conn *ct, }/* Called when a new connection for this protocol found. */ -static int udp_new (struct nf_conn *ct,const struct sk_buff *skb, -unsigned int dataoff) +static bool udp_new (struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff) { -return 1 ; +return true; } static int udp_error(struct sk_buff *skb, unsigned int dataoff,
net/netfilter/nf_conntrack_proto_udplite.c +11 -11
@@ -27,28 +27,28 @@static unsigned int nf_ct_udplite_timeout__read_mostly =30 *HZ ;static unsigned int nf_ct_udplite_timeout_stream__read_mostly =180 *HZ ; -static int udplite_pkt_to_tuple (const struct sk_buff *skb, -unsigned int dataoff, -struct nf_conntrack_tuple *tuple) +static bool +udplite_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff, +struct nf_conntrack_tuple *tuple) {const struct udphdr *hp;struct udphdr _hdr; hp =skb_header_pointer (skb, dataoff,sizeof (_hdr), &_hdr);if (hp ==NULL ) -return 0 ; +return false; tuple->src.u.udp.port = hp->source; tuple->dst.u.udp.port = hp->dest; -return 1 ; +return true; } -static int udplite_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool udplite_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) { tuple->src.u.udp.port = orig->dst.u.udp.port; tuple->dst.u.udp.port = orig->src.u.udp.port; -return 1 ; +return true; }/* Print out the per-protocol part of the tuple. */
@@ -83,10 +83,10 @@ static int udplite_packet(struct nf_conn *ct, }/* Called when a new connection for this protocol found. */ -static int udplite_new (struct nf_conn *ct,const struct sk_buff *skb, -unsigned int dataoff) +static bool udplite_new (struct nf_conn *ct,const struct sk_buff *skb, +unsigned int dataoff) { -return 1 ; +return true; } static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
Signature · 1 line
1.5.4.4
PATCH 21/29 : Use bool in nf_conntrack_l3proto
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/net/netfilter/nf_conntrack_l3proto.h | 10 +++++----- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 14 +++++++------- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 14 +++++++------- net/netfilter/nf_conntrack_l3proto_generic.c | 12 ++++++------ 4 files changed, 25 insertions(+), 25 deletions(-)
include/net/netfilter/nf_conntrack_l3proto.h +5 -5
@@ -28,15 +28,15 @@ struct nf_conntrack_l3proto* Try to fill in the third arg: nhoff is offset of l3 proto * hdr. Return true if possible. */ -int (*pkt_to_tuple)(const struct sk_buff *skb,unsigned int nhoff, -struct nf_conntrack_tuple *tuple); +bool (*pkt_to_tuple)(const struct sk_buff *skb,unsigned int nhoff, +struct nf_conntrack_tuple *tuple);/* * Invert the per-proto part of the tuple: ie. turn xmit into reply. * Some packets can't be inverted: return 0 in that case. */ -int (*invert_tuple)(struct nf_conntrack_tuple *inverse, -const struct nf_conntrack_tuple *orig); +bool (*invert_tuple)(struct nf_conntrack_tuple *inverse, +const struct nf_conntrack_tuple *orig);/* Print out the per-protocol part of the tuple. */ int (*print_tuple)(struct seq_file *s,
@@ -51,7 +51,7 @@ struct nf_conntrack_l3proto* Called when a new connection for this protocol found; * returns TRUE if it's OK. If so, packet() called next. */ -int (*new)(struct nf_conn *ct,const struct sk_buff *skb); +bool (*new)(struct nf_conn *ct,const struct sk_buff *skb);/* * Called before tracking.
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +7 -7
@@ -24,29 +24,29 @@#include <net/netfilter/nf_conntrack_core.h> #include <net/netfilter/ipv4/nf_conntrack_ipv4.h> -static int ipv4_pkt_to_tuple (const struct sk_buff *skb,unsigned int nhoff, -struct nf_conntrack_tuple *tuple) +static bool ipv4_pkt_to_tuple (const struct sk_buff *skb,unsigned int nhoff, +struct nf_conntrack_tuple *tuple) {const __be32 *ap;__be32 _addrs[2 ]; ap =skb_header_pointer (skb, nhoff + offsetof(struct iphdr , saddr),sizeof (u_int32_t) *2 , _addrs);if (ap ==NULL ) -return 0 ; +return false; tuple->src.u3.ip = ap[0 ]; tuple->dst.u3.ip = ap[1 ]; -return 1 ; +return true; } -static int ipv4_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool ipv4_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) { tuple->src.u3.ip = orig->dst.u3.ip; tuple->dst.u3.ip = orig->src.u3.ip; -return 1 ; +return true; } static int ipv4_print_tuple(struct seq_file *s,
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +7 -7
@@ -27,8 +27,8 @@#include <net/netfilter/nf_conntrack_l3proto.h> #include <net/netfilter/nf_conntrack_core.h> -static int ipv6_pkt_to_tuple (const struct sk_buff *skb,unsigned int nhoff, -struct nf_conntrack_tuple *tuple) +static bool ipv6_pkt_to_tuple (const struct sk_buff *skb,unsigned int nhoff, +struct nf_conntrack_tuple *tuple) {const u_int32_t *ap;u_int32_t _addrs[8 ];
@@ -36,21 +36,21 @@ static int ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff, ap =skb_header_pointer (skb, nhoff + offsetof(struct ipv6hdr , saddr),sizeof (_addrs), _addrs);if (ap ==NULL ) -return 0 ; +return false;memcpy (tuple->src.u3.ip6, ap,sizeof (tuple->src.u3.ip6));memcpy (tuple->dst.u3.ip6, ap +4 ,sizeof (tuple->dst.u3.ip6)); -return 1 ; +return true; } -static int ipv6_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool ipv6_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) {memcpy (tuple->src.u3.ip6, orig->dst.u3.ip6,sizeof (tuple->src.u3.ip6));memcpy (tuple->dst.u3.ip6, orig->src.u3.ip6,sizeof (tuple->dst.u3.ip6)); -return 1 ; +return true; } static int ipv6_print_tuple(struct seq_file *s,
net/netfilter/nf_conntrack_l3proto_generic.c +6 -6
@@ -31,22 +31,22 @@#include <net/netfilter/nf_conntrack_core.h> #include <net/netfilter/ipv4/nf_conntrack_ipv4.h> -static int generic_pkt_to_tuple (const struct sk_buff *skb,unsigned int nhoff, -struct nf_conntrack_tuple *tuple) +static bool generic_pkt_to_tuple (const struct sk_buff *skb,unsigned int nhoff, +struct nf_conntrack_tuple *tuple) {memset (&tuple->src.u3,0 ,sizeof (tuple->src.u3));memset (&tuple->dst.u3,0 ,sizeof (tuple->dst.u3)); -return 1 ; +return true; } -static int generic_invert_tuple (struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple *orig) +static bool generic_invert_tuple (struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple *orig) {memset (&tuple->src.u3,0 ,sizeof (tuple->src.u3));memset (&tuple->dst.u3,0 ,sizeof (tuple->dst.u3)); -return 1 ; +return true; } static int generic_print_tuple(struct seq_file *s,
Signature · 1 line
1.5.4.4
PATCH 22/29 : nf_conntrack_sctp: const annotations
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- net/netfilter/nf_conntrack_proto_sctp.c | 17 +++++++++++------ 1 files changed, 11 insertions(+), 6 deletions(-)
net/netfilter/nf_conntrack_proto_sctp.c +11 -6
@@ -33,7 +33,7 @@ static DEFINE_RWLOCK(sctp_lock);And so for me for SCTP :D -Kiran */ -static const char *sctp_conntrack_names[] = { +static const char *const sctp_conntrack_names[] = {"NONE" ,"CLOSED" ,"COOKIE_WAIT" ,
@@ -133,7 +133,8 @@ static const u8 sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {static bool sctp_pkt_to_tuple (const struct sk_buff *skb,unsigned int dataoff,struct nf_conntrack_tuple *tuple) { -sctp_sctphdr_t _hdr, *hp; +const struct sctphdr *hp; +struct sctphdr _hdr;/* Actually only need first 8 bytes. */ hp =skb_header_pointer (skb, dataoff,8 , &_hdr);
@@ -291,8 +292,10 @@ static int sctp_packet(struct nf_conn *ct, {enum sctp_conntrack new_state, old_state;enum ip_conntrack_dir dir =CTINFO2DIR (ctinfo); -sctp_sctphdr_t _sctph, *sh; -sctp_chunkhdr_t _sch, *sch; +const struct sctphdr *sh; +struct sctphdr _sctph; +const struct sctp_chunkhdr *sch; +struct sctp_chunkhdr _sch;u_int32_t offset, count;unsigned long map[256 /sizeof (unsigned long )] = {0 };
@@ -393,8 +396,10 @@ static bool sctp_new(struct nf_conn *ct, const struct sk_buff *skb, unsigned int dataoff) {enum sctp_conntrack new_state; -sctp_sctphdr_t _sctph, *sh; -sctp_chunkhdr_t _sch, *sch; +const struct sctphdr *sh; +struct sctphdr _sctph; +const struct sctp_chunkhdr *sch; +struct sctp_chunkhdr _sch;u_int32_t offset, count;unsigned long map[256 /sizeof (unsigned long )] = {0 };
Signature · 1 line
1.5.4.4
PATCH 23/29 : Use bool in nf_conntrack_tuple.h
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/net/netfilter/nf_conntrack.h | 11 +++--- include/net/netfilter/nf_conntrack_core.h | 4 +- include/net/netfilter/nf_conntrack_tuple.h | 39 +++++++++++--------- net/netfilter/nf_conntrack_core.c | 22 +++++------ 4 files changed, 38 insertions(+), 38 deletions(-)
include/net/netfilter/nf_conntrack.h +5 -6
@@ -189,12 +189,11 @@ extern void nf_conntrack_hash_insert(struct nf_conn *ct);extern void nf_conntrack_flush (void ); -extern int nf_ct_get_tuplepr (const struct sk_buff *skb, -unsigned int nhoff, -u_int16_t l3num, -struct nf_conntrack_tuple *tuple); -extern int nf_ct_invert_tuplepr (struct nf_conntrack_tuple *inverse, -const struct nf_conntrack_tuple *orig); +extern bool nf_ct_get_tuplepr (const struct sk_buff *skb, +unsigned int nhoff,u_int16_t l3num, +struct nf_conntrack_tuple *tuple); +extern bool nf_ct_invert_tuplepr (struct nf_conntrack_tuple *inverse, +const struct nf_conntrack_tuple *orig); extern void __nf_ct_refresh_acct(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
include/net/netfilter/nf_conntrack_core.h +2 -2
@@ -30,7 +30,7 @@ extern void nf_conntrack_cleanup(void);extern int nf_conntrack_proto_init (void );extern void nf_conntrack_proto_fini (void ); -extern int +extern bool nf_ct_get_tuple(const struct sk_buff *skb, unsigned int nhoff, unsigned int dataoff,
@@ -40,7 +40,7 @@ nf_ct_get_tuple(const struct sk_buff *skb,const struct nf_conntrack_l3proto *l3proto, const struct nf_conntrack_l4proto *l4proto); -extern int +extern bool nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse, const struct nf_conntrack_tuple *orig, const struct nf_conntrack_l3proto *l3proto,
include/net/netfilter/nf_conntrack_tuple.h +21 -18
@@ -160,61 +160,64 @@ struct nf_conntrack_tuple_hash#endif /* __KERNEL__ */ -static inline int __nf_ct_tuple_src_equal (const struct nf_conntrack_tuple *t1, -const struct nf_conntrack_tuple *t2) +static inline bool __nf_ct_tuple_src_equal (const struct nf_conntrack_tuple *t1, +const struct nf_conntrack_tuple *t2) {return (nf_inet_addr_cmp (&t1->src.u3, &t2->src.u3) && t1->src.u.all == t2->src.u.all && t1->src.l3num == t2->src.l3num); } -static inline int __nf_ct_tuple_dst_equal (const struct nf_conntrack_tuple *t1, -const struct nf_conntrack_tuple *t2) +static inline bool __nf_ct_tuple_dst_equal (const struct nf_conntrack_tuple *t1, +const struct nf_conntrack_tuple *t2) {return (nf_inet_addr_cmp (&t1->dst.u3, &t2->dst.u3) && t1->dst.u.all == t2->dst.u.all && t1->dst.protonum == t2->dst.protonum); } -static inline int nf_ct_tuple_equal (const struct nf_conntrack_tuple *t1, -const struct nf_conntrack_tuple *t2) +static inline bool nf_ct_tuple_equal (const struct nf_conntrack_tuple *t1, +const struct nf_conntrack_tuple *t2) {return __nf_ct_tuple_src_equal (t1, t2) &&__nf_ct_tuple_dst_equal (t1, t2); } -static inline int nf_ct_tuple_mask_equal (const struct nf_conntrack_tuple_mask *m1, -const struct nf_conntrack_tuple_mask *m2) +static inline bool +nf_ct_tuple_mask_equal (const struct nf_conntrack_tuple_mask *m1, +const struct nf_conntrack_tuple_mask *m2) {return (nf_inet_addr_cmp (&m1->src.u3, &m2->src.u3) && m1->src.u.all == m2->src.u.all); } -static inline int nf_ct_tuple_src_mask_cmp (const struct nf_conntrack_tuple *t1, -const struct nf_conntrack_tuple *t2, -const struct nf_conntrack_tuple_mask *mask) +static inline bool +nf_ct_tuple_src_mask_cmp (const struct nf_conntrack_tuple *t1, +const struct nf_conntrack_tuple *t2, +const struct nf_conntrack_tuple_mask *mask) {int count;for (count =0 ; count <NF_CT_TUPLE_L3SIZE ; count++) {if ((t1->src.u3.all[count] ^ t2->src.u3.all[count]) & mask->src.u3.all[count]) -return 0 ; +return false; }if ((t1->src.u.all ^ t2->src.u.all) & mask->src.u.all) -return 0 ; +return false;if (t1->src.l3num != t2->src.l3num || t1->dst.protonum != t2->dst.protonum) -return 0 ; +return false; -return 1 ; +return true; } -static inline int nf_ct_tuple_mask_cmp (const struct nf_conntrack_tuple *t, -const struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_tuple_mask *mask) +static inline bool +nf_ct_tuple_mask_cmp (const struct nf_conntrack_tuple *t, +const struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_tuple_mask *mask) {return nf_ct_tuple_src_mask_cmp (t, tuple, mask) &&__nf_ct_tuple_dst_equal (t, tuple);
net/netfilter/nf_conntrack_core.c +10 -12
@@ -94,7 +94,7 @@ static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple) nf_conntrack_hash_rnd); } -int +bool nf_ct_get_tuple(const struct sk_buff *skb, unsigned int nhoff, unsigned int dataoff,
@@ -108,7 +108,7 @@ nf_ct_get_tuple(const struct sk_buff *skb, tuple->src.l3num = l3num;if (l3proto->pkt_to_tuple (skb, nhoff, tuple) ==0 ) -return 0 ; +return false; tuple->dst.protonum = protonum; tuple->dst.dir =IP_CT_DIR_ORIGINAL ;
@@ -117,10 +117,8 @@ nf_ct_get_tuple(const struct sk_buff *skb, }EXPORT_SYMBOL_GPL (nf_ct_get_tuple); -int nf_ct_get_tuplepr (const struct sk_buff *skb, -unsigned int nhoff, -u_int16_t l3num, -struct nf_conntrack_tuple *tuple) +bool nf_ct_get_tuplepr (const struct sk_buff *skb,unsigned int nhoff, +u_int16_t l3num,struct nf_conntrack_tuple *tuple) {struct nf_conntrack_l3proto *l3proto;struct nf_conntrack_l4proto *l4proto;
@@ -134,7 +132,7 @@ int nf_ct_get_tuplepr(const struct sk_buff *skb, ret = l3proto->get_l4proto (skb, nhoff, &protoff, &protonum);if (ret !=NF_ACCEPT ) {rcu_read_unlock (); -return 0 ; +return false; } l4proto =__nf_ct_l4proto_find (l3num, protonum);
@@ -147,7 +145,7 @@ int nf_ct_get_tuplepr(const struct sk_buff *skb, }EXPORT_SYMBOL_GPL (nf_ct_get_tuplepr); -int +bool nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse, const struct nf_conntrack_tuple *orig, const struct nf_conntrack_l3proto *l3proto,
@@ -157,7 +155,7 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse, inverse->src.l3num = orig->src.l3num;if (l3proto->invert_tuple (inverse, orig) ==0 ) -return 0 ; +return false; inverse->dst.dir = !orig->dst.dir;
@@ -739,10 +737,10 @@ nf_conntrack_in(unsigned int pf, unsigned int hooknum, struct sk_buff *skb) }EXPORT_SYMBOL_GPL (nf_conntrack_in); -int nf_ct_invert_tuplepr (struct nf_conntrack_tuple *inverse, -const struct nf_conntrack_tuple *orig) +bool nf_ct_invert_tuplepr (struct nf_conntrack_tuple *inverse, +const struct nf_conntrack_tuple *orig) { -int ret; +bool ret;rcu_read_lock (); ret = nf_ct_invert_tuple(inverse, orig,
Signature · 1 line
1.5.4.4
PATCH 24/29 : Replace anon union by nf_conntrack_man_proto
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/net/netfilter/nf_conntrack_tuple.h | 28 +++++--------------- 1 files changed, 7 insertions(+), 21 deletions(-)
include/net/netfilter/nf_conntrack_tuple.h +7 -21
@@ -37,7 +37,12 @@ union nf_conntrack_man_proto__be16 port; } udp;struct { -__be16 id; +union { +__be16 id; +struct { +__u8 type, code; + }; + }; } icmp;struct {__be16 port;
@@ -64,26 +69,7 @@ struct nf_conntrack_tuple/* These are the parts of the tuple which are fixed. */ struct {union nf_inet_addr u3; -union { -/* Add other protocols here. */ -__be16 all; - -struct { -__be16 port; - } tcp; -struct { -__be16 port; - } udp; -struct { -u_int8_t type, code; - } icmp; -struct { -__be16 port; - } sctp; -struct { -__be16 key; - } gre; - } u; +union nf_conntrack_man_proto u;/* The protocol. */ u_int8_t protonum;
Signature · 1 line
1.5.4.4
PATCH 25/29 : Give AF-independent extensions an arpt_ alias
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- net/netfilter/xt_CLASSIFY.c | 1 + net/netfilter/xt_MARK.c | 1 + net/netfilter/xt_RATEEST.c | 1 + net/netfilter/xt_limit.c | 1 + net/netfilter/xt_mark.c | 1 + net/netfilter/xt_quota.c | 1 + net/netfilter/xt_rateest.c | 1 + net/netfilter/xt_statistic.c | 1 + net/netfilter/xt_time.c | 1 + net/netfilter/xt_u32.c | 1 + 10 files changed, 10 insertions(+), 0 deletions(-)
net/netfilter/xt_CLASSIFY.c +1 -0
@@ -25,6 +25,7 @@ MODULE_LICENSE("GPL");MODULE_DESCRIPTION ("Xtables: Qdisc classification" );MODULE_ALIAS ("ipt_CLASSIFY" );MODULE_ALIAS ("ip6t_CLASSIFY" ); +MODULE_ALIAS ("arpt_CLASSIFY" ); static unsigned int classify_tg(struct sk_buff *skb, const struct net_device *in,
net/netfilter/xt_MARK.c +1 -0
@@ -23,6 +23,7 @@ MODULE_AUTHOR("Marc Boucher <[email protected]>");MODULE_DESCRIPTION ("Xtables: packet mark modification" );MODULE_ALIAS ("ipt_MARK" );MODULE_ALIAS ("ip6t_MARK" ); +MODULE_ALIAS ("arpt_MARK" ); static unsigned int mark_tg_v0(struct sk_buff *skb, const struct net_device *in,
net/netfilter/xt_RATEEST.c +1 -0
@@ -190,5 +190,6 @@ MODULE_LICENSE("GPL");MODULE_DESCRIPTION ("Xtables: packet rate estimator" );MODULE_ALIAS ("ipt_RATEEST" );MODULE_ALIAS ("ip6t_RATEEST" ); +MODULE_ALIAS ("arpt_RATEEST" );module_init (xt_rateest_tg_init);module_exit (xt_rateest_tg_fini);
net/netfilter/xt_limit.c +1 -0
@@ -19,6 +19,7 @@ MODULE_AUTHOR("Herve Eychenne <[email protected]>");MODULE_DESCRIPTION ("Xtables: rate-limit match" );MODULE_ALIAS ("ipt_limit" );MODULE_ALIAS ("ip6t_limit" ); +MODULE_ALIAS ("arpt_limit" );/* The algorithm used is the Simple Token Bucket Filter (TBF) * see net/sched/sch_tbf.c in the linux source tree
net/netfilter/xt_mark.c +1 -0
@@ -21,6 +21,7 @@ MODULE_AUTHOR("Marc Boucher <[email protected]>");MODULE_DESCRIPTION ("Xtables: packet mark match" );MODULE_ALIAS ("ipt_mark" );MODULE_ALIAS ("ip6t_mark" ); +MODULE_ALIAS ("arpt_mark" ); static bool mark_mt_v0(const struct sk_buff *skb, const struct net_device *in,
net/netfilter/xt_quota.c +1 -0
@@ -14,6 +14,7 @@ MODULE_AUTHOR("Sam Johnston <[email protected]>");MODULE_DESCRIPTION ("Xtables: countdown quota match" );MODULE_ALIAS ("ipt_quota" );MODULE_ALIAS ("ip6t_quota" ); +MODULE_ALIAS ("arpt_quota" );static DEFINE_SPINLOCK (quota_lock);
net/netfilter/xt_rateest.c +1 -0
@@ -163,5 +163,6 @@ MODULE_LICENSE("GPL");MODULE_DESCRIPTION ("xtables rate estimator match" );MODULE_ALIAS ("ipt_rateest" );MODULE_ALIAS ("ip6t_rateest" ); +MODULE_ALIAS ("arpt_rateest" );module_init (xt_rateest_mt_init);module_exit (xt_rateest_mt_fini);
net/netfilter/xt_statistic.c +1 -0
@@ -21,6 +21,7 @@ MODULE_AUTHOR("Patrick McHardy <[email protected]>");MODULE_DESCRIPTION ("Xtables: statistics-based matching (\"Nth\", random)" );MODULE_ALIAS ("ipt_statistic" );MODULE_ALIAS ("ip6t_statistic" ); +MODULE_ALIAS ("arpt_statistic" );static DEFINE_SPINLOCK (nth_lock);
net/netfilter/xt_time.c +1 -0
@@ -261,3 +261,4 @@ MODULE_DESCRIPTION("Xtables: time-based matching");MODULE_LICENSE ("GPL" );MODULE_ALIAS ("ipt_time" );MODULE_ALIAS ("ip6t_time" ); +MODULE_ALIAS ("arpt_time" );
net/netfilter/xt_u32.c +1 -0
@@ -125,3 +125,4 @@ MODULE_DESCRIPTION("Xtables: arbitrary byte matching");MODULE_LICENSE ("GPL" );MODULE_ALIAS ("ipt_u32" );MODULE_ALIAS ("ip6t_u32" ); +MODULE_ALIAS ("arpt_u32" );
Signature · 1 line
1.5.4.4
PATCH 26/29 : Make Ebtables use Xtables infrastructure
In reply to Jan EngelhardtSigned-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter_bridge/ebtables.h | 15 +- net/bridge/netfilter/ebt_802_3.c | 41 ++-- net/bridge/netfilter/ebt_among.c | 45 ++-- net/bridge/netfilter/ebt_arp.c | 45 ++-- net/bridge/netfilter/ebt_arpreply.c | 49 +++-- net/bridge/netfilter/ebt_dnat.c | 47 ++-- net/bridge/netfilter/ebt_ip.c | 56 +++-- net/bridge/netfilter/ebt_limit.c | 44 ++-- net/bridge/netfilter/ebt_log.c | 52 +++-- net/bridge/netfilter/ebt_mark.c | 46 ++-- net/bridge/netfilter/ebt_mark_m.c | 45 ++-- net/bridge/netfilter/ebt_pkttype.c | 44 ++-- net/bridge/netfilter/ebt_redirect.c | 47 ++-- net/bridge/netfilter/ebt_snat.c | 55 +++-- net/bridge/netfilter/ebt_stp.c | 46 ++-- net/bridge/netfilter/ebt_ulog.c | 51 +++-- net/bridge/netfilter/ebt_vlan.c | 59 +++--- net/bridge/netfilter/ebtables.c | 266 ++++++++------------- net/netfilter/x_tables.c | 6 +- 19 files changed, 539 insertions(+), 520 deletions(-)
include/linux/netfilter_bridge/ebtables.h +6 -9
@@ -117,11 +117,14 @@ struct ebt_entries {#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \ | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST) +struct xt_match ; +struct xt_target ; +struct ebt_entry_match {union {char name[EBT_FUNCTION_MAXNAMELEN ]; -struct ebt_match *match; +struct xt_match *match; } u;/* size of data */ unsigned int match_size;
@@ -132,7 +135,7 @@ struct ebt_entry_watcher {union {char name[EBT_FUNCTION_MAXNAMELEN ]; -struct ebt_watcher *watcher; +struct xt_target *watcher; } u;/* size of data */ unsigned int watcher_size;
@@ -143,7 +146,7 @@ struct ebt_entry_target {union {char name[EBT_FUNCTION_MAXNAMELEN ]; -struct ebt_target *target; +struct xt_target *target; } u;/* size of data */ unsigned int target_size;
@@ -288,12 +291,6 @@ struct ebt_table ~(__alignof__(struct ebt_replace)-1))extern int ebt_register_table (struct ebt_table *table);extern void ebt_unregister_table (struct ebt_table *table); -extern int ebt_register_match (struct ebt_match *match); -extern void ebt_unregister_match (struct ebt_match *match); -extern int ebt_register_watcher (struct ebt_watcher *watcher); -extern void ebt_unregister_watcher (struct ebt_watcher *watcher); -extern int ebt_register_target (struct ebt_target *target); -extern void ebt_unregister_target (struct ebt_target *target);extern unsigned int ebt_do_table (unsigned int hook,struct sk_buff *skb,const struct net_device *in,const struct net_device *out,struct ebt_table *table);
net/bridge/netfilter/ebt_802_3.c +23 -18
71 lines not on this page · raw message
net/bridge/netfilter/ebt_among.c +25 -20
88 lines not on this page · raw message
net/bridge/netfilter/ebt_arp.c +26 -19
78 lines not on this page · raw message
net/bridge/netfilter/ebt_arpreply.c +28 -21
86 lines not on this page · raw message
net/bridge/netfilter/ebt_dnat.c +26 -21
85 lines not on this page · raw message
net/bridge/netfilter/ebt_ip.c +31 -25
103 lines not on this page · raw message
net/bridge/netfilter/ebt_limit.c +23 -21
89 lines not on this page · raw message
net/bridge/netfilter/ebt_log.c +29 -23
101 lines not on this page · raw message
net/bridge/netfilter/ebt_mark.c +26 -20
85 lines not on this page · raw message
net/bridge/netfilter/ebt_mark_m.c +25 -20
76 lines not on this page · raw message
net/bridge/netfilter/ebt_pkttype.c +24 -20
74 lines not on this page · raw message
net/bridge/netfilter/ebt_redirect.c +26 -21
85 lines not on this page · raw message
net/bridge/netfilter/ebt_snat.c +30 -25
97 lines not on this page · raw message
net/bridge/netfilter/ebt_stp.c +26 -20
87 lines not on this page · raw message
net/bridge/netfilter/ebt_ulog.c +29 -22
98 lines not on this page · raw message
net/bridge/netfilter/ebt_vlan.c +28 -31
130 lines not on this page · raw message
net/bridge/netfilter/ebtables.c +104 -162
429 lines not on this page · raw message
net/netfilter/x_tables.c +4 -2
@@ -30,7 +30,7 @@MODULE_LICENSE ("GPL" );MODULE_AUTHOR ("Harald Welte <[email protected]>" ); -MODULE_DESCRIPTION ("[ip,ip6,arp]_tables backend module" ); +MODULE_DESCRIPTION ("{ip,eb,ip6,arp}_tables backend module" );#define SMP_ALIGN (x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
@@ -61,6 +61,7 @@ static struct xt_af *xt;static const char *const xt_prefix[NPROTO ] = { [AF_UNSPEC ] ="x" , [AF_INET ] ="ip" , + [AF_BRIDGE ] ="eb" , [AF_INET6 ] ="ip6" , [AF_ARP ] ="arp" , };
@@ -327,7 +328,8 @@ int xt_check_match(const struct xt_match *match, unsigned short family, unsigned int size, const char *table, unsigned int hook_mask, unsigned short proto, int inv_proto) { - if (XT_ALIGN(match->matchsize) != size) { + /* testing for -1 is temporary until ebtables is fixed up */ + if (match->matchsize != -1 && XT_ALIGN(match->matchsize) != size) { printk("%s_tables: %s match: invalid size %Zu != %u\n", xt_prefix[family], match->name, XT_ALIGN(match->matchsize), size);
Signature · 1 line
1.5.4.4
PATCH 27/29 : Deploy a prefix_length-to-network mask mapping table
In reply to Jan EngelhardtUserspace utilities commonly transform a prefix length (CIDR notation like 192.168.222.1/32) into a full netmask before submitting it to the kernel.
The size of struct xt_conntrack_mtinfo1 is currently 152 bytes, of which 64 bytes are for masks. By submitting prefix lengths to the kernel instead, 60 bytes (almost 40%) memory per rule can be saved as prefix lengths can fit into one uint8_t. Since we do not want to recompute the mask for each invocation of the match function, a static translation table will be used (net/core/pfxlen.c).
The patch changes xt_conntrack revision 1 into revision 2. Userspace can easily fall back to revision 0.
The patch also removes xt_hashlimit's obsolete mask computation.
Signed-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter/xt_conntrack.h | 12 +- include/net/pfxlen.h | 8 ++ net/Kconfig | 6 + net/core/Makefile | 1 + net/core/pfxlen.c | 146 ++++++++++++++++++++++++ net/netfilter/Kconfig | 1 + net/netfilter/xt_conntrack.c | 43 +++++--- net/netfilter/xt_hashlimit.c | 40 ++----- 8 files changed, 206 insertions(+), 51 deletions(-) create mode 100644 include/net/pfxlen.h create mode 100644 net/core/pfxlen.c
include/linux/netfilter/xt_conntrack.h +7 -5
@@ -67,17 +67,19 @@ struct xt_conntrack_info u_int8_t invflags; }; -struct xt_conntrack_mtinfo1 { -union nf_inet_addr origsrc_addr, origsrc_mask; -union nf_inet_addr origdst_addr, origdst_mask; -union nf_inet_addr replsrc_addr, replsrc_mask; -union nf_inet_addr repldst_addr, repldst_mask; +struct xt_conntrack_mtinfo2 { +union nf_inet_addr origsrc_addr; +union nf_inet_addr origdst_addr; +union nf_inet_addr replsrc_addr; +union nf_inet_addr repldst_addr;u_int32_t expires_min, expires_max;u_int16_t l4proto;__be16 origsrc_port, origdst_port;__be16 replsrc_port, repldst_port;u_int16_t match_flags, invert_flags;u_int8_t state_mask, status_mask; +u_int8_t origsrc_pfx, origdst_pfx; +u_int8_t replsrc_pfx, repldst_pfx; };#endif /*_XT_CONNTRACK_H*/
include/net/pfxlen.h new file +8 -0
@@ -0,0 +1,8 @@ +#ifndef _NET_PFXLEN_H +#define _NET_PFXLEN_H 1 + +#include <linux/netfilter.h> + +extern union nf_inet_addr prefixlen_netmask_map[]; + +#endif /* _NET_PFXLEN_H */
net/Kconfig +6 -0
@@ -27,6 +27,12 @@ if NET menu "Networking options" +config NET_PFXLEN + tristate + ---help--- + This option adds a translation table from prefix length to + expanded netmasks (e.g. /28 => 255.255.255.240) + config NET_NS bool "Network namespace support" default n
net/core/Makefile +1 -0
@@ -16,3 +16,4 @@ obj-$(CONFIG_NET_PKTGEN) += pktgen.o obj-$(CONFIG_NETPOLL) += netpoll.o obj-$(CONFIG_NET_DMA) += user_dma.o obj-$(CONFIG_FIB_RULES) += fib_rules.o +obj-$(CONFIG_NET_PFXLEN) += pfxlen.o
net/core/pfxlen.c new file +146 -0
146 lines not on this page · raw message
net/netfilter/Kconfig +1 -0
@@ -27,6 +27,7 @@ config NETFILTER_NETLINK_LOG config NF_CONNTRACK tristate "Netfilter connection tracking support" default m if NETFILTER_ADVANCED=n + select NET_PFXLEN help Connection tracking keeps a record of what packets have passed through your machine, in order to figure out how they are related
net/netfilter/xt_conntrack.c +29 -14
108 lines not on this page · raw message
net/netfilter/xt_hashlimit.c +8 -32
@@ -26,6 +26,7 @@#endif #include <net/net_namespace.h> +#include <net/pfxlen.h> #include <linux/netfilter/x_tables.h> #include <linux/netfilter_ipv4/ip_tables.h>
@@ -466,43 +467,18 @@ static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)static inline __be32 maskl (__be32 a,unsigned int l) { -return htonl (ntohl (a) & ~(~(u_int32_t )0 >> l)); +return a & prefixlen_netmask_map[l].ip; }#if defined(CONFIG_IP6_NF_IPTABLES ) || defined(CONFIG_IP6_NF_IPTABLES_MODULE )static void hashlimit_ipv6_mask (__be32 *i,unsigned int p) { -switch (p) { -case 0 : - i[0 ] = i[1 ] =0 ; - i[2 ] = i[3 ] =0 ; -break ; - case 1 ... 31: - i[0 ] =maskl (i[0 ], p); - i[1 ] = i[2 ] = i[3 ] =0 ; -break ; -case 32 : - i[1 ] = i[2 ] = i[3 ] =0 ; -break ; - case 33 ... 63: - i[1 ] =maskl (i[1 ], p -32 ); - i[2 ] = i[3 ] =0 ; -break ; -case 64 : - i[2 ] = i[3 ] =0 ; -break ; - case 65 ... 95: - i[2 ] =maskl (i[2 ], p -64 ); - i[3 ] =0 ; -case 96 : - i[3 ] =0 ; -break ; - case 97 ... 127: - i[3 ] =maskl (i[3 ], p -96 ); -break ; -case 128 : -break ; - } +const union nf_inet_addr *mask = &prefixlen_netmask_map[p]; + + i[0 ] &= mask->ip6[0 ]; + i[1 ] &= mask->ip6[1 ]; + i[2 ] &= mask->ip6[2 ]; + i[3 ] &= mask->ip6[3 ]; }#endif
Signature · 1 line
1.5.4.4
PATCH 28/29 : xt_length match, revision 1
In reply to Jan EngelhardtIntroduce xt_length match revision 1. It adds support for layer-4, layer-5 and layer-7 length matching. It is much easier than writing up the according xt_u32 magic.
This can be used for packet scheduling; specific example are online games where all data is transferred over the same port, but the regular gameplay has a characteristically lower packet size than bulk downloads of game maps.
Signed-off-by Jan Engelhardt <[email protected]>
--- include/linux/netfilter/xt_length.h | 21 +++ net/netfilter/xt_length.c | 260 +++++++++++++++++++++++++-- 2 files changed, 264 insertions(+), 17 deletions(-)
include/linux/netfilter/xt_length.h +21 -0
@@ -6,4 +6,25 @@ struct xt_length_info { u_int8_t invert; }; +enum { +XT_LENGTH_INVERT =1 <<0 , + +/* IP header plus payload */ +XT_LENGTH_LAYER3 =1 <<1 , + +/* TCP/UDP/etc. header plus payload */ +XT_LENGTH_LAYER4 =1 <<2 , + +/* TCP/UDP/etc. payload */ +XT_LENGTH_LAYER5 =1 <<3 , + +/* SCTP payload */ +XT_LENGTH_LAYER7 =1 <<4 , +}; + +struct xt_length_mtinfo1 { +__u32 min, max; +__u16 flags; +}; +#endif /*_XT_LENGTH_H*/
net/netfilter/xt_length.c +243 -17
308 lines not on this page · raw message
Signature · 1 line
1.5.4.4
PATCH 29/29 : Replace NF_CT_DUMP_TUPLE macro indrection by function call
In reply to Jan EngelhardtDirectly call IPv4 and IPv6 variants where the address family is easily known.
Signed-off-by Jan Engelhardt <[email protected]>
--- include/net/netfilter/nf_conntrack_tuple.h | 2 - net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 2 +- net/ipv4/netfilter/nf_nat_pptp.c | 2 +- net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 2 +- net/netfilter/nf_conntrack_core.c | 2 +- net/netfilter/nf_conntrack_h323_main.c | 26 ++++++++-------- net/netfilter/nf_conntrack_pptp.c | 4 +- net/netfilter/nf_conntrack_proto_gre.c | 6 ++-- net/netfilter/nf_conntrack_proto_tcp.c | 6 ++-- net/netfilter/nf_conntrack_sane.c | 2 +- net/netfilter/nf_conntrack_tftp.c | 6 ++-- 12 files changed, 30 insertions(+), 32 deletions(-)
include/net/netfilter/nf_conntrack_tuple.h +0 -2
@@ -131,8 +131,6 @@ static inline void nf_ct_dump_tuple(const struct nf_conntrack_tuple *t) } } -#define NF_CT_DUMP_TUPLE (tp) nf_ct_dump_tuple(tp) -/* If we're the first tuple, it's the original dir. */ #define NF_CT_DIRECTION (h) \ ((enum ip_conntrack_dir)(h)->tuple.dst.dir)
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
@@ -332,7 +332,7 @@ clusterip_tg(struct sk_buff *skb, const struct net_device *in, }#ifdef DEBUG -NF_CT_DUMP_TUPLE (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple); +nf_ct_dump_tuple_ip (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple);#endif pr_debug ("hash=%u ct_hash=%u " , hash, ct->mark);if (!clusterip_responsible (cipinfo->config, hash)) {
net/ipv4/netfilter/nf_conntrack_proto_icmp.c +1 -1
@@ -115,7 +115,7 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,/* Can't create a new ICMP `conn' with this. */ pr_debug ("icmp: can't create new conn with type %u\n" , ct->tuplehash[0 ].tuple.dst.u.icmp.type); -NF_CT_DUMP_TUPLE (&ct->tuplehash[0 ].tuple); +nf_ct_dump_tuple_ip (&ct->tuplehash[0 ].tuple);return false; }atomic_set (&ct->proto.icmp.count,0 );
net/ipv4/netfilter/nf_nat_pptp.c +1 -1
@@ -72,7 +72,7 @@ static void pptp_nat_expected(struct nf_conn *ct, }pr_debug ("trying to unexpect other dir: " ); -NF_CT_DUMP_TUPLE (&t); +nf_ct_dump_tuple_ip (&t); other_exp =nf_ct_expect_find_get (&t);if (other_exp) {nf_ct_unexpect_related (other_exp);
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +1 -1
@@ -115,7 +115,7 @@ static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb,/* Can't create a new ICMPv6 `conn' with this. */ pr_debug ("icmpv6: can't create new conn with type %u\n" , type +128 ); -NF_CT_DUMP_TUPLE (&ct->tuplehash[0 ].tuple); +nf_ct_dump_tuple_ipv6 (&ct->tuplehash[0 ].tuple);return false; }atomic_set (&ct->proto.icmp.count,0 );
net/netfilter/nf_conntrack_core.c +1 -1
@@ -764,7 +764,7 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,NF_CT_ASSERT (!nf_ct_is_confirmed (ct));pr_debug ("Altering reply tuple of %p to " , ct); -NF_CT_DUMP_TUPLE (newreply); +nf_ct_dump_tuple (newreply); ct->tuplehash[IP_CT_DIR_REPLY ].tuple = *newreply;if (ct->master || (help && help->expecting !=0 ))
net/netfilter/nf_conntrack_h323_main.c +13 -13
@@ -306,9 +306,9 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,if (nf_ct_expect_related (rtp_exp) ==0 ) {if (nf_ct_expect_related (rtcp_exp) ==0 ) {pr_debug ("nf_ct_h323: expect RTP " ); -NF_CT_DUMP_TUPLE (&rtp_exp->tuple); +nf_ct_dump_tuple (&rtp_exp->tuple);pr_debug ("nf_ct_h323: expect RTCP " ); -NF_CT_DUMP_TUPLE (&rtcp_exp->tuple); +nf_ct_dump_tuple (&rtcp_exp->tuple); }else {nf_ct_unexpect_related (rtp_exp); ret =-1 ;
@@ -364,7 +364,7 @@ static int expect_t120(struct sk_buff *skb, }else {/* Conntrack only */ if (nf_ct_expect_related (exp) ==0 ) {pr_debug ("nf_ct_h323: expect T.120 " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple); }else ret =-1 ; }
@@ -586,7 +586,7 @@ static int h245_help(struct sk_buff *skb, unsigned int protoff,while (get_tpkt_data (skb, protoff, ct, ctinfo, &data, &datalen, &dataoff)) {pr_debug ("nf_ct_h245: TPKT len=%d " , datalen); -NF_CT_DUMP_TUPLE (&ct->tuplehash[CTINFO2DIR (ctinfo)].tuple); +nf_ct_dump_tuple (&ct->tuplehash[CTINFO2DIR (ctinfo)].tuple);/* Decode H.245 signal */ ret = DecodeMultimediaSystemControlMessage(data, datalen,
@@ -701,7 +701,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct, }else {/* Conntrack only */ if (nf_ct_expect_related (exp) ==0 ) {pr_debug ("nf_ct_q931: expect H.245 " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple); }else ret =-1 ; }
@@ -818,7 +818,7 @@ static int expect_callforwarding(struct sk_buff *skb, }else {/* Conntrack only */ if (nf_ct_expect_related (exp) ==0 ) {pr_debug ("nf_ct_q931: expect Call Forwarding " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple); }else ret =-1 ; }
@@ -1138,7 +1138,7 @@ static int q931_help(struct sk_buff *skb, unsigned int protoff,while (get_tpkt_data (skb, protoff, ct, ctinfo, &data, &datalen, &dataoff)) {pr_debug ("nf_ct_q931: TPKT len=%d " , datalen); -NF_CT_DUMP_TUPLE (&ct->tuplehash[CTINFO2DIR (ctinfo)].tuple); +nf_ct_dump_tuple (&ct->tuplehash[CTINFO2DIR (ctinfo)].tuple);/* Decode Q.931 signal */ ret =DecodeQ931 (data, datalen, &q931);
@@ -1288,7 +1288,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct, }else {/* Conntrack only */ if (nf_ct_expect_related (exp) ==0 ) {pr_debug ("nf_ct_ras: expect Q.931 " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple);/* Save port for looking up expect in processing RCF */ info->sig_port[dir] = port;
@@ -1353,7 +1353,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,if (nf_ct_expect_related (exp) ==0 ) {pr_debug ("nf_ct_ras: expect RAS " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple); }else ret =-1 ;
@@ -1437,7 +1437,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,pr_debug ("nf_ct_ras: set Q.931 expect " "timeout to %u seconds for" , info->timeout); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple);set_expect_timeout (exp, info->timeout); }spin_unlock_bh (&nf_conntrack_lock);
@@ -1559,7 +1559,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct,if (nf_ct_expect_related (exp) ==0 ) {pr_debug ("nf_ct_ras: expect Q.931 " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple); }else ret =-1 ;
@@ -1613,7 +1613,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct,if (nf_ct_expect_related (exp) ==0 ) {pr_debug ("nf_ct_ras: expect Q.931 " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple); }else ret =-1 ;
@@ -1717,7 +1717,7 @@ static int ras_help(struct sk_buff *skb, unsigned int protoff,if (data ==NULL ) goto accept;pr_debug ("nf_ct_ras: RAS message len=%d " , datalen); -NF_CT_DUMP_TUPLE (&ct->tuplehash[CTINFO2DIR (ctinfo)].tuple); +nf_ct_dump_tuple (&ct->tuplehash[CTINFO2DIR (ctinfo)].tuple);/* Decode RAS message */ ret =DecodeRasMessage (data, datalen, &ras);
net/netfilter/nf_conntrack_pptp.c +2 -2
@@ -119,7 +119,7 @@ static void pptp_expectfn(struct nf_conn *ct,/* obviously this tuple inversion only works until you do NAT */ nf_ct_invert_tuplepr (&inv_t, &exp->tuple);pr_debug ("trying to unexpect other dir: " ); -NF_CT_DUMP_TUPLE (&inv_t); +nf_ct_dump_tuple (&inv_t); exp_other =nf_ct_expect_find_get (&inv_t);if (exp_other) {
@@ -141,7 +141,7 @@ static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)struct nf_conn *sibling;pr_debug ("trying to timeout ct or exp for tuple " ); -NF_CT_DUMP_TUPLE (t); +nf_ct_dump_tuple (t); h =nf_conntrack_find_get (t);if (h) {
net/netfilter/nf_conntrack_proto_gre.c +3 -3
@@ -82,7 +82,7 @@ static __be16 gre_keymap_lookup(struct nf_conntrack_tuple *t)read_unlock_bh (&nf_ct_gre_lock);pr_debug ("lookup src key 0x%x for " , key); -NF_CT_DUMP_TUPLE (t); +nf_ct_dump_tuple (t);return key; }
@@ -113,7 +113,7 @@ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir, *kmp = km;pr_debug ("adding new entry %p: " , km); -NF_CT_DUMP_TUPLE (&km->tuple); +nf_ct_dump_tuple (&km->tuple);write_lock_bh (&nf_ct_gre_lock);list_add_tail (&km->list, &gre_keymap_list);
@@ -238,7 +238,7 @@ static bool gre_new(struct nf_conn *ct, const struct sk_buff *skb, unsigned int dataoff) {pr_debug (": " ); -NF_CT_DUMP_TUPLE (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple); +nf_ct_dump_tuple (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple);/* initialize to sane value. Ideally a conntrack helper * (e.g. in case of pptp) is increasing them */
net/netfilter/nf_conntrack_proto_tcp.c +3 -3
@@ -501,7 +501,7 @@ static bool tcp_in_window(const struct nf_conn *ct, struct ip_ct_tcp *state,pr_debug ("tcp_in_window: START\n" );pr_debug ("tcp_in_window: " ); -NF_CT_DUMP_TUPLE (tuple); +nf_ct_dump_tuple (tuple);pr_debug ("seq=%u ack=%u sack=%u win=%u end=%u\n" , seq, ack, sack, win, end); pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
@@ -588,7 +588,7 @@ static bool tcp_in_window(const struct nf_conn *ct, struct ip_ct_tcp *state, seq = end = sender->td_end;pr_debug ("tcp_in_window: " ); -NF_CT_DUMP_TUPLE (tuple); +nf_ct_dump_tuple (tuple);pr_debug ("seq=%u ack=%u sack =%u win=%u end=%u\n" , seq, ack, sack, win, end); pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
@@ -932,7 +932,7 @@ static int tcp_packet(struct nf_conn *ct, ct->proto.tcp.last_dir = dir;pr_debug ("tcp_conntracks: " ); -NF_CT_DUMP_TUPLE (tuple); +nf_ct_dump_tuple (tuple); pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n", (th->syn ? 1 : 0), (th->ack ? 1 : 0), (th->fin ? 1 : 0), (th->rst ? 1 : 0),
net/netfilter/nf_conntrack_sane.c +1 -1
@@ -148,7 +148,7 @@ static int help(struct sk_buff *skb, IPPROTO_TCP, NULL, &reply->port);pr_debug ("nf_ct_sane: expect: " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple);/* Can't expect this? Best to drop packet now. */ if (nf_ct_expect_related (exp) !=0 )
net/netfilter/nf_conntrack_tftp.c +3 -3
@@ -56,8 +56,8 @@ static int tftp_help(struct sk_buff *skb,case TFTP_OPCODE_READ :case TFTP_OPCODE_WRITE :/* RRQ and WRQ works the same way */ -NF_CT_DUMP_TUPLE (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple); -NF_CT_DUMP_TUPLE (&ct->tuplehash[IP_CT_DIR_REPLY ].tuple); +nf_ct_dump_tuple (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple); +nf_ct_dump_tuple (&ct->tuplehash[IP_CT_DIR_REPLY ].tuple); exp =nf_ct_expect_alloc (ct);if (exp ==NULL )
@@ -68,7 +68,7 @@ static int tftp_help(struct sk_buff *skb, IPPROTO_UDP, NULL, &tuple->dst.u.udp.port);pr_debug ("expect: " ); -NF_CT_DUMP_TUPLE (&exp->tuple); +nf_ct_dump_tuple (&exp->tuple); nf_nat_tftp =rcu_dereference (nf_nat_tftp_hook);if (nf_nat_tftp && ct->status &IPS_NAT_MASK )
Signature · 1 line
1.5.4.4
Quoted 10 lines · Jan Engelhardt
git@ cc'd for justice.
<rants>
*
git-format-patch --stdout | git-send-emaildoes not fly, files need to be exported first, it's a bit inconvenient* git-send-email should really default to --no-chain
Quoted 7 lines
* git-send-email should stop if it cannot find the headers it is looking for (esp. Subject), even if I dared to forget --dry-run (point in case: git log -1 mycommit >x.diff; git-send-email x.diff)
</rants>
And now some apology to the mailbomb caused by that program.
That was three failed attempts (last one went to netfilter instead of netfilter-devel). Please try this on yourself or someone you don't like next time :)
Re: git-format-patch|git-send-email sucks
In reply to Jan EngelhardtQuoted 8 lines · Jan Engelhardt
git@ cc'd for justice.
<rants>
*
git-format-patch --stdout | git-send-emaildoes not fly, files need to be exported first, it's a bit inconvenient
Quoted 7 lines
* git-send-email should really default to --no-chain
* git-send-email should stop if it cannot find the headers it is looking for (esp. Subject), even if I dared to forget --dry-run (point in case: git log -1 mycommit >x.diff; git-send-email x.diff)
</rants>
<more rants>
To be in the picture, the command issued was:
rm -f 00*; git-format-patch -C -M --stat=72 --summary -p --thread -n origin/symbolic/upstream..HEAD; git-send-email --thread --no-signed-off-by-cc --no-chain --to user2@localhost 00*
* jengelh@localhost _still_ gets all the mails
</more rants>
Re: git-format-patch|git-send-email sucks
Quoted 5 lines · Jan Engelhardt
To be in the picture, the command issued was:
rm -f 00*; git-format-patch -C -M --stat=72 --summary -p --thread -n origin/symbolic/upstream..HEAD; git-send-email --thread --no-signed-off-by-cc --no-chain --to user2@localhost 00*
Maybe adding --suppress-from would help?
See the --suppress-* family in the git-send-email docs along with the sendemail.suppress* configuration counterparts.
-brandon