Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 737535c5 authored by Jan Engelhardt's avatar Jan Engelhardt
Browse files

netfilter: xtables: compact table hook functions (1/2) 



This patch combines all the per-hook functions in a given table into
a single function. Together with the 2nd patch, further
simplifications are possible up to the point of output code reduction.

Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
parent 9ab99d5a

net/ipv4/netfilter/arptable_filter.c

+12 −18
Original line number Diff line number Diff line
@@ -53,43 +53,37 @@ static const struct xt_table packet_filter = { 
};



/* The work comes in here from netfilter.c */

static unsigned int arpt_in_hook(unsigned int hook,

				 struct sk_buff *skb,

				 const struct net_device *in,

				 const struct net_device *out,

static unsigned int

arptable_filter_hook(unsigned int hook, struct sk_buff *skb,

		     const struct net_device *in, const struct net_device *out,

		     int (*okfn)(struct sk_buff *))

{

	if (hook == NF_ARP_OUT)

		return arpt_do_table(skb, hook, in, out,

			     dev_net(in)->ipv4.arptable_filter);

}

				     dev_net(out)->ipv4.arptable_filter);



static unsigned int arpt_out_hook(unsigned int hook,

				  struct sk_buff *skb,

				  const struct net_device *in,

				  const struct net_device *out,

				  int (*okfn)(struct sk_buff *))

{

	/* INPUT/FORWARD: */

	return arpt_do_table(skb, hook, in, out,

			     dev_net(out)->ipv4.arptable_filter);

			     dev_net(in)->ipv4.arptable_filter);

}



static struct nf_hook_ops arpt_ops[] __read_mostly = {

	{

		.hook		= arpt_in_hook,

		.hook		= arptable_filter_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_ARP,

		.hooknum	= NF_ARP_IN,

		.priority	= NF_IP_PRI_FILTER,

	},

	{

		.hook		= arpt_out_hook,

		.hook		= arptable_filter_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_ARP,

		.hooknum	= NF_ARP_OUT,

		.priority	= NF_IP_PRI_FILTER,

	},

	{

		.hook		= arpt_in_hook,

		.hook		= arptable_filter_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_ARP,

		.hooknum	= NF_ARP_FORWARD,

net/ipv4/netfilter/iptable_filter.c

+16 −34
Original line number Diff line number Diff line
@@ -60,61 +60,43 @@ static const struct xt_table packet_filter = { 
	.af		= NFPROTO_IPV4,

};



/* The work comes in here from netfilter.c. */

static unsigned int

ipt_local_in_hook(unsigned int hook,

		  struct sk_buff *skb,

		  const struct net_device *in,

		  const struct net_device *out,

iptable_filter_hook(unsigned int hook, struct sk_buff *skb,

		    const struct net_device *in, const struct net_device *out,

		    int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_filter);

}



static unsigned int

ipt_hook(unsigned int hook,

	 struct sk_buff *skb,

	 const struct net_device *in,

	 const struct net_device *out,

	 int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_filter);

}



static unsigned int

ipt_local_out_hook(unsigned int hook,

		   struct sk_buff *skb,

		   const struct net_device *in,

		   const struct net_device *out,

		   int (*okfn)(struct sk_buff *))

{

	/* root is playing with raw sockets. */

	if (hook == NF_INET_LOCAL_OUT) {

		if (skb->len < sizeof(struct iphdr) ||

		    ip_hdrlen(skb) < sizeof(struct iphdr))

			/* root is playing with raw sockets. */

			return NF_ACCEPT;



		return ipt_do_table(skb, hook, in, out,

				    dev_net(out)->ipv4.iptable_filter);

	}



	/* LOCAL_IN/FORWARD: */

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_filter);

}



static struct nf_hook_ops ipt_ops[] __read_mostly = {

	{

		.hook		= ipt_local_in_hook,

		.hook		= iptable_filter_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP_PRI_FILTER,

	},

	{

		.hook		= ipt_hook,

		.hook		= iptable_filter_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_FORWARD,

		.priority	= NF_IP_PRI_FILTER,

	},

	{

		.hook		= ipt_local_out_hook,

		.hook		= iptable_filter_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_OUT,

net/ipv4/netfilter/iptable_mangle.c

+21 −50
Original line number Diff line number Diff line
@@ -71,51 +71,6 @@ static const struct xt_table packet_mangler = { 
	.af		= NFPROTO_IPV4,

};



/* The work comes in here from netfilter.c. */

static unsigned int

ipt_pre_routing_hook(unsigned int hook,

		     struct sk_buff *skb,

		     const struct net_device *in,

		     const struct net_device *out,

		     int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_mangle);

}



static unsigned int

ipt_post_routing_hook(unsigned int hook,

		      struct sk_buff *skb,

		      const struct net_device *in,

		      const struct net_device *out,

		      int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(out)->ipv4.iptable_mangle);

}



static unsigned int

ipt_local_in_hook(unsigned int hook,

		  struct sk_buff *skb,

		  const struct net_device *in,

		  const struct net_device *out,

		  int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_mangle);

}



static unsigned int

ipt_forward_hook(unsigned int hook,

	 struct sk_buff *skb,

	 const struct net_device *in,

	 const struct net_device *out,

	 int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_mangle);

}



static unsigned int

ipt_local_hook(unsigned int hook,

		   struct sk_buff *skb,
@@ -158,37 +113,53 @@ ipt_local_hook(unsigned int hook, 
	return ret;

}



/* The work comes in here from netfilter.c. */

static unsigned int

iptable_mangle_hook(unsigned int hook,

		     struct sk_buff *skb,

		     const struct net_device *in,

		     const struct net_device *out,

		     int (*okfn)(struct sk_buff *))

{

	if (hook == NF_INET_LOCAL_OUT)

		return ipt_local_hook(hook, skb, in, out, okfn);



	/* PREROUTING/INPUT/FORWARD: */

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_mangle);

}



static struct nf_hook_ops ipt_ops[] __read_mostly = {

	{

		.hook		= ipt_pre_routing_hook,

		.hook		= iptable_mangle_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_PRE_ROUTING,

		.priority	= NF_IP_PRI_MANGLE,

	},

	{

		.hook		= ipt_local_in_hook,

		.hook		= iptable_mangle_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP_PRI_MANGLE,

	},

	{

		.hook		= ipt_forward_hook,

		.hook		= iptable_mangle_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_FORWARD,

		.priority	= NF_IP_PRI_MANGLE,

	},

	{

		.hook		= ipt_local_hook,

		.hook		= iptable_mangle_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_OUT,

		.priority	= NF_IP_PRI_MANGLE,

	},

	{

		.hook		= ipt_post_routing_hook,

		.hook		= iptable_mangle_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_POST_ROUTING,

net/ipv4/netfilter/iptable_raw.c

+9 −17
Original line number Diff line number Diff line
@@ -45,23 +45,15 @@ static const struct xt_table packet_raw = { 


/* The work comes in here from netfilter.c. */

static unsigned int

ipt_hook(unsigned int hook,

	 struct sk_buff *skb,

	 const struct net_device *in,

	 const struct net_device *out,

iptable_raw_hook(unsigned int hook, struct sk_buff *skb,

		 const struct net_device *in, const struct net_device *out,

		 int (*okfn)(struct sk_buff *))

{

	if (hook == NF_INET_PRE_ROUTING)

		return ipt_do_table(skb, hook, in, out,

				    dev_net(in)->ipv4.iptable_raw);

}



static unsigned int

ipt_local_hook(unsigned int hook,

	       struct sk_buff *skb,

	       const struct net_device *in,

	       const struct net_device *out,

	       int (*okfn)(struct sk_buff *))

{

	/* OUTPUT: */

	/* root is playing with raw sockets. */

	if (skb->len < sizeof(struct iphdr) ||

	    ip_hdrlen(skb) < sizeof(struct iphdr))
@@ -73,14 +65,14 @@ ipt_local_hook(unsigned int hook, 
/* 'raw' is the very first table. */

static struct nf_hook_ops ipt_ops[] __read_mostly = {

	{

		.hook = ipt_hook,

		.hook = iptable_raw_hook,

		.pf = NFPROTO_IPV4,

		.hooknum = NF_INET_PRE_ROUTING,

		.priority = NF_IP_PRI_RAW,

		.owner = THIS_MODULE,

	},

	{

		.hook = ipt_local_hook,

		.hook = iptable_raw_hook,

		.pf = NFPROTO_IPV4,

		.hooknum = NF_INET_LOCAL_OUT,

		.priority = NF_IP_PRI_RAW,

net/ipv4/netfilter/iptable_security.c

+17 −33
Original line number Diff line number Diff line
@@ -65,59 +65,43 @@ static const struct xt_table security_table = { 
};



static unsigned int

ipt_local_in_hook(unsigned int hook,

		  struct sk_buff *skb,

iptable_security_hook(unsigned int hook, struct sk_buff *skb,

		      const struct net_device *in,

		      const struct net_device *out,

		      int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_security);

}



static unsigned int

ipt_forward_hook(unsigned int hook,

		 struct sk_buff *skb,

		 const struct net_device *in,

		 const struct net_device *out,

		 int (*okfn)(struct sk_buff *))

{

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_security);

}



static unsigned int

ipt_local_out_hook(unsigned int hook,

		   struct sk_buff *skb,

		   const struct net_device *in,

		   const struct net_device *out,

		   int (*okfn)(struct sk_buff *))

{

	/* Somebody is playing with raw sockets. */

	if (hook == NF_INET_LOCAL_OUT) {

		if (skb->len < sizeof(struct iphdr) ||

		    ip_hdrlen(skb) < sizeof(struct iphdr))

			/* Somebody is playing with raw sockets. */

			return NF_ACCEPT;



		return ipt_do_table(skb, hook, in, out,

				    dev_net(out)->ipv4.iptable_security);

	}



	/* INPUT/FORWARD: */

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_security);

}



static struct nf_hook_ops ipt_ops[] __read_mostly = {

	{

		.hook		= ipt_local_in_hook,

		.hook		= iptable_security_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP_PRI_SECURITY,

	},

	{

		.hook		= ipt_forward_hook,

		.hook		= iptable_security_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_FORWARD,

		.priority	= NF_IP_PRI_SECURITY,

	},

	{

		.hook		= ipt_local_out_hook,

		.hook		= iptable_security_hook,

		.owner		= THIS_MODULE,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_OUT,