Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e5a1c7e authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: use hook state from xt_action_param structure 



Don't copy relevant fields from hook state structure, instead use the
one that is already available in struct xt_action_param.

This patch also adds a set of new wrapper functions to fetch relevant
hook state structure fields.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 613dbd95

include/net/netfilter/nf_tables.h

+25 −10
Original line number Diff line number Diff line
@@ -14,27 +14,42 @@ 


struct nft_pktinfo {

	struct sk_buff			*skb;

	struct net			*net;

	const struct net_device		*in;

	const struct net_device		*out;

	u8				pf;

	u8				hook;

	bool				tprot_set;

	u8				tprot;

	/* for x_tables compatibility */

	struct xt_action_param		xt;

};



static inline struct net *nft_net(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->net;

}



static inline unsigned int nft_hook(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->hook;

}



static inline u8 nft_pf(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->pf;

}



static inline const struct net_device *nft_in(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->in;

}



static inline const struct net_device *nft_out(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->out;

}



static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,

				   struct sk_buff *skb,

				   const struct nf_hook_state *state)

{

	pkt->skb = skb;

	pkt->net = state->net;

	pkt->in = state->in;

	pkt->out = state->out;

	pkt->hook = state->hook;

	pkt->pf = state->pf;

	pkt->xt.state = state;

}

net/bridge/netfilter/nft_meta_bridge.c

+1 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr, 
				     const struct nft_pktinfo *pkt)

{

	const struct nft_meta *priv = nft_expr_priv(expr);

	const struct net_device *in = pkt->in, *out = pkt->out;

	const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);

	u32 *dest = &regs->data[priv->dreg];

	const struct net_bridge_port *p;

net/bridge/netfilter/nft_reject_bridge.c

+18 −12
Original line number Diff line number Diff line
@@ -315,17 +315,20 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, 
	case htons(ETH_P_IP):

		switch (priv->type) {

		case NFT_REJECT_ICMP_UNREACH:

			nft_reject_br_send_v4_unreach(pkt->net, pkt->skb,

						      pkt->in, pkt->hook,

			nft_reject_br_send_v4_unreach(nft_net(pkt), pkt->skb,

						      nft_in(pkt),

						      nft_hook(pkt),

						      priv->icmp_code);

			break;

		case NFT_REJECT_TCP_RST:

			nft_reject_br_send_v4_tcp_reset(pkt->net, pkt->skb,

							pkt->in, pkt->hook);

			nft_reject_br_send_v4_tcp_reset(nft_net(pkt), pkt->skb,

							nft_in(pkt),

							nft_hook(pkt));

			break;

		case NFT_REJECT_ICMPX_UNREACH:

			nft_reject_br_send_v4_unreach(pkt->net, pkt->skb,

						      pkt->in, pkt->hook,

			nft_reject_br_send_v4_unreach(nft_net(pkt), pkt->skb,

						      nft_in(pkt),

						      nft_hook(pkt),

						      nft_reject_icmp_code(priv->icmp_code));

			break;

		}
@@ -333,17 +336,20 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, 
	case htons(ETH_P_IPV6):

		switch (priv->type) {

		case NFT_REJECT_ICMP_UNREACH:

			nft_reject_br_send_v6_unreach(pkt->net, pkt->skb,

						      pkt->in, pkt->hook,

			nft_reject_br_send_v6_unreach(nft_net(pkt), pkt->skb,

						      nft_in(pkt),

						      nft_hook(pkt),

						      priv->icmp_code);

			break;

		case NFT_REJECT_TCP_RST:

			nft_reject_br_send_v6_tcp_reset(pkt->net, pkt->skb,

							pkt->in, pkt->hook);

			nft_reject_br_send_v6_tcp_reset(nft_net(pkt), pkt->skb,

							nft_in(pkt),

							nft_hook(pkt));

			break;

		case NFT_REJECT_ICMPX_UNREACH:

			nft_reject_br_send_v6_unreach(pkt->net, pkt->skb,

						      pkt->in, pkt->hook,

			nft_reject_br_send_v6_unreach(nft_net(pkt), pkt->skb,

						      nft_in(pkt),

						      nft_hook(pkt),

						      nft_reject_icmpv6_code(priv->icmp_code));

			break;

		}

net/ipv4/netfilter/nft_dup_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -30,7 +30,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr, 
	};

	int oif = regs->data[priv->sreg_dev];



	nf_dup_ipv4(pkt->net, pkt->skb, pkt->hook, &gw, oif);

	nf_dup_ipv4(nft_net(pkt), pkt->skb, nft_hook(pkt), &gw, oif);

}



static int nft_dup_ipv4_init(const struct nft_ctx *ctx,

net/ipv4/netfilter/nft_fib_ipv4.c

+7 −7
Original line number Diff line number Diff line
@@ -45,9 +45,9 @@ void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs, 
	__be32 addr;



	if (priv->flags & NFTA_FIB_F_IIF)

		dev = pkt->in;

		dev = nft_in(pkt);

	else if (priv->flags & NFTA_FIB_F_OIF)

		dev = pkt->out;

		dev = nft_out(pkt);



	iph = ip_hdr(pkt->skb);

	if (priv->flags & NFTA_FIB_F_DADDR)
@@ -55,7 +55,7 @@ void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs, 
	else

		addr = iph->saddr;



	*dst = inet_dev_addr_type(pkt->net, dev, addr);

	*dst = inet_dev_addr_type(nft_net(pkt), dev, addr);

}

EXPORT_SYMBOL_GPL(nft_fib4_eval_type);
@@ -89,13 +89,13 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	 * Search results for the desired outinterface instead.

	 */

	if (priv->flags & NFTA_FIB_F_OIF)

		oif = pkt->out;

		oif = nft_out(pkt);

	else if (priv->flags & NFTA_FIB_F_IIF)

		oif = pkt->in;

		oif = nft_in(pkt);

	else

		oif = NULL;



	if (pkt->hook == NF_INET_PRE_ROUTING && fib4_is_local(pkt->skb)) {

	if (nft_hook(pkt) == NF_INET_PRE_ROUTING && fib4_is_local(pkt->skb)) {

		nft_fib_store_result(dest, priv->result, pkt, LOOPBACK_IFINDEX);

		return;

	}
@@ -122,7 +122,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 
		fl4.saddr = get_saddr(iph->daddr);

	}



	if (fib_lookup(pkt->net, &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE))

	if (fib_lookup(nft_net(pkt), &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE))

		return;



	switch (res.type) {