Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c4b0e771 authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

netfilter: avoid using skb->nf_bridge directly 



This pointer is going to be removed soon, so use the existing helpers in
more places to avoid noise when the removal happens.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8239d579

include/linux/netfilter_bridge.h

+24 −9
Original line number Diff line number Diff line
@@ -17,43 +17,58 @@ static inline void br_drop_fake_rtable(struct sk_buff *skb) 
		skb_dst_drop(skb);

}



static inline struct nf_bridge_info *

nf_bridge_info_get(const struct sk_buff *skb)

{

	return skb->nf_bridge;

}



static inline bool nf_bridge_info_exists(const struct sk_buff *skb)

{

	return skb->nf_bridge != NULL;

}



static inline int nf_bridge_get_physinif(const struct sk_buff *skb)

{

	struct nf_bridge_info *nf_bridge;

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	if (skb->nf_bridge == NULL)

	if (!nf_bridge)

		return 0;



	nf_bridge = skb->nf_bridge;

	return nf_bridge->physindev ? nf_bridge->physindev->ifindex : 0;

}



static inline int nf_bridge_get_physoutif(const struct sk_buff *skb)

{

	struct nf_bridge_info *nf_bridge;

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	if (skb->nf_bridge == NULL)

	if (!nf_bridge)

		return 0;



	nf_bridge = skb->nf_bridge;

	return nf_bridge->physoutdev ? nf_bridge->physoutdev->ifindex : 0;

}



static inline struct net_device *

nf_bridge_get_physindev(const struct sk_buff *skb)

{

	return skb->nf_bridge ? skb->nf_bridge->physindev : NULL;

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	return nf_bridge ? nf_bridge->physindev : NULL;

}



static inline struct net_device *

nf_bridge_get_physoutdev(const struct sk_buff *skb)

{

	return skb->nf_bridge ? skb->nf_bridge->physoutdev : NULL;

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	return nf_bridge ? nf_bridge->physoutdev : NULL;

}



static inline bool nf_bridge_in_prerouting(const struct sk_buff *skb)

{

	return skb->nf_bridge && skb->nf_bridge->in_prerouting;

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	return nf_bridge && nf_bridge->in_prerouting;

}

#else

#define br_drop_fake_rtable(skb)	        do { } while (0)

include/net/netfilter/br_netfilter.h

+0 −6
Original line number Diff line number Diff line
@@ -22,12 +22,6 @@ int br_nf_hook_thresh(unsigned int hook, struct net *net, struct sock *sk, 
		      int (*okfn)(struct net *, struct sock *,

				  struct sk_buff *));



static inline struct nf_bridge_info *

nf_bridge_info_get(const struct sk_buff *skb)

{

	return skb->nf_bridge;

}



unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb);



static inline void nf_bridge_push_encap_header(struct sk_buff *skb)

net/bridge/br_netfilter_hooks.c

+14 −5
Original line number Diff line number Diff line
@@ -247,7 +247,9 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb) 


void nf_bridge_update_protocol(struct sk_buff *skb)

{

	switch (skb->nf_bridge->orig_proto) {

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	switch (nf_bridge->orig_proto) {

	case BRNF_PROTO_8021Q:

		skb->protocol = htons(ETH_P_8021Q);

		break;
@@ -569,7 +571,8 @@ static unsigned int br_nf_forward_ip(void *priv, 
	struct net_device *parent;

	u_int8_t pf;



	if (!skb->nf_bridge)

	nf_bridge = nf_bridge_info_get(skb);

	if (!nf_bridge)

		return NF_ACCEPT;



	/* Need exclusive nf_bridge_info since we might have multiple
@@ -701,7 +704,9 @@ br_nf_ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, 


static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)

{

	if (skb->nf_bridge->orig_proto == BRNF_PROTO_PPPOE)

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	if (nf_bridge->orig_proto == BRNF_PROTO_PPPOE)

		return PPPOE_SES_HLEN;

	return 0;

}
@@ -839,7 +844,9 @@ static unsigned int ip_sabotage_in(void *priv, 
				   struct sk_buff *skb,

				   const struct nf_hook_state *state)

{

	if (skb->nf_bridge && !skb->nf_bridge->in_prerouting &&

	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	if (nf_bridge && !nf_bridge->in_prerouting &&

	    !netif_is_l3_master(skb->dev)) {

		state->okfn(state->net, state->sk, skb);

		return NF_STOLEN;
@@ -877,7 +884,9 @@ static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb) 


static int br_nf_dev_xmit(struct sk_buff *skb)

{

	if (skb->nf_bridge && skb->nf_bridge->bridged_dnat) {

	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);



	if (nf_bridge && nf_bridge->bridged_dnat) {

		br_nf_pre_routing_finish_bridge_slow(skb);

		return 1;

	}

net/ipv4/netfilter/nf_reject_ipv4.c

+4 −2
Original line number Diff line number Diff line
@@ -102,6 +102,7 @@ EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put); 
/* Send RST reply */

void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)

{

	struct net_device *br_indev __maybe_unused;

	struct sk_buff *nskb;

	struct iphdr *niph;

	const struct tcphdr *oth;
@@ -147,10 +148,11 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) 
	 * build the eth header using the original destination's MAC as the

	 * source, and send the RST packet directly.

	 */

	if (oldskb->nf_bridge) {

	br_indev = nf_bridge_get_physindev(oldskb);

	if (br_indev) {

		struct ethhdr *oeth = eth_hdr(oldskb);



		nskb->dev = nf_bridge_get_physindev(oldskb);

		nskb->dev = br_indev;

		niph->tot_len = htons(nskb->len);

		ip_send_check(niph);

		if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),

net/ipv6/netfilter/nf_reject_ipv6.c

+7 −3
Original line number Diff line number Diff line
@@ -131,6 +131,7 @@ EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_put); 


void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)

{

	struct net_device *br_indev __maybe_unused;

	struct sk_buff *nskb;

	struct tcphdr _otcph;

	const struct tcphdr *otcph;
@@ -197,15 +198,18 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook) 
	 * build the eth header using the original destination's MAC as the

	 * source, and send the RST packet directly.

	 */

	if (oldskb->nf_bridge) {

	br_indev = nf_bridge_get_physindev(oldskb);

	if (br_indev) {

		struct ethhdr *oeth = eth_hdr(oldskb);



		nskb->dev = nf_bridge_get_physindev(oldskb);

		nskb->dev = br_indev;

		nskb->protocol = htons(ETH_P_IPV6);

		ip6h->payload_len = htons(sizeof(struct tcphdr));

		if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),

				    oeth->h_source, oeth->h_dest, nskb->len) < 0)

				    oeth->h_source, oeth->h_dest, nskb->len) < 0) {

			kfree_skb(nskb);

			return;

		}

		dev_queue_xmit(nskb);

	} else

#endif