Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a55e22e9 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: get rid of NFT_REG_VERDICT usage 



Replace the array of registers passed to expressions by a struct nft_regs,
containing the verdict as a seperate member, which aliases to the
NFT_REG_VERDICT register.

This is needed to seperate the verdict from the data registers completely,
so their size can be changed.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d07db988

include/net/netfilter/nf_tables.h

+29 −3
Original line number Diff line number Diff line
@@ -36,6 +36,17 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, 
	pkt->xt.family = ops->pf;

}



/**

 * 	struct nft_verdict - nf_tables verdict

 *

 * 	@code: nf_tables/netfilter verdict code

 * 	@chain: destination chain for NFT_JUMP/NFT_GOTO

 */

struct nft_verdict {

	u32				code;

	struct nft_chain		*chain;

};



struct nft_data {

	union {

		u32				data[4];
@@ -46,6 +57,21 @@ struct nft_data { 
	};

} __attribute__((aligned(__alignof__(u64))));



/**

 *	struct nft_regs - nf_tables register set

 *

 *	@data: data registers

 *	@verdict: verdict register

 *

 *	The first four data registers alias to the verdict register.

 */

struct nft_regs {

	union {

		struct nft_data 	data[NFT_REG_MAX + 1];

		struct nft_verdict	verdict;

	};

};



static inline int nft_data_cmp(const struct nft_data *d1,

			       const struct nft_data *d2,

			       unsigned int len)
@@ -221,9 +247,9 @@ struct nft_set_ops { 
						  const struct nft_data *key,

						  void *(*new)(struct nft_set *,

							       const struct nft_expr *,

							       struct nft_data []),

							       struct nft_regs *),

						  const struct nft_expr *expr,

						  struct nft_data data[],

						  struct nft_regs *regs,

						  const struct nft_set_ext **ext);



	int				(*insert)(const struct nft_set *set,
@@ -583,7 +609,7 @@ struct nft_expr_type { 
struct nft_expr;

struct nft_expr_ops {

	void				(*eval)(const struct nft_expr *expr,

						struct nft_data data[NFT_REG_MAX + 1],

						struct nft_regs *regs,

						const struct nft_pktinfo *pkt);

	unsigned int			size;

include/net/netfilter/nft_meta.h

+2 −2
Original line number Diff line number Diff line
@@ -26,11 +26,11 @@ int nft_meta_set_dump(struct sk_buff *skb, 
		      const struct nft_expr *expr);



void nft_meta_get_eval(const struct nft_expr *expr,

		       struct nft_data data[NFT_REG_MAX + 1],

		       struct nft_regs *regs,

		       const struct nft_pktinfo *pkt);



void nft_meta_set_eval(const struct nft_expr *expr,

		       struct nft_data data[NFT_REG_MAX + 1],

		       struct nft_regs *regs,

		       const struct nft_pktinfo *pkt);



#endif

net/bridge/netfilter/nft_meta_bridge.c

+4 −4
Original line number Diff line number Diff line
@@ -19,12 +19,12 @@ 
#include "../br_private.h"



static void nft_meta_bridge_get_eval(const struct nft_expr *expr,

				     struct nft_data data[NFT_REG_MAX + 1],

				     struct nft_regs *regs,

				     const struct nft_pktinfo *pkt)

{

	const struct nft_meta *priv = nft_expr_priv(expr);

	const struct net_device *in = pkt->in, *out = pkt->out;

	struct nft_data *dest = &data[priv->dreg];

	struct nft_data *dest = &regs->data[priv->dreg];

	const struct net_bridge_port *p;



	switch (priv->key) {
@@ -43,9 +43,9 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr, 
	strncpy((char *)dest->data, p->br->dev->name, sizeof(dest->data));

	return;

out:

	return nft_meta_get_eval(expr, data, pkt);

	return nft_meta_get_eval(expr, regs, pkt);

err:

	data[NFT_REG_VERDICT].verdict = NFT_BREAK;

	regs->verdict.code = NFT_BREAK;

}



static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,

net/bridge/netfilter/nft_reject_bridge.c

+3 −3
Original line number Diff line number Diff line
@@ -257,7 +257,7 @@ static void nft_reject_br_send_v6_unreach(struct net *net, 
}



static void nft_reject_bridge_eval(const struct nft_expr *expr,

				 struct nft_data data[NFT_REG_MAX + 1],

				   struct nft_regs *regs,

				   const struct nft_pktinfo *pkt)

{

	struct nft_reject *priv = nft_expr_priv(expr);
@@ -310,7 +310,7 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, 
		break;

	}

out:

	data[NFT_REG_VERDICT].verdict = NF_DROP;

	regs->verdict.code = NF_DROP;

}



static int nft_reject_bridge_validate(const struct nft_ctx *ctx,

net/ipv4/netfilter/nft_masq_ipv4.c

+3 −6
Original line number Diff line number Diff line
@@ -17,20 +17,17 @@ 
#include <net/netfilter/ipv4/nf_nat_masquerade.h>



static void nft_masq_ipv4_eval(const struct nft_expr *expr,

			       struct nft_data data[NFT_REG_MAX + 1],

			       struct nft_regs *regs,

			       const struct nft_pktinfo *pkt)

{

	struct nft_masq *priv = nft_expr_priv(expr);

	struct nf_nat_range range;

	unsigned int verdict;



	memset(&range, 0, sizeof(range));

	range.flags = priv->flags;



	verdict = nf_nat_masquerade_ipv4(pkt->skb, pkt->ops->hooknum,

	regs->verdict.code = nf_nat_masquerade_ipv4(pkt->skb, pkt->ops->hooknum,

						    &range, pkt->out);



	data[NFT_REG_VERDICT].verdict = verdict;

}



static struct nft_expr_type nft_masq_ipv4_type;