Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c74454fa authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: add and use nf_ct_set helper 



Add a helper to assign a nf_conn entry and the ctinfo bits to an sk_buff.
This avoids changing code in followup patch that merges skb->nfct and
skb->nfctinfo into skb->_nfct.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cb9c6836

include/net/ip_vs.h

+1 −2
Original line number Diff line number Diff line
@@ -1559,8 +1559,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb) 
		nf_conntrack_put(&ct->ct_general);

		untracked = nf_ct_untracked_get();

		nf_conntrack_get(&untracked->ct_general);

		skb->nfct = &untracked->ct_general;

		skb->nfctinfo = IP_CT_NEW;

		nf_ct_set(skb, untracked, IP_CT_NEW);

	}

#endif

}

include/net/netfilter/nf_conntrack.h

+8 −0
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ union nf_conntrack_proto { 
	struct ip_ct_sctp sctp;

	struct ip_ct_tcp tcp;

	struct nf_ct_gre gre;

	unsigned int tmpl_padto;

};



union nf_conntrack_expect_proto {
@@ -341,6 +342,13 @@ struct nf_conn *nf_ct_tmpl_alloc(struct net *net, 
				 gfp_t flags);

void nf_ct_tmpl_free(struct nf_conn *tmpl);



static inline void

nf_ct_set(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info info)

{

	skb->nfct = &ct->ct_general;

	skb->nfctinfo = info;

}



#define NF_CT_STAT_INC(net, count)	  __this_cpu_inc((net)->ct.stat->count)

#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)

#define NF_CT_STAT_ADD_ATOMIC(net, count, v) this_cpu_add((net)->ct.stat->count, (v))

net/ipv4/netfilter/ipt_SYNPROXY.c

+1 −2
Original line number Diff line number Diff line
@@ -57,8 +57,7 @@ synproxy_send_tcp(struct net *net, 
		goto free_nskb;



	if (nfct) {

		nskb->nfct = nfct;

		nskb->nfctinfo = ctinfo;

		nf_ct_set(nskb, (struct nf_conn *)nfct, ctinfo);

		nf_conntrack_get(nfct);

	}

net/ipv4/netfilter/nf_conntrack_proto_icmp.c

+1 −2
Original line number Diff line number Diff line
@@ -172,8 +172,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, 
		ctinfo += IP_CT_IS_REPLY;



	/* Update skb to refer to this connection */

	skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;

	skb->nfctinfo = ctinfo;

	nf_ct_set(skb, nf_ct_tuplehash_to_ctrack(h), ctinfo);

	return NF_ACCEPT;

}

net/ipv4/netfilter/nf_dup_ipv4.c

+1 −2
Original line number Diff line number Diff line
@@ -69,8 +69,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, 
#if IS_ENABLED(CONFIG_NF_CONNTRACK)

	/* Avoid counting cloned packets towards the original connection. */

	nf_reset(skb);

	skb->nfct     = &nf_ct_untracked_get()->ct_general;

	skb->nfctinfo = IP_CT_NEW;

	nf_ct_set(skb, nf_ct_untracked_get(), IP_CT_NEW);

	nf_conntrack_get(skb_nfct(skb));

#endif

	/*