Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 92f3b2b1 authored by Jan Engelhardt's avatar Jan Engelhardt Committed by Patrick McHardy
Browse files

netfilter: xtables: cut down on static data for family-independent extensions 



Using ->family in struct xt_*_param, multiple struct xt_{match,target}
can be squashed together.

Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 916a917d

net/netfilter/xt_CONNMARK.c

+7 −32
Original line number Diff line number Diff line
@@ -128,9 +128,9 @@ static bool connmark_tg_check_v0(const struct xt_tgchk_param *par) 
		printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");

		return false;

	}

	if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {

	if (nf_ct_l3proto_try_module_get(par->family) < 0) {

		printk(KERN_WARNING "can't load conntrack support for "

				    "proto=%u\n", par->target->family);

				    "proto=%u\n", par->family);

		return false;

	}

	return true;
@@ -138,9 +138,9 @@ static bool connmark_tg_check_v0(const struct xt_tgchk_param *par) 


static bool connmark_tg_check(const struct xt_tgchk_param *par)

{

	if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {

	if (nf_ct_l3proto_try_module_get(par->family) < 0) {

		printk(KERN_WARNING "cannot load conntrack support for "

		       "proto=%u\n", par->target->family);

		       "proto=%u\n", par->family);

		return false;

	}

	return true;
@@ -148,7 +148,7 @@ static bool connmark_tg_check(const struct xt_tgchk_param *par) 


static void connmark_tg_destroy(const struct xt_tgdtor_param *par)

{

	nf_ct_l3proto_module_put(par->target->family);

	nf_ct_l3proto_module_put(par->family);

}



#ifdef CONFIG_COMPAT
@@ -186,7 +186,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = { 
	{

		.name		= "CONNMARK",

		.revision	= 0,

		.family		= NFPROTO_IPV4,

		.family		= NFPROTO_UNSPEC,

		.checkentry	= connmark_tg_check_v0,

		.destroy	= connmark_tg_destroy,

		.target		= connmark_tg_v0,
@@ -198,35 +198,10 @@ static struct xt_target connmark_tg_reg[] __read_mostly = { 
#endif

		.me		= THIS_MODULE

	},

	{

		.name		= "CONNMARK",

		.revision	= 0,

		.family		= NFPROTO_IPV6,

		.checkentry	= connmark_tg_check_v0,

		.destroy	= connmark_tg_destroy,

		.target		= connmark_tg_v0,

		.targetsize	= sizeof(struct xt_connmark_target_info),

#ifdef CONFIG_COMPAT

		.compatsize	= sizeof(struct compat_xt_connmark_target_info),

		.compat_from_user = connmark_tg_compat_from_user_v0,

		.compat_to_user	= connmark_tg_compat_to_user_v0,

#endif

		.me		= THIS_MODULE

	},

	{

		.name           = "CONNMARK",

		.revision       = 1,

		.family         = NFPROTO_IPV4,

		.checkentry     = connmark_tg_check,

		.target         = connmark_tg,

		.targetsize     = sizeof(struct xt_connmark_tginfo1),

		.destroy        = connmark_tg_destroy,

		.me             = THIS_MODULE,

	},

	{

		.name           = "CONNMARK",

		.revision       = 1,

		.family         = NFPROTO_IPV6,

		.family         = NFPROTO_UNSPEC,

		.checkentry     = connmark_tg_check,

		.target         = connmark_tg,

		.targetsize     = sizeof(struct xt_connmark_tginfo1),

net/netfilter/xt_CONNSECMARK.c

+14 −26
Original line number Diff line number Diff line
@@ -106,9 +106,9 @@ static bool connsecmark_tg_check(const struct xt_tgchk_param *par) 
		return false;

	}



	if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {

	if (nf_ct_l3proto_try_module_get(par->family) < 0) {

		printk(KERN_WARNING "can't load conntrack support for "

				    "proto=%u\n", par->target->family);

				    "proto=%u\n", par->family);

		return false;

	}

	return true;
@@ -116,40 +116,28 @@ static bool connsecmark_tg_check(const struct xt_tgchk_param *par) 


static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)

{

	nf_ct_l3proto_module_put(par->target->family);

	nf_ct_l3proto_module_put(par->family);

}



static struct xt_target connsecmark_tg_reg[] __read_mostly = {

	{

		.name		= "CONNSECMARK",

		.family		= NFPROTO_IPV4,

		.checkentry	= connsecmark_tg_check,

		.destroy	= connsecmark_tg_destroy,

		.target		= connsecmark_tg,

		.targetsize	= sizeof(struct xt_connsecmark_target_info),

		.me		= THIS_MODULE,

	},

	{

static struct xt_target connsecmark_tg_reg __read_mostly = {

	.name       = "CONNSECMARK",

		.family		= NFPROTO_IPV6,

	.revision   = 0,

	.family     = NFPROTO_UNSPEC,

	.checkentry = connsecmark_tg_check,

	.destroy    = connsecmark_tg_destroy,

	.target     = connsecmark_tg,

	.targetsize = sizeof(struct xt_connsecmark_target_info),

	.me         = THIS_MODULE,

	},

};



static int __init connsecmark_tg_init(void)

{

	return xt_register_targets(connsecmark_tg_reg,

	       ARRAY_SIZE(connsecmark_tg_reg));

	return xt_register_target(&connsecmark_tg_reg);

}



static void __exit connsecmark_tg_exit(void)

{

	xt_unregister_targets(connsecmark_tg_reg,

	                      ARRAY_SIZE(connsecmark_tg_reg));

	xt_unregister_target(&connsecmark_tg_reg);

}



module_init(connsecmark_tg_init);

net/netfilter/xt_NFLOG.c

+11 −20
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_target_param *par) 
	li.u.ulog.group	     = info->group;

	li.u.ulog.qthreshold = info->threshold;



	nf_log_packet(par->target->family, par->hooknum, skb, par->in,

	nf_log_packet(par->family, par->hooknum, skb, par->in,

	              par->out, &li, "%s", info->prefix);

	return XT_CONTINUE;

}
@@ -47,33 +47,24 @@ static bool nflog_tg_check(const struct xt_tgchk_param *par) 
	return true;

}



static struct xt_target nflog_tg_reg[] __read_mostly = {

	{

		.name		= "NFLOG",

		.family		= NFPROTO_IPV4,

		.checkentry	= nflog_tg_check,

		.target		= nflog_tg,

		.targetsize	= sizeof(struct xt_nflog_info),

		.me		= THIS_MODULE,

	},

	{

static struct xt_target nflog_tg_reg __read_mostly = {

	.name       = "NFLOG",

		.family		= NFPROTO_IPV6,

	.revision   = 0,

	.family     = NFPROTO_UNSPEC,

	.checkentry = nflog_tg_check,

	.target     = nflog_tg,

	.targetsize = sizeof(struct xt_nflog_info),

	.me         = THIS_MODULE,

	},

};



static int __init nflog_tg_init(void)

{

	return xt_register_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));

	return xt_register_target(&nflog_tg_reg);

}



static void __exit nflog_tg_exit(void)

{

	xt_unregister_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));

	xt_unregister_target(&nflog_tg_reg);

}



module_init(nflog_tg_init);

net/netfilter/xt_connbytes.c

+14 −25
Original line number Diff line number Diff line
@@ -106,9 +106,9 @@ static bool connbytes_mt_check(const struct xt_mtchk_param *par) 
	    sinfo->direction != XT_CONNBYTES_DIR_BOTH)

		return false;



	if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {

	if (nf_ct_l3proto_try_module_get(par->family) < 0) {

		printk(KERN_WARNING "can't load conntrack support for "

				    "proto=%u\n", par->match->family);

				    "proto=%u\n", par->family);

		return false;

	}
@@ -117,39 +117,28 @@ static bool connbytes_mt_check(const struct xt_mtchk_param *par) 


static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)

{

	nf_ct_l3proto_module_put(par->match->family);

	nf_ct_l3proto_module_put(par->family);

}



static struct xt_match connbytes_mt_reg[] __read_mostly = {

	{

		.name		= "connbytes",

		.family		= NFPROTO_IPV4,

		.checkentry	= connbytes_mt_check,

		.match		= connbytes_mt,

		.destroy	= connbytes_mt_destroy,

		.matchsize	= sizeof(struct xt_connbytes_info),

		.me		= THIS_MODULE

	},

	{

static struct xt_match connbytes_mt_reg __read_mostly = {

	.name       = "connbytes",

		.family		= NFPROTO_IPV6,

	.revision   = 0,

	.family     = NFPROTO_UNSPEC,

	.checkentry = connbytes_mt_check,

	.match      = connbytes_mt,

	.destroy    = connbytes_mt_destroy,

	.matchsize  = sizeof(struct xt_connbytes_info),

		.me		= THIS_MODULE

	},

	.me         = THIS_MODULE,

};



static int __init connbytes_mt_init(void)

{

	return xt_register_matches(connbytes_mt_reg,

	       ARRAY_SIZE(connbytes_mt_reg));

	return xt_register_match(&connbytes_mt_reg);

}



static void __exit connbytes_mt_exit(void)

{

	xt_unregister_matches(connbytes_mt_reg, ARRAY_SIZE(connbytes_mt_reg));

	xt_unregister_match(&connbytes_mt_reg);

}



module_init(connbytes_mt_init);

net/netfilter/xt_connlimit.c

+18 −29
Original line number Diff line number Diff line
@@ -192,10 +192,10 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par) 
	if (ct != NULL)

		tuple_ptr = &ct->tuplehash[0].tuple;

	else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),

				    par->match->family, &tuple))

				    par->family, &tuple))

		goto hotdrop;



	if (par->match->family == NFPROTO_IPV6) {

	if (par->family == NFPROTO_IPV6) {

		const struct ipv6hdr *iph = ipv6_hdr(skb);

		memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));

	} else {
@@ -226,16 +226,16 @@ static bool connlimit_mt_check(const struct xt_mtchk_param *par) 
	struct xt_connlimit_info *info = par->matchinfo;

	unsigned int i;



	if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {

	if (nf_ct_l3proto_try_module_get(par->family) < 0) {

		printk(KERN_WARNING "cannot load conntrack support for "

		       "address family %u\n", par->match->family);

		       "address family %u\n", par->family);

		return false;

	}



	/* init private data */

	info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);

	if (info->data == NULL) {

		nf_ct_l3proto_module_put(par->match->family);

		nf_ct_l3proto_module_put(par->family);

		return false;

	}
@@ -254,7 +254,7 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par) 
	struct list_head *hash = info->data->iphash;

	unsigned int i;



	nf_ct_l3proto_module_put(par->match->family);

	nf_ct_l3proto_module_put(par->family);



	for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {

		list_for_each_entry_safe(conn, tmp, &hash[i], list) {
@@ -266,41 +266,30 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par) 
	kfree(info->data);

}



static struct xt_match connlimit_mt_reg[] __read_mostly = {

	{

		.name       = "connlimit",

		.family     = NFPROTO_IPV4,

		.checkentry = connlimit_mt_check,

		.match      = connlimit_mt,

		.matchsize  = sizeof(struct xt_connlimit_info),

		.destroy    = connlimit_mt_destroy,

		.me         = THIS_MODULE,

	},

	{

static struct xt_match connlimit_mt_reg __read_mostly = {

	.name       = "connlimit",

		.family     = NFPROTO_IPV6,

	.revision   = 0,

	.family     = NFPROTO_UNSPEC,

	.checkentry = connlimit_mt_check,

	.match      = connlimit_mt,

	.matchsize  = sizeof(struct xt_connlimit_info),

	.destroy    = connlimit_mt_destroy,

	.me         = THIS_MODULE,

	},

};



static int __init connlimit_mt_init(void)

{

	return xt_register_matches(connlimit_mt_reg,

	       ARRAY_SIZE(connlimit_mt_reg));

	return xt_register_match(&connlimit_mt_reg);

}



static void __exit connlimit_mt_exit(void)

{

	xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));

	xt_unregister_match(&connlimit_mt_reg);

}



module_init(connlimit_mt_init);

module_exit(connlimit_mt_exit);

MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");

MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");

MODULE_DESCRIPTION("Xtables: Number of connections matching");

MODULE_LICENSE("GPL");

MODULE_ALIAS("ipt_connlimit");