Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7191483 authored by Pablo Neira's avatar Pablo Neira Committed by David S. Miller
Browse files

netfilter: add hook list to nf_hook_state 



Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 87d5c18c

include/linux/netfilter.h

+5 −2
Original line number Diff line number Diff line
@@ -54,10 +54,12 @@ struct nf_hook_state { 
	struct net_device *in;

	struct net_device *out;

	struct sock *sk;

	struct list_head *hook_list;

	int (*okfn)(struct sock *, struct sk_buff *);

};



static inline void nf_hook_state_init(struct nf_hook_state *p,

				      struct list_head *hook_list,

				      unsigned int hook,

				      int thresh, u_int8_t pf,

				      struct net_device *indev,
@@ -71,6 +73,7 @@ static inline void nf_hook_state_init(struct nf_hook_state *p, 
	p->in = indev;

	p->out = outdev;

	p->sk = sk;

	p->hook_list = hook_list;

	p->okfn = okfn;

}
@@ -166,8 +169,8 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 
	if (nf_hooks_active(pf, hook)) {

		struct nf_hook_state state;



		nf_hook_state_init(&state, hook, thresh, pf,

				   indev, outdev, sk, okfn);

		nf_hook_state_init(&state, &nf_hooks[pf][hook], hook, thresh,

				   pf, indev, outdev, sk, okfn);

		return nf_hook_slow(skb, &state);

	}

	return 1;

net/netfilter/core.c

+2 −4
Original line number Diff line number Diff line
@@ -166,11 +166,9 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state) 
	/* We may already have this, but read-locks nest anyway */

	rcu_read_lock();



	elem = list_entry_rcu(&nf_hooks[state->pf][state->hook],

			      struct nf_hook_ops, list);

	elem = list_entry_rcu(state->hook_list, struct nf_hook_ops, list);

next_hook:

	verdict = nf_iterate(&nf_hooks[state->pf][state->hook], skb, state,

			     &elem);

	verdict = nf_iterate(state->hook_list, skb, state, &elem);

	if (verdict == NF_ACCEPT || verdict == NF_STOP) {

		ret = 1;

	} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {