Commit 8f8a3715 authored by David S. Miller's avatar David S. Miller

netfilter: Pass nf_hook_state through ip6t_do_table().

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8fe22382
...@@ -31,8 +31,7 @@ extern struct xt_table *ip6t_register_table(struct net *net, ...@@ -31,8 +31,7 @@ extern struct xt_table *ip6t_register_table(struct net *net,
extern void ip6t_unregister_table(struct net *net, struct xt_table *table); extern void ip6t_unregister_table(struct net *net, struct xt_table *table);
extern unsigned int ip6t_do_table(struct sk_buff *skb, extern unsigned int ip6t_do_table(struct sk_buff *skb,
unsigned int hook, unsigned int hook,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct xt_table *table); struct xt_table *table);
/* Check for an extension */ /* Check for an extension */
......
...@@ -317,8 +317,7 @@ ip6t_next_entry(const struct ip6t_entry *entry) ...@@ -317,8 +317,7 @@ ip6t_next_entry(const struct ip6t_entry *entry)
unsigned int unsigned int
ip6t_do_table(struct sk_buff *skb, ip6t_do_table(struct sk_buff *skb,
unsigned int hook, unsigned int hook,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct xt_table *table) struct xt_table *table)
{ {
static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
...@@ -333,8 +332,8 @@ ip6t_do_table(struct sk_buff *skb, ...@@ -333,8 +332,8 @@ ip6t_do_table(struct sk_buff *skb,
unsigned int addend; unsigned int addend;
/* Initialization */ /* Initialization */
indev = in ? in->name : nulldevname; indev = state->in ? state->in->name : nulldevname;
outdev = out ? out->name : nulldevname; outdev = state->out ? state->out->name : nulldevname;
/* We handle fragments by dealing with the first fragment as /* We handle fragments by dealing with the first fragment as
* if it was a normal packet. All other fragments are treated * if it was a normal packet. All other fragments are treated
* normally, except that they will NEVER match rules that ask * normally, except that they will NEVER match rules that ask
...@@ -342,8 +341,8 @@ ip6t_do_table(struct sk_buff *skb, ...@@ -342,8 +341,8 @@ ip6t_do_table(struct sk_buff *skb,
* rule is also a fragment-specific rule, non-fragments won't * rule is also a fragment-specific rule, non-fragments won't
* match it. */ * match it. */
acpar.hotdrop = false; acpar.hotdrop = false;
acpar.in = in; acpar.in = state->in;
acpar.out = out; acpar.out = state->out;
acpar.family = NFPROTO_IPV6; acpar.family = NFPROTO_IPV6;
acpar.hooknum = hook; acpar.hooknum = hook;
...@@ -393,7 +392,7 @@ ip6t_do_table(struct sk_buff *skb, ...@@ -393,7 +392,7 @@ ip6t_do_table(struct sk_buff *skb,
#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
/* The packet is traced: log it */ /* The packet is traced: log it */
if (unlikely(skb->nf_trace)) if (unlikely(skb->nf_trace))
trace_packet(skb, hook, in, out, trace_packet(skb, hook, state->in, state->out,
table->name, private, e); table->name, private, e);
#endif #endif
/* Standard target? */ /* Standard target? */
......
...@@ -37,8 +37,7 @@ ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -37,8 +37,7 @@ ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
{ {
const struct net *net = dev_net(state->in ? state->in : state->out); const struct net *net = dev_net(state->in ? state->in : state->out);
return ip6t_do_table(skb, ops->hooknum, state->in, state->out, return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_filter);
net->ipv6.ip6table_filter);
} }
static struct nf_hook_ops *filter_ops __read_mostly; static struct nf_hook_ops *filter_ops __read_mostly;
......
...@@ -32,7 +32,7 @@ static const struct xt_table packet_mangler = { ...@@ -32,7 +32,7 @@ static const struct xt_table packet_mangler = {
}; };
static unsigned int static unsigned int
ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out) ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
{ {
unsigned int ret; unsigned int ret;
struct in6_addr saddr, daddr; struct in6_addr saddr, daddr;
...@@ -57,8 +57,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out) ...@@ -57,8 +57,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
/* flowlabel and prio (includes version, which shouldn't change either */ /* flowlabel and prio (includes version, which shouldn't change either */
flowlabel = *((u_int32_t *)ipv6_hdr(skb)); flowlabel = *((u_int32_t *)ipv6_hdr(skb));
ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, NULL, out, ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, state,
dev_net(out)->ipv6.ip6table_mangle); dev_net(state->out)->ipv6.ip6table_mangle);
if (ret != NF_DROP && ret != NF_STOLEN && if (ret != NF_DROP && ret != NF_STOLEN &&
(!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) || (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
...@@ -80,12 +80,12 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -80,12 +80,12 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
if (ops->hooknum == NF_INET_LOCAL_OUT) if (ops->hooknum == NF_INET_LOCAL_OUT)
return ip6t_mangle_out(skb, state->out); return ip6t_mangle_out(skb, state);
if (ops->hooknum == NF_INET_POST_ROUTING) if (ops->hooknum == NF_INET_POST_ROUTING)
return ip6t_do_table(skb, ops->hooknum, state->in, state->out, return ip6t_do_table(skb, ops->hooknum, state,
dev_net(state->out)->ipv6.ip6table_mangle); dev_net(state->out)->ipv6.ip6table_mangle);
/* INPUT/FORWARD */ /* INPUT/FORWARD */
return ip6t_do_table(skb, ops->hooknum, state->in, state->out, return ip6t_do_table(skb, ops->hooknum, state,
dev_net(state->in)->ipv6.ip6table_mangle); dev_net(state->in)->ipv6.ip6table_mangle);
} }
......
...@@ -37,8 +37,7 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops, ...@@ -37,8 +37,7 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,
{ {
struct net *net = nf_ct_net(ct); struct net *net = nf_ct_net(ct);
return ip6t_do_table(skb, ops->hooknum, state->in, state->out, return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_nat);
net->ipv6.ip6table_nat);
} }
static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops, static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
......
...@@ -24,8 +24,7 @@ ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -24,8 +24,7 @@ ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
{ {
const struct net *net = dev_net(state->in ? state->in : state->out); const struct net *net = dev_net(state->in ? state->in : state->out);
return ip6t_do_table(skb, ops->hooknum, state->in, state->out, return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_raw);
net->ipv6.ip6table_raw);
} }
static struct nf_hook_ops *rawtable_ops __read_mostly; static struct nf_hook_ops *rawtable_ops __read_mostly;
......
...@@ -41,7 +41,7 @@ ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -41,7 +41,7 @@ ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
{ {
const struct net *net = dev_net(state->in ? state->in : state->out); const struct net *net = dev_net(state->in ? state->in : state->out);
return ip6t_do_table(skb, ops->hooknum, state->in, state->out, return ip6t_do_table(skb, ops->hooknum, state,
net->ipv6.ip6table_security); net->ipv6.ip6table_security);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment