Commit 90ff6d1c authored by Jamal Hadi Salim's avatar Jamal Hadi Salim Committed by David S. Miller

[NETFILTER]: Small cleanup for {ipt,ip6t,arpt}_find_target

Signed-off-by: default avatarJamal Hadi Salim <hadi@zynx.com>
Signed-off-by: default avatarDavid S. Miller <davem@redhat.com>
parent 56e4943c
...@@ -171,6 +171,12 @@ extern void nf_reinject(struct sk_buff *skb, ...@@ -171,6 +171,12 @@ extern void nf_reinject(struct sk_buff *skb,
struct nf_info *info, struct nf_info *info,
unsigned int verdict); unsigned int verdict);
extern inline struct ipt_target *
ipt_find_target_lock(const char *name, int *error, struct semaphore *mutex);
extern inline struct ip6t_target *
ip6t_find_target_lock(const char *name, int *error, struct semaphore *mutex);
extern inline struct arpt_target *
arpt_find_target_lock(const char *name, int *error, struct semaphore *mutex);
extern void (*ip_ct_attach)(struct sk_buff *, struct nf_ct_info *); extern void (*ip_ct_attach)(struct sk_buff *, struct nf_ct_info *);
#ifdef CONFIG_NETFILTER_DEBUG #ifdef CONFIG_NETFILTER_DEBUG
......
...@@ -17,4 +17,5 @@ ...@@ -17,4 +17,5 @@
#define NF_ARP_FORWARD 2 #define NF_ARP_FORWARD 2
#define NF_ARP_NUMHOOKS 3 #define NF_ARP_NUMHOOKS 3
static DECLARE_MUTEX(arpt_mutex);
#endif /* __LINUX_ARP_NETFILTER_H */ #endif /* __LINUX_ARP_NETFILTER_H */
...@@ -283,6 +283,8 @@ struct ipt_get_entries ...@@ -283,6 +283,8 @@ struct ipt_get_entries
struct ipt_entry entrytable[0]; struct ipt_entry entrytable[0];
}; };
extern struct semaphore ipt_mutex;
/* Standard return verdict, or do jump. */ /* Standard return verdict, or do jump. */
#define IPT_STANDARD_TARGET "" #define IPT_STANDARD_TARGET ""
/* Error verdict. */ /* Error verdict. */
...@@ -334,6 +336,7 @@ ipt_get_target(struct ipt_entry *e) ...@@ -334,6 +336,7 @@ ipt_get_target(struct ipt_entry *e)
/* /*
* Main firewall chains definitions and global var's definitions. * Main firewall chains definitions and global var's definitions.
*/ */
static DECLARE_MUTEX(ipt_mutex);
#ifdef __KERNEL__ #ifdef __KERNEL__
#include <linux/init.h> #include <linux/init.h>
...@@ -406,6 +409,11 @@ struct ipt_target ...@@ -406,6 +409,11 @@ struct ipt_target
struct module *me; struct module *me;
}; };
extern struct ipt_target *
ipt_find_target_lock(const char *name, int *error, struct semaphore *mutex);
extern struct arpt_target *
arpt_find_target_lock(const char *name, int *error, struct semaphore *mutex);
extern int ipt_register_target(struct ipt_target *target); extern int ipt_register_target(struct ipt_target *target);
extern void ipt_unregister_target(struct ipt_target *target); extern void ipt_unregister_target(struct ipt_target *target);
......
...@@ -106,6 +106,8 @@ struct ip6t_counters ...@@ -106,6 +106,8 @@ struct ip6t_counters
u_int64_t pcnt, bcnt; /* Packet and byte counters */ u_int64_t pcnt, bcnt; /* Packet and byte counters */
}; };
static DECLARE_MUTEX(ip6t_mutex);
/* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */ /* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
#define IP6T_F_PROTO 0x01 /* Set if rule cares about upper #define IP6T_F_PROTO 0x01 /* Set if rule cares about upper
protocols */ protocols */
......
...@@ -56,7 +56,6 @@ do { \ ...@@ -56,7 +56,6 @@ do { \
#endif #endif
#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
static DECLARE_MUTEX(arpt_mutex);
#define ASSERT_READ_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0) #define ASSERT_READ_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
#define ASSERT_WRITE_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0) #define ASSERT_WRITE_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
...@@ -388,12 +387,12 @@ find_inlist_lock(struct list_head *head, ...@@ -388,12 +387,12 @@ find_inlist_lock(struct list_head *head,
} }
#endif #endif
static inline struct arpt_table *find_table_lock(const char *name, int *error, struct semaphore *mutex) static inline struct arpt_table *arpt_find_table_lock(const char *name, int *error, struct semaphore *mutex)
{ {
return find_inlist_lock(&arpt_tables, name, "arptable_", error, mutex); return find_inlist_lock(&arpt_tables, name, "arptable_", error, mutex);
} }
static inline struct arpt_target *find_target_lock(const char *name, int *error, struct semaphore *mutex) struct arpt_target *arpt_find_target_lock(const char *name, int *error, struct semaphore *mutex)
{ {
return find_inlist_lock(&arpt_target, name, "arpt_", error, mutex); return find_inlist_lock(&arpt_target, name, "arpt_", error, mutex);
} }
...@@ -543,7 +542,7 @@ static inline int check_entry(struct arpt_entry *e, const char *name, unsigned i ...@@ -543,7 +542,7 @@ static inline int check_entry(struct arpt_entry *e, const char *name, unsigned i
} }
t = arpt_get_target(e); t = arpt_get_target(e);
target = find_target_lock(t->u.user.name, &ret, &arpt_mutex); target = arpt_find_target_lock(t->u.user.name, &ret, &arpt_mutex);
if (!target) { if (!target) {
duprintf("check_entry: `%s' not found\n", t->u.user.name); duprintf("check_entry: `%s' not found\n", t->u.user.name);
goto out; goto out;
...@@ -843,7 +842,7 @@ static int get_entries(const struct arpt_get_entries *entries, ...@@ -843,7 +842,7 @@ static int get_entries(const struct arpt_get_entries *entries,
int ret; int ret;
struct arpt_table *t; struct arpt_table *t;
t = find_table_lock(entries->name, &ret, &arpt_mutex); t = arpt_find_table_lock(entries->name, &ret, &arpt_mutex);
if (t) { if (t) {
duprintf("t->private->number = %u\n", duprintf("t->private->number = %u\n",
t->private->number); t->private->number);
...@@ -909,7 +908,7 @@ static int do_replace(void __user *user, unsigned int len) ...@@ -909,7 +908,7 @@ static int do_replace(void __user *user, unsigned int len)
duprintf("arp_tables: Translated table\n"); duprintf("arp_tables: Translated table\n");
t = find_table_lock(tmp.name, &ret, &arpt_mutex); t = arpt_find_table_lock(tmp.name, &ret, &arpt_mutex);
if (!t) if (!t)
goto free_newinfo_counters_untrans; goto free_newinfo_counters_untrans;
...@@ -1002,7 +1001,7 @@ static int do_add_counters(void __user *user, unsigned int len) ...@@ -1002,7 +1001,7 @@ static int do_add_counters(void __user *user, unsigned int len)
goto free; goto free;
} }
t = find_table_lock(tmp.name, &ret, &arpt_mutex); t = arpt_find_table_lock(tmp.name, &ret, &arpt_mutex);
if (!t) if (!t)
goto free; goto free;
...@@ -1075,7 +1074,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len ...@@ -1075,7 +1074,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
break; break;
} }
name[ARPT_TABLE_MAXNAMELEN-1] = '\0'; name[ARPT_TABLE_MAXNAMELEN-1] = '\0';
t = find_table_lock(name, &ret, &arpt_mutex); t = arpt_find_table_lock(name, &ret, &arpt_mutex);
if (t) { if (t) {
struct arpt_getinfo info; struct arpt_getinfo info;
...@@ -1323,6 +1322,7 @@ static void __exit fini(void) ...@@ -1323,6 +1322,7 @@ static void __exit fini(void)
EXPORT_SYMBOL(arpt_register_table); EXPORT_SYMBOL(arpt_register_table);
EXPORT_SYMBOL(arpt_unregister_table); EXPORT_SYMBOL(arpt_unregister_table);
EXPORT_SYMBOL(arpt_do_table); EXPORT_SYMBOL(arpt_do_table);
EXPORT_SYMBOL(arpt_find_target_lock);
EXPORT_SYMBOL(arpt_register_target); EXPORT_SYMBOL(arpt_register_target);
EXPORT_SYMBOL(arpt_unregister_target); EXPORT_SYMBOL(arpt_unregister_target);
......
...@@ -61,9 +61,6 @@ do { \ ...@@ -61,9 +61,6 @@ do { \
#endif #endif
#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
/* Mutex protects lists (only traversed in user context). */
static DECLARE_MUTEX(ipt_mutex);
/* Must have mutex */ /* Must have mutex */
#define ASSERT_READ_LOCK(x) IP_NF_ASSERT(down_trylock(&ipt_mutex) != 0) #define ASSERT_READ_LOCK(x) IP_NF_ASSERT(down_trylock(&ipt_mutex) != 0)
#define ASSERT_WRITE_LOCK(x) IP_NF_ASSERT(down_trylock(&ipt_mutex) != 0) #define ASSERT_WRITE_LOCK(x) IP_NF_ASSERT(down_trylock(&ipt_mutex) != 0)
...@@ -461,7 +458,7 @@ find_inlist_lock(struct list_head *head, ...@@ -461,7 +458,7 @@ find_inlist_lock(struct list_head *head,
#endif #endif
static inline struct ipt_table * static inline struct ipt_table *
find_table_lock(const char *name, int *error, struct semaphore *mutex) ipt_find_table_lock(const char *name, int *error, struct semaphore *mutex)
{ {
return find_inlist_lock(&ipt_tables, name, "iptable_", error, mutex); return find_inlist_lock(&ipt_tables, name, "iptable_", error, mutex);
} }
...@@ -472,8 +469,8 @@ find_match_lock(const char *name, int *error, struct semaphore *mutex) ...@@ -472,8 +469,8 @@ find_match_lock(const char *name, int *error, struct semaphore *mutex)
return find_inlist_lock(&ipt_match, name, "ipt_", error, mutex); return find_inlist_lock(&ipt_match, name, "ipt_", error, mutex);
} }
static inline struct ipt_target * struct ipt_target *
find_target_lock(const char *name, int *error, struct semaphore *mutex) ipt_find_target_lock(const char *name, int *error, struct semaphore *mutex)
{ {
return find_inlist_lock(&ipt_target, name, "ipt_", error, mutex); return find_inlist_lock(&ipt_target, name, "ipt_", error, mutex);
} }
...@@ -688,7 +685,7 @@ check_entry(struct ipt_entry *e, const char *name, unsigned int size, ...@@ -688,7 +685,7 @@ check_entry(struct ipt_entry *e, const char *name, unsigned int size,
goto cleanup_matches; goto cleanup_matches;
t = ipt_get_target(e); t = ipt_get_target(e);
target = find_target_lock(t->u.user.name, &ret, &ipt_mutex); target = ipt_find_target_lock(t->u.user.name, &ret, &ipt_mutex);
if (!target) { if (!target) {
duprintf("check_entry: `%s' not found\n", t->u.user.name); duprintf("check_entry: `%s' not found\n", t->u.user.name);
goto cleanup_matches; goto cleanup_matches;
...@@ -1025,7 +1022,7 @@ get_entries(const struct ipt_get_entries *entries, ...@@ -1025,7 +1022,7 @@ get_entries(const struct ipt_get_entries *entries,
int ret; int ret;
struct ipt_table *t; struct ipt_table *t;
t = find_table_lock(entries->name, &ret, &ipt_mutex); t = ipt_find_table_lock(entries->name, &ret, &ipt_mutex);
if (t) { if (t) {
duprintf("t->private->number = %u\n", duprintf("t->private->number = %u\n",
t->private->number); t->private->number);
...@@ -1092,7 +1089,7 @@ do_replace(void __user *user, unsigned int len) ...@@ -1092,7 +1089,7 @@ do_replace(void __user *user, unsigned int len)
duprintf("ip_tables: Translated table\n"); duprintf("ip_tables: Translated table\n");
t = find_table_lock(tmp.name, &ret, &ipt_mutex); t = ipt_find_table_lock(tmp.name, &ret, &ipt_mutex);
if (!t) if (!t)
goto free_newinfo_counters_untrans; goto free_newinfo_counters_untrans;
...@@ -1195,7 +1192,7 @@ do_add_counters(void __user *user, unsigned int len) ...@@ -1195,7 +1192,7 @@ do_add_counters(void __user *user, unsigned int len)
goto free; goto free;
} }
t = find_table_lock(tmp.name, &ret, &ipt_mutex); t = ipt_find_table_lock(tmp.name, &ret, &ipt_mutex);
if (!t) if (!t)
goto free; goto free;
...@@ -1270,7 +1267,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) ...@@ -1270,7 +1267,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
break; break;
} }
name[IPT_TABLE_MAXNAMELEN-1] = '\0'; name[IPT_TABLE_MAXNAMELEN-1] = '\0';
t = find_table_lock(name, &ret, &ipt_mutex); t = ipt_find_table_lock(name, &ret, &ipt_mutex);
if (t) { if (t) {
struct ipt_getinfo info; struct ipt_getinfo info;
...@@ -1855,6 +1852,7 @@ EXPORT_SYMBOL(ipt_unregister_match); ...@@ -1855,6 +1852,7 @@ EXPORT_SYMBOL(ipt_unregister_match);
EXPORT_SYMBOL(ipt_do_table); EXPORT_SYMBOL(ipt_do_table);
EXPORT_SYMBOL(ipt_register_target); EXPORT_SYMBOL(ipt_register_target);
EXPORT_SYMBOL(ipt_unregister_target); EXPORT_SYMBOL(ipt_unregister_target);
EXPORT_SYMBOL(ipt_find_target_lock);
module_init(init); module_init(init);
module_exit(fini); module_exit(fini);
...@@ -66,8 +66,6 @@ do { \ ...@@ -66,8 +66,6 @@ do { \
#endif #endif
#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
/* Mutex protects lists (only traversed in user context). */
static DECLARE_MUTEX(ip6t_mutex);
/* Must have mutex */ /* Must have mutex */
#define ASSERT_READ_LOCK(x) IP_NF_ASSERT(down_trylock(&ip6t_mutex) != 0) #define ASSERT_READ_LOCK(x) IP_NF_ASSERT(down_trylock(&ip6t_mutex) != 0)
...@@ -544,7 +542,7 @@ find_inlist_lock(struct list_head *head, ...@@ -544,7 +542,7 @@ find_inlist_lock(struct list_head *head,
#endif #endif
static inline struct ip6t_table * static inline struct ip6t_table *
find_table_lock(const char *name, int *error, struct semaphore *mutex) ip6t_find_table_lock(const char *name, int *error, struct semaphore *mutex)
{ {
return find_inlist_lock(&ip6t_tables, name, "ip6table_", error, mutex); return find_inlist_lock(&ip6t_tables, name, "ip6table_", error, mutex);
} }
...@@ -555,8 +553,8 @@ find_match_lock(const char *name, int *error, struct semaphore *mutex) ...@@ -555,8 +553,8 @@ find_match_lock(const char *name, int *error, struct semaphore *mutex)
return find_inlist_lock(&ip6t_match, name, "ip6t_", error, mutex); return find_inlist_lock(&ip6t_match, name, "ip6t_", error, mutex);
} }
static inline struct ip6t_target * struct ip6t_target *
find_target_lock(const char *name, int *error, struct semaphore *mutex) ip6t_find_target_lock(const char *name, int *error, struct semaphore *mutex)
{ {
return find_inlist_lock(&ip6t_target, name, "ip6t_", error, mutex); return find_inlist_lock(&ip6t_target, name, "ip6t_", error, mutex);
} }
...@@ -771,7 +769,7 @@ check_entry(struct ip6t_entry *e, const char *name, unsigned int size, ...@@ -771,7 +769,7 @@ check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
goto cleanup_matches; goto cleanup_matches;
t = ip6t_get_target(e); t = ip6t_get_target(e);
target = find_target_lock(t->u.user.name, &ret, &ip6t_mutex); target = ip6t_find_target_lock(t->u.user.name, &ret, &ip6t_mutex);
if (!target) { if (!target) {
duprintf("check_entry: `%s' not found\n", t->u.user.name); duprintf("check_entry: `%s' not found\n", t->u.user.name);
goto cleanup_matches; goto cleanup_matches;
...@@ -1111,7 +1109,7 @@ get_entries(const struct ip6t_get_entries *entries, ...@@ -1111,7 +1109,7 @@ get_entries(const struct ip6t_get_entries *entries,
int ret; int ret;
struct ip6t_table *t; struct ip6t_table *t;
t = find_table_lock(entries->name, &ret, &ip6t_mutex); t = ip6t_find_table_lock(entries->name, &ret, &ip6t_mutex);
if (t) { if (t) {
duprintf("t->private->number = %u\n", duprintf("t->private->number = %u\n",
t->private->number); t->private->number);
...@@ -1174,7 +1172,7 @@ do_replace(void __user *user, unsigned int len) ...@@ -1174,7 +1172,7 @@ do_replace(void __user *user, unsigned int len)
duprintf("ip_tables: Translated table\n"); duprintf("ip_tables: Translated table\n");
t = find_table_lock(tmp.name, &ret, &ip6t_mutex); t = ip6t_find_table_lock(tmp.name, &ret, &ip6t_mutex);
if (!t) if (!t)
goto free_newinfo_counters_untrans; goto free_newinfo_counters_untrans;
...@@ -1276,7 +1274,7 @@ do_add_counters(void __user *user, unsigned int len) ...@@ -1276,7 +1274,7 @@ do_add_counters(void __user *user, unsigned int len)
goto free; goto free;
} }
t = find_table_lock(tmp.name, &ret, &ip6t_mutex); t = ip6t_find_table_lock(tmp.name, &ret, &ip6t_mutex);
if (!t) if (!t)
goto free; goto free;
...@@ -1351,7 +1349,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) ...@@ -1351,7 +1349,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
break; break;
} }
name[IP6T_TABLE_MAXNAMELEN-1] = '\0'; name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
t = find_table_lock(name, &ret, &ip6t_mutex); t = ip6t_find_table_lock(name, &ret, &ip6t_mutex);
if (t) { if (t) {
struct ip6t_getinfo info; struct ip6t_getinfo info;
...@@ -1964,6 +1962,7 @@ static void __exit fini(void) ...@@ -1964,6 +1962,7 @@ static void __exit fini(void)
EXPORT_SYMBOL(ip6t_register_table); EXPORT_SYMBOL(ip6t_register_table);
EXPORT_SYMBOL(ip6t_unregister_table); EXPORT_SYMBOL(ip6t_unregister_table);
EXPORT_SYMBOL(ip6t_do_table); EXPORT_SYMBOL(ip6t_do_table);
EXPORT_SYMBOL(ip6t_find_target_lock);
EXPORT_SYMBOL(ip6t_register_match); EXPORT_SYMBOL(ip6t_register_match);
EXPORT_SYMBOL(ip6t_unregister_match); EXPORT_SYMBOL(ip6t_unregister_match);
EXPORT_SYMBOL(ip6t_register_target); EXPORT_SYMBOL(ip6t_register_target);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment