Skip to content

L
linux
Commit a1ff4ac8 authored by Jan Engelhardt's avatar Jan Engelhardt
Browse files
Options

netfilter: xtables: reduce indent level by one 

Cosmetic only. Transformation applied:

	-if (foo) { long block; } else { short block; }
	+if (!foo) { short block; continue; } long block;
Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
parent 98e86403
Hide whitespace changes
Inline Side-by-side
Showing with 177 additions and 189 deletions
net/ipv4/netfilter/arp_tables.c
View file @ a1ff4ac8
...@@ -273,66 +273,62 @@ unsigned int arpt_do_table(struct sk_buff *skb, ...@@ -273,66 +273,62 @@ unsigned int arpt_do_table(struct sk_buff *skb,
arp = arp_hdr(skb); arp = arp_hdr(skb);
do { do {
if (arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) { struct arpt_entry_target *t;
struct arpt_entry_target *t; int hdr_len;
int hdr_len;
hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) + if (!arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
(2 * skb->dev->addr_len); e = arpt_next_entry(e);
continue;
}
ADD_COUNTER(e->counters, hdr_len, 1); hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
(2 * skb->dev->addr_len);
ADD_COUNTER(e->counters, hdr_len, 1);
t = arpt_get_target(e); t = arpt_get_target(e);
/* Standard target? */ /* Standard target? */
if (!t->u.kernel.target->target) { if (!t->u.kernel.target->target) {
int v; int v;
v = ((struct arpt_standard_target *)t)->verdict; v = ((struct arpt_standard_target *)t)->verdict;
if (v < 0) { if (v < 0) {
/* Pop from stack? */ /* Pop from stack? */
if (v != ARPT_RETURN) { if (v != ARPT_RETURN) {
verdict = (unsigned)(-v) - 1; verdict = (unsigned)(-v) - 1;
break;
}
e = back;
back = get_entry(table_base,
back->comefrom);
continue;
}
if (table_base + v
!= arpt_next_entry(e)) {
/* Save old back ptr in next entry */
struct arpt_entry *next
= arpt_next_entry(e);
next->comefrom =
(void *)back - table_base;
/* set back pointer to next entry */
back = next;
}
e = get_entry(table_base, v);
} else {
/* Targets which reenter must return
* abs. verdicts
*/
tgpar.target = t->u.kernel.target;
tgpar.targinfo = t->data;
verdict = t->u.kernel.target->target(skb,
&tgpar);
/* Target might have changed stuff. */
arp = arp_hdr(skb);
if (verdict == ARPT_CONTINUE)
e = arpt_next_entry(e);
else
/* Verdict */
break; break;
}
e = back;
back = get_entry(table_base, back->comefrom);
continue;
} }
if (table_base + v
!= arpt_next_entry(e)) {
/* Save old back ptr in next entry */
struct arpt_entry *next = arpt_next_entry(e);
next->comefrom = (void *)back - table_base;
/* set back pointer to next entry */
back = next;
}
e = get_entry(table_base, v);
} else { } else {
e = arpt_next_entry(e); /* Targets which reenter must return
* abs. verdicts
*/
tgpar.target = t->u.kernel.target;
tgpar.targinfo = t->data;
verdict = t->u.kernel.target->target(skb, &tgpar);
/* Target might have changed stuff. */
arp = arp_hdr(skb);
if (verdict == ARPT_CONTINUE)
e = arpt_next_entry(e);
else
/* Verdict */
break;
} }
} while (!hotdrop); } while (!hotdrop);
xt_info_rdunlock_bh(); xt_info_rdunlock_bh();
......
net/ipv4/netfilter/ip_tables.c
View file @ a1ff4ac8
...@@ -354,91 +354,87 @@ ipt_do_table(struct sk_buff *skb, ...@@ -354,91 +354,87 @@ ipt_do_table(struct sk_buff *skb,
back = get_entry(table_base, private->underflow[hook]); back = get_entry(table_base, private->underflow[hook]);
do { do {
struct ipt_entry_target *t;
IP_NF_ASSERT(e); IP_NF_ASSERT(e);
IP_NF_ASSERT(back); IP_NF_ASSERT(back);
if (ip_packet_match(ip, indev, outdev, if (!ip_packet_match(ip, indev, outdev,
&e->ip, mtpar.fragoff)) { &e->ip, mtpar.fragoff)) {
struct ipt_entry_target *t; no_match:
e = ipt_next_entry(e);
continue;
}
if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
goto no_match; goto no_match;
ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1); ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
t = ipt_get_target(e); t = ipt_get_target(e);
IP_NF_ASSERT(t->u.kernel.target); IP_NF_ASSERT(t->u.kernel.target);
#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \ #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE) defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
/* The packet is traced: log it */ /* The packet is traced: log it */
if (unlikely(skb->nf_trace)) if (unlikely(skb->nf_trace))
trace_packet(skb, hook, in, out, trace_packet(skb, hook, in, out,
table->name, private, e); table->name, private, e);
#endif #endif
/* Standard target? */ /* Standard target? */
if (!t->u.kernel.target->target) { if (!t->u.kernel.target->target) {
int v; int v;
v = ((struct ipt_standard_target *)t)->verdict; v = ((struct ipt_standard_target *)t)->verdict;
if (v < 0) { if (v < 0) {
/* Pop from stack? */ /* Pop from stack? */
if (v != IPT_RETURN) { if (v != IPT_RETURN) {
verdict = (unsigned)(-v) - 1; verdict = (unsigned)(-v) - 1;
break; break;
}
e = back;
back = get_entry(table_base,
back->comefrom);
continue;
}
if (table_base + v != ipt_next_entry(e)
&& !(e->ip.flags & IPT_F_GOTO)) {
/* Save old back ptr in next entry */
struct ipt_entry *next
= ipt_next_entry(e);
next->comefrom
= (void *)back - table_base;
/* set back pointer to next entry */
back = next;
} }
e = back;
back = get_entry(table_base, back->comefrom);
continue;
}
if (table_base + v != ipt_next_entry(e)
&& !(e->ip.flags & IPT_F_GOTO)) {
/* Save old back ptr in next entry */
struct ipt_entry *next = ipt_next_entry(e);
next->comefrom = (void *)back - table_base;
/* set back pointer to next entry */
back = next;
}
e = get_entry(table_base, v); e = get_entry(table_base, v);
} else { } else {
/* Targets which reenter must return /* Targets which reenter must return
abs. verdicts */ abs. verdicts */
tgpar.target = t->u.kernel.target; tgpar.target = t->u.kernel.target;
tgpar.targinfo = t->data; tgpar.targinfo = t->data;
#ifdef CONFIG_NETFILTER_DEBUG #ifdef CONFIG_NETFILTER_DEBUG
((struct ipt_entry *)table_base)->comefrom ((struct ipt_entry *)table_base)->comefrom
= 0xeeeeeeec; = 0xeeeeeeec;
#endif #endif
verdict = t->u.kernel.target->target(skb, verdict = t->u.kernel.target->target(skb, &tgpar);
&tgpar);
#ifdef CONFIG_NETFILTER_DEBUG #ifdef CONFIG_NETFILTER_DEBUG
if (((struct ipt_entry *)table_base)->comefrom if (((struct ipt_entry *)table_base)->comefrom
!= 0xeeeeeeec != 0xeeeeeeec
&& verdict == IPT_CONTINUE) { && verdict == IPT_CONTINUE) {
printk("Target %s reentered!\n", printk("Target %s reentered!\n",
t->u.kernel.target->name); t->u.kernel.target->name);
verdict = NF_DROP; verdict = NF_DROP;
}
((struct ipt_entry *)table_base)->comefrom
= 0x57acc001;
#endif
/* Target might have changed stuff. */
ip = ip_hdr(skb);
datalen = skb->len - ip->ihl * 4;
if (verdict == IPT_CONTINUE)
e = ipt_next_entry(e);
else
/* Verdict */
break;
} }
} else { ((struct ipt_entry *)table_base)->comefrom
= 0x57acc001;
no_match: #endif
e = ipt_next_entry(e); /* Target might have changed stuff. */
ip = ip_hdr(skb);
datalen = skb->len - ip->ihl * 4;
if (verdict == IPT_CONTINUE)
e = ipt_next_entry(e);
else
/* Verdict */
break;
} }
} while (!hotdrop); } while (!hotdrop);
xt_info_rdunlock_bh(); xt_info_rdunlock_bh();
......
net/ipv6/netfilter/ip6_tables.c
View file @ a1ff4ac8
...@@ -381,91 +381,87 @@ ip6t_do_table(struct sk_buff *skb, ...@@ -381,91 +381,87 @@ ip6t_do_table(struct sk_buff *skb,
back = get_entry(table_base, private->underflow[hook]); back = get_entry(table_base, private->underflow[hook]);
do { do {
struct ip6t_entry_target *t;
IP_NF_ASSERT(e); IP_NF_ASSERT(e);
IP_NF_ASSERT(back); IP_NF_ASSERT(back);
if (ip6_packet_match(skb, indev, outdev, &e->ipv6, if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
&mtpar.thoff, &mtpar.fragoff, &hotdrop)) { &mtpar.thoff, &mtpar.fragoff, &hotdrop)) {
struct ip6t_entry_target *t; no_match:
e = ip6t_next_entry(e);
continue;
}
if (IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) if (IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
goto no_match; goto no_match;
ADD_COUNTER(e->counters, ADD_COUNTER(e->counters,
ntohs(ipv6_hdr(skb)->payload_len) + ntohs(ipv6_hdr(skb)->payload_len) +
sizeof(struct ipv6hdr), 1); sizeof(struct ipv6hdr), 1);
t = ip6t_get_target(e); t = ip6t_get_target(e);
IP_NF_ASSERT(t->u.kernel.target); IP_NF_ASSERT(t->u.kernel.target);
#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \ #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE) defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
/* The packet is traced: log it */ /* The packet is traced: log it */
if (unlikely(skb->nf_trace)) if (unlikely(skb->nf_trace))
trace_packet(skb, hook, in, out, trace_packet(skb, hook, in, out,
table->name, private, e); table->name, private, e);
#endif #endif
/* Standard target? */ /* Standard target? */
if (!t->u.kernel.target->target) { if (!t->u.kernel.target->target) {
int v; int v;
v = ((struct ip6t_standard_target *)t)->verdict; v = ((struct ip6t_standard_target *)t)->verdict;
if (v < 0) { if (v < 0) {
/* Pop from stack? */ /* Pop from stack? */
if (v != IP6T_RETURN) { if (v != IP6T_RETURN) {
verdict = (unsigned)(-v) - 1; verdict = (unsigned)(-v) - 1;
break; break;
}
e = back;
back = get_entry(table_base,
back->comefrom);
continue;
}
if (table_base + v != ip6t_next_entry(e)
&& !(e->ipv6.flags & IP6T_F_GOTO)) {
/* Save old back ptr in next entry */
struct ip6t_entry *next
= ip6t_next_entry(e);
next->comefrom
= (void *)back - table_base;
/* set back pointer to next entry */
back = next;
} }
e = back;
back = get_entry(table_base, back->comefrom);
continue;
}
if (table_base + v != ip6t_next_entry(e)
&& !(e->ipv6.flags & IP6T_F_GOTO)) {
/* Save old back ptr in next entry */
struct ip6t_entry *next = ip6t_next_entry(e);
next->comefrom = (void *)back - table_base;
/* set back pointer to next entry */
back = next;
}
e = get_entry(table_base, v); e = get_entry(table_base, v);
} else { } else {
/* Targets which reenter must return /* Targets which reenter must return
abs. verdicts */ abs. verdicts */
tgpar.target = t->u.kernel.target; tgpar.target = t->u.kernel.target;
tgpar.targinfo = t->data; tgpar.targinfo = t->data;
#ifdef CONFIG_NETFILTER_DEBUG #ifdef CONFIG_NETFILTER_DEBUG
((struct ip6t_entry *)table_base)->comefrom ((struct ip6t_entry *)table_base)->comefrom
= 0xeeeeeeec; = 0xeeeeeeec;
#endif #endif
verdict = t->u.kernel.target->target(skb, verdict = t->u.kernel.target->target(skb, &tgpar);
&tgpar);
#ifdef CONFIG_NETFILTER_DEBUG #ifdef CONFIG_NETFILTER_DEBUG
if (((struct ip6t_entry *)table_base)->comefrom if (((struct ip6t_entry *)table_base)->comefrom
!= 0xeeeeeeec != 0xeeeeeeec
&& verdict == IP6T_CONTINUE) { && verdict == IP6T_CONTINUE) {
printk("Target %s reentered!\n", printk("Target %s reentered!\n",
t->u.kernel.target->name); t->u.kernel.target->name);
verdict = NF_DROP; verdict = NF_DROP;
}
((struct ip6t_entry *)table_base)->comefrom
= 0x57acc001;
#endif
if (verdict == IP6T_CONTINUE)
e = ip6t_next_entry(e);
else
/* Verdict */
break;
} }
} else { ((struct ip6t_entry *)table_base)->comefrom
= 0x57acc001;
no_match: #endif
e = ip6t_next_entry(e); if (verdict == IP6T_CONTINUE)
e = ip6t_next_entry(e);
else
/* Verdict */
break;
} }
} while (!hotdrop); } while (!hotdrop);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7