Commit 1c491ba2 authored by David S. Miller's avatar David S. Miller
Browse files

netfilter: Pass nf_hook_state through ipt_do_table(). 



Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d7cf4081

include/linux/netfilter_ipv4/ip_tables.h

+1 −2
Original line number Diff line number Diff line
@@ -65,8 +65,7 @@ struct ipt_error { 
extern void *ipt_alloc_initial_table(const struct xt_table *);

extern unsigned int ipt_do_table(struct sk_buff *skb,

				 unsigned int hook,

				 const struct net_device *in,

				 const struct net_device *out,

				 const struct nf_hook_state *state,

				 struct xt_table *table);



#ifdef CONFIG_COMPAT

net/ipv4/netfilter/ip_tables.c

+6 −7
Original line number Diff line number Diff line
@@ -288,8 +288,7 @@ struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry) 
unsigned int

ipt_do_table(struct sk_buff *skb,

	     unsigned int hook,

	     const struct net_device *in,

	     const struct net_device *out,

	     const struct nf_hook_state *state,

	     struct xt_table *table)

{

	static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
@@ -306,8 +305,8 @@ ipt_do_table(struct sk_buff *skb, 


	/* Initialization */

	ip = ip_hdr(skb);

	indev = in ? in->name : nulldevname;

	outdev = out ? out->name : nulldevname;

	indev = state->in ? state->in->name : nulldevname;

	outdev = state->out ? state->out->name : nulldevname;

	/* We handle fragments by dealing with the first fragment as

	 * if it was a normal packet.  All other fragments are treated

	 * normally, except that they will NEVER match rules that ask
@@ -317,8 +316,8 @@ ipt_do_table(struct sk_buff *skb, 
	acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;

	acpar.thoff   = ip_hdrlen(skb);

	acpar.hotdrop = false;

	acpar.in      = in;

	acpar.out     = out;

	acpar.in      = state->in;

	acpar.out     = state->out;

	acpar.family  = NFPROTO_IPV4;

	acpar.hooknum = hook;
@@ -370,7 +369,7 @@ ipt_do_table(struct sk_buff *skb, 
#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)

		/* The packet is traced: log it */

		if (unlikely(skb->nf_trace))

			trace_packet(skb, hook, in, out,

			trace_packet(skb, hook, state->in, state->out,

				     table->name, private, e);

#endif

		/* Standard target? */

net/ipv4/netfilter/iptable_filter.c

+1 −2
Original line number Diff line number Diff line
@@ -45,8 +45,7 @@ iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, 
		return NF_ACCEPT;



	net = dev_net(state->in ? state->in : state->out);

	return ipt_do_table(skb, ops->hooknum, state->in, state->out,

			    net->ipv4.iptable_filter);

	return ipt_do_table(skb, ops->hooknum, state, net->ipv4.iptable_filter);

}



static struct nf_hook_ops *filter_ops __read_mostly;

net/ipv4/netfilter/iptable_mangle.c

+6 −5
Original line number Diff line number Diff line
@@ -37,8 +37,9 @@ static const struct xt_table packet_mangler = { 
};



static unsigned int

ipt_mangle_out(struct sk_buff *skb, const struct net_device *out)

ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)

{

	struct net_device *out = state->out;

	unsigned int ret;

	const struct iphdr *iph;

	u_int8_t tos;
@@ -58,7 +59,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct net_device *out) 
	daddr = iph->daddr;

	tos = iph->tos;



	ret = ipt_do_table(skb, NF_INET_LOCAL_OUT, NULL, out,

	ret = ipt_do_table(skb, NF_INET_LOCAL_OUT, state,

			   dev_net(out)->ipv4.iptable_mangle);

	/* Reroute for ANY change. */

	if (ret != NF_DROP && ret != NF_STOLEN) {
@@ -84,12 +85,12 @@ iptable_mangle_hook(const struct nf_hook_ops *ops, 
		     const struct nf_hook_state *state)

{

	if (ops->hooknum == NF_INET_LOCAL_OUT)

		return ipt_mangle_out(skb, state->out);

		return ipt_mangle_out(skb, state);

	if (ops->hooknum == NF_INET_POST_ROUTING)

		return ipt_do_table(skb, ops->hooknum, state->in, state->out,

		return ipt_do_table(skb, ops->hooknum, state,

				    dev_net(state->out)->ipv4.iptable_mangle);

	/* PREROUTING/INPUT/FORWARD: */

	return ipt_do_table(skb, ops->hooknum, state->in, state->out,

	return ipt_do_table(skb, ops->hooknum, state,

			    dev_net(state->in)->ipv4.iptable_mangle);

}

net/ipv4/netfilter/iptable_nat.c

+1 −2
Original line number Diff line number Diff line
@@ -35,8 +35,7 @@ static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops, 
{

	struct net *net = nf_ct_net(ct);



	return ipt_do_table(skb, ops->hooknum, state->in, state->out,

			    net->ipv4.nat_table);

	return ipt_do_table(skb, ops->hooknum, state, net->ipv4.nat_table);

}



static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,