Commit 44b5990e authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: ip6tables: allow use of ip6t_do_table as hookfn 



This is possible now that the xt_table structure is passed via *priv.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent e8d225b6

include/linux/netfilter_ipv6/ip6_tables.h

+2 −3
Original line number Diff line number Diff line
@@ -29,9 +29,8 @@ int ip6t_register_table(struct net *net, const struct xt_table *table, 
			const struct nf_hook_ops *ops);

void ip6t_unregister_table_pre_exit(struct net *net, const char *name);

void ip6t_unregister_table_exit(struct net *net, const char *name);

extern unsigned int ip6t_do_table(struct sk_buff *skb,

				  const struct nf_hook_state *state,

				  struct xt_table *table);

extern unsigned int ip6t_do_table(void *priv, struct sk_buff *skb,

				  const struct nf_hook_state *state);



#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

#include <net/compat.h>

net/ipv6/netfilter/ip6_tables.c

+3 −3
Original line number Diff line number Diff line
@@ -247,10 +247,10 @@ ip6t_next_entry(const struct ip6t_entry *entry) 


/* Returns one of the generic firewall policies, like NF_ACCEPT. */

unsigned int

ip6t_do_table(struct sk_buff *skb,

	      const struct nf_hook_state *state,

	      struct xt_table *table)

ip6t_do_table(void *priv, struct sk_buff *skb,

	      const struct nf_hook_state *state)

{

	const struct xt_table *table = priv;

	unsigned int hook = state->hook;

	static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));

	/* Initializing verdict to NF_DROP keeps gcc happy. */

net/ipv6/netfilter/ip6table_filter.c

+1 −9
Original line number Diff line number Diff line
@@ -27,14 +27,6 @@ static const struct xt_table packet_filter = { 
	.priority	= NF_IP6_PRI_FILTER,

};



/* The work comes in here from netfilter.c. */

static unsigned int

ip6table_filter_hook(void *priv, struct sk_buff *skb,

		     const struct nf_hook_state *state)

{

	return ip6t_do_table(skb, state, priv);

}



static struct nf_hook_ops *filter_ops __read_mostly;



/* Default to forward because I got too much mail already. */
@@ -90,7 +82,7 @@ static int __init ip6table_filter_init(void) 
	if (ret < 0)

		return ret;



	filter_ops = xt_hook_ops_alloc(&packet_filter, ip6table_filter_hook);

	filter_ops = xt_hook_ops_alloc(&packet_filter, ip6t_do_table);

	if (IS_ERR(filter_ops)) {

		xt_unregister_template(&packet_filter);

		return PTR_ERR(filter_ops);

net/ipv6/netfilter/ip6table_mangle.c

+4 −4
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ static const struct xt_table packet_mangler = { 
};



static unsigned int

ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state, void *priv)

ip6t_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)

{

	unsigned int ret;

	struct in6_addr saddr, daddr;
@@ -46,7 +46,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state, void *pr 
	/* flowlabel and prio (includes version, which shouldn't change either */

	flowlabel = *((u_int32_t *)ipv6_hdr(skb));



	ret = ip6t_do_table(skb, state, priv);

	ret = ip6t_do_table(priv, skb, state);



	if (ret != NF_DROP && ret != NF_STOLEN &&

	    (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@@ -68,8 +68,8 @@ ip6table_mangle_hook(void *priv, struct sk_buff *skb, 
		     const struct nf_hook_state *state)

{

	if (state->hook == NF_INET_LOCAL_OUT)

		return ip6t_mangle_out(skb, state, priv);

	return ip6t_do_table(skb, state, priv);

		return ip6t_mangle_out(priv, skb, state);

	return ip6t_do_table(priv, skb, state);

}



static struct nf_hook_ops *mangle_ops __read_mostly;

net/ipv6/netfilter/ip6table_nat.c

+4 −11
Original line number Diff line number Diff line
@@ -31,34 +31,27 @@ static const struct xt_table nf_nat_ipv6_table = { 
	.af		= NFPROTO_IPV6,

};



static unsigned int ip6table_nat_do_chain(void *priv,

					  struct sk_buff *skb,

					  const struct nf_hook_state *state)

{

	return ip6t_do_table(skb, state, priv);

}



static const struct nf_hook_ops nf_nat_ipv6_ops[] = {

	{

		.hook		= ip6table_nat_do_chain,

		.hook		= ip6t_do_table,

		.pf		= NFPROTO_IPV6,

		.hooknum	= NF_INET_PRE_ROUTING,

		.priority	= NF_IP6_PRI_NAT_DST,

	},

	{

		.hook		= ip6table_nat_do_chain,

		.hook		= ip6t_do_table,

		.pf		= NFPROTO_IPV6,

		.hooknum	= NF_INET_POST_ROUTING,

		.priority	= NF_IP6_PRI_NAT_SRC,

	},

	{

		.hook		= ip6table_nat_do_chain,

		.hook		= ip6t_do_table,

		.pf		= NFPROTO_IPV6,

		.hooknum	= NF_INET_LOCAL_OUT,

		.priority	= NF_IP6_PRI_NAT_DST,

	},

	{

		.hook		= ip6table_nat_do_chain,

		.hook		= ip6t_do_table,

		.pf		= NFPROTO_IPV6,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP6_PRI_NAT_SRC,