Commit 8844e010 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: iptables: allow use of ipt_do_table as hookfn 



This is possible now that the xt_table structure is passed in via *priv.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0d7308c0

include/linux/netfilter_ipv4/ip_tables.h

+3 −3
Original line number Diff line number Diff line
@@ -63,9 +63,9 @@ struct ipt_error { 
}



extern void *ipt_alloc_initial_table(const struct xt_table *);

extern unsigned int ipt_do_table(struct sk_buff *skb,

				 const struct nf_hook_state *state,

				 struct xt_table *table);

extern unsigned int ipt_do_table(void *priv,

				 struct sk_buff *skb,

				 const struct nf_hook_state *state);



#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

#include <net/compat.h>

net/ipv4/netfilter/ip_tables.c

+4 −3
Original line number Diff line number Diff line
@@ -222,10 +222,11 @@ struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry) 


/* Returns one of the generic firewall policies, like NF_ACCEPT. */

unsigned int

ipt_do_table(struct sk_buff *skb,

	     const struct nf_hook_state *state,

	     struct xt_table *table)

ipt_do_table(void *priv,

	     struct sk_buff *skb,

	     const struct nf_hook_state *state)

{

	const struct xt_table *table = priv;

	unsigned int hook = state->hook;

	static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));

	const struct iphdr *ip;

net/ipv4/netfilter/iptable_filter.c

+1 −8
Original line number Diff line number Diff line
@@ -28,13 +28,6 @@ static const struct xt_table packet_filter = { 
	.priority	= NF_IP_PRI_FILTER,

};



static unsigned int

iptable_filter_hook(void *priv, struct sk_buff *skb,

		    const struct nf_hook_state *state)

{

	return ipt_do_table(skb, state, priv);

}



static struct nf_hook_ops *filter_ops __read_mostly;



/* Default to forward because I got too much mail already. */
@@ -90,7 +83,7 @@ static int __init iptable_filter_init(void) 
	if (ret < 0)

		return ret;



	filter_ops = xt_hook_ops_alloc(&packet_filter, iptable_filter_hook);

	filter_ops = xt_hook_ops_alloc(&packet_filter, ipt_do_table);

	if (IS_ERR(filter_ops)) {

		xt_unregister_template(&packet_filter);

		return PTR_ERR(filter_ops);

net/ipv4/netfilter/iptable_mangle.c

+4 −4
Original line number Diff line number Diff line
@@ -34,7 +34,7 @@ static const struct xt_table packet_mangler = { 
};



static unsigned int

ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state, void *priv)

ipt_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)

{

	unsigned int ret;

	const struct iphdr *iph;
@@ -50,7 +50,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state, void *pri 
	daddr = iph->daddr;

	tos = iph->tos;



	ret = ipt_do_table(skb, state, priv);

	ret = ipt_do_table(priv, skb, state);

	/* Reroute for ANY change. */

	if (ret != NF_DROP && ret != NF_STOLEN) {

		iph = ip_hdr(skb);
@@ -75,8 +75,8 @@ iptable_mangle_hook(void *priv, 
		     const struct nf_hook_state *state)

{

	if (state->hook == NF_INET_LOCAL_OUT)

		return ipt_mangle_out(skb, state, priv);

	return ipt_do_table(skb, state, priv);

		return ipt_mangle_out(priv, skb, state);

	return ipt_do_table(priv, skb, state);

}



static struct nf_hook_ops *mangle_ops __read_mostly;

net/ipv4/netfilter/iptable_nat.c

+4 −11
Original line number Diff line number Diff line
@@ -29,34 +29,27 @@ static const struct xt_table nf_nat_ipv4_table = { 
	.af		= NFPROTO_IPV4,

};



static unsigned int iptable_nat_do_chain(void *priv,

					 struct sk_buff *skb,

					 const struct nf_hook_state *state)

{

	return ipt_do_table(skb, state, priv);

}



static const struct nf_hook_ops nf_nat_ipv4_ops[] = {

	{

		.hook		= iptable_nat_do_chain,

		.hook		= ipt_do_table,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_PRE_ROUTING,

		.priority	= NF_IP_PRI_NAT_DST,

	},

	{

		.hook		= iptable_nat_do_chain,

		.hook		= ipt_do_table,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_POST_ROUTING,

		.priority	= NF_IP_PRI_NAT_SRC,

	},

	{

		.hook		= iptable_nat_do_chain,

		.hook		= ipt_do_table,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_OUT,

		.priority	= NF_IP_PRI_NAT_DST,

	},

	{

		.hook		= iptable_nat_do_chain,

		.hook		= ipt_do_table,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP_PRI_NAT_SRC,