OpenWrt – Blame information for rev 1
?pathlinks?
Rev | Author | Line No. | Line |
---|---|---|---|
1 | office | 1 | From: Pablo Neira Ayuso <pablo@netfilter.org> |
2 | Date: Sat, 9 Dec 2017 15:36:24 +0100 |
||
3 | Subject: [PATCH] netfilter: nf_tables_inet: don't use multihook infrastructure |
||
4 | anymore |
||
5 | |||
6 | Use new native NFPROTO_INET support in netfilter core, this gets rid of |
||
7 | ad-hoc code in the nf_tables API codebase. |
||
8 | |||
9 | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
||
10 | --- |
||
11 | |||
12 | --- a/include/net/netfilter/nf_tables_ipv4.h |
||
13 | +++ b/include/net/netfilter/nf_tables_ipv4.h |
||
14 | @@ -53,6 +53,4 @@ static inline void nft_set_pktinfo_ipv4_ |
||
15 | nft_set_pktinfo_unspec(pkt, skb); |
||
16 | } |
||
17 | |||
18 | -extern struct nft_af_info nft_af_ipv4; |
||
19 | - |
||
20 | #endif |
||
21 | --- a/include/net/netfilter/nf_tables_ipv6.h |
||
22 | +++ b/include/net/netfilter/nf_tables_ipv6.h |
||
23 | @@ -69,6 +69,4 @@ static inline void nft_set_pktinfo_ipv6_ |
||
24 | nft_set_pktinfo_unspec(pkt, skb); |
||
25 | } |
||
26 | |||
27 | -extern struct nft_af_info nft_af_ipv6; |
||
28 | - |
||
29 | #endif |
||
30 | --- a/net/ipv4/netfilter/nf_tables_ipv4.c |
||
31 | +++ b/net/ipv4/netfilter/nf_tables_ipv4.c |
||
32 | @@ -45,7 +45,7 @@ static unsigned int nft_ipv4_output(void |
||
33 | return nft_do_chain_ipv4(priv, skb, state); |
||
34 | } |
||
35 | |||
36 | -struct nft_af_info nft_af_ipv4 __read_mostly = { |
||
37 | +static struct nft_af_info nft_af_ipv4 __read_mostly = { |
||
38 | .family = NFPROTO_IPV4, |
||
39 | .nhooks = NF_INET_NUMHOOKS, |
||
40 | .owner = THIS_MODULE, |
||
41 | @@ -58,7 +58,6 @@ struct nft_af_info nft_af_ipv4 __read_mo |
||
42 | [NF_INET_POST_ROUTING] = nft_do_chain_ipv4, |
||
43 | }, |
||
44 | }; |
||
45 | -EXPORT_SYMBOL_GPL(nft_af_ipv4); |
||
46 | |||
47 | static int nf_tables_ipv4_init_net(struct net *net) |
||
48 | { |
||
49 | --- a/net/ipv6/netfilter/nf_tables_ipv6.c |
||
50 | +++ b/net/ipv6/netfilter/nf_tables_ipv6.c |
||
51 | @@ -42,7 +42,7 @@ static unsigned int nft_ipv6_output(void |
||
52 | return nft_do_chain_ipv6(priv, skb, state); |
||
53 | } |
||
54 | |||
55 | -struct nft_af_info nft_af_ipv6 __read_mostly = { |
||
56 | +static struct nft_af_info nft_af_ipv6 __read_mostly = { |
||
57 | .family = NFPROTO_IPV6, |
||
58 | .nhooks = NF_INET_NUMHOOKS, |
||
59 | .owner = THIS_MODULE, |
||
60 | @@ -55,7 +55,6 @@ struct nft_af_info nft_af_ipv6 __read_mo |
||
61 | [NF_INET_POST_ROUTING] = nft_do_chain_ipv6, |
||
62 | }, |
||
63 | }; |
||
64 | -EXPORT_SYMBOL_GPL(nft_af_ipv6); |
||
65 | |||
66 | static int nf_tables_ipv6_init_net(struct net *net) |
||
67 | { |
||
68 | --- a/net/netfilter/nf_tables_inet.c |
||
69 | +++ b/net/netfilter/nf_tables_inet.c |
||
70 | @@ -9,6 +9,7 @@ |
||
71 | #include <linux/init.h> |
||
72 | #include <linux/module.h> |
||
73 | #include <linux/ip.h> |
||
74 | +#include <linux/ipv6.h> |
||
75 | #include <linux/netfilter_ipv4.h> |
||
76 | #include <linux/netfilter_ipv6.h> |
||
77 | #include <net/netfilter/nf_tables.h> |
||
78 | @@ -16,26 +17,71 @@ |
||
79 | #include <net/netfilter/nf_tables_ipv6.h> |
||
80 | #include <net/ip.h> |
||
81 | |||
82 | -static void nft_inet_hook_ops_init(struct nf_hook_ops *ops, unsigned int n) |
||
83 | +static unsigned int nft_do_chain_inet(void *priv, struct sk_buff *skb, |
||
84 | + const struct nf_hook_state *state) |
||
85 | { |
||
86 | - struct nft_af_info *afi; |
||
87 | + struct nft_pktinfo pkt; |
||
88 | |||
89 | - if (n == 1) |
||
90 | - afi = &nft_af_ipv4; |
||
91 | - else |
||
92 | - afi = &nft_af_ipv6; |
||
93 | - |
||
94 | - ops->pf = afi->family; |
||
95 | - if (afi->hooks[ops->hooknum]) |
||
96 | - ops->hook = afi->hooks[ops->hooknum]; |
||
97 | + nft_set_pktinfo(&pkt, skb, state); |
||
98 | + |
||
99 | + switch (state->pf) { |
||
100 | + case NFPROTO_IPV4: |
||
101 | + nft_set_pktinfo_ipv4(&pkt, skb); |
||
102 | + break; |
||
103 | + case NFPROTO_IPV6: |
||
104 | + nft_set_pktinfo_ipv6(&pkt, skb); |
||
105 | + break; |
||
106 | + default: |
||
107 | + break; |
||
108 | + } |
||
109 | + |
||
110 | + return nft_do_chain(&pkt, priv); |
||
111 | +} |
||
112 | + |
||
113 | +static unsigned int nft_inet_output(void *priv, struct sk_buff *skb, |
||
114 | + const struct nf_hook_state *state) |
||
115 | +{ |
||
116 | + struct nft_pktinfo pkt; |
||
117 | + |
||
118 | + nft_set_pktinfo(&pkt, skb, state); |
||
119 | + |
||
120 | + switch (state->pf) { |
||
121 | + case NFPROTO_IPV4: |
||
122 | + if (unlikely(skb->len < sizeof(struct iphdr) || |
||
123 | + ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) { |
||
124 | + if (net_ratelimit()) |
||
125 | + pr_info("ignoring short SOCK_RAW packet\n"); |
||
126 | + return NF_ACCEPT; |
||
127 | + } |
||
128 | + nft_set_pktinfo_ipv4(&pkt, skb); |
||
129 | + break; |
||
130 | + case NFPROTO_IPV6: |
||
131 | + if (unlikely(skb->len < sizeof(struct ipv6hdr))) { |
||
132 | + if (net_ratelimit()) |
||
133 | + pr_info("ignoring short SOCK_RAW packet\n"); |
||
134 | + return NF_ACCEPT; |
||
135 | + } |
||
136 | + nft_set_pktinfo_ipv6(&pkt, skb); |
||
137 | + break; |
||
138 | + default: |
||
139 | + break; |
||
140 | + } |
||
141 | + |
||
142 | + return nft_do_chain(&pkt, priv); |
||
143 | } |
||
144 | |||
145 | static struct nft_af_info nft_af_inet __read_mostly = { |
||
146 | .family = NFPROTO_INET, |
||
147 | .nhooks = NF_INET_NUMHOOKS, |
||
148 | .owner = THIS_MODULE, |
||
149 | - .nops = 2, |
||
150 | - .hook_ops_init = nft_inet_hook_ops_init, |
||
151 | + .nops = 1, |
||
152 | + .hooks = { |
||
153 | + [NF_INET_LOCAL_IN] = nft_do_chain_inet, |
||
154 | + [NF_INET_LOCAL_OUT] = nft_inet_output, |
||
155 | + [NF_INET_FORWARD] = nft_do_chain_inet, |
||
156 | + [NF_INET_PRE_ROUTING] = nft_do_chain_inet, |
||
157 | + [NF_INET_POST_ROUTING] = nft_do_chain_inet, |
||
158 | + }, |
||
159 | }; |
||
160 | |||
161 | static int __net_init nf_tables_inet_init_net(struct net *net) |