Skip to content

Commit 795aa6e

Browse files
kaberummakynes
kaber
authored and
ummakynes
committed
netfilter: pass hook ops to hookfn
Pass the hook ops to the hookfn to allow for generic hook functions. This change is required by nf_tables. Signed-off-by: Patrick McHardy <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent ccdbb6e commit 795aa6e

26 files changed

+148
-122
lines changed

‎include/linux/netfilter.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ int netfilter_init(void);
4242

4343
struct sk_buff;
4444

45-
typedef unsigned int nf_hookfn(unsigned int hooknum,
45+
struct nf_hook_ops;
46+
typedef unsigned int nf_hookfn(const struct nf_hook_ops *ops,
4647
struct sk_buff *skb,
4748
const struct net_device *in,
4849
const struct net_device *out,

‎net/bridge/br_netfilter.c

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -619,7 +619,7 @@ static int check_hbh_len(struct sk_buff *skb)
619619

620620
/* Replicate the checks that IPv6 does on packet reception and pass the packet
621621
* to ip6tables, which doesn't support NAT, so things are fairly simple. */
622-
static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
622+
static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
623623
struct sk_buff *skb,
624624
const struct net_device *in,
625625
const struct net_device *out,
@@ -669,7 +669,8 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
669669
* receiving device) to make netfilter happy, the REDIRECT
670670
* target in particular. Save the original destination IP
671671
* address to be able to detect DNAT afterwards. */
672-
static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
672+
static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops,
673+
struct sk_buff *skb,
673674
const struct net_device *in,
674675
const struct net_device *out,
675676
int (*okfn)(struct sk_buff *))
@@ -691,7 +692,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
691692
return NF_ACCEPT;
692693

693694
nf_bridge_pull_encap_header_rcsum(skb);
694-
return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
695+
return br_nf_pre_routing_ipv6(ops, skb, in, out, okfn);
695696
}
696697

697698
if (!brnf_call_iptables && !br->nf_call_iptables)
@@ -727,7 +728,8 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
727728
* took place when the packet entered the bridge), but we
728729
* register an IPv4 PRE_ROUTING 'sabotage' hook that will
729730
* prevent this from happening. */
730-
static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
731+
static unsigned int br_nf_local_in(const struct nf_hook_ops *ops,
732+
struct sk_buff *skb,
731733
const struct net_device *in,
732734
const struct net_device *out,
733735
int (*okfn)(struct sk_buff *))
@@ -765,7 +767,8 @@ static int br_nf_forward_finish(struct sk_buff *skb)
765767
* but we are still able to filter on the 'real' indev/outdev
766768
* because of the physdev module. For ARP, indev and outdev are the
767769
* bridge ports. */
768-
static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
770+
static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops,
771+
struct sk_buff *skb,
769772
const struct net_device *in,
770773
const struct net_device *out,
771774
int (*okfn)(struct sk_buff *))
@@ -818,7 +821,8 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
818821
return NF_STOLEN;
819822
}
820823

821-
static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
824+
static unsigned int br_nf_forward_arp(const struct nf_hook_ops *ops,
825+
struct sk_buff *skb,
822826
const struct net_device *in,
823827
const struct net_device *out,
824828
int (*okfn)(struct sk_buff *))
@@ -878,7 +882,8 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
878882
#endif
879883

880884
/* PF_BRIDGE/POST_ROUTING ********************************************/
881-
static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
885+
static unsigned int br_nf_post_routing(const struct nf_hook_ops *ops,
886+
struct sk_buff *skb,
882887
const struct net_device *in,
883888
const struct net_device *out,
884889
int (*okfn)(struct sk_buff *))
@@ -923,7 +928,8 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
923928
/* IP/SABOTAGE *****************************************************/
924929
/* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING
925930
* for the second time. */
926-
static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
931+
static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops,
932+
struct sk_buff *skb,
927933
const struct net_device *in,
928934
const struct net_device *out,
929935
int (*okfn)(struct sk_buff *))

‎net/bridge/netfilter/ebtable_filter.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,17 +60,21 @@ static const struct ebt_table frame_filter =
6060
};
6161

6262
static unsigned int
63-
ebt_in_hook(unsigned int hook, struct sk_buff *skb, const struct net_device *in,
64-
const struct net_device *out, int (*okfn)(struct sk_buff *))
63+
ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
64+
const struct net_device *in, const struct net_device *out,
65+
int (*okfn)(struct sk_buff *))
6566
{
66-
return ebt_do_table(hook, skb, in, out, dev_net(in)->xt.frame_filter);
67+
return ebt_do_table(ops->hooknum, skb, in, out,
68+
dev_net(in)->xt.frame_filter);
6769
}
6870

6971
static unsigned int
70-
ebt_out_hook(unsigned int hook, struct sk_buff *skb, const struct net_device *in,
71-
const struct net_device *out, int (*okfn)(struct sk_buff *))
72+
ebt_out_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
73+
const struct net_device *in, const struct net_device *out,
74+
int (*okfn)(struct sk_buff *))
7275
{
73-
return ebt_do_table(hook, skb, in, out, dev_net(out)->xt.frame_filter);
76+
return ebt_do_table(ops->hooknum, skb, in, out,
77+
dev_net(out)->xt.frame_filter);
7478
}
7579

7680
static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {

‎net/bridge/netfilter/ebtable_nat.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,17 +60,21 @@ static struct ebt_table frame_nat =
6060
};
6161

6262
static unsigned int
63-
ebt_nat_in(unsigned int hook, struct sk_buff *skb, const struct net_device *in
64-
, const struct net_device *out, int (*okfn)(struct sk_buff *))
63+
ebt_nat_in(const struct nf_hook_ops *ops, struct sk_buff *skb,
64+
const struct net_device *in, const struct net_device *out,
65+
int (*okfn)(struct sk_buff *))
6566
{
66-
return ebt_do_table(hook, skb, in, out, dev_net(in)->xt.frame_nat);
67+
return ebt_do_table(ops->hooknum, skb, in, out,
68+
dev_net(in)->xt.frame_nat);
6769
}
6870

6971
static unsigned int
70-
ebt_nat_out(unsigned int hook, struct sk_buff *skb, const struct net_device *in
71-
, const struct net_device *out, int (*okfn)(struct sk_buff *))
72+
ebt_nat_out(const struct nf_hook_ops *ops, struct sk_buff *skb,
73+
const struct net_device *in, const struct net_device *out,
74+
int (*okfn)(struct sk_buff *))
7275
{
73-
return ebt_do_table(hook, skb, in, out, dev_net(out)->xt.frame_nat);
76+
return ebt_do_table(ops->hooknum, skb, in, out,
77+
dev_net(out)->xt.frame_nat);
7478
}
7579

7680
static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {

‎net/decnet/netfilter/dn_rtmsg.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ static void dnrmg_send_peer(struct sk_buff *skb)
8787
}
8888

8989

90-
static unsigned int dnrmg_hook(unsigned int hook,
90+
static unsigned int dnrmg_hook(const struct nf_hook_ops *ops,
9191
struct sk_buff *skb,
9292
const struct net_device *in,
9393
const struct net_device *out,

‎net/ipv4/netfilter/arptable_filter.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,14 @@ static const struct xt_table packet_filter = {
2727

2828
/* The work comes in here from netfilter.c */
2929
static unsigned int
30-
arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
30+
arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
3131
const struct net_device *in, const struct net_device *out,
3232
int (*okfn)(struct sk_buff *))
3333
{
3434
const struct net *net = dev_net((in != NULL) ? in : out);
3535

36-
return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
36+
return arpt_do_table(skb, ops->hooknum, in, out,
37+
net->ipv4.arptable_filter);
3738
}
3839

3940
static struct nf_hook_ops *arpfilter_ops __read_mostly;

‎net/ipv4/netfilter/ipt_CLUSTERIP.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,7 @@ static void arp_print(struct arp_payload *payload)
483483
#endif
484484

485485
static unsigned int
486-
arp_mangle(unsigned int hook,
486+
arp_mangle(const struct nf_hook_ops *ops,
487487
struct sk_buff *skb,
488488
const struct net_device *in,
489489
const struct net_device *out,

‎net/ipv4/netfilter/ipt_SYNPROXY.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
297297
return XT_CONTINUE;
298298
}
299299

300-
static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
300+
static unsigned int ipv4_synproxy_hook(const struct nf_hook_ops *ops,
301301
struct sk_buff *skb,
302302
const struct net_device *in,
303303
const struct net_device *out,

‎net/ipv4/netfilter/iptable_filter.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,20 +33,21 @@ static const struct xt_table packet_filter = {
3333
};
3434

3535
static unsigned int
36-
iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
36+
iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
3737
const struct net_device *in, const struct net_device *out,
3838
int (*okfn)(struct sk_buff *))
3939
{
4040
const struct net *net;
4141

42-
if (hook == NF_INET_LOCAL_OUT &&
42+
if (ops->hooknum == NF_INET_LOCAL_OUT &&
4343
(skb->len < sizeof(struct iphdr) ||
4444
ip_hdrlen(skb) < sizeof(struct iphdr)))
4545
/* root is playing with raw sockets. */
4646
return NF_ACCEPT;
4747

4848
net = dev_net((in != NULL) ? in : out);
49-
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
49+
return ipt_do_table(skb, ops->hooknum, in, out,
50+
net->ipv4.iptable_filter);
5051
}
5152

5253
static struct nf_hook_ops *filter_ops __read_mostly;

‎net/ipv4/netfilter/iptable_mangle.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,19 +79,19 @@ ipt_mangle_out(struct sk_buff *skb, const struct net_device *out)
7979

8080
/* The work comes in here from netfilter.c. */
8181
static unsigned int
82-
iptable_mangle_hook(unsigned int hook,
82+
iptable_mangle_hook(const struct nf_hook_ops *ops,
8383
struct sk_buff *skb,
8484
const struct net_device *in,
8585
const struct net_device *out,
8686
int (*okfn)(struct sk_buff *))
8787
{
88-
if (hook == NF_INET_LOCAL_OUT)
88+
if (ops->hooknum == NF_INET_LOCAL_OUT)
8989
return ipt_mangle_out(skb, out);
90-
if (hook == NF_INET_POST_ROUTING)
91-
return ipt_do_table(skb, hook, in, out,
90+
if (ops->hooknum == NF_INET_POST_ROUTING)
91+
return ipt_do_table(skb, ops->hooknum, in, out,
9292
dev_net(out)->ipv4.iptable_mangle);
9393
/* PREROUTING/INPUT/FORWARD: */
94-
return ipt_do_table(skb, hook, in, out,
94+
return ipt_do_table(skb, ops->hooknum, in, out,
9595
dev_net(in)->ipv4.iptable_mangle);
9696
}
9797

0 commit comments

Comments
 (0)