* [NETFILTER 01/49]: x_tables: add TCPOPTSTRIP target
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
@ 2007-12-04 12:01 ` Patrick McHardy
2007-12-04 12:01 ` [NETFILTER 02/49]: replace list_for_each with list_for_each_entry Patrick McHardy
` (47 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:01 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: x_tables: add TCPOPTSTRIP target
Signed-off-by: Sven Schnelle <svens@bitebene.org>
Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit b3e4042d568acf92a0e4b5334c8a9ca499bb3a4a
tree bbcd2fdf9fc37af122af3bb8f63caed8bf83b68c
parent f2d0e339181e7973299401191dd22031494114ae
author Sven Schnelle <svens@bitebene.org> Tue, 04 Dec 2007 10:46:50 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:46:50 +0100
include/linux/netfilter/xt_TCPOPTSTRIP.h | 13 +++
net/netfilter/Kconfig | 8 ++
net/netfilter/Makefile | 1
net/netfilter/xt_TCPOPTSTRIP.c | 147 ++++++++++++++++++++++++++++++
4 files changed, 169 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/xt_TCPOPTSTRIP.h b/include/linux/netfilter/xt_TCPOPTSTRIP.h
new file mode 100644
index 0000000..2db5432
--- /dev/null
+++ b/include/linux/netfilter/xt_TCPOPTSTRIP.h
@@ -0,0 +1,13 @@
+#ifndef _XT_TCPOPTSTRIP_H
+#define _XT_TCPOPTSTRIP_H
+
+#define tcpoptstrip_set_bit(bmap, idx) \
+ (bmap[(idx) >> 5] |= 1U << (idx & 31))
+#define tcpoptstrip_test_bit(bmap, idx) \
+ (((1U << (idx & 31)) & bmap[(idx) >> 5]) != 0)
+
+struct xt_tcpoptstrip_target_info {
+ u_int32_t strip_bmap[8];
+};
+
+#endif /* _XT_TCPOPTSTRIP_H */
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 21a9fcc..693f861 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -411,6 +411,14 @@ config NETFILTER_XT_TARGET_TCPMSS
To compile it as a module, choose M here. If unsure, say N.
+config NETFILTER_XT_TARGET_TCPOPTSTRIP
+ tristate '"TCPOPTSTRIP" target support (EXPERIMENTAL)'
+ depends on EXPERIMENTAL && NETFILTER_XTABLES
+ depends on IP_NF_MANGLE || IP6_NF_MANGLE
+ help
+ This option adds a "TCPOPTSTRIP" target, which allows you to strip
+ TCP options from TCP packets.
+
config NETFILTER_XT_MATCH_COMMENT
tristate '"comment" match support'
depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index ad0e36e..7763dea 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -48,6 +48,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP) += xt_TCPOPTSTRIP.o
obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o
# matches
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c
new file mode 100644
index 0000000..43d6ac2
--- /dev/null
+++ b/net/netfilter/xt_TCPOPTSTRIP.c
@@ -0,0 +1,147 @@
+/*
+ * A module for stripping a specific TCP option from TCP packets.
+ *
+ * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
+ * Copyright © CC Computer Consultants GmbH, 2007
+ * Contact: Jan Engelhardt <jengelh@computergmbh.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/tcp.h>
+#include <net/ipv6.h>
+#include <net/tcp.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_TCPOPTSTRIP.h>
+
+static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
+{
+ /* Beware zero-length options: make finite progress */
+ if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
+ return 1;
+ else
+ return opt[offset+1];
+}
+
+static unsigned int
+tcpoptstrip_mangle_packet(struct sk_buff *skb,
+ const struct xt_tcpoptstrip_target_info *info,
+ unsigned int tcphoff, unsigned int minlen)
+{
+ unsigned int optl, i, j;
+ struct tcphdr *tcph;
+ u_int16_t n, o;
+ u_int8_t *opt;
+
+ if (!skb_make_writable(skb, skb->len))
+ return NF_DROP;
+
+ tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
+ opt = (u_int8_t *)tcph;
+
+ /*
+ * Walk through all TCP options - if we find some option to remove,
+ * set all octets to %TCPOPT_NOP and adjust checksum.
+ */
+ for (i = sizeof(struct tcphdr); i < tcp_hdrlen(skb); i += optl) {
+ optl = optlen(opt, i);
+
+ if (i + optl > tcp_hdrlen(skb))
+ break;
+
+ if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
+ continue;
+
+ for (j = 0; j < optl; ++j) {
+ o = opt[i+j];
+ n = TCPOPT_NOP;
+ if ((i + j) % 2 == 0) {
+ o <<= 8;
+ n <<= 8;
+ }
+ inet_proto_csum_replace2(&tcph->check, skb, htons(o),
+ htons(n), 0);
+ }
+ memset(opt + i, TCPOPT_NOP, optl);
+ }
+
+ return XT_CONTINUE;
+}
+
+static unsigned int
+tcpoptstrip_tg4(struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+ const struct xt_target *target, const void *targinfo)
+{
+ return tcpoptstrip_mangle_packet(skb, targinfo, ip_hdrlen(skb),
+ sizeof(struct iphdr) + sizeof(struct tcphdr));
+}
+
+#if defined(CONFIG_IP6_NF_MANGLE) || defined(CONFIG_IP6_NF_MANGLE_MODULE)
+static unsigned int
+tcpoptstrip_tg6(struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+ const struct xt_target *target, const void *targinfo)
+{
+ struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+ unsigned int tcphoff;
+ u_int8_t nexthdr;
+
+ nexthdr = ipv6h->nexthdr;
+ tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
+ if (tcphoff < 0)
+ return NF_DROP;
+
+ return tcpoptstrip_mangle_packet(skb, targinfo, tcphoff,
+ sizeof(*ipv6h) + sizeof(struct tcphdr));
+}
+#endif
+
+static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
+ {
+ .name = "TCPOPTSTRIP",
+ .family = AF_INET,
+ .table = "mangle",
+ .proto = IPPROTO_TCP,
+ .target = tcpoptstrip_tg4,
+ .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
+ .me = THIS_MODULE,
+ },
+#if defined(CONFIG_IP6_NF_MANGLE) || defined(CONFIG_IP6_NF_MANGLE_MODULE)
+ {
+ .name = "TCPOPTSTRIP",
+ .family = AF_INET6,
+ .table = "mangle",
+ .proto = IPPROTO_TCP,
+ .target = tcpoptstrip_tg6,
+ .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
+ .me = THIS_MODULE,
+ },
+#endif
+};
+
+static int __init tcpoptstrip_tg_init(void)
+{
+ return xt_register_targets(tcpoptstrip_tg_reg,
+ ARRAY_SIZE(tcpoptstrip_tg_reg));
+}
+
+static void __exit tcpoptstrip_tg_exit(void)
+{
+ xt_unregister_targets(tcpoptstrip_tg_reg,
+ ARRAY_SIZE(tcpoptstrip_tg_reg));
+}
+
+module_init(tcpoptstrip_tg_init);
+module_exit(tcpoptstrip_tg_exit);
+MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@computergmbh.de>");
+MODULE_DESCRIPTION("netfilter \"TCPOPTSTRIP\" target module");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_TCPOPTSTRIP");
+MODULE_ALIAS("ip6t_TCPOPTSTRIP");
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 02/49]: replace list_for_each with list_for_each_entry
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
2007-12-04 12:01 ` [NETFILTER 01/49]: x_tables: add TCPOPTSTRIP target Patrick McHardy
@ 2007-12-04 12:01 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 04/49]: x_tables: struct xt_table_info diet Patrick McHardy
` (46 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:01 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: replace list_for_each with list_for_each_entry
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit c801dee0df0f79c1bf5dd448b4081c29c9266da8
tree a682609069d2b133c441e0df3081c6144e708c12
parent b3e4042d568acf92a0e4b5334c8a9ca499bb3a4a
author Li Zefan <lizf@cn.fujitsu.com> Tue, 04 Dec 2007 10:46:51 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:46:51 +0100
net/ipv4/netfilter/ipt_CLUSTERIP.c | 6 ++----
net/netfilter/core.c | 8 ++++----
2 files changed, 6 insertions(+), 8 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 2f544da..311361e 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -109,11 +109,9 @@ clusterip_config_entry_put(struct clusterip_config *c)
static struct clusterip_config *
__clusterip_config_find(__be32 clusterip)
{
- struct list_head *pos;
+ struct clusterip_config *c;
- list_for_each(pos, &clusterip_configs) {
- struct clusterip_config *c = list_entry(pos,
- struct clusterip_config, list);
+ list_for_each_entry(c, &clusterip_configs, list) {
if (c->clusterip == clusterip)
return c;
}
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 631d269..e6d3a69 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -62,17 +62,17 @@ static DEFINE_MUTEX(nf_hook_mutex);
int nf_register_hook(struct nf_hook_ops *reg)
{
- struct list_head *i;
+ struct nf_hook_ops *elem;
int err;
err = mutex_lock_interruptible(&nf_hook_mutex);
if (err < 0)
return err;
- list_for_each(i, &nf_hooks[reg->pf][reg->hooknum]) {
- if (reg->priority < ((struct nf_hook_ops *)i)->priority)
+ list_for_each_entry(elem, &nf_hooks[reg->pf][reg->hooknum], list) {
+ if (reg->priority < elem->priority)
break;
}
- list_add_rcu(®->list, i->prev);
+ list_add_rcu(®->list, elem->list.prev);
mutex_unlock(&nf_hook_mutex);
return 0;
}
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 04/49]: x_tables: struct xt_table_info diet
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
2007-12-04 12:01 ` [NETFILTER 01/49]: x_tables: add TCPOPTSTRIP target Patrick McHardy
2007-12-04 12:01 ` [NETFILTER 02/49]: replace list_for_each with list_for_each_entry Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 05/49]: x_tables: remove obsolete overflow check Patrick McHardy
` (45 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: x_tables: struct xt_table_info diet
Instead of using a big array of NR_CPUS entries, we can compute the size
needed at runtime, using nr_cpu_ids
This should save some ram (especially on David's machines where NR_CPUS=4096 :
32 KB can be saved per table, and 64KB for dynamically allocated ones (because
of slab/slub alignements) )
In particular, the 'bootstrap' tables are not any more static (in data
section) but on stack as their size is now very small.
This also should reduce the size used on stack in compat functions
(get_info() declares an automatic variable, that could be bigger than kernel
stack size for big NR_CPUS)
Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit e648b28460f8bcbdb6293ce66b99735efa31a1ee
tree d0e9de24d3746bbcb1b6bdd39a5f21c6cfd5b609
parent 15b20d2de585dd83c73067783150c667d1229259
author Eric Dumazet <dada1@cosmosbay.com> Tue, 04 Dec 2007 10:46:56 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:46:56 +0100
include/linux/netfilter/x_tables.h | 5 ++++-
net/ipv4/netfilter/arp_tables.c | 5 ++---
net/ipv4/netfilter/ip_tables.c | 24 +++++++++---------------
net/ipv6/netfilter/ip6_tables.c | 5 ++---
net/netfilter/x_tables.c | 2 +-
5 files changed, 18 insertions(+), 23 deletions(-)
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 9657c4e..e305f2d 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -269,9 +269,12 @@ struct xt_table_info
unsigned int underflow[NF_INET_NUMHOOKS];
/* ipt_entry tables: one per CPU */
- char *entries[NR_CPUS];
+ /* Note : this field MUST be the last one, see XT_TABLE_INFO_SZ */
+ char *entries[1];
};
+#define XT_TABLE_INFO_SZ (offsetof(struct xt_table_info, entries) \
+ + nr_cpu_ids * sizeof(char *))
extern int xt_register_target(struct xt_target *target);
extern void xt_unregister_target(struct xt_target *target);
extern int xt_register_targets(struct xt_target *target, unsigned int n);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 2909c92..a21722d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -811,8 +811,7 @@ static int do_replace(void __user *user, unsigned int len)
return -ENOPROTOOPT;
/* overflow check */
- if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
- SMP_CACHE_BYTES)
+ if (tmp.size >= INT_MAX / num_possible_cpus())
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
@@ -1090,7 +1089,7 @@ int arpt_register_table(struct arpt_table *table,
{
int ret;
struct xt_table_info *newinfo;
- static struct xt_table_info bootstrap
+ struct xt_table_info bootstrap
= { 0, 0, 0, { 0 }, { 0 }, { } };
void *loc_cpu_entry;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index a99fe89..4200fde 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1090,7 +1090,8 @@ compat_calc_match(struct ipt_entry_match *m, int * size)
return 0;
}
-static int compat_calc_entry(struct ipt_entry *e, struct xt_table_info *info,
+static int compat_calc_entry(struct ipt_entry *e,
+ const struct xt_table_info *info,
void *base, struct xt_table_info *newinfo)
{
struct ipt_entry_target *t;
@@ -1118,22 +1119,17 @@ static int compat_calc_entry(struct ipt_entry *e, struct xt_table_info *info,
return 0;
}
-static int compat_table_info(struct xt_table_info *info,
+static int compat_table_info(const struct xt_table_info *info,
struct xt_table_info *newinfo)
{
void *loc_cpu_entry;
- int i;
if (!newinfo || !info)
return -EINVAL;
- memset(newinfo, 0, sizeof(struct xt_table_info));
- newinfo->size = info->size;
- newinfo->number = info->number;
- for (i = 0; i < NF_INET_NUMHOOKS; i++) {
- newinfo->hook_entry[i] = info->hook_entry[i];
- newinfo->underflow[i] = info->underflow[i];
- }
+ /* we dont care about newinfo->entries[] */
+ memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
+ newinfo->initial_entries = 0;
loc_cpu_entry = info->entries[raw_smp_processor_id()];
return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
compat_calc_entry, info, loc_cpu_entry, newinfo);
@@ -1327,8 +1323,7 @@ do_replace(void __user *user, unsigned int len)
return -ENOPROTOOPT;
/* overflow check */
- if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
- SMP_CACHE_BYTES)
+ if (tmp.size >= INT_MAX / num_possible_cpus())
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
@@ -1861,8 +1856,7 @@ compat_do_replace(void __user *user, unsigned int len)
return -ENOPROTOOPT;
/* overflow check */
- if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
- SMP_CACHE_BYTES)
+ if (tmp.size >= INT_MAX / num_possible_cpus())
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
@@ -2159,7 +2153,7 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
{
int ret;
struct xt_table_info *newinfo;
- static struct xt_table_info bootstrap
+ struct xt_table_info bootstrap
= { 0, 0, 0, { 0 }, { 0 }, { } };
void *loc_cpu_entry;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e1e87ef..e60c1b4 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1042,8 +1042,7 @@ do_replace(void __user *user, unsigned int len)
return -EFAULT;
/* overflow check */
- if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
- SMP_CACHE_BYTES)
+ if (tmp.size >= INT_MAX / num_possible_cpus())
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
@@ -1339,7 +1338,7 @@ int ip6t_register_table(struct xt_table *table,
{
int ret;
struct xt_table_info *newinfo;
- static struct xt_table_info bootstrap
+ struct xt_table_info bootstrap
= { 0, 0, 0, { 0 }, { 0 }, { } };
void *loc_cpu_entry;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d9a3bde..862b27d 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -495,7 +495,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > num_physpages)
return NULL;
- newinfo = kzalloc(sizeof(struct xt_table_info), GFP_KERNEL);
+ newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);
if (!newinfo)
return NULL;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 05/49]: x_tables: remove obsolete overflow check
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (2 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 04/49]: x_tables: struct xt_table_info diet Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 06/49]: merge ipt_owner/ip6t_owner in xt_owner Patrick McHardy
` (44 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: x_tables: remove obsolete overflow check
We're not multiplying the size with the number of CPUs anymore, so the
check is obsolete.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit f4026219449cce39bca209261cfff7ff9a8febfd
tree 2abbde948409f8975e610a52c727ff337742abab
parent e648b28460f8bcbdb6293ce66b99735efa31a1ee
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:46:57 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:46:57 +0100
net/ipv4/netfilter/arp_tables.c | 2 --
net/ipv4/netfilter/ip_tables.c | 2 --
net/ipv6/netfilter/ip6_tables.c | 2 --
3 files changed, 0 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index a21722d..d5cae7e 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -811,8 +811,6 @@ static int do_replace(void __user *user, unsigned int len)
return -ENOPROTOOPT;
/* overflow check */
- if (tmp.size >= INT_MAX / num_possible_cpus())
- return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 4200fde..0f2614e 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1323,8 +1323,6 @@ do_replace(void __user *user, unsigned int len)
return -ENOPROTOOPT;
/* overflow check */
- if (tmp.size >= INT_MAX / num_possible_cpus())
- return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e60c1b4..d3e884a 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1042,8 +1042,6 @@ do_replace(void __user *user, unsigned int len)
return -EFAULT;
/* overflow check */
- if (tmp.size >= INT_MAX / num_possible_cpus())
- return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 06/49]: merge ipt_owner/ip6t_owner in xt_owner
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (3 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 05/49]: x_tables: remove obsolete overflow check Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [IPV4 07/49]: Add inet_dev_addr_type() Patrick McHardy
` (43 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: merge ipt_owner/ip6t_owner in xt_owner
xt_owner merges ipt_owner and ip6t_owner, and adds a flag to match
on socket (non-)existence.
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 120d4e83e930079caf86168dea4ee6f3eab1fe88
tree f3f5d11d19ef83ccd2284557e8059d961cecef60
parent f4026219449cce39bca209261cfff7ff9a8febfd
author Jan Engelhardt <jengelh@computergmbh.de> Tue, 04 Dec 2007 10:46:58 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:46:58 +0100
include/linux/netfilter/Kbuild | 1
include/linux/netfilter/xt_owner.h | 16 +++
net/ipv4/netfilter/Kconfig | 9 --
net/ipv4/netfilter/Makefile | 1
net/ipv4/netfilter/ipt_owner.c | 87 ---------------
net/ipv6/netfilter/Kconfig | 9 --
net/ipv6/netfilter/Makefile | 1
net/ipv6/netfilter/ip6t_owner.c | 87 ---------------
net/netfilter/Kconfig | 8 +
net/netfilter/Makefile | 1
net/netfilter/xt_owner.c | 211 ++++++++++++++++++++++++++++++++++++
11 files changed, 237 insertions(+), 194 deletions(-)
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index b87e83a..1e69002 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -26,6 +26,7 @@ header-y += xt_limit.h
header-y += xt_mac.h
header-y += xt_mark.h
header-y += xt_multiport.h
+header-y += xt_owner.h
header-y += xt_pkttype.h
header-y += xt_policy.h
header-y += xt_realm.h
diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h
new file mode 100644
index 0000000..eacd34e
--- /dev/null
+++ b/include/linux/netfilter/xt_owner.h
@@ -0,0 +1,16 @@
+#ifndef _XT_OWNER_MATCH_H
+#define _XT_OWNER_MATCH_H
+
+enum {
+ XT_OWNER_UID = 1 << 0,
+ XT_OWNER_GID = 1 << 1,
+ XT_OWNER_SOCKET = 1 << 2,
+};
+
+struct xt_owner_match_info {
+ u_int32_t uid;
+ u_int32_t gid;
+ u_int8_t match, invert;
+};
+
+#endif /* _XT_OWNER_MATCH_H */
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 9aca9c5..6c563d9 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -111,15 +111,6 @@ config IP_NF_MATCH_TTL
To compile it as a module, choose M here. If unsure, say N.
-config IP_NF_MATCH_OWNER
- tristate "Owner match support"
- depends on IP_NF_IPTABLES
- help
- Packet owner matching allows you to match locally-generated packets
- based on who created them: the user, group, process or session.
-
- To compile it as a module, choose M here. If unsure, say N.
-
config IP_NF_MATCH_ADDRTYPE
tristate 'address type match support'
depends on IP_NF_IPTABLES
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 7456833..42199e9 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -45,7 +45,6 @@ obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
-obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
diff --git a/net/ipv4/netfilter/ipt_owner.c b/net/ipv4/netfilter/ipt_owner.c
deleted file mode 100644
index 4f1aa89..0000000
--- a/net/ipv4/netfilter/ipt_owner.c
+++ /dev/null
@@ -1,87 +0,0 @@
-/* Kernel module to match various things tied to sockets associated with
- locally generated outgoing packets. */
-
-/* (C) 2000 Marc Boucher <marc@mbsi.ca>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/file.h>
-#include <linux/rcupdate.h>
-#include <net/sock.h>
-
-#include <linux/netfilter_ipv4/ipt_owner.h>
-#include <linux/netfilter/x_tables.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
-MODULE_DESCRIPTION("iptables owner match");
-
-static bool
-owner_mt(const struct sk_buff *skb, const struct net_device *in,
- const struct net_device *out, const struct xt_match *match,
- const void *matchinfo, int offset, unsigned int protoff,
- bool *hotdrop)
-{
- const struct ipt_owner_info *info = matchinfo;
-
- if (!skb->sk || !skb->sk->sk_socket || !skb->sk->sk_socket->file)
- return false;
-
- if(info->match & IPT_OWNER_UID) {
- if ((skb->sk->sk_socket->file->f_uid != info->uid) ^
- !!(info->invert & IPT_OWNER_UID))
- return false;
- }
-
- if(info->match & IPT_OWNER_GID) {
- if ((skb->sk->sk_socket->file->f_gid != info->gid) ^
- !!(info->invert & IPT_OWNER_GID))
- return false;
- }
-
- return true;
-}
-
-static bool
-owner_mt_check(const char *tablename, const void *ip,
- const struct xt_match *match, void *matchinfo,
- unsigned int hook_mask)
-{
- const struct ipt_owner_info *info = matchinfo;
-
- if (info->match & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
- printk("ipt_owner: pid, sid and command matching "
- "not supported anymore\n");
- return false;
- }
- return true;
-}
-
-static struct xt_match owner_mt_reg __read_mostly = {
- .name = "owner",
- .family = AF_INET,
- .match = owner_mt,
- .matchsize = sizeof(struct ipt_owner_info),
- .hooks = (1 << NF_INET_LOCAL_OUT) |
- (1 << NF_INET_POST_ROUTING),
- .checkentry = owner_mt_check,
- .me = THIS_MODULE,
-};
-
-static int __init owner_mt_init(void)
-{
- return xt_register_match(&owner_mt_reg);
-}
-
-static void __exit owner_mt_exit(void)
-{
- xt_unregister_match(&owner_mt_reg);
-}
-
-module_init(owner_mt_init);
-module_exit(owner_mt_exit);
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 838b8dd..30d4852 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -89,15 +89,6 @@ config IP6_NF_MATCH_HL
To compile it as a module, choose M here. If unsure, say N.
-config IP6_NF_MATCH_OWNER
- tristate "Owner match support"
- depends on IP6_NF_IPTABLES
- help
- Packet owner matching allows you to match locally-generated packets
- based on who created them: the user, group, process or session.
-
- To compile it as a module, choose M here. If unsure, say N.
-
config IP6_NF_MATCH_IPV6HEADER
tristate "IPv6 Extension Headers Match"
depends on IP6_NF_IPTABLES
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index e789ec4..fbf2c14 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -23,7 +23,6 @@ obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o
-obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
# targets
diff --git a/net/ipv6/netfilter/ip6t_owner.c b/net/ipv6/netfilter/ip6t_owner.c
deleted file mode 100644
index 6a52ed9..0000000
--- a/net/ipv6/netfilter/ip6t_owner.c
+++ /dev/null
@@ -1,87 +0,0 @@
-/* Kernel module to match various things tied to sockets associated with
- locally generated outgoing packets. */
-
-/* (C) 2000-2001 Marc Boucher <marc@mbsi.ca>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/file.h>
-#include <linux/rcupdate.h>
-#include <net/sock.h>
-
-#include <linux/netfilter_ipv6/ip6t_owner.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <linux/netfilter/x_tables.h>
-
-MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
-MODULE_DESCRIPTION("IP6 tables owner matching module");
-MODULE_LICENSE("GPL");
-
-
-static bool
-owner_mt6(const struct sk_buff *skb, const struct net_device *in,
- const struct net_device *out, const struct xt_match *match,
- const void *matchinfo, int offset, unsigned int protoff,
- bool *hotdrop)
-{
- const struct ip6t_owner_info *info = matchinfo;
-
- if (!skb->sk || !skb->sk->sk_socket || !skb->sk->sk_socket->file)
- return false;
-
- if (info->match & IP6T_OWNER_UID)
- if ((skb->sk->sk_socket->file->f_uid != info->uid) ^
- !!(info->invert & IP6T_OWNER_UID))
- return false;
-
- if (info->match & IP6T_OWNER_GID)
- if ((skb->sk->sk_socket->file->f_gid != info->gid) ^
- !!(info->invert & IP6T_OWNER_GID))
- return false;
-
- return true;
-}
-
-static bool
-owner_mt6_check(const char *tablename, const void *ip,
- const struct xt_match *match, void *matchinfo,
- unsigned int hook_mask)
-{
- const struct ip6t_owner_info *info = matchinfo;
-
- if (info->match & (IP6T_OWNER_PID | IP6T_OWNER_SID)) {
- printk("ipt_owner: pid and sid matching "
- "not supported anymore\n");
- return false;
- }
- return true;
-}
-
-static struct xt_match owner_mt6_reg __read_mostly = {
- .name = "owner",
- .family = AF_INET6,
- .match = owner_mt6,
- .matchsize = sizeof(struct ip6t_owner_info),
- .hooks = (1 << NF_INET_LOCAL_OUT) |
- (1 << NF_INET_POST_ROUTING),
- .checkentry = owner_mt6_check,
- .me = THIS_MODULE,
-};
-
-static int __init owner_mt6_init(void)
-{
- return xt_register_match(&owner_mt6_reg);
-}
-
-static void __exit owner_mt6_exit(void)
-{
- xt_unregister_match(&owner_mt6_reg);
-}
-
-module_init(owner_mt6_init);
-module_exit(owner_mt6_exit);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 693f861..4bc0552 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -554,6 +554,14 @@ config NETFILTER_XT_MATCH_MARK
To compile it as a module, choose M here. If unsure, say N.
+config NETFILTER_XT_MATCH_OWNER
+ tristate '"owner" match support'
+ depends on NETFILTER_XTABLES
+ ---help---
+ Socket owner matching allows you to match locally-generated packets
+ based on who created the socket: the user or group. It is also
+ possible to check whether a socket actually exists.
+
config NETFILTER_XT_MATCH_POLICY
tristate 'IPsec "policy" match support'
depends on NETFILTER_XTABLES && XFRM
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 7763dea..28f59a3 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -67,6 +67,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o
obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o
obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_OWNER) += xt_owner.o
obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
new file mode 100644
index 0000000..4222fa2
--- /dev/null
+++ b/net/netfilter/xt_owner.c
@@ -0,0 +1,211 @@
+/*
+ * Kernel module to match various things tied to sockets associated with
+ * locally generated outgoing packets.
+ *
+ * (C) 2000 Marc Boucher <marc@mbsi.ca>
+ *
+ * Copyright © CC Computer Consultants GmbH, 2007
+ * Contact: <jengelh@computergmbh.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/file.h>
+#include <net/sock.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_owner.h>
+#include <linux/netfilter_ipv4/ipt_owner.h>
+#include <linux/netfilter_ipv6/ip6t_owner.h>
+
+static bool
+owner_mt_v0(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const struct xt_match *match,
+ const void *matchinfo, int offset, unsigned int protoff,
+ bool *hotdrop)
+{
+ const struct ipt_owner_info *info = matchinfo;
+ const struct file *filp;
+
+ if (skb->sk == NULL || skb->sk->sk_socket == NULL)
+ return false;
+
+ filp = skb->sk->sk_socket->file;
+ if (filp == NULL)
+ return false;
+
+ if (info->match & IPT_OWNER_UID)
+ if ((filp->f_uid != info->uid) ^
+ !!(info->invert & IPT_OWNER_UID))
+ return false;
+
+ if (info->match & IPT_OWNER_GID)
+ if ((filp->f_gid != info->gid) ^
+ !!(info->invert & IPT_OWNER_GID))
+ return false;
+
+ return true;
+}
+
+static bool
+owner_mt6_v0(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const struct xt_match *match,
+ const void *matchinfo, int offset, unsigned int protoff,
+ bool *hotdrop)
+{
+ const struct ip6t_owner_info *info = matchinfo;
+ const struct file *filp;
+
+ if (skb->sk == NULL || skb->sk->sk_socket == NULL)
+ return false;
+
+ filp = skb->sk->sk_socket->file;
+ if (filp == NULL)
+ return false;
+
+ if (info->match & IP6T_OWNER_UID)
+ if ((filp->f_uid != info->uid) ^
+ !!(info->invert & IP6T_OWNER_UID))
+ return false;
+
+ if (info->match & IP6T_OWNER_GID)
+ if ((filp->f_gid != info->gid) ^
+ !!(info->invert & IP6T_OWNER_GID))
+ return false;
+
+ return true;
+}
+
+static bool
+owner_mt(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const struct xt_match *match,
+ const void *matchinfo, int offset, unsigned int protoff,
+ bool *hotdrop)
+{
+ const struct xt_owner_match_info *info = matchinfo;
+ const struct file *filp;
+
+ if (skb->sk == NULL || skb->sk->sk_socket == NULL)
+ return (info->match ^ info->invert) == 0;
+ else if (info->match & info->invert & XT_OWNER_SOCKET)
+ /*
+ * Socket exists but user wanted ! --socket-exists.
+ * (Single ampersands intended.)
+ */
+ return false;
+
+ filp = skb->sk->sk_socket->file;
+ if (filp == NULL)
+ return ((info->match ^ info->invert) &
+ (XT_OWNER_UID | XT_OWNER_GID)) == 0;
+
+ if (info->match & XT_OWNER_UID)
+ if ((filp->f_uid != info->uid) ^
+ !!(info->invert & XT_OWNER_UID))
+ return false;
+
+ if (info->match & XT_OWNER_GID)
+ if ((filp->f_gid != info->gid) ^
+ !!(info->invert & XT_OWNER_GID))
+ return false;
+
+ return true;
+}
+
+static bool
+owner_mt_check_v0(const char *tablename, const void *ip,
+ const struct xt_match *match, void *matchinfo,
+ unsigned int hook_mask)
+{
+ const struct ipt_owner_info *info = matchinfo;
+
+ if (info->match & (IPT_OWNER_PID | IPT_OWNER_SID | IPT_OWNER_COMM)) {
+ printk(KERN_WARNING KBUILD_MODNAME
+ ": PID, SID and command matching is not "
+ "supported anymore\n");
+ return false;
+ }
+
+ return true;
+}
+
+static bool
+owner_mt6_check_v0(const char *tablename, const void *ip,
+ const struct xt_match *match, void *matchinfo,
+ unsigned int hook_mask)
+{
+ const struct ip6t_owner_info *info = matchinfo;
+
+ if (info->match & (IP6T_OWNER_PID | IP6T_OWNER_SID)) {
+ printk(KERN_WARNING KBUILD_MODNAME
+ ": PID and SID matching is not supported anymore\n");
+ return false;
+ }
+
+ return true;
+}
+
+static struct xt_match owner_mt_reg[] __read_mostly = {
+ {
+ .name = "owner",
+ .revision = 0,
+ .family = AF_INET,
+ .match = owner_mt_v0,
+ .matchsize = sizeof(struct ipt_owner_info),
+ .checkentry = owner_mt_check_v0,
+ .hooks = (1 << NF_INET_LOCAL_OUT) |
+ (1 << NF_INET_POST_ROUTING),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "owner",
+ .revision = 0,
+ .family = AF_INET6,
+ .match = owner_mt6_v0,
+ .matchsize = sizeof(struct ip6t_owner_info),
+ .checkentry = owner_mt6_check_v0,
+ .hooks = (1 << NF_INET_LOCAL_OUT) |
+ (1 << NF_INET_POST_ROUTING),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "owner",
+ .revision = 1,
+ .family = AF_INET,
+ .match = owner_mt,
+ .matchsize = sizeof(struct xt_owner_match_info),
+ .hooks = (1 << NF_INET_LOCAL_OUT) |
+ (1 << NF_INET_POST_ROUTING),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "owner",
+ .revision = 1,
+ .family = AF_INET6,
+ .match = owner_mt,
+ .matchsize = sizeof(struct xt_owner_match_info),
+ .hooks = (1 << NF_INET_LOCAL_OUT) |
+ (1 << NF_INET_POST_ROUTING),
+ .me = THIS_MODULE,
+ },
+};
+
+static int __init owner_mt_init(void)
+{
+ return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
+}
+
+static void __exit owner_mt_exit(void)
+{
+ xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
+}
+
+module_init(owner_mt_init);
+module_exit(owner_mt_exit);
+MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
+MODULE_DESCRIPTION("netfilter \"owner\" match module");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_owner");
+MODULE_ALIAS("ip6t_owner");
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 50+ messages in thread* [IPV4 07/49]: Add inet_dev_addr_type()
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (4 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 06/49]: merge ipt_owner/ip6t_owner in xt_owner Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 08/49]: ipt_addrtype: limit address type checking to an interface Patrick McHardy
` (42 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[IPV4]: Add inet_dev_addr_type()
Address type search can be limited to an interface by
inet_dev_addr_type function.
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit f7856f723b508049e599b8126cd17246bdaed633
tree 8231eecded93da7cc99ddbbbf2e87953d2242224
parent 120d4e83e930079caf86168dea4ee6f3eab1fe88
author Laszlo Attila Toth <panther@balabit.hu> Tue, 04 Dec 2007 10:46:59 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:46:59 +0100
include/net/route.h | 1 +
net/ipv4/fib_frontend.c | 21 +++++++++++++++++++--
2 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/include/net/route.h b/include/net/route.h
index f7ce625..723b519 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -119,6 +119,7 @@ extern unsigned short ip_rt_frag_needed(struct iphdr *iph, unsigned short new_mt
extern void ip_rt_send_redirect(struct sk_buff *skb);
extern unsigned inet_addr_type(__be32 addr);
+extern unsigned inet_dev_addr_type(const struct net_device *dev, __be32 addr);
extern void ip_rt_multicast_event(struct in_device *);
extern int ip_rt_ioctl(unsigned int cmd, void __user *arg);
extern void ip_rt_get_source(u8 *src, struct rtable *rt);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index c211887..7962830 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -155,7 +155,12 @@ out:
return dev;
}
-unsigned inet_addr_type(__be32 addr)
+/*
+ * Find address type as if only "dev" was present in the system. If
+ * on_dev is NULL then all interfaces are taken into consideration.
+ */
+static inline unsigned __inet_dev_addr_type(const struct net_device *dev,
+ __be32 addr)
{
struct flowi fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
struct fib_result res;
@@ -175,13 +180,24 @@ unsigned inet_addr_type(__be32 addr)
if (local_table) {
ret = RTN_UNICAST;
if (!local_table->tb_lookup(local_table, &fl, &res)) {
- ret = res.type;
+ if (!dev || dev == res.fi->fib_dev)
+ ret = res.type;
fib_res_put(&res);
}
}
return ret;
}
+unsigned int inet_addr_type(__be32 addr)
+{
+ return __inet_dev_addr_type(NULL, addr);
+}
+
+unsigned int inet_dev_addr_type(const struct net_device *dev, __be32 addr)
+{
+ return __inet_dev_addr_type(dev, addr);
+}
+
/* Given (packet source, input interface) and optional (dst, oif, tos):
- (main) check, that source is valid i.e. not broadcast or our local
address.
@@ -937,4 +953,5 @@ void __init ip_fib_init(void)
}
EXPORT_SYMBOL(inet_addr_type);
+EXPORT_SYMBOL(inet_dev_addr_type);
EXPORT_SYMBOL(ip_dev_find);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 08/49]: ipt_addrtype: limit address type checking to an interface
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (5 preceding siblings ...)
2007-12-04 12:02 ` [IPV4 07/49]: Add inet_dev_addr_type() Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 09/49]: Use lowercase names for matches in Kconfig Patrick McHardy
` (41 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: ipt_addrtype: limit address type checking to an interface
Addrtype match has a new revision (1), which lets address type checking
limited to the interface the current packet belongs to. Either incoming
or outgoing interface can be used depending on the current hook. In the
FORWARD hook two maches should be used if both interfaces have to be checked.
The new structure is ipt_addrtype_info_v1.
Revision 0 lets older userspace programs use the match as earlier.
ipt_addrtype_info is used.
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit aaa25832938c3900fc8711fc45dc753bc2885d06
tree 4da40e913eb4a2d8360da23ddc1b2baecfaa392b
parent f7856f723b508049e599b8126cd17246bdaed633
author Laszlo Attila Toth <panther@balabit.hu> Tue, 04 Dec 2007 10:47:00 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:22:25 +0100
include/linux/netfilter_ipv4/ipt_addrtype.h | 14 ++++
net/ipv4/netfilter/ipt_addrtype.c | 104 +++++++++++++++++++++++----
2 files changed, 102 insertions(+), 16 deletions(-)
diff --git a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
index 166ed01..446de6a 100644
--- a/include/linux/netfilter_ipv4/ipt_addrtype.h
+++ b/include/linux/netfilter_ipv4/ipt_addrtype.h
@@ -1,6 +1,20 @@
#ifndef _IPT_ADDRTYPE_H
#define _IPT_ADDRTYPE_H
+enum {
+ IPT_ADDRTYPE_INVERT_SOURCE = 0x0001,
+ IPT_ADDRTYPE_INVERT_DEST = 0x0002,
+ IPT_ADDRTYPE_LIMIT_IFACE_IN = 0x0004,
+ IPT_ADDRTYPE_LIMIT_IFACE_OUT = 0x0008,
+};
+
+struct ipt_addrtype_info_v1 {
+ u_int16_t source; /* source-type mask */
+ u_int16_t dest; /* dest-type mask */
+ u_int32_t flags;
+};
+
+/* revision 0 */
struct ipt_addrtype_info {
u_int16_t source; /* source-type mask */
u_int16_t dest; /* dest-type mask */
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index b75421c..14394c6 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -2,6 +2,7 @@
* iptables module to match inet_addr_type() of an ip.
*
* Copyright (c) 2004 Patrick McHardy <kaber@trash.net>
+ * (C) 2007 Laszlo Attila Toth <panther@balabit.hu>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -22,45 +23,116 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_DESCRIPTION("iptables addrtype match");
-static inline bool match_type(__be32 addr, u_int16_t mask)
+static inline bool match_type(const struct net_device *dev, __be32 addr,
+ u_int16_t mask)
{
- return !!(mask & (1 << inet_addr_type(addr)));
+ return !!(mask & (1 << inet_dev_addr_type(dev, addr)));
}
static bool
-addrtype_mt(const struct sk_buff *skb, const struct net_device *in,
- const struct net_device *out, const struct xt_match *match,
- const void *matchinfo, int offset, unsigned int protoff,
- bool *hotdrop)
+addrtype_mt_v0(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const struct xt_match *match,
+ const void *matchinfo, int offset, unsigned int protoff,
+ bool *hotdrop)
{
const struct ipt_addrtype_info *info = matchinfo;
const struct iphdr *iph = ip_hdr(skb);
bool ret = true;
if (info->source)
- ret &= match_type(iph->saddr, info->source)^info->invert_source;
+ ret &= match_type(NULL, iph->saddr, info->source) ^
+ info->invert_source;
if (info->dest)
- ret &= match_type(iph->daddr, info->dest)^info->invert_dest;
+ ret &= match_type(NULL, iph->daddr, info->dest) ^
+ info->invert_dest;
return ret;
}
-static struct xt_match addrtype_mt_reg __read_mostly = {
- .name = "addrtype",
- .family = AF_INET,
- .match = addrtype_mt,
- .matchsize = sizeof(struct ipt_addrtype_info),
- .me = THIS_MODULE
+static bool
+addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const struct xt_match *match,
+ const void *matchinfo, int offset, unsigned int protoff,
+ bool *hotdrop)
+{
+ const struct ipt_addrtype_info_v1 *info = matchinfo;
+ const struct iphdr *iph = ip_hdr(skb);
+ const struct net_device *dev = NULL;
+ bool ret = true;
+
+ if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN)
+ dev = in;
+ else if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT)
+ dev = out;
+
+ if (info->source)
+ ret &= match_type(dev, iph->saddr, info->source) ^
+ (info->flags & IPT_ADDRTYPE_INVERT_SOURCE);
+ if (ret && info->dest)
+ ret &= match_type(dev, iph->daddr, info->dest) ^
+ (info->flags & IPT_ADDRTYPE_INVERT_DEST);
+ return ret;
+}
+
+static bool
+addrtype_mt_checkentry_v1(const char *tablename, const void *ip_void,
+ const struct xt_match *match, void *matchinfo,
+ unsigned int hook_mask)
+{
+ struct ipt_addrtype_info_v1 *info = matchinfo;
+
+ if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN &&
+ info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) {
+ printk(KERN_ERR "ipt_addrtype: both incoming and outgoing "
+ "interface limitation cannot be selected\n");
+ return false;
+ }
+
+ if (hook_mask & (1 << NF_INET_PRE_ROUTING | 1 << NF_INET_LOCAL_IN) &&
+ info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) {
+ printk(KERN_ERR "ipt_addrtype: output interface limitation "
+ "not valid in PRE_ROUTING and INPUT\n");
+ return false;
+ }
+
+ if (hook_mask & (1 << NF_INET_POST_ROUTING | 1 << NF_INET_LOCAL_OUT) &&
+ info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN) {
+ printk(KERN_ERR "ipt_addrtype: input interface limitation "
+ "not valid in POST_ROUTING and OUTPUT\n");
+ return false;
+ }
+
+ return true;
+}
+
+static struct xt_match addrtype_mt_reg[] __read_mostly = {
+ {
+ .name = "addrtype",
+ .family = AF_INET,
+ .match = addrtype_mt_v0,
+ .matchsize = sizeof(struct ipt_addrtype_info),
+ .me = THIS_MODULE
+ },
+ {
+ .name = "addrtype",
+ .family = AF_INET,
+ .revision = 1,
+ .match = addrtype_mt_v1,
+ .checkentry = addrtype_mt_checkentry_v1,
+ .matchsize = sizeof(struct ipt_addrtype_info_v1),
+ .me = THIS_MODULE
+ }
};
static int __init addrtype_mt_init(void)
{
- return xt_register_match(&addrtype_mt_reg);
+ return xt_register_matches(addrtype_mt_reg,
+ ARRAY_SIZE(addrtype_mt_reg));
}
static void __exit addrtype_mt_exit(void)
{
- xt_unregister_match(&addrtype_mt_reg);
+ xt_unregister_matches(addrtype_mt_reg, ARRAY_SIZE(addrtype_mt_reg));
}
module_init(addrtype_mt_init);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 09/49]: Use lowercase names for matches in Kconfig
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (6 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 08/49]: ipt_addrtype: limit address type checking to an interface Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NET 10/49]: Constify include/net/dsfield.h Patrick McHardy
` (40 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: Use lowercase names for matches in Kconfig
Unify netfilter match kconfig descriptions
Consistently use lowercase for matches in kconfig one-line
descriptions and name the match module.
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 08d5ebfa5d171ca207ccdd5086cc86eadf99ebea
tree 340cba3958d37cea7bf68e3a1e5fd49009f1a79c
parent aaa25832938c3900fc8711fc45dc753bc2885d06
author Jan Engelhardt <jengelh@computergmbh.de> Tue, 04 Dec 2007 10:47:01 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:23:07 +0100
net/ipv4/netfilter/Kconfig | 12 ++++++------
net/ipv6/netfilter/Kconfig | 16 ++++++++--------
net/netfilter/Kconfig | 8 ++++----
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 6c563d9..244e91d 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -55,7 +55,7 @@ config IP_NF_IPTABLES
# The matches.
config IP_NF_MATCH_IPRANGE
- tristate "IP range match support"
+ tristate '"iprange" match support'
depends on IP_NF_IPTABLES
help
This option makes possible to match IP addresses against IP address
@@ -73,7 +73,7 @@ config IP_NF_MATCH_TOS
To compile it as a module, choose M here. If unsure, say N.
config IP_NF_MATCH_RECENT
- tristate "recent match support"
+ tristate '"recent" match support'
depends on IP_NF_IPTABLES
help
This match is used for creating one or many lists of recently
@@ -85,7 +85,7 @@ config IP_NF_MATCH_RECENT
To compile it as a module, choose M here. If unsure, say N.
config IP_NF_MATCH_ECN
- tristate "ECN match support"
+ tristate '"ecn" match support'
depends on IP_NF_IPTABLES
help
This option adds a `ECN' match, which allows you to match against
@@ -94,7 +94,7 @@ config IP_NF_MATCH_ECN
To compile it as a module, choose M here. If unsure, say N.
config IP_NF_MATCH_AH
- tristate "AH match support"
+ tristate '"ah" match support'
depends on IP_NF_IPTABLES
help
This match extension allows you to match a range of SPIs
@@ -103,7 +103,7 @@ config IP_NF_MATCH_AH
To compile it as a module, choose M here. If unsure, say N.
config IP_NF_MATCH_TTL
- tristate "TTL match support"
+ tristate '"ttl" match support'
depends on IP_NF_IPTABLES
help
This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
@@ -112,7 +112,7 @@ config IP_NF_MATCH_TTL
To compile it as a module, choose M here. If unsure, say N.
config IP_NF_MATCH_ADDRTYPE
- tristate 'address type match support'
+ tristate '"addrtype" address type match support'
depends on IP_NF_IPTABLES
help
This option allows you to match what routing thinks of an address,
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 30d4852..5374c66 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -54,7 +54,7 @@ config IP6_NF_IPTABLES
# The simple matches.
config IP6_NF_MATCH_RT
- tristate "Routing header match support"
+ tristate '"rt" Routing header match support'
depends on IP6_NF_IPTABLES
help
rt matching allows you to match packets based on the routing
@@ -63,7 +63,7 @@ config IP6_NF_MATCH_RT
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_MATCH_OPTS
- tristate "Hop-by-hop and Dst opts header match support"
+ tristate '"hopbyhop" and "dst" opts header match support'
depends on IP6_NF_IPTABLES
help
This allows one to match packets based on the hop-by-hop
@@ -72,7 +72,7 @@ config IP6_NF_MATCH_OPTS
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_MATCH_FRAG
- tristate "Fragmentation header match support"
+ tristate '"frag" Fragmentation header match support'
depends on IP6_NF_IPTABLES
help
frag matching allows you to match packets based on the fragmentation
@@ -81,7 +81,7 @@ config IP6_NF_MATCH_FRAG
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_MATCH_HL
- tristate "HL match support"
+ tristate '"hl" match support'
depends on IP6_NF_IPTABLES
help
HL matching allows you to match packets based on the hop
@@ -90,7 +90,7 @@ config IP6_NF_MATCH_HL
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_MATCH_IPV6HEADER
- tristate "IPv6 Extension Headers Match"
+ tristate '"ipv6header" IPv6 Extension Headers Match'
depends on IP6_NF_IPTABLES
help
This module allows one to match packets based upon
@@ -99,7 +99,7 @@ config IP6_NF_MATCH_IPV6HEADER
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_MATCH_AH
- tristate "AH match support"
+ tristate '"ah" match support'
depends on IP6_NF_IPTABLES
help
This module allows one to match AH packets.
@@ -107,7 +107,7 @@ config IP6_NF_MATCH_AH
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_MATCH_MH
- tristate "MH match support"
+ tristate '"mh" match support'
depends on IP6_NF_IPTABLES
help
This module allows one to match MH packets.
@@ -115,7 +115,7 @@ config IP6_NF_MATCH_MH
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_MATCH_EUI64
- tristate "EUI64 address check"
+ tristate '"eui64" address check'
depends on IP6_NF_IPTABLES
help
This module performs checking on the IPv6 source address
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 4bc0552..d220607 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -476,7 +476,7 @@ config NETFILTER_XT_MATCH_CONNTRACK
To compile it as a module, choose M here. If unsure, say N.
config NETFILTER_XT_MATCH_DCCP
- tristate '"DCCP" protocol match support'
+ tristate '"dccp" protocol match support'
depends on NETFILTER_XTABLES
help
With this option enabled, you will be able to use the iptables
@@ -487,7 +487,7 @@ config NETFILTER_XT_MATCH_DCCP
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
config NETFILTER_XT_MATCH_DSCP
- tristate '"DSCP" match support'
+ tristate '"dscp" match support'
depends on NETFILTER_XTABLES
help
This option adds a `DSCP' match, which allows you to match against
@@ -498,7 +498,7 @@ config NETFILTER_XT_MATCH_DSCP
To compile it as a module, choose M here. If unsure, say N.
config NETFILTER_XT_MATCH_ESP
- tristate '"ESP" match support'
+ tristate '"esp" match support'
depends on NETFILTER_XTABLES
help
This match extension allows you to match a range of SPIs
@@ -573,7 +573,7 @@ config NETFILTER_XT_MATCH_POLICY
To compile it as a module, choose M here. If unsure, say N.
config NETFILTER_XT_MATCH_MULTIPORT
- tristate "Multiple port match support"
+ tristate '"multiport" Multiple port match support'
depends on NETFILTER_XTABLES
help
Multiport matching allows you to match TCP or UDP packets based on
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NET 10/49]: Constify include/net/dsfield.h
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (7 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 09/49]: Use lowercase names for matches in Kconfig Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 11/49]: Merge ipt_tos into xt_dscp Patrick McHardy
` (39 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NET]: Constify include/net/dsfield.h
Constify include/net/dsfield.h
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 93a030a957dbe5c4ff8648e6dec5f7ac09bd3a5d
tree 87dc4a20d080269a0e9b6bc34b5443ce4c9ed0ca
parent 08d5ebfa5d171ca207ccdd5086cc86eadf99ebea
author Jan Engelhardt <jengelh@computergmbh.de> Tue, 04 Dec 2007 10:47:02 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:23:15 +0100
include/net/dsfield.h | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/net/dsfield.h b/include/net/dsfield.h
index eb65bf2..8a8d4e0 100644
--- a/include/net/dsfield.h
+++ b/include/net/dsfield.h
@@ -12,15 +12,15 @@
#include <asm/byteorder.h>
-static inline __u8 ipv4_get_dsfield(struct iphdr *iph)
+static inline __u8 ipv4_get_dsfield(const struct iphdr *iph)
{
return iph->tos;
}
-static inline __u8 ipv6_get_dsfield(struct ipv6hdr *ipv6h)
+static inline __u8 ipv6_get_dsfield(const struct ipv6hdr *ipv6h)
{
- return ntohs(*(__be16 *) ipv6h) >> 4;
+ return ntohs(*(const __be16 *)ipv6h) >> 4;
}
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 11/49]: Merge ipt_tos into xt_dscp
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (8 preceding siblings ...)
2007-12-04 12:02 ` [NET 10/49]: Constify include/net/dsfield.h Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 12/49]: Merge ipt_TOS into xt_DSCP Patrick McHardy
` (38 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: Merge ipt_tos into xt_dscp
Merge ipt_tos into xt_dscp.
Merge ipt_tos (tos v0 match) into xt_dscp. They both match on the same
field in the IPv4 header, so it seems reasonable to keep them in one
piece. This is part one of the implicit 4-patch series to move tos to
xtables and extend it by IPv6.
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit d986d0ecb03d4a040893bf1061fa0f0928c3bbc5
tree fcb6801a9c7f3e016591e92c038a9639f0449700
parent 93a030a957dbe5c4ff8648e6dec5f7ac09bd3a5d
author Jan Engelhardt <jengelh@computergmbh.de> Tue, 04 Dec 2007 10:47:03 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:23:20 +0100
net/ipv4/netfilter/Kconfig | 9 --------
net/ipv4/netfilter/Makefile | 1 -
net/ipv4/netfilter/ipt_tos.c | 50 ------------------------------------------
net/netfilter/Kconfig | 6 ++++-
net/netfilter/xt_dscp.c | 24 ++++++++++++++++++--
5 files changed, 27 insertions(+), 63 deletions(-)
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 244e91d..232817c 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -63,15 +63,6 @@ config IP_NF_MATCH_IPRANGE
To compile it as a module, choose M here. If unsure, say N.
-config IP_NF_MATCH_TOS
- tristate "TOS match support"
- depends on IP_NF_IPTABLES
- help
- TOS matching allows you to match packets based on the Type Of
- Service fields of the IP packet.
-
- To compile it as a module, choose M here. If unsure, say N.
-
config IP_NF_MATCH_RECENT
tristate '"recent" match support'
depends on IP_NF_IPTABLES
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 42199e9..00c19c7 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -46,7 +46,6 @@ obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
-obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
# targets
diff --git a/net/ipv4/netfilter/ipt_tos.c b/net/ipv4/netfilter/ipt_tos.c
deleted file mode 100644
index 7d60868..0000000
--- a/net/ipv4/netfilter/ipt_tos.c
+++ /dev/null
@@ -1,50 +0,0 @@
-/* Kernel module to match TOS values. */
-
-/* (C) 1999-2001 Paul `Rusty' Russell
- * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/ip.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter_ipv4/ipt_tos.h>
-#include <linux/netfilter/x_tables.h>
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("iptables TOS match module");
-
-static bool
-tos_mt(const struct sk_buff *skb, const struct net_device *in,
- const struct net_device *out, const struct xt_match *match,
- const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
-{
- const struct ipt_tos_info *info = matchinfo;
-
- return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
-}
-
-static struct xt_match tos_mt_reg __read_mostly = {
- .name = "tos",
- .family = AF_INET,
- .match = tos_mt,
- .matchsize = sizeof(struct ipt_tos_info),
- .me = THIS_MODULE,
-};
-
-static int __init tos_mt_init(void)
-{
- return xt_register_match(&tos_mt_reg);
-}
-
-static void __exit tos_mt_exit(void)
-{
- xt_unregister_match(&tos_mt_reg);
-}
-
-module_init(tos_mt_init);
-module_exit(tos_mt_exit);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index d220607..1804916 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -487,7 +487,7 @@ config NETFILTER_XT_MATCH_DCCP
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
config NETFILTER_XT_MATCH_DSCP
- tristate '"dscp" match support'
+ tristate '"dscp" and "tos" match support'
depends on NETFILTER_XTABLES
help
This option adds a `DSCP' match, which allows you to match against
@@ -495,6 +495,10 @@ config NETFILTER_XT_MATCH_DSCP
The DSCP field can have any value between 0x0 and 0x3f inclusive.
+ It will also add a "tos" match, which allows you to match packets
+ based on the Type Of Service fields of the IPv4 packet (which share
+ the same bits as DSCP).
+
To compile it as a module, choose M here. If unsure, say N.
config NETFILTER_XT_MATCH_ESP
diff --git a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
index 63f7354..75b0df9 100644
--- a/net/netfilter/xt_dscp.c
+++ b/net/netfilter/xt_dscp.c
@@ -13,14 +13,16 @@
#include <linux/ipv6.h>
#include <net/dsfield.h>
-#include <linux/netfilter/xt_dscp.h>
#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_dscp.h>
+#include <linux/netfilter_ipv4/ipt_tos.h>
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("x_tables DSCP matching module");
+MODULE_DESCRIPTION("x_tables DSCP/tos matching module");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_dscp");
MODULE_ALIAS("ip6t_dscp");
+MODULE_ALIAS("ipt_tos");
static bool
dscp_mt(const struct sk_buff *skb, const struct net_device *in,
@@ -60,6 +62,16 @@ dscp_mt_check(const char *tablename, const void *info,
return true;
}
+static bool tos_mt_v0(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out,
+ const struct xt_match *match, const void *matchinfo,
+ int offset, unsigned int protoff, bool *hotdrop)
+{
+ const struct ipt_tos_info *info = matchinfo;
+
+ return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
+}
+
static struct xt_match dscp_mt_reg[] __read_mostly = {
{
.name = "dscp",
@@ -77,6 +89,14 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
.matchsize = sizeof(struct xt_dscp_info),
.me = THIS_MODULE,
},
+ {
+ .name = "tos",
+ .revision = 0,
+ .family = AF_INET,
+ .match = tos_mt_v0,
+ .matchsize = sizeof(struct ipt_tos_info),
+ .me = THIS_MODULE,
+ },
};
static int __init dscp_mt_init(void)
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 12/49]: Merge ipt_TOS into xt_DSCP
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (9 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 11/49]: Merge ipt_tos into xt_dscp Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 13/49]: IPv6 capable xt_tos v1 match Patrick McHardy
` (37 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: Merge ipt_TOS into xt_DSCP
Merge ipt_TOS into xt_DSCP.
Merge ipt_TOS (tos v0 target) into xt_DSCP. They both modify the same
field in the IPv4 header, so it seems reasonable to keep them in one
piece. This is part two of the implicit 4-patch series to move tos to
xtables and extend it by IPv6.
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 8566a393780f1db8d84bd066f2d1734ffa90d709
tree c5ee3283f8762b0d5825f7130aae3ae2c1caf188
parent d986d0ecb03d4a040893bf1061fa0f0928c3bbc5
author Jan Engelhardt <jengelh@computergmbh.de> Tue, 04 Dec 2007 10:47:04 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:23:27 +0100
net/ipv4/netfilter/Kconfig | 10 --------
net/ipv4/netfilter/Makefile | 1 -
net/netfilter/Kconfig | 6 ++++-
net/netfilter/xt_DSCP.c | 51 +++++++++++++++++++++++++++++++++++++++++++
4 files changed, 56 insertions(+), 12 deletions(-)
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 232817c..b11231d 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -293,16 +293,6 @@ config IP_NF_MANGLE
To compile it as a module, choose M here. If unsure, say N.
-config IP_NF_TARGET_TOS
- tristate "TOS target support"
- depends on IP_NF_MANGLE
- help
- This option adds a `TOS' target, which allows you to create rules in
- the `mangle' table which alter the Type Of Service field of an IP
- packet prior to routing.
-
- To compile it as a module, choose M here. If unsure, say N.
-
config IP_NF_TARGET_ECN
tristate "ECN target support"
depends on IP_NF_MANGLE
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 00c19c7..2fc0561 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -57,7 +57,6 @@ obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt_NETMAP.o
obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
obj-$(CONFIG_IP_NF_TARGET_SAME) += ipt_SAME.o
-obj-$(CONFIG_IP_NF_TARGET_TOS) += ipt_TOS.o
obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 1804916..9c82d4c 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -293,7 +293,7 @@ config NETFILTER_XT_TARGET_CONNMARK
ipt_CONNMARK.ko. If unsure, say `N'.
config NETFILTER_XT_TARGET_DSCP
- tristate '"DSCP" target support'
+ tristate '"DSCP" and "TOS" target support'
depends on NETFILTER_XTABLES
depends on IP_NF_MANGLE || IP6_NF_MANGLE
help
@@ -302,6 +302,10 @@ config NETFILTER_XT_TARGET_DSCP
The DSCP field can have any value between 0x0 and 0x3f inclusive.
+ It also adds the "TOS" target, which allows you to create rules in
+ the "mangle" table which alter the Type Of Service field of an IPv4
+ packet prior to routing.
+
To compile it as a module, choose M here. If unsure, say N.
config NETFILTER_XT_TARGET_MARK
diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index 1882355..40a4f1d 100644
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -18,12 +18,14 @@
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_DSCP.h>
+#include <linux/netfilter_ipv4/ipt_TOS.h>
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("x_tables DSCP modification module");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_DSCP");
MODULE_ALIAS("ip6t_DSCP");
+MODULE_ALIAS("ipt_TOS");
static unsigned int
dscp_tg(struct sk_buff *skb, const struct net_device *in,
@@ -76,6 +78,45 @@ dscp_tg_check(const char *tablename, const void *e_void,
return true;
}
+static unsigned int
+tos_tg_v0(struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+ const struct xt_target *target, const void *targinfo)
+{
+ const struct ipt_tos_target_info *info = targinfo;
+ struct iphdr *iph = ip_hdr(skb);
+ u_int8_t oldtos;
+
+ if ((iph->tos & IPTOS_TOS_MASK) != info->tos) {
+ if (!skb_make_writable(skb, sizeof(struct iphdr)))
+ return NF_DROP;
+
+ iph = ip_hdr(skb);
+ oldtos = iph->tos;
+ iph->tos = (iph->tos & IPTOS_PREC_MASK) | info->tos;
+ csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
+ }
+
+ return XT_CONTINUE;
+}
+
+static bool
+tos_tg_check_v0(const char *tablename, const void *e_void,
+ const struct xt_target *target, void *targinfo,
+ unsigned int hook_mask)
+{
+ const u_int8_t tos = ((struct ipt_tos_target_info *)targinfo)->tos;
+
+ if (tos != IPTOS_LOWDELAY && tos != IPTOS_THROUGHPUT &&
+ tos != IPTOS_RELIABILITY && tos != IPTOS_MINCOST &&
+ tos != IPTOS_NORMALSVC) {
+ printk(KERN_WARNING "TOS: bad tos value %#x\n", tos);
+ return false;
+ }
+
+ return true;
+}
+
static struct xt_target dscp_tg_reg[] __read_mostly = {
{
.name = "DSCP",
@@ -95,6 +136,16 @@ static struct xt_target dscp_tg_reg[] __read_mostly = {
.table = "mangle",
.me = THIS_MODULE,
},
+ {
+ .name = "TOS",
+ .revision = 0,
+ .family = AF_INET,
+ .table = "mangle",
+ .target = tos_tg_v0,
+ .targetsize = sizeof(struct ipt_tos_target_info),
+ .checkentry = tos_tg_check_v0,
+ .me = THIS_MODULE,
+ },
};
static int __init dscp_tg_init(void)
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 13/49]: IPv6 capable xt_tos v1 match
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (10 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 12/49]: Merge ipt_TOS into xt_DSCP Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 14/49]: IPv6 capable xt_TOS v1 target Patrick McHardy
` (36 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: IPv6 capable xt_tos v1 match
Extends the xt_dscp match by xt_tos v1 to add support for selectively
matching any bit in the IPv4 TOS and IPv6 Priority fields. (ipt_tos
and xt_dscp only accepted a limited range of possible values.)
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit ef44af12ba911ba711ac38989aabfaeee0fedd71
tree 88d954f58ab6413c0104c8ead3d5cdccc8951389
parent 8566a393780f1db8d84bd066f2d1734ffa90d709
author Jan Engelhardt <jengelh@computergmbh.de> Tue, 04 Dec 2007 10:47:05 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:23:37 +0100
include/linux/netfilter/xt_dscp.h | 6 ++++++
net/netfilter/xt_dscp.c | 32 ++++++++++++++++++++++++++++++++
2 files changed, 38 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/xt_dscp.h b/include/linux/netfilter/xt_dscp.h
index 1da61e6..f49bc1a 100644
--- a/include/linux/netfilter/xt_dscp.h
+++ b/include/linux/netfilter/xt_dscp.h
@@ -20,4 +20,10 @@ struct xt_dscp_info {
u_int8_t invert;
};
+struct xt_tos_match_info {
+ u_int8_t tos_mask;
+ u_int8_t tos_value;
+ u_int8_t invert;
+};
+
#endif /* _XT_DSCP_H */
diff --git a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
index 75b0df9..834e437 100644
--- a/net/netfilter/xt_dscp.c
+++ b/net/netfilter/xt_dscp.c
@@ -23,6 +23,7 @@ MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_dscp");
MODULE_ALIAS("ip6t_dscp");
MODULE_ALIAS("ipt_tos");
+MODULE_ALIAS("ip6t_tos");
static bool
dscp_mt(const struct sk_buff *skb, const struct net_device *in,
@@ -72,6 +73,21 @@ static bool tos_mt_v0(const struct sk_buff *skb, const struct net_device *in,
return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
}
+static bool tos_mt(const struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const struct xt_match *match,
+ const void *matchinfo, int offset, unsigned int protoff,
+ bool *hotdrop)
+{
+ const struct xt_tos_match_info *info = matchinfo;
+
+ if (match->family == AF_INET)
+ return ((ip_hdr(skb)->tos & info->tos_mask) ==
+ info->tos_value) ^ !!info->invert;
+ else
+ return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) ==
+ info->tos_value) ^ !!info->invert;
+}
+
static struct xt_match dscp_mt_reg[] __read_mostly = {
{
.name = "dscp",
@@ -97,6 +113,22 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
.matchsize = sizeof(struct ipt_tos_info),
.me = THIS_MODULE,
},
+ {
+ .name = "tos",
+ .revision = 1,
+ .family = AF_INET,
+ .match = tos_mt,
+ .matchsize = sizeof(struct xt_tos_match_info),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "tos",
+ .revision = 1,
+ .family = AF_INET6,
+ .match = tos_mt,
+ .matchsize = sizeof(struct xt_tos_match_info),
+ .me = THIS_MODULE,
+ },
};
static int __init dscp_mt_init(void)
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 14/49]: IPv6 capable xt_TOS v1 target
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (11 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 13/49]: IPv6 capable xt_tos v1 match Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 15/49]: ip_tables: remove obsolete SAME target Patrick McHardy
` (35 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: IPv6 capable xt_TOS v1 target
Extends the xt_DSCP target by xt_TOS v1 to add support for selectively
setting and flipping any bit in the IPv4 TOS and IPv6 Priority fields.
(ipt_TOS and xt_DSCP only accepted a limited range of possible
values.)
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 76a21a5927f267f96a9049c77627d2983652686a
tree 088243b4cd84c7bef3fd4fd6176a95d858cee65c
parent ef44af12ba911ba711ac38989aabfaeee0fedd71
author Jan Engelhardt <jengelh@computergmbh.de> Tue, 04 Dec 2007 10:47:06 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:24:03 +0100
include/linux/netfilter/xt_DSCP.h | 5 +++
net/netfilter/Kconfig | 2 +
net/netfilter/xt_DSCP.c | 63 +++++++++++++++++++++++++++++++++++++
3 files changed, 69 insertions(+), 1 deletions(-)
diff --git a/include/linux/netfilter/xt_DSCP.h b/include/linux/netfilter/xt_DSCP.h
index 3c7c963..14da196 100644
--- a/include/linux/netfilter/xt_DSCP.h
+++ b/include/linux/netfilter/xt_DSCP.h
@@ -17,4 +17,9 @@ struct xt_DSCP_info {
u_int8_t dscp;
};
+struct xt_tos_target_info {
+ u_int8_t tos_value;
+ u_int8_t tos_mask;
+};
+
#endif /* _XT_DSCP_TARGET_H */
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 9c82d4c..7bde631 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -304,7 +304,7 @@ config NETFILTER_XT_TARGET_DSCP
It also adds the "TOS" target, which allows you to create rules in
the "mangle" table which alter the Type Of Service field of an IPv4
- packet prior to routing.
+ or the Priority field of an IPv6 packet, prior to routing.
To compile it as a module, choose M here. If unsure, say N.
diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index 40a4f1d..fd7500e 100644
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -26,6 +26,7 @@ MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_DSCP");
MODULE_ALIAS("ip6t_DSCP");
MODULE_ALIAS("ipt_TOS");
+MODULE_ALIAS("ip6t_TOS");
static unsigned int
dscp_tg(struct sk_buff *skb, const struct net_device *in,
@@ -117,6 +118,50 @@ tos_tg_check_v0(const char *tablename, const void *e_void,
return true;
}
+static unsigned int
+tos_tg(struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+ const struct xt_target *target, const void *targinfo)
+{
+ const struct xt_tos_target_info *info = targinfo;
+ struct iphdr *iph = ip_hdr(skb);
+ u_int8_t orig, nv;
+
+ orig = ipv4_get_dsfield(iph);
+ nv = (orig & info->tos_mask) ^ info->tos_value;
+
+ if (orig != nv) {
+ if (!skb_make_writable(skb, sizeof(struct iphdr)))
+ return NF_DROP;
+ iph = ip_hdr(skb);
+ ipv4_change_dsfield(iph, ~0, nv);
+ }
+
+ return XT_CONTINUE;
+}
+
+static unsigned int
+tos_tg6(struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+ const struct xt_target *target, const void *targinfo)
+{
+ const struct xt_tos_target_info *info = targinfo;
+ struct ipv6hdr *iph = ipv6_hdr(skb);
+ u_int8_t orig, nv;
+
+ orig = ipv6_get_dsfield(iph);
+ nv = (orig & info->tos_mask) ^ info->tos_value;
+
+ if (orig != nv) {
+ if (!skb_make_writable(skb, sizeof(struct iphdr)))
+ return NF_DROP;
+ iph = ipv6_hdr(skb);
+ ipv6_change_dsfield(iph, ~0, nv);
+ }
+
+ return XT_CONTINUE;
+}
+
static struct xt_target dscp_tg_reg[] __read_mostly = {
{
.name = "DSCP",
@@ -146,6 +191,24 @@ static struct xt_target dscp_tg_reg[] __read_mostly = {
.checkentry = tos_tg_check_v0,
.me = THIS_MODULE,
},
+ {
+ .name = "TOS",
+ .revision = 1,
+ .family = AF_INET,
+ .table = "mangle",
+ .target = tos_tg,
+ .targetsize = sizeof(struct xt_tos_target_info),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "TOS",
+ .revision = 1,
+ .family = AF_INET6,
+ .table = "mangle",
+ .target = tos_tg6,
+ .targetsize = sizeof(struct xt_tos_target_info),
+ .me = THIS_MODULE,
+ },
};
static int __init dscp_tg_init(void)
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 15/49]: ip_tables: remove obsolete SAME target
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (12 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 14/49]: IPv6 capable xt_TOS v1 target Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 16/49]: x_tables: add RATEEST target Patrick McHardy
` (34 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: ip_tables: remove obsolete SAME target
Remove the ipt_SAME target as scheduled in feature-removal-schedule.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit cd5e5ce6b1f5ca260806c7ed72418d4b1a8e9e1f
tree 649ade75a1cdb2c394b95d68488c443d9f3cd630
parent 76a21a5927f267f96a9049c77627d2983652686a
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:07 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:24:38 +0100
Documentation/feature-removal-schedule.txt | 9 -
net/ipv4/netfilter/Kconfig | 9 -
net/ipv4/netfilter/Makefile | 1
net/ipv4/netfilter/ipt_SAME.c | 174 ----------------------------
4 files changed, 0 insertions(+), 193 deletions(-)
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index aeaa129..c9c3603 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -273,15 +273,6 @@ Who: Jean Delvare <khali@linux-fr.org>
---------------------------
-What: iptables SAME target
-When: 1.1. 2008
-Files: net/ipv4/netfilter/ipt_SAME.c, include/linux/netfilter_ipv4/ipt_SAME.h
-Why: Obsolete for multiple years now, NAT core provides the same behaviour.
- Unfixable broken wrt. 32/64 bit cleanness.
-Who: Patrick McHardy <kaber@trash.net>
-
----------------------------
-
What: The arch/ppc and include/asm-ppc directories
When: Jun 2008
Why: The arch/powerpc tree is the merged architecture for ppc32 and ppc64
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index b11231d..ad26f66 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -211,15 +211,6 @@ config IP_NF_TARGET_NETMAP
To compile it as a module, choose M here. If unsure, say N.
-config IP_NF_TARGET_SAME
- tristate "SAME target support (OBSOLETE)"
- depends on NF_NAT
- help
- This option adds a `SAME' target, which works like the standard SNAT
- target, but attempts to give clients the same IP for all connections.
-
- To compile it as a module, choose M here. If unsure, say N.
-
config NF_NAT_SNMP_BASIC
tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
depends on EXPERIMENTAL && NF_NAT
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 2fc0561..fd7d4a5 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -56,7 +56,6 @@ obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt_NETMAP.o
obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
-obj-$(CONFIG_IP_NF_TARGET_SAME) += ipt_SAME.o
obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
diff --git a/net/ipv4/netfilter/ipt_SAME.c b/net/ipv4/netfilter/ipt_SAME.c
deleted file mode 100644
index a43923d..0000000
--- a/net/ipv4/netfilter/ipt_SAME.c
+++ /dev/null
@@ -1,174 +0,0 @@
-/* Same. Just like SNAT, only try to make the connections
- * between client A and server B always have the same source ip.
- *
- * (C) 2000 Paul `Rusty' Russell
- * (C) 2001 Martin Josefsson
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/types.h>
-#include <linux/ip.h>
-#include <linux/timer.h>
-#include <linux/module.h>
-#include <linux/netfilter.h>
-#include <linux/netdevice.h>
-#include <linux/if.h>
-#include <linux/inetdevice.h>
-#include <net/protocol.h>
-#include <net/checksum.h>
-#include <linux/netfilter_ipv4.h>
-#include <linux/netfilter/x_tables.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <linux/netfilter_ipv4/ipt_SAME.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>");
-MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip");
-
-static bool
-same_tg_check(const char *tablename, const void *e,
- const struct xt_target *target, void *targinfo,
- unsigned int hook_mask)
-{
- unsigned int count, countess, rangeip, index = 0;
- struct ipt_same_info *mr = targinfo;
-
- mr->ipnum = 0;
-
- if (mr->rangesize < 1) {
- pr_debug("same_check: need at least one dest range.\n");
- return false;
- }
- if (mr->rangesize > IPT_SAME_MAX_RANGE) {
- pr_debug("same_check: too many ranges specified, maximum "
- "is %u ranges\n", IPT_SAME_MAX_RANGE);
- return false;
- }
- for (count = 0; count < mr->rangesize; count++) {
- if (ntohl(mr->range[count].min_ip) >
- ntohl(mr->range[count].max_ip)) {
- pr_debug("same_check: min_ip is larger than max_ip in "
- "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n",
- NIPQUAD(mr->range[count].min_ip),
- NIPQUAD(mr->range[count].max_ip));
- return false;
- }
- if (!(mr->range[count].flags & IP_NAT_RANGE_MAP_IPS)) {
- pr_debug("same_check: bad MAP_IPS.\n");
- return false;
- }
- rangeip = (ntohl(mr->range[count].max_ip) -
- ntohl(mr->range[count].min_ip) + 1);
- mr->ipnum += rangeip;
-
- pr_debug("same_check: range %u, ipnum = %u\n", count, rangeip);
- }
- pr_debug("same_check: total ipaddresses = %u\n", mr->ipnum);
-
- mr->iparray = kmalloc((sizeof(u_int32_t) * mr->ipnum), GFP_KERNEL);
- if (!mr->iparray) {
- pr_debug("same_check: Couldn't allocate %Zu bytes "
- "for %u ipaddresses!\n",
- (sizeof(u_int32_t) * mr->ipnum), mr->ipnum);
- return false;
- }
- pr_debug("same_check: Allocated %Zu bytes for %u ipaddresses.\n",
- (sizeof(u_int32_t) * mr->ipnum), mr->ipnum);
-
- for (count = 0; count < mr->rangesize; count++) {
- for (countess = ntohl(mr->range[count].min_ip);
- countess <= ntohl(mr->range[count].max_ip);
- countess++) {
- mr->iparray[index] = countess;
- pr_debug("same_check: Added ipaddress `%u.%u.%u.%u' "
- "in index %u.\n", HIPQUAD(countess), index);
- index++;
- }
- }
- return true;
-}
-
-static void same_tg_destroy(const struct xt_target *target, void *targinfo)
-{
- struct ipt_same_info *mr = targinfo;
-
- kfree(mr->iparray);
-
- pr_debug("same_destroy: Deallocated %Zu bytes for %u ipaddresses.\n",
- (sizeof(u_int32_t) * mr->ipnum), mr->ipnum);
-}
-
-static unsigned int
-same_tg(struct sk_buff *skb, const struct net_device *in,
- const struct net_device *out, unsigned int hooknum,
- const struct xt_target *target, const void *targinfo)
-{
- struct nf_conn *ct;
- enum ip_conntrack_info ctinfo;
- u_int32_t tmpip, aindex;
- __be32 new_ip;
- const struct ipt_same_info *same = targinfo;
- struct nf_nat_range newrange;
- const struct nf_conntrack_tuple *t;
-
- NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING ||
- hooknum == NF_INET_POST_ROUTING);
- ct = nf_ct_get(skb, &ctinfo);
-
- t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
-
- /* Base new source on real src ip and optionally dst ip,
- giving some hope for consistency across reboots.
- Here we calculate the index in same->iparray which
- holds the ipaddress we should use */
-
- tmpip = ntohl(t->src.u3.ip);
-
- if (!(same->info & IPT_SAME_NODST))
- tmpip += ntohl(t->dst.u3.ip);
- aindex = tmpip % same->ipnum;
-
- new_ip = htonl(same->iparray[aindex]);
-
- pr_debug("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, "
- "new src=%u.%u.%u.%u\n",
- NIPQUAD(t->src.u3.ip), NIPQUAD(t->dst.u3.ip), NIPQUAD(new_ip));
-
- /* Transfer from original range. */
- newrange = ((struct nf_nat_range)
- { same->range[0].flags, new_ip, new_ip,
- /* FIXME: Use ports from correct range! */
- same->range[0].min, same->range[0].max });
-
- /* Hand modified range to generic setup. */
- return nf_nat_setup_info(ct, &newrange, hooknum);
-}
-
-static struct xt_target same_tg_reg __read_mostly = {
- .name = "SAME",
- .family = AF_INET,
- .target = same_tg,
- .targetsize = sizeof(struct ipt_same_info),
- .table = "nat",
- .hooks = (1 << NF_INET_PRE_ROUTING) |
- (1 << NF_INET_POST_ROUTING),
- .checkentry = same_tg_check,
- .destroy = same_tg_destroy,
- .me = THIS_MODULE,
-};
-
-static int __init same_tg_init(void)
-{
- return xt_register_target(&same_tg_reg);
-}
-
-static void __exit same_tg_exit(void)
-{
- xt_unregister_target(&same_tg_reg);
-}
-
-module_init(same_tg_init);
-module_exit(same_tg_exit);
-
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 16/49]: x_tables: add RATEEST target
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (13 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 15/49]: ip_tables: remove obsolete SAME target Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 17/49]: x_tables: add rateest match Patrick McHardy
` (33 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: x_tables: add RATEEST target
Add new rate estimator target (using gen_estimator). In combination with
the rateest match (next patch) this can be used for load-based multipath
routing.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 8c6e468fc5afd31f405d87c2977f013b8343fe1d
tree 0412b1a8c10234e26b6af5fe6fc7c4333523bb38
parent cd5e5ce6b1f5ca260806c7ed72418d4b1a8e9e1f
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:08 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:24:44 +0100
include/linux/netfilter/Kbuild | 1
include/linux/netfilter/xt_RATEEST.h | 11 ++
include/net/netfilter/xt_rateest.h | 17 +++
net/netfilter/Kconfig | 10 ++
net/netfilter/Makefile | 1
net/netfilter/xt_RATEEST.c | 204 ++++++++++++++++++++++++++++++++++
6 files changed, 244 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index 1e69002..707a158 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -10,6 +10,7 @@ header-y += xt_DSCP.h
header-y += xt_MARK.h
header-y += xt_NFLOG.h
header-y += xt_NFQUEUE.h
+header-y += xt_RATEEST.h
header-y += xt_SECMARK.h
header-y += xt_TCPMSS.h
header-y += xt_comment.h
diff --git a/include/linux/netfilter/xt_RATEEST.h b/include/linux/netfilter/xt_RATEEST.h
new file mode 100644
index 0000000..670f2e4
--- /dev/null
+++ b/include/linux/netfilter/xt_RATEEST.h
@@ -0,0 +1,11 @@
+#ifndef _XT_RATEEST_TARGET_H
+#define _XT_RATEEST_TARGET_H
+
+struct xt_rateest_target_info {
+ char name[IFNAMSIZ];
+ int8_t interval;
+ u_int8_t ewma_log;
+ struct xt_rateest *est __attribute__((aligned(8)));
+};
+
+#endif /* _XT_RATEEST_TARGET_H */
diff --git a/include/net/netfilter/xt_rateest.h b/include/net/netfilter/xt_rateest.h
new file mode 100644
index 0000000..65d594d
--- /dev/null
+++ b/include/net/netfilter/xt_rateest.h
@@ -0,0 +1,17 @@
+#ifndef _XT_RATEEST_H
+#define _XT_RATEEST_H
+
+struct xt_rateest {
+ struct hlist_node list;
+ char name[IFNAMSIZ];
+ unsigned int refcnt;
+ spinlock_t lock;
+ struct gnet_estimator params;
+ struct gnet_stats_rate_est rstats;
+ struct gnet_stats_basic bstats;
+};
+
+extern struct xt_rateest *xt_rateest_lookup(const char *name);
+extern void xt_rateest_put(struct xt_rateest *est);
+
+#endif /* _XT_RATEEST_H */
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 7bde631..22d1f10 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -357,6 +357,16 @@ config NETFILTER_XT_TARGET_NOTRACK
If you want to compile it as a module, say M here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
+config NETFILTER_XT_TARGET_RATEEST
+ tristate '"RATEEST" target support'
+ depends on NETFILTER_XTABLES
+ help
+ This option adds a `RATEEST' target, which allows to measure
+ rates similar to TC estimators. The `rateest' match can be
+ used to match on the measured rates.
+
+ To compile it as a module, choose M here. If unsure, say N.
+
config NETFILTER_XT_TARGET_TRACE
tristate '"TRACE" target support'
depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 28f59a3..413afaa 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -46,6 +46,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_MARK) += xt_MARK.o
obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o
obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_RATEEST) += xt_RATEEST.o
obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
obj-$(CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP) += xt_TCPOPTSTRIP.o
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
new file mode 100644
index 0000000..c008883
--- /dev/null
+++ b/net/netfilter/xt_RATEEST.c
@@ -0,0 +1,204 @@
+/*
+ * (C) 2007 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/gen_stats.h>
+#include <linux/jhash.h>
+#include <linux/rtnetlink.h>
+#include <linux/random.h>
+#include <net/gen_stats.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_RATEEST.h>
+#include <net/netfilter/xt_rateest.h>
+
+static DEFINE_MUTEX(xt_rateest_mutex);
+
+#define RATEEST_HSIZE 16
+static struct hlist_head rateest_hash[RATEEST_HSIZE] __read_mostly;
+static unsigned int jhash_rnd __read_mostly;
+
+static unsigned int xt_rateest_hash(const char *name)
+{
+ return jhash(name, FIELD_SIZEOF(struct xt_rateest, name), jhash_rnd) &
+ (RATEEST_HSIZE - 1);
+}
+
+static void xt_rateest_hash_insert(struct xt_rateest *est)
+{
+ unsigned int h;
+
+ h = xt_rateest_hash(est->name);
+ hlist_add_head(&est->list, &rateest_hash[h]);
+}
+
+struct xt_rateest *xt_rateest_lookup(const char *name)
+{
+ struct xt_rateest *est;
+ struct hlist_node *n;
+ unsigned int h;
+
+ h = xt_rateest_hash(name);
+ mutex_lock(&xt_rateest_mutex);
+ hlist_for_each_entry(est, n, &rateest_hash[h], list) {
+ if (strcmp(est->name, name) == 0) {
+ est->refcnt++;
+ mutex_unlock(&xt_rateest_mutex);
+ return est;
+ }
+ }
+ mutex_unlock(&xt_rateest_mutex);
+ return NULL;
+}
+EXPORT_SYMBOL_GPL(xt_rateest_lookup);
+
+void xt_rateest_put(struct xt_rateest *est)
+{
+ mutex_lock(&xt_rateest_mutex);
+ if (--est->refcnt == 0) {
+ hlist_del(&est->list);
+ gen_kill_estimator(&est->bstats, &est->rstats);
+ kfree(est);
+ }
+ mutex_unlock(&xt_rateest_mutex);
+}
+EXPORT_SYMBOL_GPL(xt_rateest_put);
+
+static unsigned int
+xt_rateest_tg(struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ unsigned int hooknum,
+ const struct xt_target *target,
+ const void *targinfo)
+{
+ const struct xt_rateest_target_info *info = targinfo;
+ struct gnet_stats_basic *stats = &info->est->bstats;
+
+ spin_lock_bh(&info->est->lock);
+ stats->bytes += skb->len;
+ stats->packets++;
+ spin_unlock_bh(&info->est->lock);
+
+ return XT_CONTINUE;
+}
+
+static bool
+xt_rateest_tg_checkentry(const char *tablename,
+ const void *entry,
+ const struct xt_target *target,
+ void *targinfo,
+ unsigned int hook_mask)
+{
+ struct xt_rateest_target_info *info = (void *)targinfo;
+ struct xt_rateest *est;
+ struct {
+ struct rtattr opt;
+ struct gnet_estimator est;
+ } cfg;
+
+ est = xt_rateest_lookup(info->name);
+ if (est) {
+ /*
+ * If estimator parameters are specified, they must match the
+ * existing estimator.
+ */
+ if ((!info->interval && !info->ewma_log) ||
+ (info->interval != est->params.interval ||
+ info->ewma_log != est->params.ewma_log)) {
+ xt_rateest_put(est);
+ return false;
+ }
+ info->est = est;
+ return true;
+ }
+
+ est = kzalloc(sizeof(*est), GFP_KERNEL);
+ if (!est)
+ goto err1;
+
+ strlcpy(est->name, info->name, sizeof(est->name));
+ spin_lock_init(&est->lock);
+ est->refcnt = 1;
+ est->params.interval = info->interval;
+ est->params.ewma_log = info->ewma_log;
+
+ cfg.opt.rta_len = RTA_LENGTH(sizeof(cfg.est));
+ cfg.opt.rta_type = TCA_STATS_RATE_EST;
+ cfg.est.interval = info->interval;
+ cfg.est.ewma_log = info->ewma_log;
+
+ if (gen_new_estimator(&est->bstats, &est->rstats, &est->lock,
+ &cfg.opt) < 0)
+ goto err2;
+
+ info->est = est;
+ xt_rateest_hash_insert(est);
+
+ return true;
+
+err2:
+ kfree(est);
+err1:
+ return false;
+}
+
+static void xt_rateest_tg_destroy(const struct xt_target *target,
+ void *targinfo)
+{
+ struct xt_rateest_target_info *info = targinfo;
+
+ xt_rateest_put(info->est);
+}
+
+static struct xt_target xt_rateest_target[] __read_mostly = {
+ {
+ .family = AF_INET,
+ .name = "RATEEST",
+ .target = xt_rateest_tg,
+ .checkentry = xt_rateest_tg_checkentry,
+ .destroy = xt_rateest_tg_destroy,
+ .targetsize = sizeof(struct xt_rateest_target_info),
+ .me = THIS_MODULE,
+ },
+ {
+ .family = AF_INET6,
+ .name = "RATEEST",
+ .target = xt_rateest_tg,
+ .checkentry = xt_rateest_tg_checkentry,
+ .destroy = xt_rateest_tg_destroy,
+ .targetsize = sizeof(struct xt_rateest_target_info),
+ .me = THIS_MODULE,
+ },
+};
+
+static int __init xt_rateest_tg_init(void)
+{
+ unsigned int i;
+
+ for (i = 0; i < ARRAY_SIZE(rateest_hash); i++)
+ INIT_HLIST_HEAD(&rateest_hash[i]);
+
+ get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));
+ return xt_register_targets(xt_rateest_target,
+ ARRAY_SIZE(xt_rateest_target));
+}
+
+static void __exit xt_rateest_tg_fini(void)
+{
+ xt_unregister_targets(xt_rateest_target, ARRAY_SIZE(xt_rateest_target));
+}
+
+
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("xtables rate estimator");
+MODULE_ALIAS("ipt_RATEEST");
+MODULE_ALIAS("ip6t_RATEEST");
+module_init(xt_rateest_tg_init);
+module_exit(xt_rateest_tg_fini);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 17/49]: x_tables: add rateest match
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (14 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 16/49]: x_tables: add RATEEST target Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 18/49]: {ip,ip6}t_LOG: log GID Patrick McHardy
` (32 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: x_tables: add rateest match
Add rate estimator match. The rate estimator match can match on
estimated rates by the RATEEST target. It supports matching on
absolute bps/pps values, comparing two rate estimators and matching
on the difference between two rate estimators.
This is what I use to route outgoing data connections from a FTP
server over two lines based on the available bandwidth:
# estimate outgoing rates
iptables -t mangle -A POSTROUTING -o eth0 -j RATEEST --rateest-name eth0 \
--rateest-interval 250ms \
--rateest-ewma 0.5s
iptables -t mangle -A POSTROUTING -o ppp0 -j RATEEST --rateest-name ppp0 \
--rateest-interval 250ms \
--rateest-ewma 0.5s
# mark based on available bandwidth
iptables -t mangle -A BALANCE -m state --state NEW \
-m helper --helper ftp \
-m rateest --rateest-delta \
--rateest1 eth0 \
--rateest-bps1 2.5mbit \
--rateest-gt \
--rateest2 ppp0 \
--rateest-bps2 2mbit \
-j CONNMARK --set-mark 0x1
iptables -t mangle -A BALANCE -m state --state NEW \
-m helper --helper ftp \
-m rateest --rateest-delta \
--rateest1 ppp0 \
--rateest-bps1 2mbit \
--rateest-gt \
--rateest2 eth0 \
--rateest-bps2 2.5mbit \
-j CONNMARK --set-mark 0x2
iptables -t mangle -A BALANCE -j CONNMARK --restore-mark
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 57b89170e9765f9ce899abf12ac4e0a91b5cc42c
tree 157fc15b8c40f19194d24c4d10a83400a19db591
parent 8c6e468fc5afd31f405d87c2977f013b8343fe1d
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:09 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:26:52 +0100
include/linux/netfilter/Kbuild | 1
include/linux/netfilter/xt_rateest.h | 33 ++++++
net/netfilter/Kconfig | 10 ++
net/netfilter/Makefile | 1
net/netfilter/xt_rateest.c | 178 ++++++++++++++++++++++++++++++++++
5 files changed, 223 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index 707a158..ac9e642 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -30,6 +30,7 @@ header-y += xt_multiport.h
header-y += xt_owner.h
header-y += xt_pkttype.h
header-y += xt_policy.h
+header-y += xt_rateest.h
header-y += xt_realm.h
header-y += xt_sctp.h
header-y += xt_state.h
diff --git a/include/linux/netfilter/xt_rateest.h b/include/linux/netfilter/xt_rateest.h
new file mode 100644
index 0000000..51948e1
--- /dev/null
+++ b/include/linux/netfilter/xt_rateest.h
@@ -0,0 +1,33 @@
+#ifndef _XT_RATEEST_MATCH_H
+#define _XT_RATEEST_MATCH_H
+
+enum xt_rateest_match_flags {
+ XT_RATEEST_MATCH_INVERT = 1<<0,
+ XT_RATEEST_MATCH_ABS = 1<<1,
+ XT_RATEEST_MATCH_REL = 1<<2,
+ XT_RATEEST_MATCH_DELTA = 1<<3,
+ XT_RATEEST_MATCH_BPS = 1<<4,
+ XT_RATEEST_MATCH_PPS = 1<<5,
+};
+
+enum xt_rateest_match_mode {
+ XT_RATEEST_MATCH_NONE,
+ XT_RATEEST_MATCH_EQ,
+ XT_RATEEST_MATCH_LT,
+ XT_RATEEST_MATCH_GT,
+};
+
+struct xt_rateest_match_info {
+ char name1[IFNAMSIZ];
+ char name2[IFNAMSIZ];
+ u_int16_t flags;
+ u_int16_t mode;
+ u_int32_t bps1;
+ u_int32_t pps1;
+ u_int32_t bps2;
+ u_int32_t pps2;
+ struct xt_rateest *est1 __attribute__((aligned(8)));
+ struct xt_rateest *est2 __attribute__((aligned(8)));
+};
+
+#endif /* _XT_RATEEST_MATCH_H */
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 22d1f10..4182393 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -631,6 +631,16 @@ config NETFILTER_XT_MATCH_QUOTA
If you want to compile it as a module, say M here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
+config NETFILTER_XT_MATCH_RATEEST
+ tristate '"rateest" match support'
+ depends on NETFILTER_XTABLES
+ select NETFILTER_XT_TARGET_RATEEST
+ help
+ This option adds a `rateest' match, which allows to match on the
+ rate estimated by the RATEEST target.
+
+ To compile it as a module, choose M here. If unsure, say N.
+
config NETFILTER_XT_MATCH_REALM
tristate '"realm" match support'
depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 413afaa..3b9ea8f 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -73,6 +73,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o
obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
new file mode 100644
index 0000000..fdb86a5
--- /dev/null
+++ b/net/netfilter/xt_rateest.c
@@ -0,0 +1,178 @@
+/*
+ * (C) 2007 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/gen_stats.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_rateest.h>
+#include <net/netfilter/xt_rateest.h>
+
+
+static bool xt_rateest_mt(const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const struct xt_match *match,
+ const void *matchinfo,
+ int offset,
+ unsigned int protoff,
+ bool *hotdrop)
+{
+ const struct xt_rateest_match_info *info = matchinfo;
+ struct gnet_stats_rate_est *r;
+ u_int32_t bps1, bps2, pps1, pps2;
+ bool ret = true;
+
+ spin_lock_bh(&info->est1->lock);
+ r = &info->est1->rstats;
+ if (info->flags & XT_RATEEST_MATCH_DELTA) {
+ bps1 = info->bps1 >= r->bps ? info->bps1 - r->bps : 0;
+ pps1 = info->pps1 >= r->pps ? info->pps1 - r->pps : 0;
+ } else {
+ bps1 = r->bps;
+ pps1 = r->pps;
+ }
+ spin_unlock_bh(&info->est1->lock);
+
+ if (info->flags & XT_RATEEST_MATCH_ABS) {
+ bps2 = info->bps2;
+ pps2 = info->pps2;
+ } else {
+ spin_lock_bh(&info->est2->lock);
+ r = &info->est2->rstats;
+ if (info->flags & XT_RATEEST_MATCH_DELTA) {
+ bps2 = info->bps2 >= r->bps ? info->bps2 - r->bps : 0;
+ pps2 = info->pps2 >= r->pps ? info->pps2 - r->pps : 0;
+ } else {
+ bps2 = r->bps;
+ pps2 = r->pps;
+ }
+ spin_unlock_bh(&info->est2->lock);
+ }
+
+ switch (info->mode) {
+ case XT_RATEEST_MATCH_LT:
+ if (info->flags & XT_RATEEST_MATCH_BPS)
+ ret &= bps1 < bps2;
+ if (info->flags & XT_RATEEST_MATCH_PPS)
+ ret &= pps1 < pps2;
+ break;
+ case XT_RATEEST_MATCH_GT:
+ if (info->flags & XT_RATEEST_MATCH_BPS)
+ ret &= bps1 > bps2;
+ if (info->flags & XT_RATEEST_MATCH_PPS)
+ ret &= pps1 > pps2;
+ break;
+ case XT_RATEEST_MATCH_EQ:
+ if (info->flags & XT_RATEEST_MATCH_BPS)
+ ret &= bps1 == bps2;
+ if (info->flags & XT_RATEEST_MATCH_PPS)
+ ret &= pps2 == pps2;
+ break;
+ }
+
+ ret ^= info->flags & XT_RATEEST_MATCH_INVERT ? true : false;
+ return ret;
+}
+
+static bool xt_rateest_mt_checkentry(const char *tablename,
+ const void *ip,
+ const struct xt_match *match,
+ void *matchinfo,
+ unsigned int hook_mask)
+{
+ struct xt_rateest_match_info *info = (void *)matchinfo;
+ struct xt_rateest *est1, *est2;
+
+ if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS |
+ XT_RATEEST_MATCH_REL)) != 1)
+ goto err1;
+
+ if (!(info->flags & (XT_RATEEST_MATCH_BPS | XT_RATEEST_MATCH_PPS)))
+ goto err1;
+
+ switch (info->mode) {
+ case XT_RATEEST_MATCH_EQ:
+ case XT_RATEEST_MATCH_LT:
+ case XT_RATEEST_MATCH_GT:
+ break;
+ default:
+ goto err1;
+ }
+
+ est1 = xt_rateest_lookup(info->name1);
+ if (!est1)
+ goto err1;
+
+ if (info->flags & XT_RATEEST_MATCH_REL) {
+ est2 = xt_rateest_lookup(info->name2);
+ if (!est2)
+ goto err2;
+ } else
+ est2 = NULL;
+
+
+ info->est1 = est1;
+ info->est2 = est2;
+ return true;
+
+err2:
+ xt_rateest_put(est1);
+err1:
+ return false;
+}
+
+static void xt_rateest_mt_destroy(const struct xt_match *match,
+ void *matchinfo)
+{
+ struct xt_rateest_match_info *info = (void *)matchinfo;
+
+ xt_rateest_put(info->est1);
+ if (info->est2)
+ xt_rateest_put(info->est2);
+}
+
+static struct xt_match xt_rateest_match[] __read_mostly = {
+ {
+ .family = AF_INET,
+ .name = "rateest",
+ .match = xt_rateest_mt,
+ .checkentry = xt_rateest_mt_checkentry,
+ .destroy = xt_rateest_mt_destroy,
+ .matchsize = sizeof(struct xt_rateest_match_info),
+ .me = THIS_MODULE,
+ },
+ {
+ .family = AF_INET6,
+ .name = "rateest",
+ .match = xt_rateest_mt,
+ .checkentry = xt_rateest_mt_checkentry,
+ .destroy = xt_rateest_mt_destroy,
+ .matchsize = sizeof(struct xt_rateest_match_info),
+ .me = THIS_MODULE,
+ },
+};
+
+static int __init xt_rateest_mt_init(void)
+{
+ return xt_register_matches(xt_rateest_match,
+ ARRAY_SIZE(xt_rateest_match));
+}
+
+static void __exit xt_rateest_mt_fini(void)
+{
+ xt_unregister_matches(xt_rateest_match, ARRAY_SIZE(xt_rateest_match));
+}
+
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("xtables rate estimator match");
+MODULE_ALIAS("ipt_rateest");
+MODULE_ALIAS("ip6t_rateest");
+module_init(xt_rateest_mt_init);
+module_exit(xt_rateest_mt_fini);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 18/49]: {ip,ip6}t_LOG: log GID
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (15 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 17/49]: x_tables: add rateest match Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 19/49]: xt_hashlimit: remove ip6tables module dependency Patrick McHardy
` (31 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: {ip,ip6}t_LOG: log GID
Log GID in addition to UID
Signed-off-by: Maciej Soltysiak <maciej.soltysiak@ae.poznan.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 5ccda5a2efbe4c504144db8fae1861a795a39258
tree be4c00aed3c33d4528c37a5f9ae509381db0552e
parent 57b89170e9765f9ce899abf12ac4e0a91b5cc42c
author Maciej Soltysiak <maciej.soltysiak@ae.poznan.pl> Tue, 04 Dec 2007 10:47:10 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:28:11 +0100
net/ipv4/netfilter/ipt_LOG.c | 4 +++-
net/ipv6/netfilter/ip6t_LOG.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index fba2155..f8c613a 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -337,7 +337,9 @@ static void dump_packet(const struct nf_loginfo *info,
if ((logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
read_lock_bh(&skb->sk->sk_callback_lock);
if (skb->sk->sk_socket && skb->sk->sk_socket->file)
- printk("UID=%u ", skb->sk->sk_socket->file->f_uid);
+ printk("UID=%u GID=%u",
+ skb->sk->sk_socket->file->f_uid,
+ skb->sk->sk_socket->file->f_gid);
read_unlock_bh(&skb->sk->sk_callback_lock);
}
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index cd51c42..1952324 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -362,7 +362,9 @@ static void dump_packet(const struct nf_loginfo *info,
if ((logflags & IP6T_LOG_UID) && recurse && skb->sk) {
read_lock_bh(&skb->sk->sk_callback_lock);
if (skb->sk->sk_socket && skb->sk->sk_socket->file)
- printk("UID=%u ", skb->sk->sk_socket->file->f_uid);
+ printk("UID=%u GID=%u",
+ skb->sk->sk_socket->file->f_uid,
+ skb->sk->sk_socket->file->f_gid);
read_unlock_bh(&skb->sk->sk_callback_lock);
}
}
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 19/49]: xt_hashlimit: remove ip6tables module dependency
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (16 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 18/49]: {ip,ip6}t_LOG: log GID Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 20/49]: nf_ct_h323: remove ipv6 " Patrick McHardy
` (30 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: xt_hashlimit: remove ip6tables module dependency
Switch from ipv6_find_hdr to ipv6_skip_exthdr to avoid pulling in ip6_tables
and ipv6 when only using it for IPv4.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit a999d6f9c41df6fdf01d58728d13a450b0712afb
tree 1ae8c17820eba48122247d09ae1c38bf6af08d9d
parent 5ccda5a2efbe4c504144db8fae1861a795a39258
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:11 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:28:18 +0100
net/netfilter/xt_hashlimit.c | 8 +++++---
1 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 8a8b267..033d448 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -21,6 +21,7 @@
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
+#include <net/ipv6.h>
#include <net/net_namespace.h>
#include <linux/netfilter/x_tables.h>
@@ -379,7 +380,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
const struct sk_buff *skb, unsigned int protoff)
{
__be16 _ports[2], *ports;
- int nexthdr;
+ u8 nexthdr;
memset(dst, 0, sizeof(*dst));
@@ -407,8 +408,9 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
if (!(hinfo->cfg.mode &
(XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
return 0;
- nexthdr = ipv6_find_hdr(skb, &protoff, -1, NULL);
- if (nexthdr < 0)
+ nexthdr = ipv6_hdr(skb)->nexthdr;
+ protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
+ if ((int)protoff < 0)
return -1;
break;
#endif
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 20/49]: nf_ct_h323: remove ipv6 module dependency
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (17 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 19/49]: xt_hashlimit: remove ip6tables module dependency Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 21/49]: nf_conntrack_proto_icmp: kill extern declaration in .c file Patrick McHardy
` (29 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_ct_h323: remove ipv6 module dependency
nf_conntrack_h323 needs ip6_route_output for the call forwarding filter.
Add a ->route function to nf_afinfo and use that to avoid pulling in the
ipv6 module.
Fix the #ifdef for the IPv6 code while I'm at it - the IPv6 support is
only needed when IPv6 conntrack is enabled.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 7ec6f2c4596936e092f8597908e325b189169cf7
tree 6791d0559110aac276feab3f952fd8201b554573
parent a999d6f9c41df6fdf01d58728d13a450b0712afb
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:12 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:28:51 +0100
include/linux/netfilter.h | 2 ++
net/ipv4/netfilter.c | 6 ++++++
net/ipv6/netfilter.c | 7 +++++++
net/netfilter/nf_conntrack_h323_main.c | 19 ++++++++++++-------
4 files changed, 27 insertions(+), 7 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index f42e436..9bfc7d4 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -298,10 +298,12 @@ extern void nf_invalidate_cache(int pf);
Returns true or false. */
extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
+struct flowi;
struct nf_afinfo {
unsigned short family;
__sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
unsigned int dataoff, u_int8_t protocol);
+ int (*route)(struct dst_entry **dst, struct flowi *fl);
void (*saveroute)(const struct sk_buff *skb,
struct nf_info *info);
int (*reroute)(struct sk_buff *skb,
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index d902246..599d448 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -182,9 +182,15 @@ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
EXPORT_SYMBOL(nf_ip_checksum);
+static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
+{
+ return ip_route_output_key((struct rtable **)dst, fl);
+}
+
static struct nf_afinfo nf_ip_afinfo = {
.family = AF_INET,
.checksum = nf_ip_checksum,
+ .route = nf_ip_route,
.saveroute = nf_ip_saveroute,
.reroute = nf_ip_reroute,
.route_key_size = sizeof(struct ip_rt_info),
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 175e19f..281f732 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -81,6 +81,12 @@ static int nf_ip6_reroute(struct sk_buff *skb, const struct nf_info *info)
return 0;
}
+static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
+{
+ *dst = ip6_route_output(NULL, fl);
+ return (*dst)->error;
+}
+
__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
unsigned int dataoff, u_int8_t protocol)
{
@@ -118,6 +124,7 @@ EXPORT_SYMBOL(nf_ip6_checksum);
static struct nf_afinfo nf_ip6_afinfo = {
.family = AF_INET6,
.checksum = nf_ip6_checksum,
+ .route = nf_ip6_route,
.saveroute = nf_ip6_saveroute,
.reroute = nf_ip6_reroute,
.route_key_size = sizeof(struct ip6_rt_info),
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index f23fd95..c550257 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -708,9 +708,15 @@ static int callforward_do_filter(union nf_conntrack_address *src,
union nf_conntrack_address *dst,
int family)
{
+ struct nf_afinfo *afinfo;
struct flowi fl1, fl2;
int ret = 0;
+ /* rcu_read_lock()ed by nf_hook_slow() */
+ afinfo = nf_get_afinfo(family);
+ if (!afinfo)
+ return 0;
+
memset(&fl1, 0, sizeof(fl1));
memset(&fl2, 0, sizeof(fl2));
@@ -720,8 +726,8 @@ static int callforward_do_filter(union nf_conntrack_address *src,
fl1.fl4_dst = src->ip;
fl2.fl4_dst = dst->ip;
- if (ip_route_output_key(&rt1, &fl1) == 0) {
- if (ip_route_output_key(&rt2, &fl2) == 0) {
+ if (!afinfo->route((struct dst_entry **)&rt1, &fl1)) {
+ if (!afinfo->route((struct dst_entry **)&rt2, &fl2)) {
if (rt1->rt_gateway == rt2->rt_gateway &&
rt1->u.dst.dev == rt2->u.dst.dev)
ret = 1;
@@ -731,16 +737,15 @@ static int callforward_do_filter(union nf_conntrack_address *src,
}
break;
}
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+#if defined(CONFIG_NF_CONNTRACK_IPV6) || \
+ defined(CONFIG_NF_CONNTRACK_IPV6_MODULE)
case AF_INET6: {
struct rt6_info *rt1, *rt2;
memcpy(&fl1.fl6_dst, src, sizeof(fl1.fl6_dst));
memcpy(&fl2.fl6_dst, dst, sizeof(fl2.fl6_dst));
- rt1 = (struct rt6_info *)ip6_route_output(NULL, &fl1);
- if (rt1) {
- rt2 = (struct rt6_info *)ip6_route_output(NULL, &fl2);
- if (rt2) {
+ if (!afinfo->route((struct dst_entry **)&rt1, &fl1)) {
+ if (!afinfo->route((struct dst_entry **)&rt2, &fl2)) {
if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
sizeof(rt1->rt6i_gateway)) &&
rt1->u.dst.dev == rt2->u.dst.dev)
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 21/49]: nf_conntrack_proto_icmp: kill extern declaration in .c file
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (18 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 20/49]: nf_ct_h323: remove ipv6 " Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 22/49]: Use nf_register_hooks for multiple registrations Patrick McHardy
` (28 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_conntrack_proto_icmp: kill extern declaration in .c file
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 1e1064d63bca1c55c2c5f9b91cc6fb5fb3fb3d71
tree 8fcf714acc6f30f0e56caad2bb3a3777ac7196bf
parent 7ec6f2c4596936e092f8597908e325b189169cf7
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:13 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:29:29 +0100
net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 0e2c448..4153e04 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -128,7 +128,6 @@ static int icmp_new(struct nf_conn *conntrack,
return 1;
}
-extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;
/* Returns conntrack if it dealt with ICMP, and filled in skb fields */
static int
icmp_error_message(struct sk_buff *skb,
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 22/49]: Use nf_register_hooks for multiple registrations
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (19 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 21/49]: nf_conntrack_proto_icmp: kill extern declaration in .c file Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 23/49]: Mark hooks __read_mostly Patrick McHardy
` (27 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: Use nf_register_hooks for multiple registrations
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 3d8f7cb0e4708c09a6420a5130dea3852e8617cf
tree e5627c08b5c52d51e1641f98ad4471a901fb66b3
parent 1e1064d63bca1c55c2c5f9b91cc6fb5fb3fb3d71
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:15 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:30:08 +0100
net/ipv4/ipvs/ip_vs_core.c | 104 +++++++++++++++++---------------------------
net/sched/sch_ingress.c | 44 ++++++++-----------
2 files changed, 57 insertions(+), 91 deletions(-)
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index 30e8f75..f5ba606 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -1025,43 +1025,42 @@ ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb,
}
-/* After packet filtering, forward packet through VS/DR, VS/TUN,
- or VS/NAT(change destination), so that filtering rules can be
- applied to IPVS. */
-static struct nf_hook_ops ip_vs_in_ops = {
- .hook = ip_vs_in,
- .owner = THIS_MODULE,
- .pf = PF_INET,
- .hooknum = NF_INET_LOCAL_IN,
- .priority = 100,
-};
-
-/* After packet filtering, change source only for VS/NAT */
-static struct nf_hook_ops ip_vs_out_ops = {
- .hook = ip_vs_out,
- .owner = THIS_MODULE,
- .pf = PF_INET,
- .hooknum = NF_INET_FORWARD,
- .priority = 100,
-};
-
-/* After packet filtering (but before ip_vs_out_icmp), catch icmp
- destined for 0.0.0.0/0, which is for incoming IPVS connections */
-static struct nf_hook_ops ip_vs_forward_icmp_ops = {
- .hook = ip_vs_forward_icmp,
- .owner = THIS_MODULE,
- .pf = PF_INET,
- .hooknum = NF_INET_FORWARD,
- .priority = 99,
-};
-
-/* Before the netfilter connection tracking, exit from POST_ROUTING */
-static struct nf_hook_ops ip_vs_post_routing_ops = {
- .hook = ip_vs_post_routing,
- .owner = THIS_MODULE,
- .pf = PF_INET,
- .hooknum = NF_INET_POST_ROUTING,
- .priority = NF_IP_PRI_NAT_SRC-1,
+static struct nf_hook_ops ip_vs_ops[] = {
+ /* After packet filtering, forward packet through VS/DR, VS/TUN,
+ * or VS/NAT(change destination), so that filtering rules can be
+ * applied to IPVS. */
+ {
+ .hook = ip_vs_in,
+ .owner = THIS_MODULE,
+ .pf = PF_INET,
+ .hooknum = NF_INET_LOCAL_IN,
+ .priority = 100,
+ },
+ /* After packet filtering, change source only for VS/NAT */
+ {
+ .hook = ip_vs_out,
+ .owner = THIS_MODULE,
+ .pf = PF_INET,
+ .hooknum = NF_INET_FORWARD,
+ .priority = 100,
+ },
+ /* After packet filtering (but before ip_vs_out_icmp), catch icmp
+ * destined for 0.0.0.0/0, which is for incoming IPVS connections */
+ {
+ .hook = ip_vs_forward_icmp,
+ .owner = THIS_MODULE,
+ .pf = PF_INET,
+ .hooknum = NF_INET_FORWARD,
+ .priority = 99,
+ },
+ /* Before the netfilter connection tracking, exit from POST_ROUTING */
+ {
+ .hook = ip_vs_post_routing,
+ .owner = THIS_MODULE,
+ .pf = PF_INET,
+ .hooknum = NF_INET_POST_ROUTING,
+ .priority = NF_IP_PRI_NAT_SRC-1,
+ },
};
@@ -1092,37 +1091,15 @@ static int __init ip_vs_init(void)
goto cleanup_app;
}
- ret = nf_register_hook(&ip_vs_in_ops);
+ ret = nf_register_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
if (ret < 0) {
- IP_VS_ERR("can't register in hook.\n");
+ IP_VS_ERR("can't register hooks.\n");
goto cleanup_conn;
}
- ret = nf_register_hook(&ip_vs_out_ops);
- if (ret < 0) {
- IP_VS_ERR("can't register out hook.\n");
- goto cleanup_inops;
- }
- ret = nf_register_hook(&ip_vs_post_routing_ops);
- if (ret < 0) {
- IP_VS_ERR("can't register post_routing hook.\n");
- goto cleanup_outops;
- }
- ret = nf_register_hook(&ip_vs_forward_icmp_ops);
- if (ret < 0) {
- IP_VS_ERR("can't register forward_icmp hook.\n");
- goto cleanup_postroutingops;
- }
-
IP_VS_INFO("ipvs loaded.\n");
return ret;
- cleanup_postroutingops:
- nf_unregister_hook(&ip_vs_post_routing_ops);
- cleanup_outops:
- nf_unregister_hook(&ip_vs_out_ops);
- cleanup_inops:
- nf_unregister_hook(&ip_vs_in_ops);
cleanup_conn:
ip_vs_conn_cleanup();
cleanup_app:
@@ -1136,10 +1113,7 @@ static int __init ip_vs_init(void)
static void __exit ip_vs_cleanup(void)
{
- nf_unregister_hook(&ip_vs_forward_icmp_ops);
- nf_unregister_hook(&ip_vs_post_routing_ops);
- nf_unregister_hook(&ip_vs_out_ops);
- nf_unregister_hook(&ip_vs_in_ops);
+ nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
ip_vs_conn_cleanup();
ip_vs_app_cleanup();
ip_vs_protocol_cleanup();
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 902d82e..f4af9b6 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -231,20 +231,21 @@ ing_hook(unsigned int hook, struct sk_buff *skb,
}
/* after ipt_filter */
-static struct nf_hook_ops ing_ops = {
- .hook = ing_hook,
- .owner = THIS_MODULE,
- .pf = PF_INET,
- .hooknum = NF_INET_PRE_ROUTING,
- .priority = NF_IP_PRI_FILTER + 1,
-};
-
-static struct nf_hook_ops ing6_ops = {
- .hook = ing_hook,
- .owner = THIS_MODULE,
- .pf = PF_INET6,
- .hooknum = NF_INET_PRE_ROUTING,
- .priority = NF_IP6_PRI_FILTER + 1,
+static struct nf_hook_ops ing_ops[] = {
+ {
+ .hook = ing_hook,
+ .owner = THIS_MODULE,
+ .pf = PF_INET,
+ .hooknum = NF_INET_PRE_ROUTING,
+ .priority = NF_IP_PRI_FILTER + 1,
+ },
+ {
+ .hook = ing_hook,
+ .owner = THIS_MODULE,
+ .pf = PF_INET6,
+ .hooknum = NF_INET_PRE_ROUTING,
+ .priority = NF_IP6_PRI_FILTER + 1,
+ },
};
#endif
@@ -268,17 +269,11 @@ static int ingress_init(struct Qdisc *sch,struct rtattr *opt)
#ifndef CONFIG_NET_CLS_ACT
#ifdef CONFIG_NETFILTER
if (!nf_registered) {
- if (nf_register_hook(&ing_ops) < 0) {
+ if (nf_register_hooks(ing_ops, ARRAY_SIZE(ing_ops)) < 0) {
printk("ingress qdisc registration error \n");
return -EINVAL;
}
nf_registered++;
-
- if (nf_register_hook(&ing6_ops) < 0) {
- printk("IPv6 ingress qdisc registration error, " \
- "disabling IPv6 support.\n");
- } else
- nf_registered++;
}
#endif
#endif
@@ -385,11 +380,8 @@ static void __exit ingress_module_exit(void)
unregister_qdisc(&ingress_qdisc_ops);
#ifndef CONFIG_NET_CLS_ACT
#ifdef CONFIG_NETFILTER
- if (nf_registered) {
- nf_unregister_hook(&ing_ops);
- if (nf_registered > 1)
- nf_unregister_hook(&ing6_ops);
- }
+ if (nf_registered)
+ nf_unregister_hooks(ing_ops, ARRAY_SIZE(ing_ops));
#endif
#endif
}
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 23/49]: Mark hooks __read_mostly
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (20 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 22/49]: Use nf_register_hooks for multiple registrations Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 24/49]: nf_queue: minor cleanup Patrick McHardy
` (26 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: Mark hooks __read_mostly
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit eb9d6d08051c003ea481be88c27526d3cccb4507
tree 2c582cc5fad6f565fff9182d63e25fbaa2defc51
parent 3d8f7cb0e4708c09a6420a5130dea3852e8617cf
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:17 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:30:17 +0100
net/bridge/br_netfilter.c | 2 +-
net/bridge/netfilter/ebtable_filter.c | 2 +-
net/bridge/netfilter/ebtable_nat.c | 2 +-
net/decnet/netfilter/dn_rtmsg.c | 2 +-
net/ipv4/ipvs/ip_vs_core.c | 2 +-
net/ipv4/netfilter/arptable_filter.c | 2 +-
net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +-
net/ipv4/netfilter/iptable_filter.c | 2 +-
net/ipv4/netfilter/iptable_mangle.c | 2 +-
net/ipv4/netfilter/iptable_raw.c | 2 +-
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 +-
net/ipv4/netfilter/nf_nat_standalone.c | 2 +-
net/ipv6/netfilter/ip6table_filter.c | 2 +-
net/ipv6/netfilter/ip6table_mangle.c | 2 +-
net/ipv6/netfilter/ip6table_raw.c | 2 +-
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 2 +-
net/sched/sch_ingress.c | 2 +-
17 files changed, 17 insertions(+), 17 deletions(-)
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 5f5b98a..32ac035 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -838,7 +838,7 @@ static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
* PF_BRIDGE/NF_BR_LOCAL_OUT functions don't get bridged traffic as input.
* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
* ip_refrag() can return NF_STOLEN. */
-static struct nf_hook_ops br_nf_ops[] = {
+static struct nf_hook_ops br_nf_ops[] __read_mostly = {
{ .hook = br_nf_pre_routing,
.owner = THIS_MODULE,
.pf = PF_BRIDGE,
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 210493f..fb81090 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -67,7 +67,7 @@ ebt_hook(unsigned int hook, struct sk_buff *skb, const struct net_device *in,
return ebt_do_table(hook, skb, in, out, &frame_filter);
}
-static struct nf_hook_ops ebt_ops_filter[] = {
+static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
{
.hook = ebt_hook,
.owner = THIS_MODULE,
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 3e58c2e..bc71273 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -74,7 +74,7 @@ ebt_nat_src(unsigned int hook, struct sk_buff *skb, const struct net_device *in
return ebt_do_table(hook, skb, in, out, &frame_nat);
}
-static struct nf_hook_ops ebt_ops_nat[] = {
+static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
{
.hook = ebt_nat_dst,
.owner = THIS_MODULE,
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 43fcd29..96375f2 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -115,7 +115,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
RCV_SKB_FAIL(-EINVAL);
}
-static struct nf_hook_ops dnrmg_ops = {
+static struct nf_hook_ops dnrmg_ops __read_mostly = {
.hook = dnrmg_hook,
.pf = PF_DECnet,
.hooknum = NF_DN_ROUTE,
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index f5ba606..041f512 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -1025,7 +1025,7 @@ ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb,
}
-static struct nf_hook_ops ip_vs_ops[] = {
+static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
/* After packet filtering, forward packet through VS/DR, VS/TUN,
* or VS/NAT(change destination), so that filtering rules can be
* applied to IPVS. */
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 302d3da..7201511 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -64,7 +64,7 @@ static unsigned int arpt_hook(unsigned int hook,
return arpt_do_table(skb, hook, in, out, &packet_filter);
}
-static struct nf_hook_ops arpt_ops[] = {
+static struct nf_hook_ops arpt_ops[] __read_mostly = {
{
.hook = arpt_hook,
.owner = THIS_MODULE,
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index b5de6bd..dc1e7b4 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -551,7 +551,7 @@ arp_mangle(unsigned int hook,
return NF_ACCEPT;
}
-static struct nf_hook_ops cip_arp_ops = {
+static struct nf_hook_ops cip_arp_ops __read_mostly = {
.hook = arp_mangle,
.pf = NF_ARP,
.hooknum = NF_ARP_OUT,
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 06ab64e..29bb4f9 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -91,7 +91,7 @@ ipt_local_out_hook(unsigned int hook,
return ipt_do_table(skb, hook, in, out, &packet_filter);
}
-static struct nf_hook_ops ipt_ops[] = {
+static struct nf_hook_ops ipt_ops[] __read_mostly = {
{
.hook = ipt_hook,
.owner = THIS_MODULE,
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 0335827..5c4be20 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -128,7 +128,7 @@ ipt_local_hook(unsigned int hook,
return ret;
}
-static struct nf_hook_ops ipt_ops[] = {
+static struct nf_hook_ops ipt_ops[] __read_mostly = {
{
.hook = ipt_route_hook,
.owner = THIS_MODULE,
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 66be232..dc34aa2 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -74,7 +74,7 @@ ipt_local_hook(unsigned int hook,
}
/* 'raw' is the very first table. */
-static struct nf_hook_ops ipt_ops[] = {
+static struct nf_hook_ops ipt_ops[] __read_mostly = {
{
.hook = ipt_hook,
.pf = PF_INET,
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 9ac3020..e0e09f5 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -185,7 +185,7 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
/* Connection tracking may drop packets, but never alters them, so
make it the first hook. */
-static struct nf_hook_ops ipv4_conntrack_ops[] = {
+static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
{
.hook = ipv4_conntrack_defrag,
.owner = THIS_MODULE,
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 84172e9..a2b02f0 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -273,7 +273,7 @@ nf_nat_adjust(unsigned int hooknum,
/* We must be after connection tracking and before packet filtering. */
-static struct nf_hook_ops nf_nat_ops[] = {
+static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
/* Before packet filtering, change destination */
{
.hook = nf_nat_in,
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 0ae072d..87d38d0 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -90,7 +90,7 @@ ip6t_local_out_hook(unsigned int hook,
return ip6t_do_table(skb, hook, in, out, &packet_filter);
}
-static struct nf_hook_ops ip6t_ops[] = {
+static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{
.hook = ip6t_hook,
.owner = THIS_MODULE,
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 8e62b23..d608260 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -120,7 +120,7 @@ ip6t_local_hook(unsigned int hook,
return ret;
}
-static struct nf_hook_ops ip6t_ops[] = {
+static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{
.hook = ip6t_route_hook,
.owner = THIS_MODULE,
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 4fecd8d..eccbaaa 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -54,7 +54,7 @@ ip6t_hook(unsigned int hook,
return ip6t_do_table(skb, hook, in, out, &packet_raw);
}
-static struct nf_hook_ops ip6t_ops[] = {
+static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{
.hook = ip6t_hook,
.pf = PF_INET6,
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 50f4678..97a5530 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -258,7 +258,7 @@ static unsigned int ipv6_conntrack_local(unsigned int hooknum,
return ipv6_conntrack_in(hooknum, skb, in, out, okfn);
}
-static struct nf_hook_ops ipv6_conntrack_ops[] = {
+static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
{
.hook = ipv6_defrag,
.owner = THIS_MODULE,
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index f4af9b6..89c32a9 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -231,7 +231,7 @@ ing_hook(unsigned int hook, struct sk_buff *skb,
}
/* after ipt_filter */
-static struct nf_hook_ops ing_ops[] = {
+static struct nf_hook_ops ing_ops[] __read_mostly = {
{
.hook = ing_hook,
.owner = THIS_MODULE,
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 24/49]: nf_queue: minor cleanup
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (21 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 23/49]: Mark hooks __read_mostly Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 25/49]: nf_queue: remove unnecessary hook existance check Patrick McHardy
` (25 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_queue: minor cleanup
Clean up
if (x) y;
constructs. We've got nothing to hide :)
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 327c86b66756bd289a3ddde5f390411406534acf
tree 44538fbe157fca4f26e9b8fe1d97c438b5833b9b
parent eb9d6d08051c003ea481be88c27526d3cccb4507
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:20 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:30:33 +0100
net/netfilter/nf_queue.c | 31 ++++++++++++++++++++-----------
1 files changed, 20 insertions(+), 11 deletions(-)
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 0cef143..81d010a 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -138,15 +138,18 @@ static int __nf_queue(struct sk_buff *skb,
}
/* Bump dev refs so they don't vanish while packet is out */
- if (indev) dev_hold(indev);
- if (outdev) dev_hold(outdev);
-
+ if (indev)
+ dev_hold(indev);
+ if (outdev)
+ dev_hold(outdev);
#ifdef CONFIG_BRIDGE_NETFILTER
if (skb->nf_bridge) {
physindev = skb->nf_bridge->physindev;
- if (physindev) dev_hold(physindev);
+ if (physindev)
+ dev_hold(physindev);
physoutdev = skb->nf_bridge->physoutdev;
- if (physoutdev) dev_hold(physoutdev);
+ if (physoutdev)
+ dev_hold(physoutdev);
}
#endif
afinfo->saveroute(skb, info);
@@ -156,11 +159,15 @@ static int __nf_queue(struct sk_buff *skb,
if (status < 0) {
/* James M doesn't say fuck enough. */
- if (indev) dev_put(indev);
- if (outdev) dev_put(outdev);
+ if (indev)
+ dev_put(indev);
+ if (outdev)
+ dev_put(outdev);
#ifdef CONFIG_BRIDGE_NETFILTER
- if (physindev) dev_put(physindev);
- if (physoutdev) dev_put(physoutdev);
+ if (physindev)
+ dev_put(physindev);
+ if (physoutdev)
+ dev_put(physoutdev);
#endif
module_put(info->elem->owner);
kfree(info);
@@ -222,8 +229,10 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
rcu_read_lock();
/* Release those devices we held, or Alexey will kill me. */
- if (info->indev) dev_put(info->indev);
- if (info->outdev) dev_put(info->outdev);
+ if (info->indev)
+ dev_put(info->indev);
+ if (info->outdev)
+ dev_put(info->outdev);
#ifdef CONFIG_BRIDGE_NETFILTER
if (skb->nf_bridge) {
if (skb->nf_bridge->physindev)
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 25/49]: nf_queue: remove unnecessary hook existance check
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (22 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 24/49]: nf_queue: minor cleanup Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 26/49]: nf_queue: make queue_handler const Patrick McHardy
` (24 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_queue: remove unnecessary hook existance check
We hold a module reference for each queued packet, so the hook that
queued the packet can't disappear. Also remove an obsolete comment
stating the opposite.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 4e99305d42d41620d4009da54be297970da7c0f7
tree 0794bda7d7cfe7c93a07e671b1b3d6a93460d54c
parent 327c86b66756bd289a3ddde5f390411406534acf
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:24 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:30:42 +0100
net/netfilter/core.c | 5 -----
net/netfilter/nf_queue.c | 13 -------------
2 files changed, 0 insertions(+), 18 deletions(-)
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index e6d3a69..6819a41 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -51,11 +51,6 @@ void nf_unregister_afinfo(struct nf_afinfo *afinfo)
}
EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
-/* In this code, we can be waiting indefinitely for userspace to
- * service a packet if a hook returns NF_QUEUE. We could keep a count
- * of skbuffs queued for userspace, and not deregister a hook unless
- * this is zero, but that sucks. Now, we simply check when the
- * packets come back: if the hook is gone, the packet is discarded. */
struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS] __read_mostly;
EXPORT_SYMBOL(nf_hooks);
static DEFINE_MUTEX(nf_hook_mutex);
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 81d010a..0bea88c 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -223,7 +223,6 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
unsigned int verdict)
{
struct list_head *elem = &info->elem->list;
- struct list_head *i;
struct nf_afinfo *afinfo;
rcu_read_lock();
@@ -245,18 +244,6 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
/* Drop reference to owner of hook which queued us. */
module_put(info->elem->owner);
- list_for_each_rcu(i, &nf_hooks[info->pf][info->hook]) {
- if (i == elem)
- break;
- }
-
- if (i == &nf_hooks[info->pf][info->hook]) {
- /* The module which sent it to userspace is gone. */
- NFDEBUG("%s: module disappeared, dropping packet.\n",
- __FUNCTION__);
- verdict = NF_DROP;
- }
-
/* Continue traversal iff userspace said ok... */
if (verdict == NF_REPEAT) {
elem = elem->prev;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 26/49]: nf_queue: make queue_handler const
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (23 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 25/49]: nf_queue: remove unnecessary hook existance check Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 27/49]: nf_queue: remove unused data pointer Patrick McHardy
` (23 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_queue: make queue_handler const
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 36e4c3f3efcf0041dd8a5f410dbb7565b97d1382
tree cc9f5b47c0261b11f074d2a03918ce884577c17b
parent 4e99305d42d41620d4009da54be297970da7c0f7
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:26 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:30:58 +0100
include/linux/netfilter.h | 8 ++++----
net/ipv4/netfilter/ip_queue.c | 2 +-
net/ipv6/netfilter/ip6_queue.c | 2 +-
net/netfilter/nf_queue.c | 12 ++++++------
net/netfilter/nfnetlink_queue.c | 2 +-
5 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 9bfc7d4..c2c3faf 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -281,11 +281,11 @@ struct nf_queue_handler {
void *data;
char *name;
};
-extern int nf_register_queue_handler(int pf,
- struct nf_queue_handler *qh);
+extern int nf_register_queue_handler(int pf,
+ const struct nf_queue_handler *qh);
extern int nf_unregister_queue_handler(int pf,
- struct nf_queue_handler *qh);
-extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
+ const struct nf_queue_handler *qh);
+extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh);
extern void nf_reinject(struct sk_buff *skb,
struct nf_info *info,
unsigned int verdict);
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 14d64a3..062ff19 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -645,7 +645,7 @@ static const struct file_operations ip_queue_proc_fops = {
.owner = THIS_MODULE,
};
-static struct nf_queue_handler nfqh = {
+static const struct nf_queue_handler nfqh = {
.name = "ip_queue",
.outfn = &ipq_enqueue_packet,
};
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index e273605..d6e971b 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -634,7 +634,7 @@ static const struct file_operations ip6_queue_proc_fops = {
.owner = THIS_MODULE,
};
-static struct nf_queue_handler nfqh = {
+static const struct nf_queue_handler nfqh = {
.name = "ip6_queue",
.outfn = &ipq_enqueue_packet,
};
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 0bea88c..dd18126 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -15,13 +15,13 @@
* long term mutex. The handler must provide an an outfn() to accept packets
* for queueing and must reinject all packets it receives, no matter what.
*/
-static struct nf_queue_handler *queue_handler[NPROTO];
+static const struct nf_queue_handler *queue_handler[NPROTO];
static DEFINE_MUTEX(queue_handler_mutex);
/* return EBUSY when somebody else is registered, return EEXIST if the
* same handler is registered, return 0 in case of success. */
-int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
+int nf_register_queue_handler(int pf, const struct nf_queue_handler *qh)
{
int ret;
@@ -44,7 +44,7 @@ int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
EXPORT_SYMBOL(nf_register_queue_handler);
/* The caller must flush their queue before this */
-int nf_unregister_queue_handler(int pf, struct nf_queue_handler *qh)
+int nf_unregister_queue_handler(int pf, const struct nf_queue_handler *qh)
{
if (pf >= NPROTO)
return -EINVAL;
@@ -64,7 +64,7 @@ int nf_unregister_queue_handler(int pf, struct nf_queue_handler *qh)
}
EXPORT_SYMBOL(nf_unregister_queue_handler);
-void nf_unregister_queue_handlers(struct nf_queue_handler *qh)
+void nf_unregister_queue_handlers(const struct nf_queue_handler *qh)
{
int pf;
@@ -98,7 +98,7 @@ static int __nf_queue(struct sk_buff *skb,
struct net_device *physoutdev = NULL;
#endif
struct nf_afinfo *afinfo;
- struct nf_queue_handler *qh;
+ const struct nf_queue_handler *qh;
/* QUEUE == DROP if noone is waiting, to be safe. */
rcu_read_lock();
@@ -313,7 +313,7 @@ static int seq_show(struct seq_file *s, void *v)
{
int ret;
loff_t *pos = v;
- struct nf_queue_handler *qh;
+ const struct nf_queue_handler *qh;
rcu_read_lock();
qh = rcu_dereference(queue_handler[*pos]);
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 3ceeffc..b75091c 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -849,7 +849,7 @@ static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
[NFQA_CFG_PARAMS] = { .len = sizeof(struct nfqnl_msg_config_params) },
};
-static struct nf_queue_handler nfqh = {
+static const struct nf_queue_handler nfqh = {
.name = "nf_queue",
.outfn = &nfqnl_enqueue_packet,
};
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 27/49]: nf_queue: remove unused data pointer
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (24 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 26/49]: nf_queue: make queue_handler const Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 28/49]: nf_queue: move queueing related functions/struct to seperate header Patrick McHardy
` (22 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_queue: remove unused data pointer
Remove the data pointer from struct nf_queue_handler. It has never been used
and is useless for the only handler that really matters, nfnetlink_queue,
since the handler is shared between all instances.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit ed35b6d3d2fe607f86dff296349a4c13d0f38720
tree 7409927263da34926ad93b1ead0584cad859ac9d
parent 36e4c3f3efcf0041dd8a5f410dbb7565b97d1382
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:29 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:31:05 +0100
include/linux/netfilter.h | 3 +--
net/ipv4/netfilter/ip_queue.c | 2 +-
net/ipv6/netfilter/ip6_queue.c | 2 +-
net/netfilter/nf_queue.c | 2 +-
net/netfilter/nfnetlink_queue.c | 2 +-
5 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index c2c3faf..1ba6011 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -277,8 +277,7 @@ int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
/* Packet queuing */
struct nf_queue_handler {
int (*outfn)(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum, void *data);
- void *data;
+ unsigned int queuenum);
char *name;
};
extern int nf_register_queue_handler(int pf,
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 062ff19..08e7f8b 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -272,7 +272,7 @@ nlmsg_failure:
static int
ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum, void *data)
+ unsigned int queuenum)
{
int status = -EINVAL;
struct sk_buff *nskb;
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index d6e971b..5a9ca0d 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -269,7 +269,7 @@ nlmsg_failure:
static int
ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum, void *data)
+ unsigned int queuenum)
{
int status = -EINVAL;
struct sk_buff *nskb;
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index dd18126..c098ccb 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -153,7 +153,7 @@ static int __nf_queue(struct sk_buff *skb,
}
#endif
afinfo->saveroute(skb, info);
- status = qh->outfn(skb, info, queuenum, qh->data);
+ status = qh->outfn(skb, info, queuenum);
rcu_read_unlock();
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index b75091c..94ec1c2 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -534,7 +534,7 @@ nla_put_failure:
static int
nfqnl_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum, void *data)
+ unsigned int queuenum)
{
int status = -EINVAL;
struct sk_buff *nskb;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 28/49]: nf_queue: move queueing related functions/struct to seperate header
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (25 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 27/49]: nf_queue: remove unused data pointer Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 29/49]: {nf_netlink,ip,ip6}_queue: use list_for_each_entry Patrick McHardy
` (21 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_queue: move queueing related functions/struct to seperate header
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 39c53418dafbd3d8b9173420294bdd4a2c637b7c
tree 6d0c8cfa947c08415a32e79c3e4a480d1fc292e5
parent ed35b6d3d2fe607f86dff296349a4c13d0f38720
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:33 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:31:23 +0100
include/linux/netfilter.h | 32 ++------------------------------
include/net/netfilter/nf_queue.h | 32 ++++++++++++++++++++++++++++++++
net/ipv4/netfilter.c | 1 +
net/ipv4/netfilter/ip_queue.c | 1 +
net/ipv6/netfilter.c | 1 +
net/ipv6/netfilter/ip6_queue.c | 1 +
net/netfilter/nf_queue.c | 1 +
net/netfilter/nfnetlink_queue.c | 1 +
8 files changed, 40 insertions(+), 30 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 1ba6011..5fe4ef4 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -101,19 +101,6 @@ struct nf_sockopt_ops
struct module *owner;
};
-/* Each queued (to userspace) skbuff has one of these. */
-struct nf_info
-{
- /* The ops struct which sent us to userspace. */
- struct nf_hook_ops *elem;
-
- /* If we're sent to userspace, this keeps housekeeping info */
- int pf;
- unsigned int hook;
- struct net_device *indev, *outdev;
- int (*okfn)(struct sk_buff *);
-};
-
/* Function to register/unregister hook points. */
int nf_register_hook(struct nf_hook_ops *reg);
void nf_unregister_hook(struct nf_hook_ops *reg);
@@ -274,21 +261,6 @@ int compat_nf_setsockopt(struct sock *sk, int pf, int optval,
int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
char __user *opt, int *len);
-/* Packet queuing */
-struct nf_queue_handler {
- int (*outfn)(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum);
- char *name;
-};
-extern int nf_register_queue_handler(int pf,
- const struct nf_queue_handler *qh);
-extern int nf_unregister_queue_handler(int pf,
- const struct nf_queue_handler *qh);
-extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh);
-extern void nf_reinject(struct sk_buff *skb,
- struct nf_info *info,
- unsigned int verdict);
-
/* FIXME: Before cache is ever used, this must be implemented for real. */
extern void nf_invalidate_cache(int pf);
@@ -298,6 +270,8 @@ extern void nf_invalidate_cache(int pf);
extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
struct flowi;
+struct nf_info;
+
struct nf_afinfo {
unsigned short family;
__sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
@@ -334,8 +308,6 @@ nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
extern int nf_register_afinfo(struct nf_afinfo *afinfo);
extern void nf_unregister_afinfo(struct nf_afinfo *afinfo);
-#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
-
#include <net/flow.h>
extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
new file mode 100644
index 0000000..8c6b382
--- /dev/null
+++ b/include/net/netfilter/nf_queue.h
@@ -0,0 +1,32 @@
+#ifndef _NF_QUEUE_H
+#define _NF_QUEUE_H
+
+/* Each queued (to userspace) skbuff has one of these. */
+struct nf_info {
+ struct nf_hook_ops *elem;
+ int pf;
+ unsigned int hook;
+ struct net_device *indev;
+ struct net_device *outdev;
+ int (*okfn)(struct sk_buff *);
+};
+
+#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
+
+/* Packet queuing */
+struct nf_queue_handler {
+ int (*outfn)(struct sk_buff *skb,
+ struct nf_info *info,
+ unsigned int queuenum);
+ char *name;
+};
+
+extern int nf_register_queue_handler(int pf,
+ const struct nf_queue_handler *qh);
+extern int nf_unregister_queue_handler(int pf,
+ const struct nf_queue_handler *qh);
+extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh);
+extern void nf_reinject(struct sk_buff *skb, struct nf_info *info,
+ unsigned int verdict);
+
+#endif /* _NF_QUEUE_H */
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 599d448..f716608 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -7,6 +7,7 @@
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>
+#include <net/netfilter/nf_queue.h>
/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 08e7f8b..2966fbd 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -28,6 +28,7 @@
#include <net/net_namespace.h>
#include <net/sock.h>
#include <net/route.h>
+#include <net/netfilter/nf_queue.h>
#define IPQ_QMAX_DEFAULT 1024
#define IPQ_PROC_FS_NAME "ip_queue"
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 281f732..55ea9c6 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -8,6 +8,7 @@
#include <net/ip6_route.h>
#include <net/xfrm.h>
#include <net/ip6_checksum.h>
+#include <net/netfilter/nf_queue.h>
int ip6_route_me_harder(struct sk_buff *skb)
{
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5a9ca0d..7ff9915 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -29,6 +29,7 @@
#include <net/sock.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
+#include <net/netfilter/nf_queue.h>
#include <linux/netfilter_ipv4/ip_queue.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index c098ccb..bd71f43 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -7,6 +7,7 @@
#include <linux/seq_file.h>
#include <linux/rcupdate.h>
#include <net/protocol.h>
+#include <net/netfilter/nf_queue.h>
#include "nf_internals.h"
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 94ec1c2..3a09f02 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -27,6 +27,7 @@
#include <linux/netfilter/nfnetlink_queue.h>
#include <linux/list.h>
#include <net/sock.h>
+#include <net/netfilter/nf_queue.h>
#include <asm/atomic.h>
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 29/49]: {nf_netlink,ip,ip6}_queue: use list_for_each_entry
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (26 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 28/49]: nf_queue: move queueing related functions/struct to seperate header Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 30/49]: nfnetlink_queue: deobfuscate entry lookups Patrick McHardy
` (20 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: {nf_netlink,ip,ip6}_queue: use list_for_each_entry
Use list_add_tail/list_for_each_entry instead of list_add and
list_for_each_prev as a preparation for switching to RCU.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 5a6886e29d4d9cd1ac4f91073ae30163446512ef
tree 1d3512786533a3b98553059e137ba228e396d084
parent 39c53418dafbd3d8b9173420294bdd4a2c637b7c
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:35 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:32:16 +0100
net/ipv4/netfilter/ip_queue.c | 8 +++-----
net/ipv6/netfilter/ip6_queue.c | 8 +++-----
net/netfilter/nfnetlink_queue.c | 8 +++-----
3 files changed, 9 insertions(+), 15 deletions(-)
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 2966fbd..9e72246 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -73,7 +73,7 @@ ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
static inline void
__ipq_enqueue_entry(struct ipq_queue_entry *entry)
{
- list_add(&entry->list, &queue_list);
+ list_add_tail(&entry->list, &queue_list);
queue_total++;
}
@@ -84,11 +84,9 @@ __ipq_enqueue_entry(struct ipq_queue_entry *entry)
static inline struct ipq_queue_entry *
__ipq_find_entry(ipq_cmpfn cmpfn, unsigned long data)
{
- struct list_head *p;
-
- list_for_each_prev(p, &queue_list) {
- struct ipq_queue_entry *entry = (struct ipq_queue_entry *)p;
+ struct ipq_queue_entry *entry;
+ list_for_each_entry(entry, &queue_list, list) {
if (!cmpfn || cmpfn(entry, data))
return entry;
}
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 7ff9915..243a00b 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -71,7 +71,7 @@ ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
static inline void
__ipq_enqueue_entry(struct ipq_queue_entry *entry)
{
- list_add(&entry->list, &queue_list);
+ list_add_tail(&entry->list, &queue_list);
queue_total++;
}
@@ -82,11 +82,9 @@ __ipq_enqueue_entry(struct ipq_queue_entry *entry)
static inline struct ipq_queue_entry *
__ipq_find_entry(ipq_cmpfn cmpfn, unsigned long data)
{
- struct list_head *p;
-
- list_for_each_prev(p, &queue_list) {
- struct ipq_queue_entry *entry = (struct ipq_queue_entry *)p;
+ struct ipq_queue_entry *entry;
+ list_for_each_entry(entry, &queue_list, list) {
if (!cmpfn || cmpfn(entry, data))
return entry;
}
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 3a09f02..74d5ed9 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -231,7 +231,7 @@ static inline void
__enqueue_entry(struct nfqnl_instance *queue,
struct nfqnl_queue_entry *entry)
{
- list_add(&entry->list, &queue->queue_list);
+ list_add_tail(&entry->list, &queue->queue_list);
queue->queue_total++;
}
@@ -243,11 +243,9 @@ static inline struct nfqnl_queue_entry *
__find_entry(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
unsigned long data)
{
- struct list_head *p;
-
- list_for_each_prev(p, &queue->queue_list) {
- struct nfqnl_queue_entry *entry = (struct nfqnl_queue_entry *)p;
+ struct nfqnl_queue_entry *entry;
+ list_for_each_entry(entry, &queue->queue_list, list) {
if (!cmpfn || cmpfn(entry, data))
return entry;
}
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 30/49]: nfnetlink_queue: deobfuscate entry lookups
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (27 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 29/49]: {nf_netlink,ip,ip6}_queue: use list_for_each_entry Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 31/49]: ip_queue: " Patrick McHardy
` (19 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: deobfuscate entry lookups
A queue entry lookup currently looks like this:
find_dequeue_entry -> __find_dequeue_entry ->
__find_entry -> cmpfn -> id_cmp
Use simple open-coded list walking and kill the cmpfn for
find_dequeue_entry. Instead add it to nfqnl_flush (after
similar cleanups) and use nfqnl_flush for both complete
flushes and flushing entries related to a device.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 554157a1a42a25819b2e64e59f19515828991435
tree e5c31cab3dbc70261c23bb9f0248e674f4ab19e9
parent 5a6886e29d4d9cd1ac4f91073ae30163446512ef
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:38 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:32:20 +0100
net/netfilter/nfnetlink_queue.c | 100 ++++++++++++---------------------------
1 files changed, 31 insertions(+), 69 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 74d5ed9..cb901cf 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -171,7 +171,8 @@ out_unlock:
return NULL;
}
-static void nfqnl_flush(struct nfqnl_instance *queue, int verdict);
+static void nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
+ unsigned long data);
static void
_instance_destroy2(struct nfqnl_instance *inst, int lock)
@@ -188,7 +189,7 @@ _instance_destroy2(struct nfqnl_instance *inst, int lock)
write_unlock_bh(&instances_lock);
/* then flush all pending skbs from the queue */
- nfqnl_flush(inst, NF_DROP);
+ nfqnl_flush(inst, NULL, 0);
/* and finally put the refcount */
instance_put(inst);
@@ -235,54 +236,6 @@ __enqueue_entry(struct nfqnl_instance *queue,
queue->queue_total++;
}
-/*
- * Find and return a queued entry matched by cmpfn, or return the last
- * entry if cmpfn is NULL.
- */
-static inline struct nfqnl_queue_entry *
-__find_entry(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
- unsigned long data)
-{
- struct nfqnl_queue_entry *entry;
-
- list_for_each_entry(entry, &queue->queue_list, list) {
- if (!cmpfn || cmpfn(entry, data))
- return entry;
- }
- return NULL;
-}
-
-static inline void
-__dequeue_entry(struct nfqnl_instance *q, struct nfqnl_queue_entry *entry)
-{
- list_del(&entry->list);
- q->queue_total--;
-}
-
-static inline struct nfqnl_queue_entry *
-__find_dequeue_entry(struct nfqnl_instance *queue,
- nfqnl_cmpfn cmpfn, unsigned long data)
-{
- struct nfqnl_queue_entry *entry;
-
- entry = __find_entry(queue, cmpfn, data);
- if (entry == NULL)
- return NULL;
-
- __dequeue_entry(queue, entry);
- return entry;
-}
-
-
-static inline void
-__nfqnl_flush(struct nfqnl_instance *queue, int verdict)
-{
- struct nfqnl_queue_entry *entry;
-
- while ((entry = __find_dequeue_entry(queue, NULL, 0)))
- issue_verdict(entry, verdict);
-}
-
static inline int
__nfqnl_set_mode(struct nfqnl_instance *queue,
unsigned char mode, unsigned int range)
@@ -313,23 +266,42 @@ __nfqnl_set_mode(struct nfqnl_instance *queue,
}
static struct nfqnl_queue_entry *
-find_dequeue_entry(struct nfqnl_instance *queue,
- nfqnl_cmpfn cmpfn, unsigned long data)
+find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
{
- struct nfqnl_queue_entry *entry;
+ struct nfqnl_queue_entry *entry = NULL, *i;
spin_lock_bh(&queue->lock);
- entry = __find_dequeue_entry(queue, cmpfn, data);
+
+ list_for_each_entry(i, &queue->queue_list, list) {
+ if (i->id == id) {
+ entry = i;
+ break;
+ }
+ }
+
+ if (entry) {
+ list_del(&entry->list);
+ queue->queue_total--;
+ }
+
spin_unlock_bh(&queue->lock);
return entry;
}
static void
-nfqnl_flush(struct nfqnl_instance *queue, int verdict)
+nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
{
+ struct nfqnl_queue_entry *entry, *next;
+
spin_lock_bh(&queue->lock);
- __nfqnl_flush(queue, verdict);
+ list_for_each_entry_safe(entry, next, &queue->queue_list, list) {
+ if (!cmpfn || cmpfn(entry, data)) {
+ list_del(&entry->list);
+ queue->queue_total--;
+ issue_verdict(entry, NF_DROP);
+ }
+ }
spin_unlock_bh(&queue->lock);
}
@@ -644,12 +616,6 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
return 0;
}
-static inline int
-id_cmp(struct nfqnl_queue_entry *e, unsigned long id)
-{
- return (id == e->id);
-}
-
static int
nfqnl_set_mode(struct nfqnl_instance *queue,
unsigned char mode, unsigned int range)
@@ -706,12 +672,8 @@ nfqnl_dev_drop(int ifindex)
struct nfqnl_instance *inst;
struct hlist_head *head = &instance_table[i];
- hlist_for_each_entry(inst, tmp, head, hlist) {
- struct nfqnl_queue_entry *entry;
- while ((entry = find_dequeue_entry(inst, dev_cmp,
- ifindex)) != NULL)
- issue_verdict(entry, NF_DROP);
- }
+ hlist_for_each_entry(inst, tmp, head, hlist)
+ nfqnl_flush(inst, dev_cmp, ifindex);
}
read_unlock_bh(&instances_lock);
@@ -811,7 +773,7 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
goto err_out_put;
}
- entry = find_dequeue_entry(queue, id_cmp, ntohl(vhdr->id));
+ entry = find_dequeue_entry(queue, ntohl(vhdr->id));
if (entry == NULL) {
err = -ENOENT;
goto err_out_put;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 31/49]: ip_queue: deobfuscate entry lookups
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (28 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 30/49]: nfnetlink_queue: deobfuscate entry lookups Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 32/49]: ip6_queue: " Patrick McHardy
` (18 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: ip_queue: deobfuscate entry lookups
A queue entry lookup currently looks like this:
ipq_find_dequeue_entry -> __ipq_find_dequeue_entry ->
__ipq_find_entry -> cmpfn -> id_cmp
Use simple open-coded list walking and kill the cmpfn for
ipq_find_dequeue_entry. Instead add it to ipq_flush (after
similar cleanups) and use ipq_flush for both complete flushes
and flushing entries related to a device.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 7238d8233fc8d2eadc92d5b8920e65645b5ee235
tree e463990b0c5faba3dce9507f9beab8d7d8abc088
parent 554157a1a42a25819b2e64e59f19515828991435
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:42 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:32:29 +0100
net/ipv4/netfilter/ip_queue.c | 101 +++++++++++++++--------------------------
1 files changed, 37 insertions(+), 64 deletions(-)
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 9e72246..df2957c 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -77,52 +77,6 @@ __ipq_enqueue_entry(struct ipq_queue_entry *entry)
queue_total++;
}
-/*
- * Find and return a queued entry matched by cmpfn, or return the last
- * entry if cmpfn is NULL.
- */
-static inline struct ipq_queue_entry *
-__ipq_find_entry(ipq_cmpfn cmpfn, unsigned long data)
-{
- struct ipq_queue_entry *entry;
-
- list_for_each_entry(entry, &queue_list, list) {
- if (!cmpfn || cmpfn(entry, data))
- return entry;
- }
- return NULL;
-}
-
-static inline void
-__ipq_dequeue_entry(struct ipq_queue_entry *entry)
-{
- list_del(&entry->list);
- queue_total--;
-}
-
-static inline struct ipq_queue_entry *
-__ipq_find_dequeue_entry(ipq_cmpfn cmpfn, unsigned long data)
-{
- struct ipq_queue_entry *entry;
-
- entry = __ipq_find_entry(cmpfn, data);
- if (entry == NULL)
- return NULL;
-
- __ipq_dequeue_entry(entry);
- return entry;
-}
-
-
-static inline void
-__ipq_flush(int verdict)
-{
- struct ipq_queue_entry *entry;
-
- while ((entry = __ipq_find_dequeue_entry(NULL, 0)))
- ipq_issue_verdict(entry, verdict);
-}
-
static inline int
__ipq_set_mode(unsigned char mode, unsigned int range)
{
@@ -149,31 +103,59 @@ __ipq_set_mode(unsigned char mode, unsigned int range)
return status;
}
+static void __ipq_flush(ipq_cmpfn cmpfn, unsigned long data);
+
static inline void
__ipq_reset(void)
{
peer_pid = 0;
net_disable_timestamp();
__ipq_set_mode(IPQ_COPY_NONE, 0);
- __ipq_flush(NF_DROP);
+ __ipq_flush(NULL, 0);
}
static struct ipq_queue_entry *
-ipq_find_dequeue_entry(ipq_cmpfn cmpfn, unsigned long data)
+ipq_find_dequeue_entry(unsigned long id)
{
- struct ipq_queue_entry *entry;
+ struct ipq_queue_entry *entry = NULL, *i;
write_lock_bh(&queue_lock);
- entry = __ipq_find_dequeue_entry(cmpfn, data);
+
+ list_for_each_entry(i, &queue_list, list) {
+ if ((unsigned long)i == id) {
+ entry = i;
+ break;
+ }
+ }
+
+ if (entry) {
+ list_del(&entry->list);
+ queue_total--;
+ }
+
write_unlock_bh(&queue_lock);
return entry;
}
static void
-ipq_flush(int verdict)
+__ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
+{
+ struct ipq_queue_entry *entry, *next;
+
+ list_for_each_entry_safe(entry, next, &queue_list, list) {
+ if (!cmpfn || cmpfn(entry, data)) {
+ list_del(&entry->list);
+ queue_total--;
+ ipq_issue_verdict(entry, NF_DROP);
+ }
+ }
+}
+
+static void
+ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
{
write_lock_bh(&queue_lock);
- __ipq_flush(verdict);
+ __ipq_flush(cmpfn, data);
write_unlock_bh(&queue_lock);
}
@@ -367,12 +349,6 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
return 0;
}
-static inline int
-id_cmp(struct ipq_queue_entry *e, unsigned long id)
-{
- return (id == (unsigned long )e);
-}
-
static int
ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
{
@@ -381,7 +357,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
if (vmsg->value > NF_MAX_VERDICT)
return -EINVAL;
- entry = ipq_find_dequeue_entry(id_cmp, vmsg->id);
+ entry = ipq_find_dequeue_entry(vmsg->id);
if (entry == NULL)
return -ENOENT;
else {
@@ -460,10 +436,7 @@ dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
static void
ipq_dev_drop(int ifindex)
{
- struct ipq_queue_entry *entry;
-
- while ((entry = ipq_find_dequeue_entry(dev_cmp, ifindex)) != NULL)
- ipq_issue_verdict(entry, NF_DROP);
+ ipq_flush(dev_cmp, ifindex);
}
#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
@@ -699,7 +672,7 @@ static void __exit ip_queue_fini(void)
{
nf_unregister_queue_handlers(&nfqh);
synchronize_net();
- ipq_flush(NF_DROP);
+ ipq_flush(NULL, 0);
unregister_sysctl_table(ipq_sysctl_header);
unregister_netdevice_notifier(&ipq_dev_notifier);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 32/49]: ip6_queue: deobfuscate entry lookups
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (29 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 31/49]: ip_queue: " Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 33/49]: ip6_queue: resync dev-index based flushing Patrick McHardy
` (17 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: ip6_queue: deobfuscate entry lookups
A queue entry lookup currently looks like this:
ipq_find_dequeue_entry -> __ipq_find_dequeue_entry ->
__ipq_find_entry -> cmpfn -> id_cmp
Use simple open-coded list walking and kill the cmpfn for
ipq_find_dequeue_entry. Instead add it to ipq_flush (after
similar cleanups) and use ipq_flush for both complete flushes
and flushing entries related to a device.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 326b67e50d8f9f6a0adc52a0999e5e307724a855
tree 630b9ff0b592a698f70ef2c5dcd90d409f04e953
parent 7238d8233fc8d2eadc92d5b8920e65645b5ee235
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:44 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:32:50 +0100
net/ipv6/netfilter/ip6_queue.c | 101 +++++++++++++++-------------------------
1 files changed, 37 insertions(+), 64 deletions(-)
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 243a00b..7d0780d 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -75,52 +75,6 @@ __ipq_enqueue_entry(struct ipq_queue_entry *entry)
queue_total++;
}
-/*
- * Find and return a queued entry matched by cmpfn, or return the last
- * entry if cmpfn is NULL.
- */
-static inline struct ipq_queue_entry *
-__ipq_find_entry(ipq_cmpfn cmpfn, unsigned long data)
-{
- struct ipq_queue_entry *entry;
-
- list_for_each_entry(entry, &queue_list, list) {
- if (!cmpfn || cmpfn(entry, data))
- return entry;
- }
- return NULL;
-}
-
-static inline void
-__ipq_dequeue_entry(struct ipq_queue_entry *entry)
-{
- list_del(&entry->list);
- queue_total--;
-}
-
-static inline struct ipq_queue_entry *
-__ipq_find_dequeue_entry(ipq_cmpfn cmpfn, unsigned long data)
-{
- struct ipq_queue_entry *entry;
-
- entry = __ipq_find_entry(cmpfn, data);
- if (entry == NULL)
- return NULL;
-
- __ipq_dequeue_entry(entry);
- return entry;
-}
-
-
-static inline void
-__ipq_flush(int verdict)
-{
- struct ipq_queue_entry *entry;
-
- while ((entry = __ipq_find_dequeue_entry(NULL, 0)))
- ipq_issue_verdict(entry, verdict);
-}
-
static inline int
__ipq_set_mode(unsigned char mode, unsigned int range)
{
@@ -147,31 +101,59 @@ __ipq_set_mode(unsigned char mode, unsigned int range)
return status;
}
+static void __ipq_flush(ipq_cmpfn cmpfn, unsigned long data);
+
static inline void
__ipq_reset(void)
{
peer_pid = 0;
net_disable_timestamp();
__ipq_set_mode(IPQ_COPY_NONE, 0);
- __ipq_flush(NF_DROP);
+ __ipq_flush(NULL, 0);
}
static struct ipq_queue_entry *
-ipq_find_dequeue_entry(ipq_cmpfn cmpfn, unsigned long data)
+ipq_find_dequeue_entry(unsigned long id)
{
- struct ipq_queue_entry *entry;
+ struct ipq_queue_entry *entry = NULL, *i;
write_lock_bh(&queue_lock);
- entry = __ipq_find_dequeue_entry(cmpfn, data);
+
+ list_for_each_entry(i, &queue_list, list) {
+ if ((unsigned long)i == id) {
+ entry = i;
+ break;
+ }
+ }
+
+ if (entry) {
+ list_del(&entry->list);
+ queue_total--;
+ }
+
write_unlock_bh(&queue_lock);
return entry;
}
static void
-ipq_flush(int verdict)
+__ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
+{
+ struct ipq_queue_entry *entry, *next;
+
+ list_for_each_entry_safe(entry, next, &queue_list, list) {
+ if (!cmpfn || cmpfn(entry, data)) {
+ list_del(&entry->list);
+ queue_total--;
+ ipq_issue_verdict(entry, NF_DROP);
+ }
+ }
+}
+
+static void
+ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
{
write_lock_bh(&queue_lock);
- __ipq_flush(verdict);
+ __ipq_flush(cmpfn, data);
write_unlock_bh(&queue_lock);
}
@@ -364,12 +346,6 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
return 0;
}
-static inline int
-id_cmp(struct ipq_queue_entry *e, unsigned long id)
-{
- return (id == (unsigned long )e);
-}
-
static int
ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
{
@@ -378,7 +354,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
if (vmsg->value > NF_MAX_VERDICT)
return -EINVAL;
- entry = ipq_find_dequeue_entry(id_cmp, vmsg->id);
+ entry = ipq_find_dequeue_entry(vmsg->id);
if (entry == NULL)
return -ENOENT;
else {
@@ -449,10 +425,7 @@ dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
static void
ipq_dev_drop(int ifindex)
{
- struct ipq_queue_entry *entry;
-
- while ((entry = ipq_find_dequeue_entry(dev_cmp, ifindex)) != NULL)
- ipq_issue_verdict(entry, NF_DROP);
+ ipq_flush(dev_cmp, ifindex);
}
#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
@@ -689,7 +662,7 @@ static void __exit ip6_queue_fini(void)
{
nf_unregister_queue_handlers(&nfqh);
synchronize_net();
- ipq_flush(NF_DROP);
+ ipq_flush(NULL, 0);
unregister_sysctl_table(ipq_sysctl_header);
unregister_netdevice_notifier(&ipq_dev_notifier);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 33/49]: ip6_queue: resync dev-index based flushing
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (30 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 32/49]: ip6_queue: " Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 34/49]: nf_queue: move list_head/skb/id to struct nf_info Patrick McHardy
` (16 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: ip6_queue: resync dev-index based flushing
Resync dev_cmp to take bridge devices into account.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit e7a1b1cd873707620365c477874645736b9388a6
tree 96864ae1684322b3ca8fd762562695ec593dc852
parent 326b67e50d8f9f6a0adc52a0999e5e307724a855
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:48 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 11:32:55 +0100
net/ipv6/netfilter/ip6_queue.c | 11 ++++++++++-
1 files changed, 10 insertions(+), 1 deletions(-)
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 7d0780d..9c50cb1 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -418,7 +418,16 @@ dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
if (entry->info->outdev)
if (entry->info->outdev->ifindex == ifindex)
return 1;
-
+#ifdef CONFIG_BRIDGE_NETFILTER
+ if (entry->skb->nf_bridge) {
+ if (entry->skb->nf_bridge->physindev &&
+ entry->skb->nf_bridge->physindev->ifindex == ifindex)
+ return 1;
+ if (entry->skb->nf_bridge->physoutdev &&
+ entry->skb->nf_bridge->physoutdev->ifindex == ifindex)
+ return 1;
+ }
+#endif
return 0;
}
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 34/49]: nf_queue: move list_head/skb/id to struct nf_info
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (31 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 33/49]: ip6_queue: resync dev-index based flushing Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 35/49]: {nfnetlink,ip,ip6}_queue: kill issue_verdict Patrick McHardy
` (15 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_queue: move list_head/skb/id to struct nf_info
Move common fields for queue management to struct nf_info and rename it
to struct nf_queue_entry. The avoids one allocation/free per packet and
simplifies the code a bit.
Alternatively we could add some private room at the tail, but since
all current users use identical structs this seems easier.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 9522be669a4499574be6df2228b6bd6e8d77b037
tree 970b62e1799f15fae7077fe8d756f89901ed8b5f
parent e7a1b1cd873707620365c477874645736b9388a6
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:51 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:27 +0100
include/linux/netfilter.h | 6 ++-
include/net/netfilter/nf_queue.h | 14 ++++---
net/ipv4/netfilter.c | 14 ++++---
net/ipv4/netfilter/ip_queue.c | 68 ++++++++++++-----------------------
net/ipv6/netfilter.c | 14 ++++---
net/ipv6/netfilter/ip6_queue.c | 67 ++++++++++++----------------------
net/netfilter/nf_queue.c | 65 ++++++++++++++++++---------------
net/netfilter/nfnetlink_queue.c | 74 ++++++++++++--------------------------
8 files changed, 132 insertions(+), 190 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 5fe4ef4..f25eec5 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -270,7 +270,7 @@ extern void nf_invalidate_cache(int pf);
extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
struct flowi;
-struct nf_info;
+struct nf_queue_entry;
struct nf_afinfo {
unsigned short family;
@@ -278,9 +278,9 @@ struct nf_afinfo {
unsigned int dataoff, u_int8_t protocol);
int (*route)(struct dst_entry **dst, struct flowi *fl);
void (*saveroute)(const struct sk_buff *skb,
- struct nf_info *info);
+ struct nf_queue_entry *entry);
int (*reroute)(struct sk_buff *skb,
- const struct nf_info *info);
+ const struct nf_queue_entry *entry);
int route_key_size;
};
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index 8c6b382..d030044 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -2,7 +2,11 @@
#define _NF_QUEUE_H
/* Each queued (to userspace) skbuff has one of these. */
-struct nf_info {
+struct nf_queue_entry {
+ struct list_head list;
+ struct sk_buff *skb;
+ unsigned int id;
+
struct nf_hook_ops *elem;
int pf;
unsigned int hook;
@@ -11,12 +15,11 @@ struct nf_info {
int (*okfn)(struct sk_buff *);
};
-#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
+#define nf_queue_entry_reroute(x) ((void *)x + sizeof(struct nf_queue_entry))
/* Packet queuing */
struct nf_queue_handler {
- int (*outfn)(struct sk_buff *skb,
- struct nf_info *info,
+ int (*outfn)(struct nf_queue_entry *entry,
unsigned int queuenum);
char *name;
};
@@ -26,7 +29,6 @@ extern int nf_register_queue_handler(int pf,
extern int nf_unregister_queue_handler(int pf,
const struct nf_queue_handler *qh);
extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh);
-extern void nf_reinject(struct sk_buff *skb, struct nf_info *info,
- unsigned int verdict);
+extern void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
#endif /* _NF_QUEUE_H */
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index f716608..7bf5e4a 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -123,11 +123,12 @@ struct ip_rt_info {
u_int8_t tos;
};
-static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
+static void nf_ip_saveroute(const struct sk_buff *skb,
+ struct nf_queue_entry *entry)
{
- struct ip_rt_info *rt_info = nf_info_reroute(info);
+ struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
- if (info->hook == NF_INET_LOCAL_OUT) {
+ if (entry->hook == NF_INET_LOCAL_OUT) {
const struct iphdr *iph = ip_hdr(skb);
rt_info->tos = iph->tos;
@@ -136,11 +137,12 @@ static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
}
}
-static int nf_ip_reroute(struct sk_buff *skb, const struct nf_info *info)
+static int nf_ip_reroute(struct sk_buff *skb,
+ const struct nf_queue_entry *entry)
{
- const struct ip_rt_info *rt_info = nf_info_reroute(info);
+ const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
- if (info->hook == NF_INET_LOCAL_OUT) {
+ if (entry->hook == NF_INET_LOCAL_OUT) {
const struct iphdr *iph = ip_hdr(skb);
if (!(iph->tos == rt_info->tos
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index df2957c..f1affd2 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -35,13 +35,7 @@
#define NET_IPQ_QMAX 2088
#define NET_IPQ_QMAX_NAME "ip_queue_maxlen"
-struct ipq_queue_entry {
- struct list_head list;
- struct nf_info *info;
- struct sk_buff *skb;
-};
-
-typedef int (*ipq_cmpfn)(struct ipq_queue_entry *, unsigned long);
+typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
@@ -56,7 +50,7 @@ static LIST_HEAD(queue_list);
static DEFINE_MUTEX(ipqnl_mutex);
static void
-ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
+ipq_issue_verdict(struct nf_queue_entry *entry, int verdict)
{
/* TCP input path (and probably other bits) assume to be called
* from softirq context, not from syscall, like ipq_issue_verdict is
@@ -64,14 +58,12 @@ ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
* softirq, e.g. We therefore emulate this by local_bh_disable() */
local_bh_disable();
- nf_reinject(entry->skb, entry->info, verdict);
+ nf_reinject(entry, verdict);
local_bh_enable();
-
- kfree(entry);
}
static inline void
-__ipq_enqueue_entry(struct ipq_queue_entry *entry)
+__ipq_enqueue_entry(struct nf_queue_entry *entry)
{
list_add_tail(&entry->list, &queue_list);
queue_total++;
@@ -114,10 +106,10 @@ __ipq_reset(void)
__ipq_flush(NULL, 0);
}
-static struct ipq_queue_entry *
+static struct nf_queue_entry *
ipq_find_dequeue_entry(unsigned long id)
{
- struct ipq_queue_entry *entry = NULL, *i;
+ struct nf_queue_entry *entry = NULL, *i;
write_lock_bh(&queue_lock);
@@ -140,7 +132,7 @@ ipq_find_dequeue_entry(unsigned long id)
static void
__ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
{
- struct ipq_queue_entry *entry, *next;
+ struct nf_queue_entry *entry, *next;
list_for_each_entry_safe(entry, next, &queue_list, list) {
if (!cmpfn || cmpfn(entry, data)) {
@@ -160,7 +152,7 @@ ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
}
static struct sk_buff *
-ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
+ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
{
sk_buff_data_t old_tail;
size_t size = 0;
@@ -217,20 +209,20 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
pmsg->timestamp_sec = tv.tv_sec;
pmsg->timestamp_usec = tv.tv_usec;
pmsg->mark = entry->skb->mark;
- pmsg->hook = entry->info->hook;
+ pmsg->hook = entry->hook;
pmsg->hw_protocol = entry->skb->protocol;
- if (entry->info->indev)
- strcpy(pmsg->indev_name, entry->info->indev->name);
+ if (entry->indev)
+ strcpy(pmsg->indev_name, entry->indev->name);
else
pmsg->indev_name[0] = '\0';
- if (entry->info->outdev)
- strcpy(pmsg->outdev_name, entry->info->outdev->name);
+ if (entry->outdev)
+ strcpy(pmsg->outdev_name, entry->outdev->name);
else
pmsg->outdev_name[0] = '\0';
- if (entry->info->indev && entry->skb->dev) {
+ if (entry->indev && entry->skb->dev) {
pmsg->hw_type = entry->skb->dev->type;
pmsg->hw_addrlen = dev_parse_header(entry->skb,
pmsg->hw_addr);
@@ -252,28 +244,17 @@ nlmsg_failure:
}
static int
-ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum)
+ipq_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
{
int status = -EINVAL;
struct sk_buff *nskb;
- struct ipq_queue_entry *entry;
if (copy_mode == IPQ_COPY_NONE)
return -EAGAIN;
- entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
- if (entry == NULL) {
- printk(KERN_ERR "ip_queue: OOM in ipq_enqueue_packet()\n");
- return -ENOMEM;
- }
-
- entry->info = info;
- entry->skb = skb;
-
nskb = ipq_build_packet_message(entry, &status);
if (nskb == NULL)
- goto err_out_free;
+ return status;
write_lock_bh(&queue_lock);
@@ -307,14 +288,11 @@ err_out_free_nskb:
err_out_unlock:
write_unlock_bh(&queue_lock);
-
-err_out_free:
- kfree(entry);
return status;
}
static int
-ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
{
int diff;
int err;
@@ -352,7 +330,7 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
static int
ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
{
- struct ipq_queue_entry *entry;
+ struct nf_queue_entry *entry;
if (vmsg->value > NF_MAX_VERDICT)
return -EINVAL;
@@ -412,13 +390,13 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
}
static int
-dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
+dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
{
- if (entry->info->indev)
- if (entry->info->indev->ifindex == ifindex)
+ if (entry->indev)
+ if (entry->indev->ifindex == ifindex)
return 1;
- if (entry->info->outdev)
- if (entry->info->outdev->ifindex == ifindex)
+ if (entry->outdev)
+ if (entry->outdev->ifindex == ifindex)
return 1;
#ifdef CONFIG_BRIDGE_NETFILTER
if (entry->skb->nf_bridge) {
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 55ea9c6..945e6ae 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -57,11 +57,12 @@ struct ip6_rt_info {
struct in6_addr saddr;
};
-static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_info *info)
+static void nf_ip6_saveroute(const struct sk_buff *skb,
+ struct nf_queue_entry *entry)
{
- struct ip6_rt_info *rt_info = nf_info_reroute(info);
+ struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
- if (info->hook == NF_INET_LOCAL_OUT) {
+ if (entry->hook == NF_INET_LOCAL_OUT) {
struct ipv6hdr *iph = ipv6_hdr(skb);
rt_info->daddr = iph->daddr;
@@ -69,11 +70,12 @@ static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_info *info)
}
}
-static int nf_ip6_reroute(struct sk_buff *skb, const struct nf_info *info)
+static int nf_ip6_reroute(struct sk_buff *skb,
+ const struct nf_queue_entry *entry)
{
- struct ip6_rt_info *rt_info = nf_info_reroute(info);
+ struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
- if (info->hook == NF_INET_LOCAL_OUT) {
+ if (entry->hook == NF_INET_LOCAL_OUT) {
struct ipv6hdr *iph = ipv6_hdr(skb);
if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
!ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9c50cb1..9014ada 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -39,13 +39,7 @@
#define NET_IPQ_QMAX 2088
#define NET_IPQ_QMAX_NAME "ip6_queue_maxlen"
-struct ipq_queue_entry {
- struct list_head list;
- struct nf_info *info;
- struct sk_buff *skb;
-};
-
-typedef int (*ipq_cmpfn)(struct ipq_queue_entry *, unsigned long);
+typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
@@ -60,16 +54,15 @@ static LIST_HEAD(queue_list);
static DEFINE_MUTEX(ipqnl_mutex);
static void
-ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
+ipq_issue_verdict(struct nf_queue_entry *entry, int verdict)
{
local_bh_disable();
- nf_reinject(entry->skb, entry->info, verdict);
+ nf_reinject(entry, verdict);
local_bh_enable();
- kfree(entry);
}
static inline void
-__ipq_enqueue_entry(struct ipq_queue_entry *entry)
+__ipq_enqueue_entry(struct nf_queue_entry *entry)
{
list_add_tail(&entry->list, &queue_list);
queue_total++;
@@ -112,10 +105,10 @@ __ipq_reset(void)
__ipq_flush(NULL, 0);
}
-static struct ipq_queue_entry *
+static struct nf_queue_entry *
ipq_find_dequeue_entry(unsigned long id)
{
- struct ipq_queue_entry *entry = NULL, *i;
+ struct nf_queue_entry *entry = NULL, *i;
write_lock_bh(&queue_lock);
@@ -138,7 +131,7 @@ ipq_find_dequeue_entry(unsigned long id)
static void
__ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
{
- struct ipq_queue_entry *entry, *next;
+ struct nf_queue_entry *entry, *next;
list_for_each_entry_safe(entry, next, &queue_list, list) {
if (!cmpfn || cmpfn(entry, data)) {
@@ -158,7 +151,7 @@ ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
}
static struct sk_buff *
-ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
+ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
{
sk_buff_data_t old_tail;
size_t size = 0;
@@ -215,20 +208,20 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
pmsg->timestamp_sec = tv.tv_sec;
pmsg->timestamp_usec = tv.tv_usec;
pmsg->mark = entry->skb->mark;
- pmsg->hook = entry->info->hook;
+ pmsg->hook = entry->hook;
pmsg->hw_protocol = entry->skb->protocol;
- if (entry->info->indev)
- strcpy(pmsg->indev_name, entry->info->indev->name);
+ if (entry->indev)
+ strcpy(pmsg->indev_name, entry->indev->name);
else
pmsg->indev_name[0] = '\0';
- if (entry->info->outdev)
- strcpy(pmsg->outdev_name, entry->info->outdev->name);
+ if (entry->outdev)
+ strcpy(pmsg->outdev_name, entry->outdev->name);
else
pmsg->outdev_name[0] = '\0';
- if (entry->info->indev && entry->skb->dev) {
+ if (entry->indev && entry->skb->dev) {
pmsg->hw_type = entry->skb->dev->type;
pmsg->hw_addrlen = dev_parse_header(entry->skb, pmsg->hw_addr);
}
@@ -249,28 +242,17 @@ nlmsg_failure:
}
static int
-ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum)
+ipq_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
{
int status = -EINVAL;
struct sk_buff *nskb;
- struct ipq_queue_entry *entry;
if (copy_mode == IPQ_COPY_NONE)
return -EAGAIN;
- entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
- if (entry == NULL) {
- printk(KERN_ERR "ip6_queue: OOM in ipq_enqueue_packet()\n");
- return -ENOMEM;
- }
-
- entry->info = info;
- entry->skb = skb;
-
nskb = ipq_build_packet_message(entry, &status);
if (nskb == NULL)
- goto err_out_free;
+ return status;
write_lock_bh(&queue_lock);
@@ -304,14 +286,11 @@ err_out_free_nskb:
err_out_unlock:
write_unlock_bh(&queue_lock);
-
-err_out_free:
- kfree(entry);
return status;
}
static int
-ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
{
int diff;
int err;
@@ -349,7 +328,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
static int
ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
{
- struct ipq_queue_entry *entry;
+ struct nf_queue_entry *entry;
if (vmsg->value > NF_MAX_VERDICT)
return -EINVAL;
@@ -409,14 +388,14 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
}
static int
-dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
+dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
{
- if (entry->info->indev)
- if (entry->info->indev->ifindex == ifindex)
+ if (entry->indev)
+ if (entry->indev->ifindex == ifindex)
return 1;
- if (entry->info->outdev)
- if (entry->info->outdev->ifindex == ifindex)
+ if (entry->outdev)
+ if (entry->outdev->ifindex == ifindex)
return 1;
#ifdef CONFIG_BRIDGE_NETFILTER
if (entry->skb->nf_bridge) {
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index bd71f43..d9d3dc4 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -93,7 +93,7 @@ static int __nf_queue(struct sk_buff *skb,
unsigned int queuenum)
{
int status;
- struct nf_info *info;
+ struct nf_queue_entry *entry;
#ifdef CONFIG_BRIDGE_NETFILTER
struct net_device *physindev = NULL;
struct net_device *physoutdev = NULL;
@@ -118,8 +118,8 @@ static int __nf_queue(struct sk_buff *skb,
return 1;
}
- info = kmalloc(sizeof(*info) + afinfo->route_key_size, GFP_ATOMIC);
- if (!info) {
+ entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
+ if (!entry) {
if (net_ratelimit())
printk(KERN_ERR "OOM queueing packet %p\n",
skb);
@@ -128,13 +128,20 @@ static int __nf_queue(struct sk_buff *skb,
return 1;
}
- *info = (struct nf_info) {
- (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
+ *entry = (struct nf_queue_entry) {
+ .skb = skb,
+ .elem = list_entry(elem, struct nf_hook_ops, list),
+ .pf = pf,
+ .hook = hook,
+ .indev = indev,
+ .outdev = outdev,
+ .okfn = okfn,
+ };
/* If it's going away, ignore hook. */
- if (!try_module_get(info->elem->owner)) {
+ if (!try_module_get(entry->elem->owner)) {
rcu_read_unlock();
- kfree(info);
+ kfree(entry);
return 0;
}
@@ -153,8 +160,8 @@ static int __nf_queue(struct sk_buff *skb,
dev_hold(physoutdev);
}
#endif
- afinfo->saveroute(skb, info);
- status = qh->outfn(skb, info, queuenum);
+ afinfo->saveroute(skb, entry);
+ status = qh->outfn(entry, queuenum);
rcu_read_unlock();
@@ -170,8 +177,8 @@ static int __nf_queue(struct sk_buff *skb,
if (physoutdev)
dev_put(physoutdev);
#endif
- module_put(info->elem->owner);
- kfree(info);
+ module_put(entry->elem->owner);
+ kfree(entry);
kfree_skb(skb);
return 1;
@@ -220,19 +227,19 @@ int nf_queue(struct sk_buff *skb,
return 1;
}
-void nf_reinject(struct sk_buff *skb, struct nf_info *info,
- unsigned int verdict)
+void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
{
- struct list_head *elem = &info->elem->list;
+ struct sk_buff *skb = entry->skb;
+ struct list_head *elem = &entry->elem->list;
struct nf_afinfo *afinfo;
rcu_read_lock();
/* Release those devices we held, or Alexey will kill me. */
- if (info->indev)
- dev_put(info->indev);
- if (info->outdev)
- dev_put(info->outdev);
+ if (entry->indev)
+ dev_put(entry->indev);
+ if (entry->outdev)
+ dev_put(entry->outdev);
#ifdef CONFIG_BRIDGE_NETFILTER
if (skb->nf_bridge) {
if (skb->nf_bridge->physindev)
@@ -243,7 +250,7 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
#endif
/* Drop reference to owner of hook which queued us. */
- module_put(info->elem->owner);
+ module_put(entry->elem->owner);
/* Continue traversal iff userspace said ok... */
if (verdict == NF_REPEAT) {
@@ -252,28 +259,28 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
}
if (verdict == NF_ACCEPT) {
- afinfo = nf_get_afinfo(info->pf);
- if (!afinfo || afinfo->reroute(skb, info) < 0)
+ afinfo = nf_get_afinfo(entry->pf);
+ if (!afinfo || afinfo->reroute(skb, entry) < 0)
verdict = NF_DROP;
}
if (verdict == NF_ACCEPT) {
next_hook:
- verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
- skb, info->hook,
- info->indev, info->outdev, &elem,
- info->okfn, INT_MIN);
+ verdict = nf_iterate(&nf_hooks[entry->pf][entry->hook],
+ skb, entry->hook,
+ entry->indev, entry->outdev, &elem,
+ entry->okfn, INT_MIN);
}
switch (verdict & NF_VERDICT_MASK) {
case NF_ACCEPT:
case NF_STOP:
- info->okfn(skb);
+ entry->okfn(skb);
case NF_STOLEN:
break;
case NF_QUEUE:
- if (!__nf_queue(skb, elem, info->pf, info->hook,
- info->indev, info->outdev, info->okfn,
+ if (!__nf_queue(skb, elem, entry->pf, entry->hook,
+ entry->indev, entry->outdev, entry->okfn,
verdict >> NF_VERDICT_BITS))
goto next_hook;
break;
@@ -281,7 +288,7 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
kfree_skb(skb);
}
rcu_read_unlock();
- kfree(info);
+ kfree(entry);
return;
}
EXPORT_SYMBOL(nf_reinject);
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index cb901cf..a493764 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -45,13 +45,6 @@
#define QDEBUG(x, ...)
#endif
-struct nfqnl_queue_entry {
- struct list_head list;
- struct nf_info *info;
- struct sk_buff *skb;
- unsigned int id;
-};
-
struct nfqnl_instance {
struct hlist_node hlist; /* global list of queues */
atomic_t use;
@@ -73,7 +66,7 @@ struct nfqnl_instance {
struct list_head queue_list; /* packets in queue */
};
-typedef int (*nfqnl_cmpfn)(struct nfqnl_queue_entry *, unsigned long);
+typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long);
static DEFINE_RWLOCK(instances_lock);
@@ -212,7 +205,7 @@ instance_destroy(struct nfqnl_instance *inst)
static void
-issue_verdict(struct nfqnl_queue_entry *entry, int verdict)
+issue_verdict(struct nf_queue_entry *entry, int verdict)
{
QDEBUG("entering for entry %p, verdict %u\n", entry, verdict);
@@ -222,15 +215,12 @@ issue_verdict(struct nfqnl_queue_entry *entry, int verdict)
* softirq, e.g. We therefore emulate this by local_bh_disable() */
local_bh_disable();
- nf_reinject(entry->skb, entry->info, verdict);
+ nf_reinject(entry, verdict);
local_bh_enable();
-
- kfree(entry);
}
static inline void
-__enqueue_entry(struct nfqnl_instance *queue,
- struct nfqnl_queue_entry *entry)
+__enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
{
list_add_tail(&entry->list, &queue->queue_list);
queue->queue_total++;
@@ -265,10 +255,10 @@ __nfqnl_set_mode(struct nfqnl_instance *queue,
return status;
}
-static struct nfqnl_queue_entry *
+static struct nf_queue_entry *
find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
{
- struct nfqnl_queue_entry *entry = NULL, *i;
+ struct nf_queue_entry *entry = NULL, *i;
spin_lock_bh(&queue->lock);
@@ -292,7 +282,7 @@ find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
static void
nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
{
- struct nfqnl_queue_entry *entry, *next;
+ struct nf_queue_entry *entry, *next;
spin_lock_bh(&queue->lock);
list_for_each_entry_safe(entry, next, &queue->queue_list, list) {
@@ -307,7 +297,7 @@ nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
static struct sk_buff *
nfqnl_build_packet_message(struct nfqnl_instance *queue,
- struct nfqnl_queue_entry *entry, int *errp)
+ struct nf_queue_entry *entry, int *errp)
{
sk_buff_data_t old_tail;
size_t size;
@@ -316,7 +306,6 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
struct nfqnl_msg_packet_hdr pmsg;
struct nlmsghdr *nlh;
struct nfgenmsg *nfmsg;
- struct nf_info *entinf = entry->info;
struct sk_buff *entskb = entry->skb;
struct net_device *indev;
struct net_device *outdev;
@@ -336,7 +325,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
+ nla_total_size(sizeof(struct nfqnl_msg_packet_hw))
+ nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp));
- outdev = entinf->outdev;
+ outdev = entry->outdev;
spin_lock_bh(&queue->lock);
@@ -379,23 +368,23 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET,
sizeof(struct nfgenmsg));
nfmsg = NLMSG_DATA(nlh);
- nfmsg->nfgen_family = entinf->pf;
+ nfmsg->nfgen_family = entry->pf;
nfmsg->version = NFNETLINK_V0;
nfmsg->res_id = htons(queue->queue_num);
pmsg.packet_id = htonl(entry->id);
pmsg.hw_protocol = entskb->protocol;
- pmsg.hook = entinf->hook;
+ pmsg.hook = entry->hook;
NLA_PUT(skb, NFQA_PACKET_HDR, sizeof(pmsg), &pmsg);
- indev = entinf->indev;
+ indev = entry->indev;
if (indev) {
tmp_uint = htonl(indev->ifindex);
#ifndef CONFIG_BRIDGE_NETFILTER
NLA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
#else
- if (entinf->pf == PF_BRIDGE) {
+ if (entry->pf == PF_BRIDGE) {
/* Case 1: indev is physical input device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
@@ -425,7 +414,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
#ifndef CONFIG_BRIDGE_NETFILTER
NLA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
#else
- if (entinf->pf == PF_BRIDGE) {
+ if (entry->pf == PF_BRIDGE) {
/* Case 1: outdev is physical output device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
@@ -504,13 +493,11 @@ nla_put_failure:
}
static int
-nfqnl_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
- unsigned int queuenum)
+nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
{
int status = -EINVAL;
struct sk_buff *nskb;
struct nfqnl_instance *queue;
- struct nfqnl_queue_entry *entry;
QDEBUG("entered\n");
@@ -526,22 +513,11 @@ nfqnl_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
goto err_out_put;
}
- entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
- if (entry == NULL) {
- if (net_ratelimit())
- printk(KERN_ERR
- "nf_queue: OOM in nfqnl_enqueue_packet()\n");
- status = -ENOMEM;
- goto err_out_put;
- }
-
- entry->info = info;
- entry->skb = skb;
entry->id = atomic_inc_return(&queue->id_sequence);
nskb = nfqnl_build_packet_message(queue, entry, &status);
if (nskb == NULL)
- goto err_out_free;
+ goto err_out_put;
spin_lock_bh(&queue->lock);
@@ -577,15 +553,13 @@ err_out_free_nskb:
err_out_unlock:
spin_unlock_bh(&queue->lock);
-err_out_free:
- kfree(entry);
err_out_put:
instance_put(queue);
return status;
}
static int
-nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
+nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e)
{
int diff;
int err;
@@ -630,15 +604,13 @@ nfqnl_set_mode(struct nfqnl_instance *queue,
}
static int
-dev_cmp(struct nfqnl_queue_entry *entry, unsigned long ifindex)
+dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
{
- struct nf_info *entinf = entry->info;
-
- if (entinf->indev)
- if (entinf->indev->ifindex == ifindex)
+ if (entry->indev)
+ if (entry->indev->ifindex == ifindex)
return 1;
- if (entinf->outdev)
- if (entinf->outdev->ifindex == ifindex)
+ if (entry->outdev)
+ if (entry->outdev->ifindex == ifindex)
return 1;
#ifdef CONFIG_BRIDGE_NETFILTER
if (entry->skb->nf_bridge) {
@@ -748,7 +720,7 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
struct nfqnl_msg_verdict_hdr *vhdr;
struct nfqnl_instance *queue;
unsigned int verdict;
- struct nfqnl_queue_entry *entry;
+ struct nf_queue_entry *entry;
int err;
queue = instance_lookup_get(queue_num);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 35/49]: {nfnetlink,ip,ip6}_queue: kill issue_verdict
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (32 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 34/49]: nf_queue: move list_head/skb/id to struct nf_info Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 36/49]: nf_queue: clean up error paths Patrick McHardy
` (14 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: {nfnetlink,ip,ip6}_queue: kill issue_verdict
Now that issue_verdict doesn't need to free the queue entries anymore,
all it does is disable local BHs and call nf_reinject. Move the BH
disabling to the okfn invocation in nf_reinject and kill the
issue_verdict functions.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 79f4f2de87033501ea05a8d47634a8cffd51418c
tree 6614f9abb1050f071f8e61e4142accb54b0fd776
parent 9522be669a4499574be6df2228b6bd6e8d77b037
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:54 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:31 +0100
net/ipv4/netfilter/ip_queue.c | 17 ++---------------
net/ipv6/netfilter/ip6_queue.c | 12 ++----------
net/netfilter/nf_queue.c | 2 ++
net/netfilter/nfnetlink_queue.c | 21 ++-------------------
4 files changed, 8 insertions(+), 44 deletions(-)
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index f1affd2..68b12ce 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -49,19 +49,6 @@ static struct sock *ipqnl __read_mostly;
static LIST_HEAD(queue_list);
static DEFINE_MUTEX(ipqnl_mutex);
-static void
-ipq_issue_verdict(struct nf_queue_entry *entry, int verdict)
-{
- /* TCP input path (and probably other bits) assume to be called
- * from softirq context, not from syscall, like ipq_issue_verdict is
- * called. TCP input path deadlocks with locks taken from timer
- * softirq, e.g. We therefore emulate this by local_bh_disable() */
-
- local_bh_disable();
- nf_reinject(entry, verdict);
- local_bh_enable();
-}
-
static inline void
__ipq_enqueue_entry(struct nf_queue_entry *entry)
{
@@ -138,7 +125,7 @@ __ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
if (!cmpfn || cmpfn(entry, data)) {
list_del(&entry->list);
queue_total--;
- ipq_issue_verdict(entry, NF_DROP);
+ nf_reinject(entry, NF_DROP);
}
}
}
@@ -345,7 +332,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
if (ipq_mangle_ipv4(vmsg, entry) < 0)
verdict = NF_DROP;
- ipq_issue_verdict(entry, verdict);
+ nf_reinject(entry, verdict);
return 0;
}
}
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9014ada..e5b0059 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -53,14 +53,6 @@ static struct sock *ipqnl __read_mostly;
static LIST_HEAD(queue_list);
static DEFINE_MUTEX(ipqnl_mutex);
-static void
-ipq_issue_verdict(struct nf_queue_entry *entry, int verdict)
-{
- local_bh_disable();
- nf_reinject(entry, verdict);
- local_bh_enable();
-}
-
static inline void
__ipq_enqueue_entry(struct nf_queue_entry *entry)
{
@@ -137,7 +129,7 @@ __ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
if (!cmpfn || cmpfn(entry, data)) {
list_del(&entry->list);
queue_total--;
- ipq_issue_verdict(entry, NF_DROP);
+ nf_reinject(entry, NF_DROP);
}
}
}
@@ -343,7 +335,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
if (ipq_mangle_ipv6(vmsg, entry) < 0)
verdict = NF_DROP;
- ipq_issue_verdict(entry, verdict);
+ nf_reinject(entry, verdict);
return 0;
}
}
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index d9d3dc4..f0dc727 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -275,7 +275,9 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
switch (verdict & NF_VERDICT_MASK) {
case NF_ACCEPT:
case NF_STOP:
+ local_bh_disable();
entry->okfn(skb);
+ local_bh_enable();
case NF_STOLEN:
break;
case NF_QUEUE:
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index a493764..d9ce394 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -202,23 +202,6 @@ instance_destroy(struct nfqnl_instance *inst)
_instance_destroy2(inst, 1);
}
-
-
-static void
-issue_verdict(struct nf_queue_entry *entry, int verdict)
-{
- QDEBUG("entering for entry %p, verdict %u\n", entry, verdict);
-
- /* TCP input path (and probably other bits) assume to be called
- * from softirq context, not from syscall, like issue_verdict is
- * called. TCP input path deadlocks with locks taken from timer
- * softirq, e.g. We therefore emulate this by local_bh_disable() */
-
- local_bh_disable();
- nf_reinject(entry, verdict);
- local_bh_enable();
-}
-
static inline void
__enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
{
@@ -289,7 +272,7 @@ nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
if (!cmpfn || cmpfn(entry, data)) {
list_del(&entry->list);
queue->queue_total--;
- issue_verdict(entry, NF_DROP);
+ nf_reinject(entry, NF_DROP);
}
}
spin_unlock_bh(&queue->lock);
@@ -761,7 +744,7 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
entry->skb->mark = ntohl(*(__be32 *)
nla_data(nfqa[NFQA_MARK]));
- issue_verdict(entry, verdict);
+ nf_reinject(entry, verdict);
instance_put(queue);
return 0;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 36/49]: nf_queue: clean up error paths
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (33 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 35/49]: {nfnetlink,ip,ip6}_queue: kill issue_verdict Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 37/49]: remove annoying debugging message Patrick McHardy
` (13 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nf_queue: clean up error paths
Move duplicated error handling to end of function and add a helper function
to release the device and module references from the queue entry.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 486aae228a98e75818b5e7091c3efd62c4b0f6a1
tree 94f8024241180f3eb14edfab5dee4388844d9205
parent 79f4f2de87033501ea05a8d47634a8cffd51418c
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:57 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:31 +0100
net/netfilter/nf_queue.c | 93 ++++++++++++++++++++--------------------------
1 files changed, 40 insertions(+), 53 deletions(-)
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index f0dc727..7796511 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -80,6 +80,27 @@ void nf_unregister_queue_handlers(const struct nf_queue_handler *qh)
}
EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
+static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
+{
+ /* Release those devices we held, or Alexey will kill me. */
+ if (entry->indev)
+ dev_put(entry->indev);
+ if (entry->outdev)
+ dev_put(entry->outdev);
+#ifdef CONFIG_BRIDGE_NETFILTER
+ if (entry->skb->nf_bridge) {
+ struct nf_bridge_info *nf_bridge = entry->skb->nf_bridge;
+
+ if (nf_bridge->physindev)
+ dev_put(nf_bridge->physindev);
+ if (nf_bridge->physoutdev)
+ dev_put(nf_bridge->physoutdev);
+ }
+#endif
+ /* Drop reference to owner of hook which queued us. */
+ module_put(entry->elem->owner);
+}
+
/*
* Any packet that leaves via this function must come back
* through nf_reinject().
@@ -93,10 +114,10 @@ static int __nf_queue(struct sk_buff *skb,
unsigned int queuenum)
{
int status;
- struct nf_queue_entry *entry;
+ struct nf_queue_entry *entry = NULL;
#ifdef CONFIG_BRIDGE_NETFILTER
- struct net_device *physindev = NULL;
- struct net_device *physoutdev = NULL;
+ struct net_device *physindev;
+ struct net_device *physoutdev;
#endif
struct nf_afinfo *afinfo;
const struct nf_queue_handler *qh;
@@ -105,28 +126,16 @@ static int __nf_queue(struct sk_buff *skb,
rcu_read_lock();
qh = rcu_dereference(queue_handler[pf]);
- if (!qh) {
- rcu_read_unlock();
- kfree_skb(skb);
- return 1;
- }
+ if (!qh)
+ goto err_unlock;
afinfo = nf_get_afinfo(pf);
- if (!afinfo) {
- rcu_read_unlock();
- kfree_skb(skb);
- return 1;
- }
+ if (!afinfo)
+ goto err_unlock;
entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
- if (!entry) {
- if (net_ratelimit())
- printk(KERN_ERR "OOM queueing packet %p\n",
- skb);
- rcu_read_unlock();
- kfree_skb(skb);
- return 1;
- }
+ if (!entry)
+ goto err_unlock;
*entry = (struct nf_queue_entry) {
.skb = skb,
@@ -166,25 +175,18 @@ static int __nf_queue(struct sk_buff *skb,
rcu_read_unlock();
if (status < 0) {
- /* James M doesn't say fuck enough. */
- if (indev)
- dev_put(indev);
- if (outdev)
- dev_put(outdev);
-#ifdef CONFIG_BRIDGE_NETFILTER
- if (physindev)
- dev_put(physindev);
- if (physoutdev)
- dev_put(physoutdev);
-#endif
- module_put(entry->elem->owner);
- kfree(entry);
- kfree_skb(skb);
-
- return 1;
+ nf_queue_entry_release_refs(entry);
+ goto err;
}
return 1;
+
+err_unlock:
+ rcu_read_unlock();
+err:
+ kfree_skb(skb);
+ kfree(entry);
+ return 1;
}
int nf_queue(struct sk_buff *skb,
@@ -235,22 +237,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
rcu_read_lock();
- /* Release those devices we held, or Alexey will kill me. */
- if (entry->indev)
- dev_put(entry->indev);
- if (entry->outdev)
- dev_put(entry->outdev);
-#ifdef CONFIG_BRIDGE_NETFILTER
- if (skb->nf_bridge) {
- if (skb->nf_bridge->physindev)
- dev_put(skb->nf_bridge->physindev);
- if (skb->nf_bridge->physoutdev)
- dev_put(skb->nf_bridge->physoutdev);
- }
-#endif
-
- /* Drop reference to owner of hook which queued us. */
- module_put(entry->elem->owner);
+ nf_queue_entry_release_refs(entry);
/* Continue traversal iff userspace said ok... */
if (verdict == NF_REPEAT) {
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 37/49]: remove annoying debugging message
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (34 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 36/49]: nf_queue: clean up error paths Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 38/49]: nfnetlink_queue: avoid unnecessary atomic operation Patrick McHardy
` (12 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: remove annoying debugging message
Don't log "nf_hook: Verdict = QUEUE." message with NETFILTER_DEBUG=y.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit e1b5dfe8599c62320973aa270e94c4d4e8872db9
tree 23c0eab90a429fe9f462de9bd0c6e506d01eded2
parent 486aae228a98e75818b5e7091c3efd62c4b0f6a1
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:47:59 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:32 +0100
net/netfilter/core.c | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 6819a41..95e1863 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -178,8 +178,7 @@ next_hook:
} else if (verdict == NF_DROP) {
kfree_skb(skb);
ret = -EPERM;
- } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
- NFDEBUG("nf_hook: Verdict = QUEUE.\n");
+ } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
verdict >> NF_VERDICT_BITS))
goto next_hook;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 38/49]: nfnetlink_queue: avoid unnecessary atomic operation
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (35 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 37/49]: remove annoying debugging message Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 39/49]: nfnetlink_queue: fix checks in nfqnl_recv_config Patrick McHardy
` (11 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: avoid unnecessary atomic operation
The sequence counter doesn't need to be an atomic_t, just move the increment
inside the locked section.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit e237561545ccdb708967d2c5ae4030e5ef05bffc
tree c7b6bb2a4c2b025387b569d831ddbc6884b176a7
parent e1b5dfe8599c62320973aa270e94c4d4e8872db9
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:03 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:32 +0100
net/netfilter/nfnetlink_queue.c | 9 ++++-----
1 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index d9ce394..bd18de7 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -56,7 +56,7 @@ struct nfqnl_instance {
unsigned int queue_dropped;
unsigned int queue_user_dropped;
- atomic_t id_sequence; /* 'sequence' of pkt ids */
+ unsigned int id_sequence; /* 'sequence' of pkt ids */
u_int16_t queue_num; /* number of this queue */
u_int8_t copy_mode;
@@ -139,7 +139,6 @@ instance_create(u_int16_t queue_num, int pid)
inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
inst->copy_range = 0xfffff;
inst->copy_mode = NFQNL_COPY_NONE;
- atomic_set(&inst->id_sequence, 0);
/* needs to be two, since we _put() after creation */
atomic_set(&inst->use, 2);
spin_lock_init(&inst->lock);
@@ -340,6 +339,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
return NULL;
}
+ entry->id = queue->id_sequence++;
+
spin_unlock_bh(&queue->lock);
skb = alloc_skb(size, GFP_ATOMIC);
@@ -496,8 +497,6 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
goto err_out_put;
}
- entry->id = atomic_inc_return(&queue->id_sequence);
-
nskb = nfqnl_build_packet_message(queue, entry, &status);
if (nskb == NULL)
goto err_out_put;
@@ -948,7 +947,7 @@ static int seq_show(struct seq_file *s, void *v)
inst->peer_pid, inst->queue_total,
inst->copy_mode, inst->copy_range,
inst->queue_dropped, inst->queue_user_dropped,
- atomic_read(&inst->id_sequence),
+ inst->id_sequence,
atomic_read(&inst->use));
}
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 39/49]: nfnetlink_queue: fix checks in nfqnl_recv_config
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (36 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 38/49]: nfnetlink_queue: avoid unnecessary atomic operation Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 40/49]: nfnetlink: use RCU for queue instances hash Patrick McHardy
` (10 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: fix checks in nfqnl_recv_config
The peer_pid must be checked in all cases when a queue exists, currently
it is not checked if for NFQA_CFG_QUEUE_MAXLEN when a NFQA_CFG_CMD
attribute exists in some cases. Same for the queue existance check,
which can cause a NULL pointer dereference.
Also consistently return -ENODEV for "queue not found". -ENOENT would
be better, but that is already used to indicate a queued skb id doesn't
exist.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit f7f606b9d4ede9a47a3fd61e40b6b688f845f8d7
tree fc59720bd96f97ec7c1457f97ed782921776e67b
parent e237561545ccdb708967d2c5ae4030e5ef05bffc
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:06 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:33 +0100
net/netfilter/nfnetlink_queue.c | 31 ++++++++++++-------------------
1 files changed, 12 insertions(+), 19 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index bd18de7..4abf62a 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -781,8 +781,14 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
QDEBUG("entering for msg %u\n", NFNL_MSG_TYPE(nlh->nlmsg_type));
queue = instance_lookup_get(queue_num);
+ if (queue && queue->peer_pid != NETLINK_CB(skb).pid) {
+ ret = -EPERM;
+ goto out_put;
+ }
+
if (nfqa[NFQA_CFG_CMD]) {
struct nfqnl_msg_config_cmd *cmd;
+
cmd = nla_data(nfqa[NFQA_CFG_CMD]);
QDEBUG("found CFG_CMD\n");
@@ -798,12 +804,6 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
case NFQNL_CFG_CMD_UNBIND:
if (!queue)
return -ENODEV;
-
- if (queue->peer_pid != NETLINK_CB(skb).pid) {
- ret = -EPERM;
- goto out_put;
- }
-
instance_destroy(queue);
break;
case NFQNL_CFG_CMD_PF_BIND:
@@ -820,25 +820,13 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
ret = -EINVAL;
break;
}
- } else {
- if (!queue) {
- QDEBUG("no config command, and no instance ENOENT\n");
- ret = -ENOENT;
- goto out_put;
- }
-
- if (queue->peer_pid != NETLINK_CB(skb).pid) {
- QDEBUG("no config command, and wrong pid\n");
- ret = -EPERM;
- goto out_put;
- }
}
if (nfqa[NFQA_CFG_PARAMS]) {
struct nfqnl_msg_config_params *params;
if (!queue) {
- ret = -ENOENT;
+ ret = -ENODEV;
goto out_put;
}
params = nla_data(nfqa[NFQA_CFG_PARAMS]);
@@ -848,6 +836,11 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
if (nfqa[NFQA_CFG_QUEUE_MAXLEN]) {
__be32 *queue_maxlen;
+
+ if (!queue) {
+ ret = -ENODEV;
+ goto out_put;
+ }
queue_maxlen = nla_data(nfqa[NFQA_CFG_QUEUE_MAXLEN]);
spin_lock_bh(&queue->lock);
queue->queue_maxlen = ntohl(*queue_maxlen);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 40/49]: nfnetlink: use RCU for queue instances hash
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (37 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 39/49]: nfnetlink_queue: fix checks in nfqnl_recv_config Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 41/49]: nfnetlink_queue: kill useless wrapper Patrick McHardy
` (9 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink: use RCU for queue instances hash
Use RCU for queue instances hash. Avoids multiple atomic operations
for each packet.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 1fb555e556b810fbcde356b7865f54f6dcb939d9
tree e4df54fec7ccfae4d0de189ec18dc8b8dc5484f6
parent f7f606b9d4ede9a47a3fd61e40b6b688f845f8d7
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:09 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:33 +0100
net/netfilter/nfnetlink_queue.c | 205 ++++++++++++++++++---------------------
1 files changed, 92 insertions(+), 113 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 4abf62a..449b880 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -47,7 +47,7 @@
struct nfqnl_instance {
struct hlist_node hlist; /* global list of queues */
- atomic_t use;
+ struct rcu_head rcu;
int peer_pid;
unsigned int queue_maxlen;
@@ -68,7 +68,7 @@ struct nfqnl_instance {
typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long);
-static DEFINE_RWLOCK(instances_lock);
+static DEFINE_SPINLOCK(instances_lock);
#define INSTANCE_BUCKETS 16
static struct hlist_head instance_table[INSTANCE_BUCKETS];
@@ -79,14 +79,14 @@ static inline u_int8_t instance_hashfn(u_int16_t queue_num)
}
static struct nfqnl_instance *
-__instance_lookup(u_int16_t queue_num)
+instance_lookup(u_int16_t queue_num)
{
struct hlist_head *head;
struct hlist_node *pos;
struct nfqnl_instance *inst;
head = &instance_table[instance_hashfn(queue_num)];
- hlist_for_each_entry(inst, pos, head, hlist) {
+ hlist_for_each_entry_rcu(inst, pos, head, hlist) {
if (inst->queue_num == queue_num)
return inst;
}
@@ -94,37 +94,15 @@ __instance_lookup(u_int16_t queue_num)
}
static struct nfqnl_instance *
-instance_lookup_get(u_int16_t queue_num)
-{
- struct nfqnl_instance *inst;
-
- read_lock_bh(&instances_lock);
- inst = __instance_lookup(queue_num);
- if (inst)
- atomic_inc(&inst->use);
- read_unlock_bh(&instances_lock);
-
- return inst;
-}
-
-static void
-instance_put(struct nfqnl_instance *inst)
-{
- if (inst && atomic_dec_and_test(&inst->use)) {
- QDEBUG("kfree(inst=%p)\n", inst);
- kfree(inst);
- }
-}
-
-static struct nfqnl_instance *
instance_create(u_int16_t queue_num, int pid)
{
struct nfqnl_instance *inst;
+ unsigned int h;
QDEBUG("entering for queue_num=%u, pid=%d\n", queue_num, pid);
- write_lock_bh(&instances_lock);
- if (__instance_lookup(queue_num)) {
+ spin_lock(&instances_lock);
+ if (instance_lookup(queue_num)) {
inst = NULL;
QDEBUG("aborting, instance already exists\n");
goto out_unlock;
@@ -139,18 +117,17 @@ instance_create(u_int16_t queue_num, int pid)
inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
inst->copy_range = 0xfffff;
inst->copy_mode = NFQNL_COPY_NONE;
- /* needs to be two, since we _put() after creation */
- atomic_set(&inst->use, 2);
spin_lock_init(&inst->lock);
INIT_LIST_HEAD(&inst->queue_list);
+ INIT_RCU_HEAD(&inst->rcu);
if (!try_module_get(THIS_MODULE))
goto out_free;
- hlist_add_head(&inst->hlist,
- &instance_table[instance_hashfn(queue_num)]);
+ h = instance_hashfn(queue_num);
+ hlist_add_head_rcu(&inst->hlist, &instance_table[h]);
- write_unlock_bh(&instances_lock);
+ spin_unlock(&instances_lock);
QDEBUG("successfully created new instance\n");
@@ -159,7 +136,7 @@ instance_create(u_int16_t queue_num, int pid)
out_free:
kfree(inst);
out_unlock:
- write_unlock_bh(&instances_lock);
+ spin_unlock(&instances_lock);
return NULL;
}
@@ -167,38 +144,29 @@ static void nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
unsigned long data);
static void
-_instance_destroy2(struct nfqnl_instance *inst, int lock)
+instance_destroy_rcu(struct rcu_head *head)
{
- /* first pull it out of the global list */
- if (lock)
- write_lock_bh(&instances_lock);
-
- QDEBUG("removing instance %p (queuenum=%u) from hash\n",
- inst, inst->queue_num);
- hlist_del(&inst->hlist);
+ struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance,
+ rcu);
- if (lock)
- write_unlock_bh(&instances_lock);
-
- /* then flush all pending skbs from the queue */
nfqnl_flush(inst, NULL, 0);
-
- /* and finally put the refcount */
- instance_put(inst);
-
+ kfree(inst);
module_put(THIS_MODULE);
}
-static inline void
+static void
__instance_destroy(struct nfqnl_instance *inst)
{
- _instance_destroy2(inst, 0);
+ hlist_del_rcu(&inst->hlist);
+ call_rcu(&inst->rcu, instance_destroy_rcu);
}
-static inline void
+static void
instance_destroy(struct nfqnl_instance *inst)
{
- _instance_destroy2(inst, 1);
+ spin_lock(&instances_lock);
+ __instance_destroy(inst);
+ spin_unlock(&instances_lock);
}
static inline void
@@ -485,7 +453,8 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
QDEBUG("entered\n");
- queue = instance_lookup_get(queuenum);
+ /* rcu_read_lock()ed by nf_hook_slow() */
+ queue = instance_lookup(queuenum);
if (!queue) {
QDEBUG("no queue instance matching\n");
return -EINVAL;
@@ -493,13 +462,12 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
if (queue->copy_mode == NFQNL_COPY_NONE) {
QDEBUG("mode COPY_NONE, aborting\n");
- status = -EAGAIN;
- goto err_out_put;
+ return -EAGAIN;
}
nskb = nfqnl_build_packet_message(queue, entry, &status);
if (nskb == NULL)
- goto err_out_put;
+ return status;
spin_lock_bh(&queue->lock);
@@ -526,7 +494,6 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
__enqueue_entry(queue, entry);
spin_unlock_bh(&queue->lock);
- instance_put(queue);
return status;
err_out_free_nskb:
@@ -534,9 +501,6 @@ err_out_free_nskb:
err_out_unlock:
spin_unlock_bh(&queue->lock);
-
-err_out_put:
- instance_put(queue);
return status;
}
@@ -616,21 +580,18 @@ nfqnl_dev_drop(int ifindex)
QDEBUG("entering for ifindex %u\n", ifindex);
- /* this only looks like we have to hold the readlock for a way too long
- * time, issue_verdict(), nf_reinject(), ... - but we always only
- * issue NF_DROP, which is processed directly in nf_reinject() */
- read_lock_bh(&instances_lock);
+ rcu_read_lock();
- for (i = 0; i < INSTANCE_BUCKETS; i++) {
+ for (i = 0; i < INSTANCE_BUCKETS; i++) {
struct hlist_node *tmp;
struct nfqnl_instance *inst;
struct hlist_head *head = &instance_table[i];
- hlist_for_each_entry(inst, tmp, head, hlist)
+ hlist_for_each_entry_rcu(inst, tmp, head, hlist)
nfqnl_flush(inst, dev_cmp, ifindex);
}
- read_unlock_bh(&instances_lock);
+ rcu_read_unlock();
}
#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
@@ -665,8 +626,8 @@ nfqnl_rcv_nl_event(struct notifier_block *this,
int i;
/* destroy all instances for this pid */
- write_lock_bh(&instances_lock);
- for (i = 0; i < INSTANCE_BUCKETS; i++) {
+ spin_lock(&instances_lock);
+ for (i = 0; i < INSTANCE_BUCKETS; i++) {
struct hlist_node *tmp, *t2;
struct nfqnl_instance *inst;
struct hlist_head *head = &instance_table[i];
@@ -677,7 +638,7 @@ nfqnl_rcv_nl_event(struct notifier_block *this,
__instance_destroy(inst);
}
}
- write_unlock_bh(&instances_lock);
+ spin_unlock(&instances_lock);
}
return NOTIFY_DONE;
}
@@ -705,18 +666,21 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
struct nf_queue_entry *entry;
int err;
- queue = instance_lookup_get(queue_num);
- if (!queue)
- return -ENODEV;
+ rcu_read_lock();
+ queue = instance_lookup(queue_num);
+ if (!queue) {
+ err = -ENODEV;
+ goto err_out_unlock;
+ }
if (queue->peer_pid != NETLINK_CB(skb).pid) {
err = -EPERM;
- goto err_out_put;
+ goto err_out_unlock;
}
if (!nfqa[NFQA_VERDICT_HDR]) {
err = -EINVAL;
- goto err_out_put;
+ goto err_out_unlock;
}
vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
@@ -724,14 +688,15 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT) {
err = -EINVAL;
- goto err_out_put;
+ goto err_out_unlock;
}
entry = find_dequeue_entry(queue, ntohl(vhdr->id));
if (entry == NULL) {
err = -ENOENT;
- goto err_out_put;
+ goto err_out_unlock;
}
+ rcu_read_unlock();
if (nfqa[NFQA_PAYLOAD]) {
if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]),
@@ -744,11 +709,10 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
nla_data(nfqa[NFQA_MARK]));
nf_reinject(entry, verdict);
- instance_put(queue);
return 0;
-err_out_put:
- instance_put(queue);
+err_out_unlock:
+ rcu_read_unlock();
return err;
}
@@ -776,45 +740,61 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
u_int16_t queue_num = ntohs(nfmsg->res_id);
struct nfqnl_instance *queue;
+ struct nfqnl_msg_config_cmd *cmd = NULL;
int ret = 0;
QDEBUG("entering for msg %u\n", NFNL_MSG_TYPE(nlh->nlmsg_type));
- queue = instance_lookup_get(queue_num);
+ if (nfqa[NFQA_CFG_CMD]) {
+ cmd = nla_data(nfqa[NFQA_CFG_CMD]);
+
+ /* Commands without queue context - might sleep */
+ switch (cmd->command) {
+ case NFQNL_CFG_CMD_PF_BIND:
+ ret = nf_register_queue_handler(ntohs(cmd->pf),
+ &nfqh);
+ break;
+ case NFQNL_CFG_CMD_PF_UNBIND:
+ ret = nf_unregister_queue_handler(ntohs(cmd->pf),
+ &nfqh);
+ break;
+ default:
+ break;
+ }
+
+ if (ret < 0)
+ return ret;
+ }
+
+ rcu_read_lock();
+ queue = instance_lookup(queue_num);
if (queue && queue->peer_pid != NETLINK_CB(skb).pid) {
ret = -EPERM;
- goto out_put;
+ goto err_out_unlock;
}
- if (nfqa[NFQA_CFG_CMD]) {
- struct nfqnl_msg_config_cmd *cmd;
-
- cmd = nla_data(nfqa[NFQA_CFG_CMD]);
- QDEBUG("found CFG_CMD\n");
-
+ if (cmd != NULL) {
switch (cmd->command) {
case NFQNL_CFG_CMD_BIND:
- if (queue)
- return -EBUSY;
-
+ if (queue) {
+ ret = -EBUSY;
+ goto err_out_unlock;
+ }
queue = instance_create(queue_num, NETLINK_CB(skb).pid);
- if (!queue)
- return -EINVAL;
+ if (!queue) {
+ ret = -EINVAL;
+ goto err_out_unlock;
+ }
break;
case NFQNL_CFG_CMD_UNBIND:
- if (!queue)
- return -ENODEV;
+ if (!queue) {
+ ret = -ENODEV;
+ goto err_out_unlock;
+ }
instance_destroy(queue);
break;
case NFQNL_CFG_CMD_PF_BIND:
- QDEBUG("registering queue handler for pf=%u\n",
- ntohs(cmd->pf));
- ret = nf_register_queue_handler(ntohs(cmd->pf), &nfqh);
- break;
case NFQNL_CFG_CMD_PF_UNBIND:
- QDEBUG("unregistering queue handler for pf=%u\n",
- ntohs(cmd->pf));
- ret = nf_unregister_queue_handler(ntohs(cmd->pf), &nfqh);
break;
default:
ret = -EINVAL;
@@ -827,7 +807,7 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
if (!queue) {
ret = -ENODEV;
- goto out_put;
+ goto err_out_unlock;
}
params = nla_data(nfqa[NFQA_CFG_PARAMS]);
nfqnl_set_mode(queue, params->copy_mode,
@@ -839,7 +819,7 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
if (!queue) {
ret = -ENODEV;
- goto out_put;
+ goto err_out_unlock;
}
queue_maxlen = nla_data(nfqa[NFQA_CFG_QUEUE_MAXLEN]);
spin_lock_bh(&queue->lock);
@@ -847,8 +827,8 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
spin_unlock_bh(&queue->lock);
}
-out_put:
- instance_put(queue);
+err_out_unlock:
+ rcu_read_unlock();
return ret;
}
@@ -916,7 +896,7 @@ static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
static void *seq_start(struct seq_file *seq, loff_t *pos)
{
- read_lock_bh(&instances_lock);
+ spin_lock(&instances_lock);
return get_idx(seq, *pos);
}
@@ -928,7 +908,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
static void seq_stop(struct seq_file *s, void *v)
{
- read_unlock_bh(&instances_lock);
+ spin_unlock(&instances_lock);
}
static int seq_show(struct seq_file *s, void *v)
@@ -940,8 +920,7 @@ static int seq_show(struct seq_file *s, void *v)
inst->peer_pid, inst->queue_total,
inst->copy_mode, inst->copy_range,
inst->queue_dropped, inst->queue_user_dropped,
- inst->id_sequence,
- atomic_read(&inst->use));
+ inst->id_sequence, 1);
}
static const struct seq_operations nfqnl_seq_ops = {
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 41/49]: nfnetlink_queue: kill useless wrapper
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (38 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 40/49]: nfnetlink: use RCU for queue instances hash Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 42/49]: nfnetlink_queue: remove useless debugging Patrick McHardy
` (8 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: kill useless wrapper
nfqnl_set_mode takes the queue lock and calls __nfqnl_set_mode. Just move
the code from __nfqnl_set_mode to nfqnl_set_mode since there is no other
user.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 264c2cc068091460172646e0611e96611684355a
tree 0b5dc98f227b6bb9a08bc899c655166b0cf9acb8
parent 1fb555e556b810fbcde356b7865f54f6dcb939d9
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:12 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:33 +0100
net/netfilter/nfnetlink_queue.c | 52 ++++++++++++++++-----------------------
1 files changed, 21 insertions(+), 31 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 449b880..37b7655 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -176,35 +176,6 @@ __enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
queue->queue_total++;
}
-static inline int
-__nfqnl_set_mode(struct nfqnl_instance *queue,
- unsigned char mode, unsigned int range)
-{
- int status = 0;
-
- switch (mode) {
- case NFQNL_COPY_NONE:
- case NFQNL_COPY_META:
- queue->copy_mode = mode;
- queue->copy_range = 0;
- break;
-
- case NFQNL_COPY_PACKET:
- queue->copy_mode = mode;
- /* we're using struct nlattr which has 16bit nla_len */
- if (range > 0xffff)
- queue->copy_range = 0xffff;
- else
- queue->copy_range = range;
- break;
-
- default:
- status = -EINVAL;
-
- }
- return status;
-}
-
static struct nf_queue_entry *
find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
{
@@ -540,10 +511,29 @@ static int
nfqnl_set_mode(struct nfqnl_instance *queue,
unsigned char mode, unsigned int range)
{
- int status;
+ int status = 0;
spin_lock_bh(&queue->lock);
- status = __nfqnl_set_mode(queue, mode, range);
+ switch (mode) {
+ case NFQNL_COPY_NONE:
+ case NFQNL_COPY_META:
+ queue->copy_mode = mode;
+ queue->copy_range = 0;
+ break;
+
+ case NFQNL_COPY_PACKET:
+ queue->copy_mode = mode;
+ /* we're using struct nlattr which has 16bit nla_len */
+ if (range > 0xffff)
+ queue->copy_range = 0xffff;
+ else
+ queue->copy_range = range;
+ break;
+
+ default:
+ status = -EINVAL;
+
+ }
spin_unlock_bh(&queue->lock);
return status;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 42/49]: nfnetlink_queue: remove useless debugging
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (39 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 41/49]: nfnetlink_queue: kill useless wrapper Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 43/49]: nfnetlink_queue: mark hash table __read_mostly Patrick McHardy
` (7 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: remove useless debugging
Originally I wanted to just remove the QDEBUG macro and use pr_debug, but
none of the messages seems worth keeping.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit adf817a9cb4ba64618227e93a4d4f84fedc72ef1
tree 7395a15bcbda516aa4cc40f3ffde5ab8d813cf2f
parent 264c2cc068091460172646e0611e96611684355a
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:14 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:34 +0100
net/netfilter/nfnetlink_queue.c | 35 ++++-------------------------------
1 files changed, 4 insertions(+), 31 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 37b7655..c3aba1e 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -37,14 +37,6 @@
#define NFQNL_QMAX_DEFAULT 1024
-#if 0
-#define QDEBUG(x, args ...) printk(KERN_DEBUG "%s(%d):%s(): " x, \
- __FILE__, __LINE__, __FUNCTION__, \
- ## args)
-#else
-#define QDEBUG(x, ...)
-#endif
-
struct nfqnl_instance {
struct hlist_node hlist; /* global list of queues */
struct rcu_head rcu;
@@ -96,17 +88,12 @@ instance_lookup(u_int16_t queue_num)
static struct nfqnl_instance *
instance_create(u_int16_t queue_num, int pid)
{
- struct nfqnl_instance *inst;
+ struct nfqnl_instance *inst = NULL;
unsigned int h;
- QDEBUG("entering for queue_num=%u, pid=%d\n", queue_num, pid);
-
spin_lock(&instances_lock);
- if (instance_lookup(queue_num)) {
- inst = NULL;
- QDEBUG("aborting, instance already exists\n");
+ if (instance_lookup(queue_num))
goto out_unlock;
- }
inst = kzalloc(sizeof(*inst), GFP_ATOMIC);
if (!inst)
@@ -129,8 +116,6 @@ instance_create(u_int16_t queue_num, int pid)
spin_unlock(&instances_lock);
- QDEBUG("successfully created new instance\n");
-
return inst;
out_free:
@@ -232,8 +217,6 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
struct net_device *outdev;
__be32 tmp_uint;
- QDEBUG("entered\n");
-
size = NLMSG_ALIGN(sizeof(struct nfgenmsg))
+ nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
+ nla_total_size(sizeof(u_int32_t)) /* ifindex */
@@ -422,19 +405,13 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
struct sk_buff *nskb;
struct nfqnl_instance *queue;
- QDEBUG("entered\n");
-
/* rcu_read_lock()ed by nf_hook_slow() */
queue = instance_lookup(queuenum);
- if (!queue) {
- QDEBUG("no queue instance matching\n");
+ if (!queue)
return -EINVAL;
- }
- if (queue->copy_mode == NFQNL_COPY_NONE) {
- QDEBUG("mode COPY_NONE, aborting\n");
+ if (queue->copy_mode == NFQNL_COPY_NONE)
return -EAGAIN;
- }
nskb = nfqnl_build_packet_message(queue, entry, &status);
if (nskb == NULL)
@@ -568,8 +545,6 @@ nfqnl_dev_drop(int ifindex)
{
int i;
- QDEBUG("entering for ifindex %u\n", ifindex);
-
rcu_read_lock();
for (i = 0; i < INSTANCE_BUCKETS; i++) {
@@ -733,8 +708,6 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
struct nfqnl_msg_config_cmd *cmd = NULL;
int ret = 0;
- QDEBUG("entering for msg %u\n", NFNL_MSG_TYPE(nlh->nlmsg_type));
-
if (nfqa[NFQA_CFG_CMD]) {
cmd = nla_data(nfqa[NFQA_CFG_CMD]);
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 43/49]: nfnetlink_queue: mark hash table __read_mostly
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (40 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 42/49]: nfnetlink_queue: remove useless debugging Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 44/49]: nfnetlink_queue: use endianness-aware attribute functions Patrick McHardy
` (6 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: mark hash table __read_mostly
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 0f3f456cc6f127fd14808cc03937ddca79057777
tree afeb9ba6ce5596ef9b626045906b3d43d58b94af
parent adf817a9cb4ba64618227e93a4d4f84fedc72ef1
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:17 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:34 +0100
net/netfilter/nfnetlink_queue.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index c3aba1e..de48fd3 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -63,7 +63,7 @@ typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long);
static DEFINE_SPINLOCK(instances_lock);
#define INSTANCE_BUCKETS 16
-static struct hlist_head instance_table[INSTANCE_BUCKETS];
+static struct hlist_head instance_table[INSTANCE_BUCKETS] __read_mostly;
static inline u_int8_t instance_hashfn(u_int16_t queue_num)
{
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 44/49]: nfnetlink_queue: use endianness-aware attribute functions
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (41 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 43/49]: nfnetlink_queue: mark hash table __read_mostly Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:02 ` [NETFILTER 45/49]: nfnetlink_queue: eliminate impossible switch case Patrick McHardy
` (5 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: use endianness-aware attribute functions
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit d6607c3125212178c2b519dc6304fd38a6ed2ee9
tree a5e532424e0c8f37415f7166b7ba6cb0b17d993d
parent 0f3f456cc6f127fd14808cc03937ddca79057777
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:20 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:35 +0100
net/netfilter/nfnetlink_queue.c | 60 +++++++++++++++------------------------
1 files changed, 23 insertions(+), 37 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index de48fd3..436b442 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -215,7 +215,6 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
struct sk_buff *entskb = entry->skb;
struct net_device *indev;
struct net_device *outdev;
- __be32 tmp_uint;
size = NLMSG_ALIGN(sizeof(struct nfgenmsg))
+ nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
@@ -286,69 +285,57 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
indev = entry->indev;
if (indev) {
- tmp_uint = htonl(indev->ifindex);
#ifndef CONFIG_BRIDGE_NETFILTER
- NLA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex));
#else
if (entry->pf == PF_BRIDGE) {
/* Case 1: indev is physical input device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
- NLA_PUT(skb, NFQA_IFINDEX_PHYSINDEV, sizeof(tmp_uint),
- &tmp_uint);
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSINDEV,
+ htonl(indev->ifindex));
/* this is the bridge group "brX" */
- tmp_uint = htonl(indev->br_port->br->dev->ifindex);
- NLA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
- &tmp_uint);
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_INDEV,
+ htonl(indev->br_port->br->dev->ifindex));
} else {
/* Case 2: indev is bridge group, we need to look for
* physical device (when called from ipv4) */
- NLA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
- &tmp_uint);
- if (entskb->nf_bridge
- && entskb->nf_bridge->physindev) {
- tmp_uint = htonl(entskb->nf_bridge->physindev->ifindex);
- NLA_PUT(skb, NFQA_IFINDEX_PHYSINDEV,
- sizeof(tmp_uint), &tmp_uint);
- }
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_INDEV,
+ htonl(indev->ifindex));
+ if (entskb->nf_bridge && entskb->nf_bridge->physindev)
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSINDEV,
+ htonl(entskb->nf_bridge->physindev->ifindex));
}
#endif
}
if (outdev) {
- tmp_uint = htonl(outdev->ifindex);
#ifndef CONFIG_BRIDGE_NETFILTER
- NLA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex));
#else
if (entry->pf == PF_BRIDGE) {
/* Case 1: outdev is physical output device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
- NLA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint),
- &tmp_uint);
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSOUTDEV,
+ htonl(outdev->ifindex));
/* this is the bridge group "brX" */
- tmp_uint = htonl(outdev->br_port->br->dev->ifindex);
- NLA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
- &tmp_uint);
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_OUTDEV,
+ htonl(outdev->br_port->br->dev->ifindex));
} else {
/* Case 2: outdev is bridge group, we need to look for
* physical output device (when called from ipv4) */
- NLA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
- &tmp_uint);
- if (entskb->nf_bridge
- && entskb->nf_bridge->physoutdev) {
- tmp_uint = htonl(entskb->nf_bridge->physoutdev->ifindex);
- NLA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV,
- sizeof(tmp_uint), &tmp_uint);
- }
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_OUTDEV,
+ htonl(outdev->ifindex));
+ if (entskb->nf_bridge && entskb->nf_bridge->physoutdev)
+ NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSOUTDEV,
+ htonl(entskb->nf_bridge->physoutdev->ifindex));
}
#endif
}
- if (entskb->mark) {
- tmp_uint = htonl(entskb->mark);
- NLA_PUT(skb, NFQA_MARK, sizeof(u_int32_t), &tmp_uint);
- }
+ if (entskb->mark)
+ NLA_PUT_BE32(skb, NFQA_MARK, htonl(entskb->mark));
if (indev && entskb->dev) {
struct nfqnl_msg_packet_hw phw;
@@ -670,8 +657,7 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
}
if (nfqa[NFQA_MARK])
- entry->skb->mark = ntohl(*(__be32 *)
- nla_data(nfqa[NFQA_MARK]));
+ entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
nf_reinject(entry, verdict);
return 0;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 45/49]: nfnetlink_queue: eliminate impossible switch case
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (42 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 44/49]: nfnetlink_queue: use endianness-aware attribute functions Patrick McHardy
@ 2007-12-04 12:02 ` Patrick McHardy
2007-12-04 12:03 ` [NETFILTER 46/49]: nfnetlink_queue: remove useless enqueue status codes Patrick McHardy
` (4 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:02 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: eliminate impossible switch case
We don't need a default case in nfqnl_build_packet_message(), the
copy_mode is validated when it is set. Tell the compiler about
the possible types and remove the default case. Saves 80b of
text on x86_64.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 9e5fe442940e535b1839192dfde9ef67ae1a3042
tree 42c7a34a6fc51a63e4b9a95cd1667b9bbdd73bb4
parent d6607c3125212178c2b519dc6304fd38a6ed2ee9
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:22 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:35 +0100
net/netfilter/nfnetlink_queue.c | 7 +------
1 files changed, 1 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 436b442..abd5ff9 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -232,7 +232,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
spin_lock_bh(&queue->lock);
- switch (queue->copy_mode) {
+ switch ((enum nfqnl_config_mode)queue->copy_mode) {
case NFQNL_COPY_META:
case NFQNL_COPY_NONE:
data_len = 0;
@@ -253,11 +253,6 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
size += nla_total_size(data_len);
break;
-
- default:
- *errp = -EINVAL;
- spin_unlock_bh(&queue->lock);
- return NULL;
}
entry->id = queue->id_sequence++;
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 46/49]: nfnetlink_queue: remove useless enqueue status codes
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (43 preceding siblings ...)
2007-12-04 12:02 ` [NETFILTER 45/49]: nfnetlink_queue: eliminate impossible switch case Patrick McHardy
@ 2007-12-04 12:03 ` Patrick McHardy
2007-12-04 12:03 ` [NETFILTER 47/49]: nfnetlink_queue: update copyright Patrick McHardy
` (3 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:03 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: remove useless enqueue status codes
The queueing core doesn't care about the exact return value from
the queue handler, so there's no need to go through the trouble
of returning a meaningful value as long as we indicate an error.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 6601c07684fee94541f63c45456d2410f2e522a6
tree 77b2a3a8887d8571fee11645b167bfaea9a47128
parent 9e5fe442940e535b1839192dfde9ef67ae1a3042
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:25 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:35 +0100
net/netfilter/nfnetlink_queue.c | 26 ++++++++++++--------------
1 files changed, 12 insertions(+), 14 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index abd5ff9..6148a41 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -203,7 +203,7 @@ nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
static struct sk_buff *
nfqnl_build_packet_message(struct nfqnl_instance *queue,
- struct nf_queue_entry *entry, int *errp)
+ struct nf_queue_entry *entry)
{
sk_buff_data_t old_tail;
size_t size;
@@ -241,7 +241,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
case NFQNL_COPY_PACKET:
if ((entskb->ip_summed == CHECKSUM_PARTIAL ||
entskb->ip_summed == CHECKSUM_COMPLETE) &&
- (*errp = skb_checksum_help(entskb))) {
+ skb_checksum_help(entskb)) {
spin_unlock_bh(&queue->lock);
return NULL;
}
@@ -374,7 +374,6 @@ nlmsg_failure:
nla_put_failure:
if (skb)
kfree_skb(skb);
- *errp = -EINVAL;
if (net_ratelimit())
printk(KERN_ERR "nf_queue: error creating packet message\n");
return NULL;
@@ -383,21 +382,21 @@ nla_put_failure:
static int
nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
{
- int status = -EINVAL;
struct sk_buff *nskb;
struct nfqnl_instance *queue;
+ int err;
/* rcu_read_lock()ed by nf_hook_slow() */
queue = instance_lookup(queuenum);
if (!queue)
- return -EINVAL;
+ goto err_out;
if (queue->copy_mode == NFQNL_COPY_NONE)
- return -EAGAIN;
+ goto err_out;
- nskb = nfqnl_build_packet_message(queue, entry, &status);
+ nskb = nfqnl_build_packet_message(queue, entry);
if (nskb == NULL)
- return status;
+ goto err_out;
spin_lock_bh(&queue->lock);
@@ -406,7 +405,6 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
if (queue->queue_total >= queue->queue_maxlen) {
queue->queue_dropped++;
- status = -ENOSPC;
if (net_ratelimit())
printk(KERN_WARNING "nf_queue: full at %d entries, "
"dropping packets(s). Dropped: %d\n",
@@ -415,8 +413,8 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
}
/* nfnetlink_unicast will either free the nskb or add it to a socket */
- status = nfnetlink_unicast(nskb, queue->peer_pid, MSG_DONTWAIT);
- if (status < 0) {
+ err = nfnetlink_unicast(nskb, queue->peer_pid, MSG_DONTWAIT);
+ if (err < 0) {
queue->queue_user_dropped++;
goto err_out_unlock;
}
@@ -424,14 +422,14 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
__enqueue_entry(queue, entry);
spin_unlock_bh(&queue->lock);
- return status;
+ return 0;
err_out_free_nskb:
kfree_skb(nskb);
-
err_out_unlock:
spin_unlock_bh(&queue->lock);
- return status;
+err_out:
+ return -1;
}
static int
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 47/49]: nfnetlink_queue: update copyright
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (44 preceding siblings ...)
2007-12-04 12:03 ` [NETFILTER 46/49]: nfnetlink_queue: remove useless enqueue status codes Patrick McHardy
@ 2007-12-04 12:03 ` Patrick McHardy
2007-12-04 12:03 ` [NETFILTER 48/49]: remove NF_CONNTRACK_ENABLED option Patrick McHardy
` (2 subsequent siblings)
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:03 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: nfnetlink_queue: update copyright
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 999e49b544d7f49aef25b4331c6d33c106a591ec
tree 8edbe2b2ac952f07d6cd66ad243dfeb966775e79
parent 6601c07684fee94541f63c45456d2410f2e522a6
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:36 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:36 +0100
net/netfilter/nfnetlink_queue.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 6148a41..d94de48 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -3,6 +3,7 @@
* userspace via nfetlink.
*
* (C) 2005 by Harald Welte <laforge@netfilter.org>
+ * (C) 2007 by Patrick McHardy <kaber@trash.net>
*
* Based on the old ipv4-only ip_queue.c:
* (C) 2000-2002 James Morris <jmorris@intercode.com.au>
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 48/49]: remove NF_CONNTRACK_ENABLED option
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (45 preceding siblings ...)
2007-12-04 12:03 ` [NETFILTER 47/49]: nfnetlink_queue: update copyright Patrick McHardy
@ 2007-12-04 12:03 ` Patrick McHardy
2007-12-04 12:03 ` [NETFILTER 49/49]: Select CONFIG_NETFILTER_NETLINK when needed Patrick McHardy
2007-12-05 9:35 ` [NETFILTER 00/49]: Netfilter update David Miller
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:03 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: remove NF_CONNTRACK_ENABLED option
Remove the NF_CONNTRACK_ENABLED option. It was meant for a smoother upgrade
to nf_conntrack, people having reconfigured their kernel at least once since
ip_conntrack was removed will have the NF_CONNTRACK option already set.
People upgrading from older kernels have to reconfigure a lot anyway.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 961020004705df03d7f44449985d98ed4b99a0f7
tree 7b7419f8ed05d9f23f467876aee969b951c7a4f7
parent 999e49b544d7f49aef25b4331c6d33c106a591ec
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:31 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:36 +0100
net/netfilter/Kconfig | 7 +------
1 files changed, 1 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 4182393..772c58c 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -25,8 +25,7 @@ config NETFILTER_NETLINK_LOG
and is also scheduled to replace the old syslog-based ipt_LOG
and ip6t_LOG modules.
-# Rename this to NF_CONNTRACK in a 2.6.25
-config NF_CONNTRACK_ENABLED
+config NF_CONNTRACK
tristate "Netfilter connection tracking support"
help
Connection tracking keeps a record of what packets have passed
@@ -40,10 +39,6 @@ config NF_CONNTRACK_ENABLED
To compile it as a module, choose M here. If unsure, say N.
-config NF_CONNTRACK
- tristate
- default NF_CONNTRACK_ENABLED
-
config NF_CT_ACCT
bool "Connection tracking flow accounting"
depends on NF_CONNTRACK
^ permalink raw reply related [flat|nested] 50+ messages in thread* [NETFILTER 49/49]: Select CONFIG_NETFILTER_NETLINK when needed
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (46 preceding siblings ...)
2007-12-04 12:03 ` [NETFILTER 48/49]: remove NF_CONNTRACK_ENABLED option Patrick McHardy
@ 2007-12-04 12:03 ` Patrick McHardy
2007-12-05 9:35 ` [NETFILTER 00/49]: Netfilter update David Miller
48 siblings, 0 replies; 50+ messages in thread
From: Patrick McHardy @ 2007-12-04 12:03 UTC (permalink / raw)
To: davem; +Cc: Patrick McHardy, netfilter-devel
[NETFILTER]: Select CONFIG_NETFILTER_NETLINK when needed
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit c2bf9632fd83ce5b3b66dcafde0d447a50b45fdd
tree 780a893558e5ac335fb5f35bc0357800528d93a4
parent 961020004705df03d7f44449985d98ed4b99a0f7
author Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 10:48:34 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 04 Dec 2007 12:37:37 +0100
net/netfilter/Kconfig | 13 +++++--------
1 files changed, 5 insertions(+), 8 deletions(-)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 772c58c..bb61f83 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -2,21 +2,18 @@ menu "Core Netfilter Configuration"
depends on NET && INET && NETFILTER
config NETFILTER_NETLINK
- tristate "Netfilter netlink interface"
- help
- If this option is enabled, the kernel will include support
- for the new netfilter netlink interface.
+ tristate
config NETFILTER_NETLINK_QUEUE
tristate "Netfilter NFQUEUE over NFNETLINK interface"
- depends on NETFILTER_NETLINK
+ select NETFILTER_NETLINK
help
If this option is enabled, the kernel will include support
for queueing packets via NFNETLINK.
config NETFILTER_NETLINK_LOG
tristate "Netfilter LOG over NFNETLINK interface"
- depends on NETFILTER_NETLINK
+ select NETFILTER_NETLINK
help
If this option is enabled, the kernel will include support
for logging packets via NFNETLINK.
@@ -246,8 +243,8 @@ config NF_CONNTRACK_TFTP
config NF_CT_NETLINK
tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
- depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
- depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
+ depends on EXPERIMENTAL && NF_CONNTRACK
+ select NETFILTER_NETLINK
depends on NF_NAT=n || NF_NAT
help
This option enables support for a netlink-based userspace interface
^ permalink raw reply related [flat|nested] 50+ messages in thread* Re: [NETFILTER 00/49]: Netfilter update
2007-12-04 12:01 [NETFILTER 00/49]: Netfilter update Patrick McHardy
` (47 preceding siblings ...)
2007-12-04 12:03 ` [NETFILTER 49/49]: Select CONFIG_NETFILTER_NETLINK when needed Patrick McHardy
@ 2007-12-05 9:35 ` David Miller
48 siblings, 0 replies; 50+ messages in thread
From: David Miller @ 2007-12-05 9:35 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel
From: Patrick McHardy <kaber@trash.net>
Date: Tue, 4 Dec 2007 13:01:54 +0100 (MET)
> following is the first batch of my netfilter patches for 2.6.25,
> containing (among other things) some x_tables unification patches
> for the owner and tos matches and the TOS target, and new
> TCPOPTSTRIP target to strip away TCP options as workaround for
> broken firewalls, a new RATEEST target + rateest match for rate
> estimation, a large queueing cleanup and some optimizations and
> a few patches to remove runtime dependencies of x_tables modules
> and the H.323 helper on IPv6 modules. The CONFIG_NETFILTER_ADVANCED
> patch is not included yet since I'm not entirely happy with it.
All applied and pushed out, thanks a lot Patrick.
^ permalink raw reply [flat|nested] 50+ messages in thread