From: Jan Engelhardt <jengelh@medozas.de>
To: kaber@trash.net
Cc: netfilter-devel@vger.kernel.org
Subject: [PATCH 06/11] netfilter: xtables: consolidate open-coded logic
Date: Fri, 8 May 2009 11:26:36 +0200 [thread overview]
Message-ID: <1241774801-2315-7-git-send-email-jengelh@medozas.de> (raw)
In-Reply-To: <1241774801-2315-1-git-send-email-jengelh@medozas.de>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
net/bridge/netfilter/ebtables.c | 16 ++++++++++------
net/ipv4/netfilter/arp_tables.c | 14 ++++++++++----
net/ipv4/netfilter/ip_tables.c | 14 ++++++++++----
net/ipv6/netfilter/ip6_tables.c | 14 ++++++++++----
4 files changed, 40 insertions(+), 18 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 820252a..2455583 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -142,6 +142,12 @@ static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
return 0;
}
+static inline __pure
+struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
+{
+ return (void *)entry + entry->next_offset;
+}
+
/* Do some firewalling */
unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out,
@@ -249,8 +255,7 @@ letsreturn:
/* jump to a udc */
cs[sp].n = i + 1;
cs[sp].chaininfo = chaininfo;
- cs[sp].e = (struct ebt_entry *)
- (((char *)point) + point->next_offset);
+ cs[sp].e = ebt_next_entry(point);
i = 0;
chaininfo = (struct ebt_entries *) (base + verdict);
#ifdef CONFIG_NETFILTER_DEBUG
@@ -266,8 +271,7 @@ letsreturn:
sp++;
continue;
letscontinue:
- point = (struct ebt_entry *)
- (((char *)point) + point->next_offset);
+ point = ebt_next_entry(point);
i++;
}
@@ -787,7 +791,7 @@ static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s
/* this can't be 0, so the loop test is correct */
cl_s[i].cs.n = pos + 1;
pos = 0;
- cl_s[i].cs.e = ((void *)e + e->next_offset);
+ cl_s[i].cs.e = ebt_next_entry(e);
e = (struct ebt_entry *)(hlp2->data);
nentries = hlp2->nentries;
cl_s[i].from = chain_nr;
@@ -797,7 +801,7 @@ static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s
continue;
}
letscontinue:
- e = (void *)e + e->next_offset;
+ e = ebt_next_entry(e);
pos++;
}
return 0;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 831fe18..940e54b 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -231,6 +231,12 @@ static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
return (struct arpt_entry *)(base + offset);
}
+static inline __pure
+struct arpt_entry *arpt_next_entry(const struct arpt_entry *entry)
+{
+ return (void *)entry + entry->next_offset;
+}
+
unsigned int arpt_do_table(struct sk_buff *skb,
unsigned int hook,
const struct net_device *in,
@@ -295,10 +301,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
continue;
}
if (table_base + v
- != (void *)e + e->next_offset) {
+ != arpt_next_entry(e)) {
/* Save old back ptr in next entry */
struct arpt_entry *next
- = (void *)e + e->next_offset;
+ = arpt_next_entry(e);
next->comefrom =
(void *)back - table_base;
@@ -320,13 +326,13 @@ unsigned int arpt_do_table(struct sk_buff *skb,
arp = arp_hdr(skb);
if (verdict == ARPT_CONTINUE)
- e = (void *)e + e->next_offset;
+ e = arpt_next_entry(e);
else
/* Verdict */
break;
}
} else {
- e = (void *)e + e->next_offset;
+ e = arpt_next_entry(e);
}
} while (!hotdrop);
xt_info_rdunlock_bh();
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 16b7c09..7ec4e40 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -297,6 +297,12 @@ static void trace_packet(struct sk_buff *skb,
}
#endif
+static inline __pure
+struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
+{
+ return (void *)entry + entry->next_offset;
+}
+
/* Returns one of the generic firewall policies, like NF_ACCEPT. */
unsigned int
ipt_do_table(struct sk_buff *skb,
@@ -385,11 +391,11 @@ ipt_do_table(struct sk_buff *skb,
back->comefrom);
continue;
}
- if (table_base + v != (void *)e + e->next_offset
+ if (table_base + v != ipt_next_entry(e)
&& !(e->ip.flags & IPT_F_GOTO)) {
/* Save old back ptr in next entry */
struct ipt_entry *next
- = (void *)e + e->next_offset;
+ = ipt_next_entry(e);
next->comefrom
= (void *)back - table_base;
/* set back pointer to next entry */
@@ -424,7 +430,7 @@ ipt_do_table(struct sk_buff *skb,
datalen = skb->len - ip->ihl * 4;
if (verdict == IPT_CONTINUE)
- e = (void *)e + e->next_offset;
+ e = ipt_next_entry(e);
else
/* Verdict */
break;
@@ -432,7 +438,7 @@ ipt_do_table(struct sk_buff *skb,
} else {
no_match:
- e = (void *)e + e->next_offset;
+ e = ipt_next_entry(e);
}
} while (!hotdrop);
xt_info_rdunlock_bh();
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 4853a3d..9176e98 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -329,6 +329,12 @@ static void trace_packet(struct sk_buff *skb,
}
#endif
+static inline __pure struct ip6t_entry *
+ip6t_next_entry(const struct ip6t_entry *entry)
+{
+ return (void *)entry + entry->next_offset;
+}
+
/* Returns one of the generic firewall policies, like NF_ACCEPT. */
unsigned int
ip6t_do_table(struct sk_buff *skb,
@@ -414,11 +420,11 @@ ip6t_do_table(struct sk_buff *skb,
back->comefrom);
continue;
}
- if (table_base + v != (void *)e + e->next_offset
+ if (table_base + v != ip6t_next_entry(e)
&& !(e->ipv6.flags & IP6T_F_GOTO)) {
/* Save old back ptr in next entry */
struct ip6t_entry *next
- = (void *)e + e->next_offset;
+ = ip6t_next_entry(e);
next->comefrom
= (void *)back - table_base;
/* set back pointer to next entry */
@@ -451,7 +457,7 @@ ip6t_do_table(struct sk_buff *skb,
= 0x57acc001;
#endif
if (verdict == IP6T_CONTINUE)
- e = (void *)e + e->next_offset;
+ e = ip6t_next_entry(e);
else
/* Verdict */
break;
@@ -459,7 +465,7 @@ ip6t_do_table(struct sk_buff *skb,
} else {
no_match:
- e = (void *)e + e->next_offset;
+ e = ip6t_next_entry(e);
}
} while (!hotdrop);
--
1.6.2.2
next prev parent reply other threads:[~2009-05-08 9:26 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-05-08 9:26 kernel/iptables patches Jan Engelhardt
2009-05-08 9:26 ` [PATCH 01/11] netfilter: xtables: use NFPROTO_ for xt_proto_init callsites Jan Engelhardt
2009-05-08 9:26 ` [PATCH 02/11] netfilter: queue: use NFPROTO_ for queue callsites Jan Engelhardt
2009-05-08 9:26 ` [PATCH 03/11] netfilter: xtables: use NFPROTO_ in standard targets Jan Engelhardt
2009-05-08 9:26 ` [PATCH 04/11] netfilter: xtables: remove redundant casts Jan Engelhardt
2009-05-08 9:26 ` [PATCH 05/11] netfilter: xtables: fix const inconsistency Jan Engelhardt
2009-05-08 9:26 ` Jan Engelhardt [this message]
2009-05-08 9:26 ` [PATCH 07/11] netfilter: xtables: reduce indent level by one Jan Engelhardt
2009-05-09 2:08 ` Amos Jeffries
2009-05-09 4:00 ` Jan Engelhardt
2009-05-10 13:39 ` Amos Jeffries
2009-05-08 9:26 ` [PATCH 08/11] netfilter: xtables: remove some goto Jan Engelhardt
2009-05-08 9:26 ` [PATCH 09/11] netfilter: xtables: remove another level of indent Jan Engelhardt
2009-05-08 9:26 ` [PATCH 10/11] netfilter: xtables: consolidate comefrom debug cast access Jan Engelhardt
2009-05-08 9:26 ` [PATCH 11/11] netfilter: xtables: print hook name instead of mask Jan Engelhardt
2009-05-09 2:06 ` Amos Jeffries
2009-06-01 11:00 ` kernel/iptables patches Jan Engelhardt
2009-06-02 11:53 ` Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1241774801-2315-7-git-send-email-jengelh@medozas.de \
--to=jengelh@medozas.de \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).