From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 07/21] netfilter: nf_tables: use struct nft_verdict within struct nft_data
Date: Mon, 13 Apr 2015 21:29:46 +0200 [thread overview]
Message-ID: <1428953401-4838-8-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1428953401-4838-1-git-send-email-pablo@netfilter.org>
From: Patrick McHardy <kaber@trash.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables.h | 7 ++-----
net/netfilter/nf_tables_api.c | 38 ++++++++++++++++++++-----------------
2 files changed, 23 insertions(+), 22 deletions(-)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 79582d0..81cd816 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -49,11 +49,8 @@ struct nft_verdict {
struct nft_data {
union {
- u32 data[4];
- struct {
- u32 verdict;
- struct nft_chain *chain;
- };
+ u32 data[4];
+ struct nft_verdict verdict;
};
} __attribute__((aligned(__alignof__(u64))));
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d47f12b..0bb16a1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4049,10 +4049,10 @@ static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
return 0;
data = nft_set_ext_data(ext);
- switch (data->verdict) {
+ switch (data->verdict.code) {
case NFT_JUMP:
case NFT_GOTO:
- return nf_tables_check_loops(ctx, data->chain);
+ return nf_tables_check_loops(ctx, data->verdict.chain);
default:
return 0;
}
@@ -4085,10 +4085,11 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
if (data == NULL)
continue;
- switch (data->verdict) {
+ switch (data->verdict.code) {
case NFT_JUMP:
case NFT_GOTO:
- err = nf_tables_check_loops(ctx, data->chain);
+ err = nf_tables_check_loops(ctx,
+ data->verdict.chain);
if (err < 0)
return err;
default:
@@ -4171,15 +4172,17 @@ int nft_validate_register_store(const struct nft_ctx *ctx,
return -EINVAL;
if (data != NULL &&
- (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP)) {
- err = nf_tables_check_loops(ctx, data->chain);
+ (data->verdict.code == NFT_GOTO ||
+ data->verdict.code == NFT_JUMP)) {
+ err = nf_tables_check_loops(ctx, data->verdict.chain);
if (err < 0)
return err;
- if (ctx->chain->level + 1 > data->chain->level) {
+ if (ctx->chain->level + 1 >
+ data->verdict.chain->level) {
if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
return -EMLINK;
- data->chain->level = ctx->chain->level + 1;
+ data->verdict.chain->level = ctx->chain->level + 1;
}
}
@@ -4220,11 +4223,11 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
if (!tb[NFTA_VERDICT_CODE])
return -EINVAL;
- data->verdict = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
+ data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
- switch (data->verdict) {
+ switch (data->verdict.code) {
default:
- switch (data->verdict & NF_VERDICT_MASK) {
+ switch (data->verdict.code & NF_VERDICT_MASK) {
case NF_ACCEPT:
case NF_DROP:
case NF_QUEUE:
@@ -4250,7 +4253,7 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
return -EOPNOTSUPP;
chain->use++;
- data->chain = chain;
+ data->verdict.chain = chain;
desc->len = sizeof(data);
break;
}
@@ -4261,10 +4264,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
static void nft_verdict_uninit(const struct nft_data *data)
{
- switch (data->verdict) {
+ switch (data->verdict.code) {
case NFT_JUMP:
case NFT_GOTO:
- data->chain->use--;
+ data->verdict.chain->use--;
break;
}
}
@@ -4277,13 +4280,14 @@ static int nft_verdict_dump(struct sk_buff *skb, const struct nft_data *data)
if (!nest)
goto nla_put_failure;
- if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict)))
+ if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict.code)))
goto nla_put_failure;
- switch (data->verdict) {
+ switch (data->verdict.code) {
case NFT_JUMP:
case NFT_GOTO:
- if (nla_put_string(skb, NFTA_VERDICT_CHAIN, data->chain->name))
+ if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
+ data->verdict.chain->name))
goto nla_put_failure;
}
nla_nest_end(skb, nest);
--
1.7.10.4
next prev parent reply other threads:[~2015-04-13 19:25 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-13 19:29 [PATCH 00/21] Netfilter updates for net-next Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 01/21] netfilter: nf_tables: validate len in nft_validate_data_load() Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 02/21] netfilter: nf_tables: rename nft_validate_data_load() Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 03/21] netfilter: nft_lookup: use nft_validate_register_store() to validate types Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 04/21] netfilter: nf_tables: kill nft_validate_output_register() Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 05/21] netfilter: nf_tables: introduce nft_validate_register_load() Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 06/21] netfilter: nf_tables: get rid of NFT_REG_VERDICT usage Pablo Neira Ayuso
2015-04-13 19:29 ` Pablo Neira Ayuso [this message]
2015-04-13 19:29 ` [PATCH 08/21] netfilter: nf_tables: convert expressions to u32 register pointers Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 09/21] netfilter: nf_tables: kill nft_data_cmp() Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 10/21] netfilter: nf_tables: convert sets to u32 data pointers Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 11/21] netfilter: nf_tables: add register parsing/dumping helpers Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 12/21] netfilter: nf_tables: switch registers to 32 bit addressing Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 13/21] netfilter: nf_tables: support variable sized data in nft_data_init() Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 14/21] netfilter: nf_tables: variable sized set element keys / data Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 15/21] uapi: ebtables: don't include linux/if.h Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 16/21] netfilter: nf_tables: add helper functions for expression handling Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 17/21] netfilter: nf_tables: prepare for expressions associated to set elements Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 18/21] netfilter: nf_tables: mark stateful expressions Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 19/21] netfilter: nf_tables: add flag to indicate set contains expressions Pablo Neira Ayuso
2015-04-13 19:29 ` [PATCH 20/21] netfilter: nft_dynset: dynamic stateful expression instantiation Pablo Neira Ayuso
2015-04-13 19:30 ` [PATCH 21/21] netfilter: nf_tables: get rid of the expression example code Pablo Neira Ayuso
2015-04-14 2:18 ` [PATCH 00/21] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1428953401-4838-8-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).