From: Patrick McHardy <kaber@trash.net>
To: davem@davemloft.net
Cc: Patrick McHardy <kaber@trash.net>, netfilter-devel@vger.kernel.org
Subject: netfilter 59/79: ebtables: use generic table checking
Date: Wed, 8 Oct 2008 12:47:40 +0200 (MEST) [thread overview]
Message-ID: <20081008104740.10423.53341.sendpatchset@x2.localnet> (raw)
In-Reply-To: <20081008104621.10423.12648.sendpatchset@x2.localnet>
commit f2ff525c8dae57b3cda51d76443f60f764f34202
Author: Jan Engelhardt <jengelh@medozas.de>
Date: Wed Oct 8 11:35:15 2008 +0200
netfilter: ebtables: use generic table checking
Ebtables ORs (1 << NF_BR_NUMHOOKS) into the hook mask to indicate that
the extension was called from a base chain. So this also needs to be
present in the extensions' ->hooks.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 8071b64..0e51c8d 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -73,8 +73,6 @@ ebt_arpreply_tg_check(const char *tablename, const void *entry,
e->invflags & EBT_IPROTO)
return false;
CLEAR_BASE_CHAIN_BIT;
- if (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING))
- return false;
return true;
}
@@ -82,6 +80,8 @@ static struct xt_target ebt_arpreply_tg_reg __read_mostly = {
.name = "arpreply",
.revision = 0,
.family = NFPROTO_BRIDGE,
+ .table = "nat",
+ .hooks = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING),
.target = ebt_arpreply_tg,
.checkentry = ebt_arpreply_tg_check,
.targetsize = XT_ALIGN(sizeof(struct ebt_arpreply_info)),
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index d2211c4..cb80101 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -51,6 +51,8 @@ static struct xt_target ebt_dnat_tg_reg __read_mostly = {
.name = "dnat",
.revision = 0,
.family = NFPROTO_BRIDGE,
+ .hooks = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING) |
+ (1 << NF_BR_LOCAL_OUT) | (1 << NF_BR_BROUTING),
.target = ebt_dnat_tg,
.checkentry = ebt_dnat_tg_check,
.targetsize = XT_ALIGN(sizeof(struct ebt_nat_info)),
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 1b7684f..a50ffbe 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -56,6 +56,8 @@ static struct xt_target ebt_redirect_tg_reg __read_mostly = {
.name = "redirect",
.revision = 0,
.family = NFPROTO_BRIDGE,
+ .hooks = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING) |
+ (1 << NF_BR_BROUTING),
.target = ebt_redirect_tg,
.checkentry = ebt_redirect_tg_check,
.targetsize = XT_ALIGN(sizeof(struct ebt_redirect_info)),
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index c90217a..8a55c7d 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -56,10 +56,6 @@ ebt_snat_tg_check(const char *tablename, const void *e,
if (BASE_CHAIN && tmp == EBT_RETURN)
return false;
CLEAR_BASE_CHAIN_BIT;
- if (strcmp(tablename, "nat"))
- return false;
- if (hookmask & ~(1 << NF_BR_POST_ROUTING))
- return false;
if (tmp < -NUM_STANDARD_TARGETS || tmp >= 0)
return false;
@@ -73,6 +69,8 @@ static struct xt_target ebt_snat_tg_reg __read_mostly = {
.name = "snat",
.revision = 0,
.family = NFPROTO_BRIDGE,
+ .table = "nat",
+ .hooks = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_POST_ROUTING),
.target = ebt_snat_tg,
.checkentry = ebt_snat_tg_check,
.targetsize = XT_ALIGN(sizeof(struct ebt_nat_info)),
next prev parent reply other threads:[~2008-10-08 10:47 UTC|newest]
Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-10-08 10:46 netfilter 00/79: netfilter update Patrick McHardy
2008-10-08 10:46 ` netfilter 01/79: Use unsigned types for hooknum and pf vars Patrick McHardy
2008-10-08 10:46 ` netfilter 02/79: rename ipt_recent to xt_recent Patrick McHardy
2008-10-08 10:46 ` netfilter 03/79: xt_recent: IPv6 support Patrick McHardy
2008-10-08 10:46 ` netfilter 04/79: Introduce NFPROTO_* constants Patrick McHardy
2008-10-08 10:46 ` netfilter 05/79: x_tables: use NFPROTO_* in extensions Patrick McHardy
2008-10-08 10:46 ` netfilter 06/79: implement NFPROTO_UNSPEC as a wildcard for extensions Patrick McHardy
2008-10-08 10:46 ` netfilter 07/79: netns: remove nf_*_net() wrappers Patrick McHardy
2008-10-08 10:46 ` netfilter 08/79: netns: ip6table_raw in netns for real Patrick McHardy
2008-10-08 10:46 ` netfilter 09/79: netns: ip6table_mangle " Patrick McHardy
2008-10-08 10:46 ` netfilter 10/79: netns: ip6t_REJECT " Patrick McHardy
2008-10-08 10:46 ` netfilter 11/79: netns nf_conntrack: add netns boilerplate Patrick McHardy
2008-10-08 10:46 ` netfilter 12/79: netns nf_conntrack: add ->ct_net pointer from conntrack to netns Patrick McHardy
2008-10-08 10:46 ` netfilter 13/79: netns nf_conntrack: per-netns conntrack count Patrick McHardy
2008-10-08 10:46 ` netfilter 14/79: netns nf_conntrack: per-netns conntrack hash Patrick McHardy
2008-10-08 10:46 ` netfilter 15/79: netns: fix {ip,6}_route_me_harder() in netns Patrick McHardy
2008-10-08 10:46 ` netfilter 16/79: netns nf_conntrack: per-netns expectations Patrick McHardy
2008-10-08 10:46 ` netfilter 17/79: netns nf_conntrack: per-netns unconfirmed list Patrick McHardy
2008-10-08 10:46 ` netfilter 18/79: netns nf_conntrack: pass netns pointer to nf_conntrack_in() Patrick McHardy
2008-10-08 10:46 ` netfilter 19/79: netns nf_conntrack: pass netns pointer to L4 protocol's ->error hook Patrick McHardy
2008-10-08 10:46 ` netfilter 20/79: netns nf_conntrack: per-netns /proc/net/nf_conntrack, /proc/net/stat/nf_conntrack Patrick McHardy
2008-10-08 10:46 ` netfilter 21/79: netns nf_conntrack: per-netns /proc/net/nf_conntrack_expect Patrick McHardy
2008-10-08 10:46 ` netfilter 22/79: netns nf_conntrack: per-netns /proc/net/ip_conntrack, /proc/net/stat/ip_conntrack, /proc/net/ip_conntrack_expect Patrick McHardy
2008-10-08 10:46 ` netns 23/79: export netns list Patrick McHardy
2008-10-08 10:46 ` netfilter 24/79: netns nf_conntrack: unregister helper in every netns Patrick McHardy
2008-10-08 10:46 ` netfilter 25/79: netns nf_conntrack: cleanup after L3 and L4 proto unregister " Patrick McHardy
2008-10-08 10:46 ` netfilter 26/79: netns nf_conntrack: pass conntrack to nf_conntrack_event_cache() not skb Patrick McHardy
2008-10-08 10:46 ` netfilter 27/79: netns nf_conntrack: per-netns event cache Patrick McHardy
2008-10-08 10:46 ` netfilter 28/79: netns nf_conntrack: per-netns statistics Patrick McHardy
2008-10-08 10:47 ` netfilter 29/79: netns nf_conntrack: per-netns /proc/net/stat/nf_conntrack, /proc/net/stat/ip_conntrack Patrick McHardy
2008-10-08 10:47 ` netfilter 30/79: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_count sysctl Patrick McHardy
2008-10-08 10:47 ` netfilter 31/79: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_checksum sysctl Patrick McHardy
2008-10-08 10:47 ` netfilter 32/79: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_log_invalid sysctl Patrick McHardy
2008-10-08 10:47 ` netfilter 33/79: netns nf_conntrack: per-netns conntrack accounting Patrick McHardy
2008-10-08 10:47 ` netfilter 34/79: netns nf_conntrack: final netns tweaks Patrick McHardy
2008-10-08 10:47 ` netfilter 35/79: netns nf_conntrack: SIP conntracking in netns Patrick McHardy
2008-10-08 10:47 ` netfilter 36/79: netns nf_conntrack: H323 " Patrick McHardy
2008-10-08 10:47 ` netfilter 37/79: netns nf_conntrack: GRE " Patrick McHardy
2008-10-08 10:47 ` netfilter 38/79: netns nf_conntrack: PPTP " Patrick McHardy
2008-10-08 10:47 ` netfilter 39/79: netns nat: fix ipt_MASQUERADE " Patrick McHardy
2008-10-08 10:47 ` netfilter 40/79: netns nat: per-netns NAT table Patrick McHardy
2008-10-08 10:47 ` netfilter 41/79: netns nat: per-netns bysource hash Patrick McHardy
2008-10-08 10:47 ` netfilter 42/79: netns nf_conntrack: fixup DNAT in netns Patrick McHardy
2008-10-08 10:47 ` netfilter 43/79: netns nat: PPTP NAT " Patrick McHardy
2008-10-08 10:47 ` netfilter 44/79: enable netfilter " Patrick McHardy
2008-10-08 10:47 ` netfilter 45/79: split netfilter IPv4 defragmentation into a separate module Patrick McHardy
2008-10-08 10:47 ` netfilter 46/79: iptables tproxy core Patrick McHardy
2008-10-08 10:47 ` netfilter 47/79: iptables socket match Patrick McHardy
2008-10-08 10:47 ` netfilter 48/79: iptables TPROXY target Patrick McHardy
2008-10-08 10:47 ` netfilter 49/79: Add documentation for tproxy Patrick McHardy
2008-10-08 10:47 ` netfilter 50/79: ebtables: do centralized size checking Patrick McHardy
2008-10-08 10:47 ` netfilter 51/79: change return types of check functions for Ebtables extensions Patrick McHardy
2008-10-08 10:47 ` netfilter 52/79: change return types of match functions for ebtables extensions Patrick McHardy
2008-10-08 10:47 ` netfilter 53/79: Change return types of targets/watchers for Ebtables extensions Patrick McHardy
2008-10-08 10:47 ` netfilter 54/79: add dummy members to Ebtables code to ease transition to Xtables Patrick McHardy
2008-10-08 10:47 ` netfilter 55/79: ebt_among: obtain match size through different means Patrick McHardy
2008-10-08 10:47 ` netfilter 56/79: change Ebtables function signatures to match Xtables's Patrick McHardy
2008-10-08 10:47 ` netfilter 57/79: move Ebtables to use Xtables Patrick McHardy
2008-10-08 10:47 ` netfilter 58/79: x_tables: output bad hook mask in hexadecimal Patrick McHardy
2008-10-08 10:47 ` Patrick McHardy [this message]
2008-10-08 10:47 ` netfilter 60/79: implement hotdrop for Ebtables Patrick McHardy
2008-10-08 10:47 ` netfilter 61/79: remove unused Ebtables functions Patrick McHardy
2008-10-08 10:47 ` netfilter 62/79: remove redundant casts from Ebtables Patrick McHardy
2008-10-08 10:47 ` netfilter 63/79: ebtables: fix one wrong return value Patrick McHardy
2008-10-08 10:47 ` netfilter 64/79: xtables: do centralized checkentry call (1/2) Patrick McHardy
2008-10-08 10:47 ` netfilter 65/79: ip6tables: fix name of hopbyhop in Kconfig Patrick McHardy
2008-10-08 10:47 ` netfilter 66/79: ip6tables: fix Kconfig entry dependency for ip6t_LOG Patrick McHardy
2008-10-08 10:47 ` netfilter 67/79: ebtables: make BRIDGE_NF_EBTABLES a menuconfig option Patrick McHardy
2008-10-08 10:47 ` netfilter 68/79: xtables: sort extensions alphabetically in Kconfig Patrick McHardy
2008-10-08 10:47 ` netfilter 69/79: xtables: use "if" blocks " Patrick McHardy
2008-10-08 10:47 ` netfilter 70/79: xtables: move extension arguments into compound structure (1/6) Patrick McHardy
2008-10-08 10:47 ` netfilter 71/79: xtables: move extension arguments into compound structure (2/6) Patrick McHardy
2008-10-08 10:47 ` netfilter 72/79: xtables: move extension arguments into compound structure (3/6) Patrick McHardy
2008-10-08 10:48 ` netfilter 73/79: xtables: move extension arguments into compound structure (4/6) Patrick McHardy
2008-10-08 10:48 ` netfilter 74/79: xtables: move extension arguments into compound structure (5/6) Patrick McHardy
2008-10-08 10:48 ` netfilter 75/79: xtables: move extension arguments into compound structure (6/6) Patrick McHardy
2008-10-08 10:48 ` netfilter 76/79: xtables: provide invoked family value to extensions Patrick McHardy
2008-10-08 10:48 ` netfilter 77/79: xtables: cut down on static data for family-independent extensions Patrick McHardy
2008-10-08 10:48 ` netfilter 78/79: xtables: use NFPROTO_UNSPEC in more extensions Patrick McHardy
2008-10-08 10:48 ` netfilter 79/79: xtables: remove bogus mangle table dependency of connmark Patrick McHardy
2008-10-08 17:29 ` netfilter 00/79: netfilter update David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20081008104740.10423.53341.sendpatchset@x2.localnet \
--to=kaber@trash.net \
--cc=davem@davemloft.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox