adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2024-12-28 03:36:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

netfilter: xtables: move extension arguments into compound structure (1/6)

Browse source 
The function signatures for Xtables extensions have grown over time.
It involves a lot of typing/replication, and also a bit of stack space
even if they are not used. Realize an NFWS2008 idea and pack them into
structs. The skb remains outside of the struct so gcc can continue to
apply its optimizations.

This patch does this for match extensions' match functions.

A few ambiguities have also been addressed. The "offset" parameter for
example has been renamed to "fragoff" (there are so many different
offsets already) and "protoff" to "thoff" (there is more than just one
protocol here, so clarify).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Jan Engelhardt 2008-10-08 11:35:18 +02:00 committed by Patrick McHardy
parent c2df73de24
commit f7108a20de
59 changed files with 286 additions and 487 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
include/linux/netfilter/x_tables.h
View file

@ -173,6 +173,26 @@ struct xt_counters_info
#include <linux/netdevice.h> #include <linux/netdevice.h>
/**
* struct xt_match_param - parameters for match extensions' match functions
*
* @in: input netdevice
* @out: output netdevice
* @match: struct xt_match through which this function was invoked
* @matchinfo: per-match data
* @fragoff: packet is a fragment, this is the data offset
* @thoff: position of transport header relative to skb->data
* @hotdrop: drop packet if we had inspection problems
*/
struct xt_match_param {
const struct net_device *in, *out;
const struct xt_match *match;
const void *matchinfo;
int fragoff;
unsigned int thoff;
bool *hotdrop;
};
struct xt_match struct xt_match
{ {
struct list_head list; struct list_head list;
@ -185,13 +205,7 @@ struct xt_match
non-linear skb, using skb_header_pointer and non-linear skb, using skb_header_pointer and
skb_ip_make_writable. */ skb_ip_make_writable. */
bool (*match)(const struct sk_buff *skb, bool (*match)(const struct sk_buff *skb,
const struct net_device *in, const struct xt_match_param *);
const struct net_device *out,
const struct xt_match *match,
const void *matchinfo,
int offset,
unsigned int protoff,
bool *hotdrop);
/* Called when user tries to insert an entry of this type. */ /* Called when user tries to insert an entry of this type. */
/* Should return true or false. */ /* Should return true or false. */

6
net/bridge/netfilter/ebt_802_3.c
View file

@ -13,11 +13,9 @@
#include <linux/netfilter_bridge/ebt_802_3.h> #include <linux/netfilter_bridge/ebt_802_3.h>
static bool static bool
ebt_802_3_mt(const struct sk_buff *skb, const struct net_device *in, ebt_802_3_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_802_3_info *info = data; const struct ebt_802_3_info *info = par->matchinfo;
const struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb); const struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb);
__be16 type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type; __be16 type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;

6
net/bridge/netfilter/ebt_among.c
View file

@ -128,11 +128,9 @@ static int get_ip_src(const struct sk_buff *skb, __be32 *addr)
} }
static bool static bool
ebt_among_mt(const struct sk_buff *skb, const struct net_device *in, ebt_among_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_among_info *info = data; const struct ebt_among_info *info = par->matchinfo;
const char *dmac, *smac; const char *dmac, *smac;
const struct ebt_mac_wormhash *wh_dst, *wh_src; const struct ebt_mac_wormhash *wh_dst, *wh_src;
__be32 dip = 0, sip = 0; __be32 dip = 0, sip = 0;

6
net/bridge/netfilter/ebt_arp.c
View file

@ -16,11 +16,9 @@
#include <linux/netfilter_bridge/ebt_arp.h> #include <linux/netfilter_bridge/ebt_arp.h>
static bool static bool
ebt_arp_mt(const struct sk_buff *skb, const struct net_device *in, ebt_arp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_arp_info *info = data; const struct ebt_arp_info *info = par->matchinfo;
const struct arphdr *ah; const struct arphdr *ah;
struct arphdr _arph; struct arphdr _arph;

6
net/bridge/netfilter/ebt_ip.c
View file

@ -25,11 +25,9 @@ struct tcpudphdr {
}; };
static bool static bool
ebt_ip_mt(const struct sk_buff *skb, const struct net_device *in, ebt_ip_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_ip_info *info = data; const struct ebt_ip_info *info = par->matchinfo;
const struct iphdr *ih; const struct iphdr *ih;
struct iphdr _iph; struct iphdr _iph;
const struct tcpudphdr *pptr; const struct tcpudphdr *pptr;

6
net/bridge/netfilter/ebt_ip6.c
View file

@ -28,11 +28,9 @@ struct tcpudphdr {
}; };
static bool static bool
ebt_ip6_mt(const struct sk_buff *skb, const struct net_device *in, ebt_ip6_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_ip6_info *info = data; const struct ebt_ip6_info *info = par->matchinfo;
const struct ipv6hdr *ih6; const struct ipv6hdr *ih6;
struct ipv6hdr _ip6h; struct ipv6hdr _ip6h;
const struct tcpudphdr *pptr; const struct tcpudphdr *pptr;

6
net/bridge/netfilter/ebt_limit.c
View file

@ -31,11 +31,9 @@ static DEFINE_SPINLOCK(limit_lock);
#define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ) #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
static bool static bool
ebt_limit_mt(const struct sk_buff *skb, const struct net_device *in, ebt_limit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
struct ebt_limit_info *info = (void *)data; struct ebt_limit_info *info = (void *)par->matchinfo;
unsigned long now = jiffies; unsigned long now = jiffies;
spin_lock_bh(&limit_lock); spin_lock_bh(&limit_lock);

6
net/bridge/netfilter/ebt_mark_m.c
View file

@ -13,11 +13,9 @@
#include <linux/netfilter_bridge/ebt_mark_m.h> #include <linux/netfilter_bridge/ebt_mark_m.h>
static bool static bool
ebt_mark_mt(const struct sk_buff *skb, const struct net_device *in, ebt_mark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_mark_m_info *info = data; const struct ebt_mark_m_info *info = par->matchinfo;
if (info->bitmask & EBT_MARK_OR) if (info->bitmask & EBT_MARK_OR)
return !!(skb->mark & info->mask) ^ info->invert; return !!(skb->mark & info->mask) ^ info->invert;

7
net/bridge/netfilter/ebt_pkttype.c
View file

@ -13,12 +13,9 @@
#include <linux/netfilter_bridge/ebt_pkttype.h> #include <linux/netfilter_bridge/ebt_pkttype.h>
static bool static bool
ebt_pkttype_mt(const struct sk_buff *skb, const struct net_device *in, ebt_pkttype_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct ebt_pkttype_info *info = data; const struct ebt_pkttype_info *info = par->matchinfo;
return (skb->pkt_type == info->pkt_type) ^ info->invert; return (skb->pkt_type == info->pkt_type) ^ info->invert;
} }

6
net/bridge/netfilter/ebt_stp.c
View file

@ -120,11 +120,9 @@ static bool ebt_filter_config(const struct ebt_stp_info *info,
} }
static bool static bool
ebt_stp_mt(const struct sk_buff *skb, const struct net_device *in, ebt_stp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_stp_info *info = data; const struct ebt_stp_info *info = par->matchinfo;
const struct stp_header *sp; const struct stp_header *sp;
struct stp_header _stph; struct stp_header _stph;
const uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00}; const uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};

6
net/bridge/netfilter/ebt_vlan.c
View file

@ -41,11 +41,9 @@ MODULE_LICENSE("GPL");
#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; } #define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; }
static bool static bool
ebt_vlan_mt(const struct sk_buff *skb, const struct net_device *in, ebt_vlan_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *data, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ebt_vlan_info *info = data; const struct ebt_vlan_info *info = par->matchinfo;
const struct vlan_hdr *fp; const struct vlan_hdr *fp;
struct vlan_hdr _frame; struct vlan_hdr _frame;

16
net/bridge/netfilter/ebtables.c
View file

@ -74,11 +74,11 @@ static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
} }
static inline int ebt_do_match (struct ebt_entry_match *m, static inline int ebt_do_match (struct ebt_entry_match *m,
const struct sk_buff *skb, const struct net_device *in, const struct sk_buff *skb, struct xt_match_param *par)
const struct net_device *out, bool *hotdrop)
{ {
return m->u.match->match(skb, in, out, m->u.match, par->match = m->u.match;
m->data, 0, 0, hotdrop); par->matchinfo = m->data;
return m->u.match->match(skb, par);
} }
static inline int ebt_dev_check(char *entry, const struct net_device *device) static inline int ebt_dev_check(char *entry, const struct net_device *device)
@ -155,6 +155,11 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
char *base; char *base;
struct ebt_table_info *private; struct ebt_table_info *private;
bool hotdrop = false; bool hotdrop = false;
struct xt_match_param mtpar;
mtpar.in = in;
mtpar.out = out;
mtpar.hotdrop = &hotdrop;
read_lock_bh(&table->lock); read_lock_bh(&table->lock);
private = table->private; private = table->private;
@ -175,8 +180,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
if (ebt_basic_match(point, eth_hdr(skb), in, out)) if (ebt_basic_match(point, eth_hdr(skb), in, out))
goto letscontinue; goto letscontinue;
if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
in, out, &hotdrop) != 0)
goto letscontinue; goto letscontinue;
if (hotdrop) { if (hotdrop) {
read_unlock_bh(&table->lock); read_unlock_bh(&table->lock);

46
net/ipv4/netfilter/ip_tables.c
View file

@ -186,16 +186,14 @@ ipt_error(struct sk_buff *skb,
/* Performance critical - called for every packet */ /* Performance critical - called for every packet */
static inline bool static inline bool
do_match(struct ipt_entry_match *m, do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
const struct sk_buff *skb, struct xt_match_param *par)
const struct net_device *in,
const struct net_device *out,
int offset,
bool *hotdrop)
{ {
par->match = m->u.kernel.match;
par->matchinfo = m->data;
/* Stop iteration if it doesn't match */ /* Stop iteration if it doesn't match */
if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data, if (!m->u.kernel.match->match(skb, par))
offset, ip_hdrlen(skb), hotdrop))
return true; return true;
else else
return false; return false;
@ -326,7 +324,6 @@ ipt_do_table(struct sk_buff *skb,
struct xt_table *table) struct xt_table *table)
{ {
static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
u_int16_t offset;
const struct iphdr *ip; const struct iphdr *ip;
u_int16_t datalen; u_int16_t datalen;
bool hotdrop = false; bool hotdrop = false;
@ -336,6 +333,7 @@ ipt_do_table(struct sk_buff *skb,
void *table_base; void *table_base;
struct ipt_entry *e, *back; struct ipt_entry *e, *back;
struct xt_table_info *private; struct xt_table_info *private;
struct xt_match_param mtpar;
/* Initialization */ /* Initialization */
ip = ip_hdr(skb); ip = ip_hdr(skb);
@ -348,7 +346,11 @@ ipt_do_table(struct sk_buff *skb,
* things we don't know, ie. tcp syn flag or ports). If the * things we don't know, ie. tcp syn flag or ports). If the
* rule is also a fragment-specific rule, non-fragments won't * rule is also a fragment-specific rule, non-fragments won't
* match it. */ * match it. */
offset = ntohs(ip->frag_off) & IP_OFFSET; mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
mtpar.thoff = ip_hdrlen(skb);
mtpar.hotdrop = &hotdrop;
mtpar.in = in;
mtpar.out = out;
read_lock_bh(&table->lock); read_lock_bh(&table->lock);
IP_NF_ASSERT(table->valid_hooks & (1 << hook)); IP_NF_ASSERT(table->valid_hooks & (1 << hook));
@ -362,12 +364,11 @@ ipt_do_table(struct sk_buff *skb,
do { do {
IP_NF_ASSERT(e); IP_NF_ASSERT(e);
IP_NF_ASSERT(back); IP_NF_ASSERT(back);
if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) { if (ip_packet_match(ip, indev, outdev,
&e->ip, mtpar.fragoff)) {
struct ipt_entry_target *t; struct ipt_entry_target *t;
if (IPT_MATCH_ITERATE(e, do_match, if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
skb, in, out,
offset, &hotdrop) != 0)
goto no_match; goto no_match;
ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1); ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
@ -2116,30 +2117,23 @@ icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
} }
static bool static bool
icmp_match(const struct sk_buff *skb, icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *in,
const struct net_device *out,
const struct xt_match *match,
const void *matchinfo,
int offset,
unsigned int protoff,
bool *hotdrop)
{ {
const struct icmphdr *ic; const struct icmphdr *ic;
struct icmphdr _icmph; struct icmphdr _icmph;
const struct ipt_icmp *icmpinfo = matchinfo; const struct ipt_icmp *icmpinfo = par->matchinfo;
/* Must not be a fragment. */ /* Must not be a fragment. */
if (offset) if (par->fragoff != 0)
return false; return false;
ic = skb_header_pointer(skb, protoff, sizeof(_icmph), &_icmph); ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
if (ic == NULL) { if (ic == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
* can't. Hence, no choice but to drop. * can't. Hence, no choice but to drop.
*/ */
duprintf("Dropping evil ICMP tinygram.\n"); duprintf("Dropping evil ICMP tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

18
net/ipv4/netfilter/ipt_addrtype.c
View file

@ -30,12 +30,9 @@ static inline bool match_type(const struct net_device *dev, __be32 addr,
} }
static bool static bool
addrtype_mt_v0(const struct sk_buff *skb, const struct net_device *in, addrtype_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct ipt_addrtype_info *info = matchinfo; const struct ipt_addrtype_info *info = par->matchinfo;
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
bool ret = true; bool ret = true;
@ -50,20 +47,17 @@ addrtype_mt_v0(const struct sk_buff *skb, const struct net_device *in,
} }
static bool static bool
addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in, addrtype_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct ipt_addrtype_info_v1 *info = matchinfo; const struct ipt_addrtype_info_v1 *info = par->matchinfo;
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
const struct net_device *dev = NULL; const struct net_device *dev = NULL;
bool ret = true; bool ret = true;
if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN) if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN)
dev = in; dev = par->in;
else if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) else if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT)
dev = out; dev = par->out;
if (info->source) if (info->source)
ret &= match_type(dev, iph->saddr, info->source) ^ ret &= match_type(dev, iph->saddr, info->source) ^

14
net/ipv4/netfilter/ipt_ah.c
View file

@ -36,27 +36,23 @@ spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
return r; return r;
} }
static bool static bool ah_mt(const struct sk_buff *skb, const struct xt_match_param *par)
ah_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
struct ip_auth_hdr _ahdr; struct ip_auth_hdr _ahdr;
const struct ip_auth_hdr *ah; const struct ip_auth_hdr *ah;
const struct ipt_ah *ahinfo = matchinfo; const struct ipt_ah *ahinfo = par->matchinfo;
/* Must not be a fragment. */ /* Must not be a fragment. */
if (offset) if (par->fragoff != 0)
return false; return false;
ah = skb_header_pointer(skb, protoff, ah = skb_header_pointer(skb, par->thoff, sizeof(_ahdr), &_ahdr);
sizeof(_ahdr), &_ahdr);
if (ah == NULL) { if (ah == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
* can't. Hence, no choice but to drop. * can't. Hence, no choice but to drop.
*/ */
duprintf("Dropping evil AH tinygram.\n"); duprintf("Dropping evil AH tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return 0; return 0;
} }

9
net/ipv4/netfilter/ipt_ecn.c
View file

@ -67,12 +67,9 @@ static inline bool match_tcp(const struct sk_buff *skb,
return true; return true;
} }
static bool static bool ecn_mt(const struct sk_buff *skb, const struct xt_match_param *par)
ecn_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ipt_ecn_info *info = matchinfo; const struct ipt_ecn_info *info = par->matchinfo;
if (info->operation & IPT_ECN_OP_MATCH_IP) if (info->operation & IPT_ECN_OP_MATCH_IP)
if (!match_ip(skb, info)) if (!match_ip(skb, info))
@ -81,7 +78,7 @@ ecn_mt(const struct sk_buff *skb, const struct net_device *in,
if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) { if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
if (ip_hdr(skb)->protocol != IPPROTO_TCP) if (ip_hdr(skb)->protocol != IPPROTO_TCP)
return false; return false;
if (!match_tcp(skb, info, hotdrop)) if (!match_tcp(skb, info, par->hotdrop))
return false; return false;
} }

7
net/ipv4/netfilter/ipt_ttl.c
View file

@ -18,12 +18,9 @@ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: IPv4 TTL field match"); MODULE_DESCRIPTION("Xtables: IPv4 TTL field match");
MODULE_LICENSE("GPL"); MODULE_LICENSE("GPL");
static bool static bool ttl_mt(const struct sk_buff *skb, const struct xt_match_param *par)
ttl_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ipt_ttl_info *info = matchinfo; const struct ipt_ttl_info *info = par->matchinfo;
const u8 ttl = ip_hdr(skb)->ttl; const u8 ttl = ip_hdr(skb)->ttl;
switch (info->mode) { switch (info->mode) {

44
net/ipv6/netfilter/ip6_tables.c
View file

@ -215,17 +215,14 @@ ip6t_error(struct sk_buff *skb,
/* Performance critical - called for every packet */ /* Performance critical - called for every packet */
static inline bool static inline bool
do_match(struct ip6t_entry_match *m, do_match(struct ip6t_entry_match *m, const struct sk_buff *skb,
const struct sk_buff *skb, struct xt_match_param *par)
const struct net_device *in,
const struct net_device *out,
int offset,
unsigned int protoff,
bool *hotdrop)
{ {
par->match = m->u.kernel.match;
par->matchinfo = m->data;
/* Stop iteration if it doesn't match */ /* Stop iteration if it doesn't match */
if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data, if (!m->u.kernel.match->match(skb, par))
offset, protoff, hotdrop))
return true; return true;
else else
return false; return false;
@ -355,8 +352,6 @@ ip6t_do_table(struct sk_buff *skb,
struct xt_table *table) struct xt_table *table)
{ {
static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
int offset = 0;
unsigned int protoff = 0;
bool hotdrop = false; bool hotdrop = false;
/* Initializing verdict to NF_DROP keeps gcc happy. */ /* Initializing verdict to NF_DROP keeps gcc happy. */
unsigned int verdict = NF_DROP; unsigned int verdict = NF_DROP;
@ -364,6 +359,7 @@ ip6t_do_table(struct sk_buff *skb,
void *table_base; void *table_base;
struct ip6t_entry *e, *back; struct ip6t_entry *e, *back;
struct xt_table_info *private; struct xt_table_info *private;
struct xt_match_param mtpar;
/* Initialization */ /* Initialization */
indev = in ? in->name : nulldevname; indev = in ? in->name : nulldevname;
@ -374,6 +370,9 @@ ip6t_do_table(struct sk_buff *skb,
* things we don't know, ie. tcp syn flag or ports). If the * things we don't know, ie. tcp syn flag or ports). If the
* rule is also a fragment-specific rule, non-fragments won't * rule is also a fragment-specific rule, non-fragments won't
* match it. */ * match it. */
mtpar.hotdrop = &hotdrop;
mtpar.in = in;
mtpar.out = out;
read_lock_bh(&table->lock); read_lock_bh(&table->lock);
IP_NF_ASSERT(table->valid_hooks & (1 << hook)); IP_NF_ASSERT(table->valid_hooks & (1 << hook));
@ -388,12 +387,10 @@ ip6t_do_table(struct sk_buff *skb,
IP_NF_ASSERT(e); IP_NF_ASSERT(e);
IP_NF_ASSERT(back); IP_NF_ASSERT(back);
if (ip6_packet_match(skb, indev, outdev, &e->ipv6, if (ip6_packet_match(skb, indev, outdev, &e->ipv6,
&protoff, &offset, &hotdrop)) { &mtpar.thoff, &mtpar.fragoff, &hotdrop)) {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
if (IP6T_MATCH_ITERATE(e, do_match, if (IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
skb, in, out,
offset, protoff, &hotdrop) != 0)
goto no_match; goto no_match;
ADD_COUNTER(e->counters, ADD_COUNTER(e->counters,
@ -2141,30 +2138,23 @@ icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
} }
static bool static bool
icmp6_match(const struct sk_buff *skb, icmp6_match(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *in,
const struct net_device *out,
const struct xt_match *match,
const void *matchinfo,
int offset,
unsigned int protoff,
bool *hotdrop)
{ {
const struct icmp6hdr *ic; const struct icmp6hdr *ic;
struct icmp6hdr _icmph; struct icmp6hdr _icmph;
const struct ip6t_icmp *icmpinfo = matchinfo; const struct ip6t_icmp *icmpinfo = par->matchinfo;
/* Must not be a fragment. */ /* Must not be a fragment. */
if (offset) if (par->fragoff != 0)
return false; return false;
ic = skb_header_pointer(skb, protoff, sizeof(_icmph), &_icmph); ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
if (ic == NULL) { if (ic == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
* can't. Hence, no choice but to drop. * can't. Hence, no choice but to drop.
*/ */
duprintf("Dropping evil ICMP tinygram.\n"); duprintf("Dropping evil ICMP tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

11
net/ipv6/netfilter/ip6t_ah.c
View file

@ -36,14 +36,11 @@ spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
return r; return r;
} }
static bool static bool ah_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
ah_mt6(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
struct ip_auth_hdr _ah; struct ip_auth_hdr _ah;
const struct ip_auth_hdr *ah; const struct ip_auth_hdr *ah;
const struct ip6t_ah *ahinfo = matchinfo; const struct ip6t_ah *ahinfo = par->matchinfo;
unsigned int ptr; unsigned int ptr;
unsigned int hdrlen = 0; unsigned int hdrlen = 0;
int err; int err;
@ -51,13 +48,13 @@ ah_mt6(const struct sk_buff *skb, const struct net_device *in,
err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL); err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
if (err < 0) { if (err < 0) {
if (err != -ENOENT) if (err != -ENOENT)
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah); ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
if (ah == NULL) { if (ah == NULL) {
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

9
net/ipv6/netfilter/ip6t_eui64.c
View file

@ -20,18 +20,15 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
static bool static bool
eui64_mt6(const struct sk_buff *skb, const struct net_device *in, eui64_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
unsigned char eui64[8]; unsigned char eui64[8];
int i = 0; int i = 0;
if (!(skb_mac_header(skb) >= skb->head && if (!(skb_mac_header(skb) >= skb->head &&
skb_mac_header(skb) + ETH_HLEN <= skb->data) && skb_mac_header(skb) + ETH_HLEN <= skb->data) &&
offset != 0) { par->fragoff != 0) {
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

11
net/ipv6/netfilter/ip6t_frag.c
View file

@ -35,27 +35,24 @@ id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
} }
static bool static bool
frag_mt6(const struct sk_buff *skb, const struct net_device *in, frag_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
struct frag_hdr _frag; struct frag_hdr _frag;
const struct frag_hdr *fh; const struct frag_hdr *fh;
const struct ip6t_frag *fraginfo = matchinfo; const struct ip6t_frag *fraginfo = par->matchinfo;
unsigned int ptr; unsigned int ptr;
int err; int err;
err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL); err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
if (err < 0) { if (err < 0) {
if (err != -ENOENT) if (err != -ENOENT)
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag); fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
if (fh == NULL) { if (fh == NULL) {
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

13
net/ipv6/netfilter/ip6t_hbh.c
View file

@ -42,14 +42,11 @@ MODULE_ALIAS("ip6t_dst");
*/ */
static bool static bool
hbh_mt6(const struct sk_buff *skb, const struct net_device *in, hbh_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
struct ipv6_opt_hdr _optsh; struct ipv6_opt_hdr _optsh;
const struct ipv6_opt_hdr *oh; const struct ipv6_opt_hdr *oh;
const struct ip6t_opts *optinfo = matchinfo; const struct ip6t_opts *optinfo = par->matchinfo;
unsigned int temp; unsigned int temp;
unsigned int ptr; unsigned int ptr;
unsigned int hdrlen = 0; unsigned int hdrlen = 0;
@ -61,16 +58,16 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
unsigned int optlen; unsigned int optlen;
int err; int err;
err = ipv6_find_hdr(skb, &ptr, match->data, NULL); err = ipv6_find_hdr(skb, &ptr, par->match->data, NULL);
if (err < 0) { if (err < 0) {
if (err != -ENOENT) if (err != -ENOENT)
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh); oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
if (oh == NULL) { if (oh == NULL) {
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

7
net/ipv6/netfilter/ip6t_hl.c
View file

@ -19,12 +19,9 @@ MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
MODULE_DESCRIPTION("Xtables: IPv6 Hop Limit field match"); MODULE_DESCRIPTION("Xtables: IPv6 Hop Limit field match");
MODULE_LICENSE("GPL"); MODULE_LICENSE("GPL");
static bool static bool hl_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
hl_mt6(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ip6t_hl_info *info = matchinfo; const struct ip6t_hl_info *info = par->matchinfo;
const struct ipv6hdr *ip6h = ipv6_hdr(skb); const struct ipv6hdr *ip6h = ipv6_hdr(skb);
switch (info->mode) { switch (info->mode) {

7
net/ipv6/netfilter/ip6t_ipv6header.c
View file

@ -27,12 +27,9 @@ MODULE_DESCRIPTION("Xtables: IPv6 header types match");
MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
static bool static bool
ipv6header_mt6(const struct sk_buff *skb, const struct net_device *in, ipv6header_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct ip6t_ipv6header_info *info = matchinfo; const struct ip6t_ipv6header_info *info = par->matchinfo;
unsigned int temp; unsigned int temp;
int len; int len;
u8 nexthdr; u8 nexthdr;

15
net/ipv6/netfilter/ip6t_mh.c
View file

@ -37,32 +37,29 @@ type_match(u_int8_t min, u_int8_t max, u_int8_t type, bool invert)
return (type >= min && type <= max) ^ invert; return (type >= min && type <= max) ^ invert;
} }
static bool static bool mh_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
mh_mt6(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
struct ip6_mh _mh; struct ip6_mh _mh;
const struct ip6_mh *mh; const struct ip6_mh *mh;
const struct ip6t_mh *mhinfo = matchinfo; const struct ip6t_mh *mhinfo = par->matchinfo;
/* Must not be a fragment. */ /* Must not be a fragment. */
if (offset) if (par->fragoff != 0)
return false; return false;
mh = skb_header_pointer(skb, protoff, sizeof(_mh), &_mh); mh = skb_header_pointer(skb, par->thoff, sizeof(_mh), &_mh);
if (mh == NULL) { if (mh == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
can't. Hence, no choice but to drop. */ can't. Hence, no choice but to drop. */
duprintf("Dropping evil MH tinygram.\n"); duprintf("Dropping evil MH tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
if (mh->ip6mh_proto != IPPROTO_NONE) { if (mh->ip6mh_proto != IPPROTO_NONE) {
duprintf("Dropping invalid MH Payload Proto: %u\n", duprintf("Dropping invalid MH Payload Proto: %u\n",
mh->ip6mh_proto); mh->ip6mh_proto);
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

11
net/ipv6/netfilter/ip6t_rt.c
View file

@ -36,14 +36,11 @@ segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
return r; return r;
} }
static bool static bool rt_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
rt_mt6(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
struct ipv6_rt_hdr _route; struct ipv6_rt_hdr _route;
const struct ipv6_rt_hdr *rh; const struct ipv6_rt_hdr *rh;
const struct ip6t_rt *rtinfo = matchinfo; const struct ip6t_rt *rtinfo = par->matchinfo;
unsigned int temp; unsigned int temp;
unsigned int ptr; unsigned int ptr;
unsigned int hdrlen = 0; unsigned int hdrlen = 0;
@ -55,13 +52,13 @@ rt_mt6(const struct sk_buff *skb, const struct net_device *in,
err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL); err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
if (err < 0) { if (err < 0) {
if (err != -ENOENT) if (err != -ENOENT)
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route); rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
if (rh == NULL) { if (rh == NULL) {
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

5
net/netfilter/xt_comment.c
View file

@ -16,10 +16,7 @@ MODULE_ALIAS("ipt_comment");
MODULE_ALIAS("ip6t_comment"); MODULE_ALIAS("ip6t_comment");
static bool static bool
comment_mt(const struct sk_buff *skb, const struct net_device *in, comment_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protooff,
bool *hotdrop)
{ {
/* We always match */ /* We always match */
return true; return true;

7
net/netfilter/xt_connbytes.c
View file

@ -17,12 +17,9 @@ MODULE_ALIAS("ipt_connbytes");
MODULE_ALIAS("ip6t_connbytes"); MODULE_ALIAS("ip6t_connbytes");
static bool static bool
connbytes_mt(const struct sk_buff *skb, const struct net_device *in, connbytes_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_connbytes_info *sinfo = matchinfo; const struct xt_connbytes_info *sinfo = par->matchinfo;
const struct nf_conn *ct; const struct nf_conn *ct;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
u_int64_t what = 0; /* initialize to make gcc happy */ u_int64_t what = 0; /* initialize to make gcc happy */

17
net/netfilter/xt_connlimit.c
View file

@ -178,12 +178,9 @@ static int count_them(struct xt_connlimit_data *data,
} }
static bool static bool
connlimit_mt(const struct sk_buff *skb, const struct net_device *in, connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_connlimit_info *info = matchinfo; const struct xt_connlimit_info *info = par->matchinfo;
union nf_inet_addr addr; union nf_inet_addr addr;
struct nf_conntrack_tuple tuple; struct nf_conntrack_tuple tuple;
const struct nf_conntrack_tuple *tuple_ptr = &tuple; const struct nf_conntrack_tuple *tuple_ptr = &tuple;
@ -195,10 +192,10 @@ connlimit_mt(const struct sk_buff *skb, const struct net_device *in,
if (ct != NULL) if (ct != NULL)
tuple_ptr = &ct->tuplehash[0].tuple; tuple_ptr = &ct->tuplehash[0].tuple;
else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
match->family, &tuple)) par->match->family, &tuple))
goto hotdrop; goto hotdrop;
if (match->family == NFPROTO_IPV6) { if (par->match->family == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb); const struct ipv6hdr *iph = ipv6_hdr(skb);
memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr)); memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));
} else { } else {
@ -208,19 +205,19 @@ connlimit_mt(const struct sk_buff *skb, const struct net_device *in,
spin_lock_bh(&info->data->lock); spin_lock_bh(&info->data->lock);
connections = count_them(info->data, tuple_ptr, &addr, connections = count_them(info->data, tuple_ptr, &addr,
&info->mask, match); &info->mask, par->match);
spin_unlock_bh(&info->data->lock); spin_unlock_bh(&info->data->lock);
if (connections < 0) { if (connections < 0) {
/* kmalloc failed, drop it entirely */ /* kmalloc failed, drop it entirely */
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
return (connections > info->limit) ^ info->inverse; return (connections > info->limit) ^ info->inverse;
hotdrop: hotdrop:
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

14
net/netfilter/xt_connmark.c
View file

@ -34,12 +34,9 @@ MODULE_ALIAS("ipt_connmark");
MODULE_ALIAS("ip6t_connmark"); MODULE_ALIAS("ip6t_connmark");
static bool static bool
connmark_mt(const struct sk_buff *skb, const struct net_device *in, connmark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_connmark_mtinfo1 *info = matchinfo; const struct xt_connmark_mtinfo1 *info = par->matchinfo;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
const struct nf_conn *ct; const struct nf_conn *ct;
@ -51,12 +48,9 @@ connmark_mt(const struct sk_buff *skb, const struct net_device *in,
} }
static bool static bool
connmark_mt_v0(const struct sk_buff *skb, const struct net_device *in, connmark_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_connmark_info *info = matchinfo; const struct xt_connmark_info *info = par->matchinfo;
const struct nf_conn *ct; const struct nf_conn *ct;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;

22
net/netfilter/xt_conntrack.c
View file

@ -25,12 +25,9 @@ MODULE_ALIAS("ipt_conntrack");
MODULE_ALIAS("ip6t_conntrack"); MODULE_ALIAS("ip6t_conntrack");
static bool static bool
conntrack_mt_v0(const struct sk_buff *skb, const struct net_device *in, conntrack_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_conntrack_info *sinfo = matchinfo; const struct xt_conntrack_info *sinfo = par->matchinfo;
const struct nf_conn *ct; const struct nf_conn *ct;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
unsigned int statebit; unsigned int statebit;
@ -205,12 +202,9 @@ ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
} }
static bool static bool
conntrack_mt(const struct sk_buff *skb, const struct net_device *in, conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_conntrack_mtinfo1 *info = matchinfo; const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
const struct nf_conn *ct; const struct nf_conn *ct;
unsigned int statebit; unsigned int statebit;
@ -244,22 +238,22 @@ conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
return false; return false;
if (info->match_flags & XT_CONNTRACK_ORIGSRC) if (info->match_flags & XT_CONNTRACK_ORIGSRC)
if (conntrack_mt_origsrc(ct, info, match->family) ^ if (conntrack_mt_origsrc(ct, info, par->match->family) ^
!(info->invert_flags & XT_CONNTRACK_ORIGSRC)) !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
return false; return false;
if (info->match_flags & XT_CONNTRACK_ORIGDST) if (info->match_flags & XT_CONNTRACK_ORIGDST)
if (conntrack_mt_origdst(ct, info, match->family) ^ if (conntrack_mt_origdst(ct, info, par->match->family) ^
!(info->invert_flags & XT_CONNTRACK_ORIGDST)) !(info->invert_flags & XT_CONNTRACK_ORIGDST))
return false; return false;
if (info->match_flags & XT_CONNTRACK_REPLSRC) if (info->match_flags & XT_CONNTRACK_REPLSRC)
if (conntrack_mt_replsrc(ct, info, match->family) ^ if (conntrack_mt_replsrc(ct, info, par->match->family) ^
!(info->invert_flags & XT_CONNTRACK_REPLSRC)) !(info->invert_flags & XT_CONNTRACK_REPLSRC))
return false; return false;
if (info->match_flags & XT_CONNTRACK_REPLDST) if (info->match_flags & XT_CONNTRACK_REPLDST)
if (conntrack_mt_repldst(ct, info, match->family) ^ if (conntrack_mt_repldst(ct, info, par->match->family) ^
!(info->invert_flags & XT_CONNTRACK_REPLDST)) !(info->invert_flags & XT_CONNTRACK_REPLDST))
return false; return false;

16
net/netfilter/xt_dccp.c
View file

@ -93,20 +93,18 @@ match_option(u_int8_t option, const struct sk_buff *skb, unsigned int protoff,
} }
static bool static bool
dccp_mt(const struct sk_buff *skb, const struct net_device *in, dccp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct xt_dccp_info *info = matchinfo; const struct xt_dccp_info *info = par->matchinfo;
const struct dccp_hdr *dh; const struct dccp_hdr *dh;
struct dccp_hdr _dh; struct dccp_hdr _dh;
if (offset) if (par->fragoff != 0)
return false; return false;
dh = skb_header_pointer(skb, protoff, sizeof(_dh), &_dh); dh = skb_header_pointer(skb, par->thoff, sizeof(_dh), &_dh);
if (dh == NULL) { if (dh == NULL) {
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
@ -118,8 +116,8 @@ dccp_mt(const struct sk_buff *skb, const struct net_device *in,
XT_DCCP_DEST_PORTS, info->flags, info->invflags) XT_DCCP_DEST_PORTS, info->flags, info->invflags)
&& DCCHECK(match_types(dh, info->typemask), && DCCHECK(match_types(dh, info->typemask),
XT_DCCP_TYPE, info->flags, info->invflags) XT_DCCP_TYPE, info->flags, info->invflags)
&& DCCHECK(match_option(info->option, skb, protoff, dh, && DCCHECK(match_option(info->option, skb, par->thoff, dh,
hotdrop), par->hotdrop),
XT_DCCP_OPTION, info->flags, info->invflags); XT_DCCP_OPTION, info->flags, info->invflags);
} }

30
net/netfilter/xt_dscp.c
View file

@ -26,23 +26,18 @@ MODULE_ALIAS("ipt_tos");
MODULE_ALIAS("ip6t_tos"); MODULE_ALIAS("ip6t_tos");
static bool static bool
dscp_mt(const struct sk_buff *skb, const struct net_device *in, dscp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct xt_dscp_info *info = matchinfo; const struct xt_dscp_info *info = par->matchinfo;
u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT; u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
return (dscp == info->dscp) ^ !!info->invert; return (dscp == info->dscp) ^ !!info->invert;
} }
static bool static bool
dscp_mt6(const struct sk_buff *skb, const struct net_device *in, dscp_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_dscp_info *info = matchinfo; const struct xt_dscp_info *info = par->matchinfo;
u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT; u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
return (dscp == info->dscp) ^ !!info->invert; return (dscp == info->dscp) ^ !!info->invert;
@ -63,24 +58,19 @@ dscp_mt_check(const char *tablename, const void *info,
return true; return true;
} }
static bool tos_mt_v0(const struct sk_buff *skb, const struct net_device *in, static bool
const struct net_device *out, tos_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct xt_match *match, const void *matchinfo,
int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ipt_tos_info *info = matchinfo; const struct ipt_tos_info *info = par->matchinfo;
return (ip_hdr(skb)->tos == info->tos) ^ info->invert; return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
} }
static bool tos_mt(const struct sk_buff *skb, const struct net_device *in, static bool tos_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_tos_match_info *info = matchinfo; const struct xt_tos_match_info *info = par->matchinfo;
if (match->family == NFPROTO_IPV4) if (par->match->family == NFPROTO_IPV4)
return ((ip_hdr(skb)->tos & info->tos_mask) == return ((ip_hdr(skb)->tos & info->tos_mask) ==
info->tos_value) ^ !!info->invert; info->tos_value) ^ !!info->invert;
else else

13
net/netfilter/xt_esp.c
View file

@ -42,26 +42,23 @@ spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
return r; return r;
} }
static bool static bool esp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
esp_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct ip_esp_hdr *eh; const struct ip_esp_hdr *eh;
struct ip_esp_hdr _esp; struct ip_esp_hdr _esp;
const struct xt_esp *espinfo = matchinfo; const struct xt_esp *espinfo = par->matchinfo;
/* Must not be a fragment. */ /* Must not be a fragment. */
if (offset) if (par->fragoff != 0)
return false; return false;
eh = skb_header_pointer(skb, protoff, sizeof(_esp), &_esp); eh = skb_header_pointer(skb, par->thoff, sizeof(_esp), &_esp);
if (eh == NULL) { if (eh == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
* can't. Hence, no choice but to drop. * can't. Hence, no choice but to drop.
*/ */
duprintf("Dropping evil ESP tinygram.\n"); duprintf("Dropping evil ESP tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

22
net/netfilter/xt_hashlimit.c
View file

@ -563,19 +563,16 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
} }
static bool static bool
hashlimit_mt_v0(const struct sk_buff *skb, const struct net_device *in, hashlimit_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_hashlimit_info *r = const struct xt_hashlimit_info *r =
((const struct xt_hashlimit_info *)matchinfo)->u.master; ((const struct xt_hashlimit_info *)par->matchinfo)->u.master;
struct xt_hashlimit_htable *hinfo = r->hinfo; struct xt_hashlimit_htable *hinfo = r->hinfo;
unsigned long now = jiffies; unsigned long now = jiffies;
struct dsthash_ent *dh; struct dsthash_ent *dh;
struct dsthash_dst dst; struct dsthash_dst dst;
if (hashlimit_init_dst(hinfo, &dst, skb, protoff) < 0) if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
goto hotdrop; goto hotdrop;
spin_lock_bh(&hinfo->lock); spin_lock_bh(&hinfo->lock);
@ -613,23 +610,20 @@ hashlimit_mt_v0(const struct sk_buff *skb, const struct net_device *in,
return false; return false;
hotdrop: hotdrop:
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
static bool static bool
hashlimit_mt(const struct sk_buff *skb, const struct net_device *in, hashlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_hashlimit_mtinfo1 *info = matchinfo; const struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
struct xt_hashlimit_htable *hinfo = info->hinfo; struct xt_hashlimit_htable *hinfo = info->hinfo;
unsigned long now = jiffies; unsigned long now = jiffies;
struct dsthash_ent *dh; struct dsthash_ent *dh;
struct dsthash_dst dst; struct dsthash_dst dst;
if (hashlimit_init_dst(hinfo, &dst, skb, protoff) < 0) if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
goto hotdrop; goto hotdrop;
spin_lock_bh(&hinfo->lock); spin_lock_bh(&hinfo->lock);
@ -666,7 +660,7 @@ hashlimit_mt(const struct sk_buff *skb, const struct net_device *in,
return info->cfg.mode & XT_HASHLIMIT_INVERT; return info->cfg.mode & XT_HASHLIMIT_INVERT;
hotdrop: hotdrop:
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

7
net/netfilter/xt_helper.c
View file

@ -24,12 +24,9 @@ MODULE_ALIAS("ip6t_helper");
static bool static bool
helper_mt(const struct sk_buff *skb, const struct net_device *in, helper_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_helper_info *info = matchinfo; const struct xt_helper_info *info = par->matchinfo;
const struct nf_conn *ct; const struct nf_conn *ct;
const struct nf_conn_help *master_help; const struct nf_conn_help *master_help;
const struct nf_conntrack_helper *helper; const struct nf_conntrack_helper *helper;

21
net/netfilter/xt_iprange.c
View file

@ -17,12 +17,9 @@
#include <linux/netfilter_ipv4/ipt_iprange.h> #include <linux/netfilter_ipv4/ipt_iprange.h>
static bool static bool
iprange_mt_v0(const struct sk_buff *skb, const struct net_device *in, iprange_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct ipt_iprange_info *info = matchinfo; const struct ipt_iprange_info *info = par->matchinfo;
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
if (info->flags & IPRANGE_SRC) { if (info->flags & IPRANGE_SRC) {
@ -55,12 +52,9 @@ iprange_mt_v0(const struct sk_buff *skb, const struct net_device *in,
} }
static bool static bool
iprange_mt4(const struct sk_buff *skb, const struct net_device *in, iprange_mt4(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_iprange_mtinfo *info = matchinfo; const struct xt_iprange_mtinfo *info = par->matchinfo;
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
bool m; bool m;
@ -111,12 +105,9 @@ iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
} }
static bool static bool
iprange_mt6(const struct sk_buff *skb, const struct net_device *in, iprange_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_iprange_mtinfo *info = matchinfo; const struct xt_iprange_mtinfo *info = par->matchinfo;
const struct ipv6hdr *iph = ipv6_hdr(skb); const struct ipv6hdr *iph = ipv6_hdr(skb);
bool m; bool m;

14
net/netfilter/xt_length.c
View file

@ -21,24 +21,18 @@ MODULE_ALIAS("ipt_length");
MODULE_ALIAS("ip6t_length"); MODULE_ALIAS("ip6t_length");
static bool static bool
length_mt(const struct sk_buff *skb, const struct net_device *in, length_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_length_info *info = matchinfo; const struct xt_length_info *info = par->matchinfo;
u_int16_t pktlen = ntohs(ip_hdr(skb)->tot_len); u_int16_t pktlen = ntohs(ip_hdr(skb)->tot_len);
return (pktlen >= info->min && pktlen <= info->max) ^ info->invert; return (pktlen >= info->min && pktlen <= info->max) ^ info->invert;
} }
static bool static bool
length_mt6(const struct sk_buff *skb, const struct net_device *in, length_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_length_info *info = matchinfo; const struct xt_length_info *info = par->matchinfo;
const u_int16_t pktlen = ntohs(ipv6_hdr(skb)->payload_len) + const u_int16_t pktlen = ntohs(ipv6_hdr(skb)->payload_len) +
sizeof(struct ipv6hdr); sizeof(struct ipv6hdr);

7
net/netfilter/xt_limit.c
View file

@ -58,13 +58,10 @@ static DEFINE_SPINLOCK(limit_lock);
#define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ) #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
static bool static bool
limit_mt(const struct sk_buff *skb, const struct net_device *in, limit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
struct xt_rateinfo *r = struct xt_rateinfo *r =
((const struct xt_rateinfo *)matchinfo)->master; ((const struct xt_rateinfo *)par->matchinfo)->master;
unsigned long now = jiffies; unsigned long now = jiffies;
spin_lock_bh(&limit_lock); spin_lock_bh(&limit_lock);

7
net/netfilter/xt_mac.c
View file

@ -24,12 +24,9 @@ MODULE_DESCRIPTION("Xtables: MAC address match");
MODULE_ALIAS("ipt_mac"); MODULE_ALIAS("ipt_mac");
MODULE_ALIAS("ip6t_mac"); MODULE_ALIAS("ip6t_mac");
static bool static bool mac_mt(const struct sk_buff *skb, const struct xt_match_param *par)
mac_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct xt_mac_info *info = matchinfo; const struct xt_mac_info *info = par->matchinfo;
/* Is mac pointer valid? */ /* Is mac pointer valid? */
return skb_mac_header(skb) >= skb->head && return skb_mac_header(skb) >= skb->head &&

13
net/netfilter/xt_mark.c
View file

@ -23,22 +23,17 @@ MODULE_ALIAS("ipt_mark");
MODULE_ALIAS("ip6t_mark"); MODULE_ALIAS("ip6t_mark");
static bool static bool
mark_mt_v0(const struct sk_buff *skb, const struct net_device *in, mark_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_mark_info *info = matchinfo; const struct xt_mark_info *info = par->matchinfo;
return ((skb->mark & info->mask) == info->mark) ^ info->invert; return ((skb->mark & info->mask) == info->mark) ^ info->invert;
} }
static bool static bool
mark_mt(const struct sk_buff *skb, const struct net_device *in, mark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct xt_mark_mtinfo1 *info = matchinfo; const struct xt_mark_mtinfo1 *info = par->matchinfo;
return ((skb->mark & info->mask) == info->mark) ^ info->invert; return ((skb->mark & info->mask) == info->mark) ^ info->invert;
} }

26
net/netfilter/xt_multiport.c
View file

@ -95,25 +95,22 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
} }
static bool static bool
multiport_mt_v0(const struct sk_buff *skb, const struct net_device *in, multiport_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const __be16 *pptr; const __be16 *pptr;
__be16 _ports[2]; __be16 _ports[2];
const struct xt_multiport *multiinfo = matchinfo; const struct xt_multiport *multiinfo = par->matchinfo;
if (offset) if (par->fragoff != 0)
return false; return false;
pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports); pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports);
if (pptr == NULL) { if (pptr == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
* can't. Hence, no choice but to drop. * can't. Hence, no choice but to drop.
*/ */
duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n"); duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
@ -122,25 +119,22 @@ multiport_mt_v0(const struct sk_buff *skb, const struct net_device *in,
} }
static bool static bool
multiport_mt(const struct sk_buff *skb, const struct net_device *in, multiport_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const __be16 *pptr; const __be16 *pptr;
__be16 _ports[2]; __be16 _ports[2];
const struct xt_multiport_v1 *multiinfo = matchinfo; const struct xt_multiport_v1 *multiinfo = par->matchinfo;
if (offset) if (par->fragoff != 0)
return false; return false;
pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports); pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports);
if (pptr == NULL) { if (pptr == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
* can't. Hence, no choice but to drop. * can't. Hence, no choice but to drop.
*/ */
duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n"); duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

21
net/netfilter/xt_owner.c
View file

@ -21,12 +21,9 @@
#include <linux/netfilter_ipv6/ip6t_owner.h> #include <linux/netfilter_ipv6/ip6t_owner.h>
static bool static bool
owner_mt_v0(const struct sk_buff *skb, const struct net_device *in, owner_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct ipt_owner_info *info = matchinfo; const struct ipt_owner_info *info = par->matchinfo;
const struct file *filp; const struct file *filp;
if (skb->sk == NULL || skb->sk->sk_socket == NULL) if (skb->sk == NULL || skb->sk->sk_socket == NULL)
@ -50,12 +47,9 @@ owner_mt_v0(const struct sk_buff *skb, const struct net_device *in,
} }
static bool static bool
owner_mt6_v0(const struct sk_buff *skb, const struct net_device *in, owner_mt6_v0(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct ip6t_owner_info *info = matchinfo; const struct ip6t_owner_info *info = par->matchinfo;
const struct file *filp; const struct file *filp;
if (skb->sk == NULL || skb->sk->sk_socket == NULL) if (skb->sk == NULL || skb->sk->sk_socket == NULL)
@ -79,12 +73,9 @@ owner_mt6_v0(const struct sk_buff *skb, const struct net_device *in,
} }
static bool static bool
owner_mt(const struct sk_buff *skb, const struct net_device *in, owner_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_owner_match_info *info = matchinfo; const struct xt_owner_match_info *info = par->matchinfo;
const struct file *filp; const struct file *filp;
if (skb->sk == NULL || skb->sk->sk_socket == NULL) if (skb->sk == NULL || skb->sk->sk_socket == NULL)

7
net/netfilter/xt_physdev.c
View file

@ -21,14 +21,11 @@ MODULE_ALIAS("ipt_physdev");
MODULE_ALIAS("ip6t_physdev"); MODULE_ALIAS("ip6t_physdev");
static bool static bool
physdev_mt(const struct sk_buff *skb, const struct net_device *in, physdev_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
int i; int i;
static const char nulldevname[IFNAMSIZ]; static const char nulldevname[IFNAMSIZ];
const struct xt_physdev_info *info = matchinfo; const struct xt_physdev_info *info = par->matchinfo;
bool ret; bool ret;
const char *indev, *outdev; const char *indev, *outdev;
const struct nf_bridge_info *nf_bridge; const struct nf_bridge_info *nf_bridge;

11
net/netfilter/xt_pkttype.c
View file

@ -23,20 +23,17 @@ MODULE_ALIAS("ipt_pkttype");
MODULE_ALIAS("ip6t_pkttype"); MODULE_ALIAS("ip6t_pkttype");
static bool static bool
pkttype_mt(const struct sk_buff *skb, const struct net_device *in, pkttype_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_pkttype_info *info = matchinfo; const struct xt_pkttype_info *info = par->matchinfo;
u_int8_t type; u_int8_t type;
if (skb->pkt_type != PACKET_LOOPBACK) if (skb->pkt_type != PACKET_LOOPBACK)
type = skb->pkt_type; type = skb->pkt_type;
else if (match->family == NFPROTO_IPV4 && else if (par->match->family == NFPROTO_IPV4 &&
ipv4_is_multicast(ip_hdr(skb)->daddr)) ipv4_is_multicast(ip_hdr(skb)->daddr))
type = PACKET_MULTICAST; type = PACKET_MULTICAST;
else if (match->family == NFPROTO_IPV6 && else if (par->match->family == NFPROTO_IPV6 &&
ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF) ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
type = PACKET_MULTICAST; type = PACKET_MULTICAST;
else else

11
net/netfilter/xt_policy.c
View file

@ -110,18 +110,15 @@ match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info,
} }
static bool static bool
policy_mt(const struct sk_buff *skb, const struct net_device *in, policy_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_policy_info *info = matchinfo; const struct xt_policy_info *info = par->matchinfo;
int ret; int ret;
if (info->flags & XT_POLICY_MATCH_IN) if (info->flags & XT_POLICY_MATCH_IN)
ret = match_policy_in(skb, info, match->family); ret = match_policy_in(skb, info, par->match->family);
else else
ret = match_policy_out(skb, info, match->family); ret = match_policy_out(skb, info, par->match->family);
if (ret < 0) if (ret < 0)
ret = info->flags & XT_POLICY_MATCH_NONE ? true : false; ret = info->flags & XT_POLICY_MATCH_NONE ? true : false;

7
net/netfilter/xt_quota.c
View file

@ -18,13 +18,10 @@ MODULE_ALIAS("ip6t_quota");
static DEFINE_SPINLOCK(quota_lock); static DEFINE_SPINLOCK(quota_lock);
static bool static bool
quota_mt(const struct sk_buff *skb, const struct net_device *in, quota_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
struct xt_quota_info *q = struct xt_quota_info *q =
((const struct xt_quota_info *)matchinfo)->master; ((const struct xt_quota_info *)par->matchinfo)->master;
bool ret = q->flags & XT_QUOTA_INVERT; bool ret = q->flags & XT_QUOTA_INVERT;
spin_lock_bh(&quota_lock); spin_lock_bh(&quota_lock);

12
net/netfilter/xt_rateest.c
View file

@ -14,16 +14,10 @@
#include <net/netfilter/xt_rateest.h> #include <net/netfilter/xt_rateest.h>
static bool xt_rateest_mt(const struct sk_buff *skb, static bool
const struct net_device *in, xt_rateest_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out,
const struct xt_match *match,
const void *matchinfo,
int offset,
unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_rateest_match_info *info = matchinfo; const struct xt_rateest_match_info *info = par->matchinfo;
struct gnet_stats_rate_est *r; struct gnet_stats_rate_est *r;
u_int32_t bps1, bps2, pps1, pps2; u_int32_t bps1, bps2, pps1, pps2;
bool ret = true; bool ret = true;

7
net/netfilter/xt_realm.c
View file

@ -22,12 +22,9 @@ MODULE_DESCRIPTION("Xtables: Routing realm match");
MODULE_ALIAS("ipt_realm"); MODULE_ALIAS("ipt_realm");
static bool static bool
realm_mt(const struct sk_buff *skb, const struct net_device *in, realm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_realm_info *info = matchinfo; const struct xt_realm_info *info = par->matchinfo;
const struct dst_entry *dst = skb->dst; const struct dst_entry *dst = skb->dst;
return (info->id == (dst->tclassid & info->mask)) ^ info->invert; return (info->id == (dst->tclassid & info->mask)) ^ info->invert;

17
net/netfilter/xt_recent.c
View file

@ -204,19 +204,16 @@ static void recent_table_flush(struct recent_table *t)
} }
static bool static bool
recent_mt(const struct sk_buff *skb, const struct net_device *in, recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_recent_mtinfo *info = matchinfo; const struct xt_recent_mtinfo *info = par->matchinfo;
struct recent_table *t; struct recent_table *t;
struct recent_entry *e; struct recent_entry *e;
union nf_inet_addr addr = {}; union nf_inet_addr addr = {};
u_int8_t ttl; u_int8_t ttl;
bool ret = info->invert; bool ret = info->invert;
if (match->family == NFPROTO_IPV4) { if (par->match->family == NFPROTO_IPV4) {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
if (info->side == XT_RECENT_DEST) if (info->side == XT_RECENT_DEST)
@ -237,19 +234,19 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in,
} }
/* use TTL as seen before forwarding */ /* use TTL as seen before forwarding */
if (out && !skb->sk) if (par->out != NULL && skb->sk == NULL)
ttl++; ttl++;
spin_lock_bh(&recent_lock); spin_lock_bh(&recent_lock);
t = recent_table_lookup(info->name); t = recent_table_lookup(info->name);
e = recent_entry_lookup(t, &addr, match->family, e = recent_entry_lookup(t, &addr, par->match->family,
(info->check_set & XT_RECENT_TTL) ? ttl : 0); (info->check_set & XT_RECENT_TTL) ? ttl : 0);
if (e == NULL) { if (e == NULL) {
if (!(info->check_set & XT_RECENT_SET)) if (!(info->check_set & XT_RECENT_SET))
goto out; goto out;
e = recent_entry_init(t, &addr, match->family, ttl); e = recent_entry_init(t, &addr, par->match->family, ttl);
if (e == NULL) if (e == NULL)
*hotdrop = true; *par->hotdrop = true;
ret = !ret; ret = !ret;
goto out; goto out;
} }

16
net/netfilter/xt_sctp.c
View file

@ -117,23 +117,21 @@ match_packet(const struct sk_buff *skb,
} }
static bool static bool
sctp_mt(const struct sk_buff *skb, const struct net_device *in, sctp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct xt_sctp_info *info = matchinfo; const struct xt_sctp_info *info = par->matchinfo;
const sctp_sctphdr_t *sh; const sctp_sctphdr_t *sh;
sctp_sctphdr_t _sh; sctp_sctphdr_t _sh;
if (offset) { if (par->fragoff != 0) {
duprintf("Dropping non-first fragment.. FIXME\n"); duprintf("Dropping non-first fragment.. FIXME\n");
return false; return false;
} }
sh = skb_header_pointer(skb, protoff, sizeof(_sh), &_sh); sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
if (sh == NULL) { if (sh == NULL) {
duprintf("Dropping evil TCP offset=0 tinygram.\n"); duprintf("Dropping evil TCP offset=0 tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
duprintf("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest)); duprintf("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
@ -144,8 +142,8 @@ sctp_mt(const struct sk_buff *skb, const struct net_device *in,
&& SCCHECK(ntohs(sh->dest) >= info->dpts[0] && SCCHECK(ntohs(sh->dest) >= info->dpts[0]
&& ntohs(sh->dest) <= info->dpts[1], && ntohs(sh->dest) <= info->dpts[1],
XT_SCTP_DEST_PORTS, info->flags, info->invflags) XT_SCTP_DEST_PORTS, info->flags, info->invflags)
&& SCCHECK(match_packet(skb, protoff + sizeof (sctp_sctphdr_t), && SCCHECK(match_packet(skb, par->thoff + sizeof(sctp_sctphdr_t),
info, hotdrop), info, par->hotdrop),
XT_SCTP_CHUNK_TYPES, info->flags, info->invflags); XT_SCTP_CHUNK_TYPES, info->flags, info->invflags);
} }

11
net/netfilter/xt_socket.c
View file

@ -86,14 +86,7 @@ extract_icmp_fields(const struct sk_buff *skb,
static bool static bool
socket_mt(const struct sk_buff *skb, socket_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *in,
const struct net_device *out,
const struct xt_match *match,
const void *matchinfo,
int offset,
unsigned int protoff,
bool *hotdrop)
{ {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
struct udphdr _hdr, *hp = NULL; struct udphdr _hdr, *hp = NULL;
@ -146,7 +139,7 @@ socket_mt(const struct sk_buff *skb,
#endif #endif
sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
saddr, daddr, sport, dport, in, false); saddr, daddr, sport, dport, par->in, false);
if (sk != NULL) { if (sk != NULL) {
bool wildcard = (inet_sk(sk)->rcv_saddr == 0); bool wildcard = (inet_sk(sk)->rcv_saddr == 0);

7
net/netfilter/xt_state.c
View file

@ -21,12 +21,9 @@ MODULE_ALIAS("ipt_state");
MODULE_ALIAS("ip6t_state"); MODULE_ALIAS("ip6t_state");
static bool static bool
state_mt(const struct sk_buff *skb, const struct net_device *in, state_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_state_info *sinfo = matchinfo; const struct xt_state_info *sinfo = par->matchinfo;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
unsigned int statebit; unsigned int statebit;

7
net/netfilter/xt_statistic.c
View file

@ -25,12 +25,9 @@ MODULE_ALIAS("ip6t_statistic");
static DEFINE_SPINLOCK(nth_lock); static DEFINE_SPINLOCK(nth_lock);
static bool static bool
statistic_mt(const struct sk_buff *skb, const struct net_device *in, statistic_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
struct xt_statistic_info *info = (struct xt_statistic_info *)matchinfo; struct xt_statistic_info *info = (void *)par->matchinfo;
bool ret = info->flags & XT_STATISTIC_INVERT; bool ret = info->flags & XT_STATISTIC_INVERT;
switch (info->mode) { switch (info->mode) {

9
net/netfilter/xt_string.c
View file

@ -22,18 +22,15 @@ MODULE_ALIAS("ipt_string");
MODULE_ALIAS("ip6t_string"); MODULE_ALIAS("ip6t_string");
static bool static bool
string_mt(const struct sk_buff *skb, const struct net_device *in, string_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_string_info *conf = matchinfo; const struct xt_string_info *conf = par->matchinfo;
struct ts_state state; struct ts_state state;
int invert; int invert;
memset(&state, 0, sizeof(struct ts_state)); memset(&state, 0, sizeof(struct ts_state));
invert = (match->revision == 0 ? conf->u.v0.invert : invert = (par->match->revision == 0 ? conf->u.v0.invert :
conf->u.v1.flags & XT_STRING_FLAG_INVERT); conf->u.v1.flags & XT_STRING_FLAG_INVERT);
return (skb_find_text((struct sk_buff *)skb, conf->from_offset, return (skb_find_text((struct sk_buff *)skb, conf->from_offset,

13
net/netfilter/xt_tcpmss.c
View file

@ -25,12 +25,9 @@ MODULE_ALIAS("ipt_tcpmss");
MODULE_ALIAS("ip6t_tcpmss"); MODULE_ALIAS("ip6t_tcpmss");
static bool static bool
tcpmss_mt(const struct sk_buff *skb, const struct net_device *in, tcpmss_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff,
bool *hotdrop)
{ {
const struct xt_tcpmss_match_info *info = matchinfo; const struct xt_tcpmss_match_info *info = par->matchinfo;
const struct tcphdr *th; const struct tcphdr *th;
struct tcphdr _tcph; struct tcphdr _tcph;
/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */ /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
@ -39,7 +36,7 @@ tcpmss_mt(const struct sk_buff *skb, const struct net_device *in,
unsigned int i, optlen; unsigned int i, optlen;
/* If we don't have the whole header, drop packet. */ /* If we don't have the whole header, drop packet. */
th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph); th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
if (th == NULL) if (th == NULL)
goto dropit; goto dropit;
@ -52,7 +49,7 @@ tcpmss_mt(const struct sk_buff *skb, const struct net_device *in,
goto out; goto out;
/* Truncated options. */ /* Truncated options. */
op = skb_header_pointer(skb, protoff + sizeof(*th), optlen, _opt); op = skb_header_pointer(skb, par->thoff + sizeof(*th), optlen, _opt);
if (op == NULL) if (op == NULL)
goto dropit; goto dropit;
@ -76,7 +73,7 @@ out:
return info->invert; return info->invert;
dropit: dropit:
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

36
net/netfilter/xt_tcpudp.c
View file

@ -68,25 +68,22 @@ tcp_find_option(u_int8_t option,
return invert; return invert;
} }
static bool static bool tcp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
tcp_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct tcphdr *th; const struct tcphdr *th;
struct tcphdr _tcph; struct tcphdr _tcph;
const struct xt_tcp *tcpinfo = matchinfo; const struct xt_tcp *tcpinfo = par->matchinfo;
if (offset) { if (par->fragoff != 0) {
/* To quote Alan: /* To quote Alan:
Don't allow a fragment of TCP 8 bytes in. Nobody normal Don't allow a fragment of TCP 8 bytes in. Nobody normal
causes this. Its a cracker trying to break in by doing a causes this. Its a cracker trying to break in by doing a
flag overwrite to pass the direction checks. flag overwrite to pass the direction checks.
*/ */
if (offset == 1) { if (par->fragoff == 1) {
duprintf("Dropping evil TCP offset=1 frag.\n"); duprintf("Dropping evil TCP offset=1 frag.\n");
*hotdrop = true; *par->hotdrop = true;
} }
/* Must not be a fragment. */ /* Must not be a fragment. */
return false; return false;
@ -94,12 +91,12 @@ tcp_mt(const struct sk_buff *skb, const struct net_device *in,
#define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg))) #define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph); th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
if (th == NULL) { if (th == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
can't. Hence, no choice but to drop. */ can't. Hence, no choice but to drop. */
duprintf("Dropping evil TCP offset=0 tinygram.\n"); duprintf("Dropping evil TCP offset=0 tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
@ -117,13 +114,13 @@ tcp_mt(const struct sk_buff *skb, const struct net_device *in,
return false; return false;
if (tcpinfo->option) { if (tcpinfo->option) {
if (th->doff * 4 < sizeof(_tcph)) { if (th->doff * 4 < sizeof(_tcph)) {
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }
if (!tcp_find_option(tcpinfo->option, skb, protoff, if (!tcp_find_option(tcpinfo->option, skb, par->thoff,
th->doff*4 - sizeof(_tcph), th->doff*4 - sizeof(_tcph),
tcpinfo->invflags & XT_TCP_INV_OPTION, tcpinfo->invflags & XT_TCP_INV_OPTION,
hotdrop)) par->hotdrop))
return false; return false;
} }
return true; return true;
@ -141,25 +138,22 @@ tcp_mt_check(const char *tablename, const void *info,
return !(tcpinfo->invflags & ~XT_TCP_INV_MASK); return !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
} }
static bool static bool udp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
udp_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct udphdr *uh; const struct udphdr *uh;
struct udphdr _udph; struct udphdr _udph;
const struct xt_udp *udpinfo = matchinfo; const struct xt_udp *udpinfo = par->matchinfo;
/* Must not be a fragment. */ /* Must not be a fragment. */
if (offset) if (par->fragoff != 0)
return false; return false;
uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph); uh = skb_header_pointer(skb, par->thoff, sizeof(_udph), &_udph);
if (uh == NULL) { if (uh == NULL) {
/* We've been asked to examine this packet, and we /* We've been asked to examine this packet, and we
can't. Hence, no choice but to drop. */ can't. Hence, no choice but to drop. */
duprintf("Dropping evil UDP tinygram.\n"); duprintf("Dropping evil UDP tinygram.\n");
*hotdrop = true; *par->hotdrop = true;
return false; return false;
} }

6
net/netfilter/xt_time.c
View file

@ -153,11 +153,9 @@ static void localtime_3(struct xtm *r, time_t time)
} }
static bool static bool
time_mt(const struct sk_buff *skb, const struct net_device *in, time_mt(const struct sk_buff *skb, const struct xt_match_param *par)
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct xt_time_info *info = matchinfo; const struct xt_time_info *info = par->matchinfo;
unsigned int packet_time; unsigned int packet_time;
struct xtm current_time; struct xtm current_time;
s64 stamp; s64 stamp;

7
net/netfilter/xt_u32.c
View file

@ -87,12 +87,9 @@ static bool u32_match_it(const struct xt_u32 *data,
return true; return true;
} }
static bool static bool u32_mt(const struct sk_buff *skb, const struct xt_match_param *par)
u32_mt(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct xt_match *match,
const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{ {
const struct xt_u32 *data = matchinfo; const struct xt_u32 *data = par->matchinfo;
bool ret; bool ret;
ret = u32_match_it(data, skb); ret = u32_match_it(data, skb);