Commit 737535c5 authored by Jan Engelhardt's avatar Jan Engelhardt

netfilter: xtables: compact table hook functions (1/2)

This patch combines all the per-hook functions in a given table into
a single function. Together with the 2nd patch, further
simplifications are possible up to the point of output code reduction.
Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
parent 9ab99d5a
...@@ -53,43 +53,37 @@ static const struct xt_table packet_filter = { ...@@ -53,43 +53,37 @@ static const struct xt_table packet_filter = {
}; };
/* The work comes in here from netfilter.c */ /* The work comes in here from netfilter.c */
static unsigned int arpt_in_hook(unsigned int hook, static unsigned int
struct sk_buff *skb, arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *in, const struct net_device *out,
const struct net_device *out, int (*okfn)(struct sk_buff *))
int (*okfn)(struct sk_buff *))
{ {
return arpt_do_table(skb, hook, in, out, if (hook == NF_ARP_OUT)
dev_net(in)->ipv4.arptable_filter); return arpt_do_table(skb, hook, in, out,
} dev_net(out)->ipv4.arptable_filter);
static unsigned int arpt_out_hook(unsigned int hook, /* INPUT/FORWARD: */
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return arpt_do_table(skb, hook, in, out, return arpt_do_table(skb, hook, in, out,
dev_net(out)->ipv4.arptable_filter); dev_net(in)->ipv4.arptable_filter);
} }
static struct nf_hook_ops arpt_ops[] __read_mostly = { static struct nf_hook_ops arpt_ops[] __read_mostly = {
{ {
.hook = arpt_in_hook, .hook = arptable_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_ARP, .pf = NFPROTO_ARP,
.hooknum = NF_ARP_IN, .hooknum = NF_ARP_IN,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = arpt_out_hook, .hook = arptable_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_ARP, .pf = NFPROTO_ARP,
.hooknum = NF_ARP_OUT, .hooknum = NF_ARP_OUT,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = arpt_in_hook, .hook = arptable_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_ARP, .pf = NFPROTO_ARP,
.hooknum = NF_ARP_FORWARD, .hooknum = NF_ARP_FORWARD,
......
...@@ -60,61 +60,43 @@ static const struct xt_table packet_filter = { ...@@ -60,61 +60,43 @@ static const struct xt_table packet_filter = {
.af = NFPROTO_IPV4, .af = NFPROTO_IPV4,
}; };
/* The work comes in here from netfilter.c. */
static unsigned int static unsigned int
ipt_local_in_hook(unsigned int hook, iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
struct sk_buff *skb, const struct net_device *in, const struct net_device *out,
const struct net_device *in, int (*okfn)(struct sk_buff *))
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{ {
return ipt_do_table(skb, hook, in, out, if (hook == NF_INET_LOCAL_OUT) {
dev_net(in)->ipv4.iptable_filter); if (skb->len < sizeof(struct iphdr) ||
} ip_hdrlen(skb) < sizeof(struct iphdr))
/* root is playing with raw sockets. */
return NF_ACCEPT;
return ipt_do_table(skb, hook, in, out,
dev_net(out)->ipv4.iptable_filter);
}
static unsigned int /* LOCAL_IN/FORWARD: */
ipt_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ipt_do_table(skb, hook, in, out, return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_filter); dev_net(in)->ipv4.iptable_filter);
} }
static unsigned int
ipt_local_out_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
/* root is playing with raw sockets. */
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr))
return NF_ACCEPT;
return ipt_do_table(skb, hook, in, out,
dev_net(out)->ipv4.iptable_filter);
}
static struct nf_hook_ops ipt_ops[] __read_mostly = { static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_local_in_hook, .hook = iptable_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = ipt_hook, .hook = iptable_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = ipt_local_out_hook, .hook = iptable_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
......
...@@ -71,51 +71,6 @@ static const struct xt_table packet_mangler = { ...@@ -71,51 +71,6 @@ static const struct xt_table packet_mangler = {
.af = NFPROTO_IPV4, .af = NFPROTO_IPV4,
}; };
/* The work comes in here from netfilter.c. */
static unsigned int
ipt_pre_routing_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_mangle);
}
static unsigned int
ipt_post_routing_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ipt_do_table(skb, hook, in, out,
dev_net(out)->ipv4.iptable_mangle);
}
static unsigned int
ipt_local_in_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_mangle);
}
static unsigned int
ipt_forward_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_mangle);
}
static unsigned int static unsigned int
ipt_local_hook(unsigned int hook, ipt_local_hook(unsigned int hook,
struct sk_buff *skb, struct sk_buff *skb,
...@@ -158,37 +113,53 @@ ipt_local_hook(unsigned int hook, ...@@ -158,37 +113,53 @@ ipt_local_hook(unsigned int hook,
return ret; return ret;
} }
/* The work comes in here from netfilter.c. */
static unsigned int
iptable_mangle_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
if (hook == NF_INET_LOCAL_OUT)
return ipt_local_hook(hook, skb, in, out, okfn);
/* PREROUTING/INPUT/FORWARD: */
return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_mangle);
}
static struct nf_hook_ops ipt_ops[] __read_mostly = { static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_pre_routing_hook, .hook = iptable_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_local_in_hook, .hook = iptable_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_forward_hook, .hook = iptable_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_local_hook, .hook = iptable_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_post_routing_hook, .hook = iptable_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
......
...@@ -45,23 +45,15 @@ static const struct xt_table packet_raw = { ...@@ -45,23 +45,15 @@ static const struct xt_table packet_raw = {
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
static unsigned int static unsigned int
ipt_hook(unsigned int hook, iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
struct sk_buff *skb, const struct net_device *in, const struct net_device *out,
const struct net_device *in, int (*okfn)(struct sk_buff *))
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{ {
return ipt_do_table(skb, hook, in, out, if (hook == NF_INET_PRE_ROUTING)
dev_net(in)->ipv4.iptable_raw); return ipt_do_table(skb, hook, in, out,
} dev_net(in)->ipv4.iptable_raw);
static unsigned int /* OUTPUT: */
ipt_local_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
/* root is playing with raw sockets. */ /* root is playing with raw sockets. */
if (skb->len < sizeof(struct iphdr) || if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)) ip_hdrlen(skb) < sizeof(struct iphdr))
...@@ -73,14 +65,14 @@ ipt_local_hook(unsigned int hook, ...@@ -73,14 +65,14 @@ ipt_local_hook(unsigned int hook,
/* 'raw' is the very first table. */ /* 'raw' is the very first table. */
static struct nf_hook_ops ipt_ops[] __read_mostly = { static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_hook, .hook = iptable_raw_hook,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_RAW, .priority = NF_IP_PRI_RAW,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
{ {
.hook = ipt_local_hook, .hook = iptable_raw_hook,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_RAW, .priority = NF_IP_PRI_RAW,
......
...@@ -65,59 +65,43 @@ static const struct xt_table security_table = { ...@@ -65,59 +65,43 @@ static const struct xt_table security_table = {
}; };
static unsigned int static unsigned int
ipt_local_in_hook(unsigned int hook, iptable_security_hook(unsigned int hook, struct sk_buff *skb,
struct sk_buff *skb, const struct net_device *in,
const struct net_device *in, const struct net_device *out,
const struct net_device *out, int (*okfn)(struct sk_buff *))
int (*okfn)(struct sk_buff *))
{ {
return ipt_do_table(skb, hook, in, out, if (hook == NF_INET_LOCAL_OUT) {
dev_net(in)->ipv4.iptable_security); if (skb->len < sizeof(struct iphdr) ||
} ip_hdrlen(skb) < sizeof(struct iphdr))
/* Somebody is playing with raw sockets. */
return NF_ACCEPT;
static unsigned int return ipt_do_table(skb, hook, in, out,
ipt_forward_hook(unsigned int hook, dev_net(out)->ipv4.iptable_security);
struct sk_buff *skb, }
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_security);
}
static unsigned int /* INPUT/FORWARD: */
ipt_local_out_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
/* Somebody is playing with raw sockets. */
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr))
return NF_ACCEPT;
return ipt_do_table(skb, hook, in, out, return ipt_do_table(skb, hook, in, out,
dev_net(out)->ipv4.iptable_security); dev_net(in)->ipv4.iptable_security);
} }
static struct nf_hook_ops ipt_ops[] __read_mostly = { static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_local_in_hook, .hook = iptable_security_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_SECURITY, .priority = NF_IP_PRI_SECURITY,
}, },
{ {
.hook = ipt_forward_hook, .hook = iptable_security_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_SECURITY, .priority = NF_IP_PRI_SECURITY,
}, },
{ {
.hook = ipt_local_out_hook, .hook = iptable_security_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV4, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
......
...@@ -60,54 +60,36 @@ static const struct xt_table packet_filter = { ...@@ -60,54 +60,36 @@ static const struct xt_table packet_filter = {
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
static unsigned int static unsigned int
ip6t_in_hook(unsigned int hook, ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
struct sk_buff *skb, const struct net_device *in, const struct net_device *out,
const struct net_device *in, int (*okfn)(struct sk_buff *))
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{ {
return ip6t_do_table(skb, hook, in, out, if (hook == NF_INET_LOCAL_OUT)
dev_net(in)->ipv6.ip6table_filter); return ip6t_do_table(skb, hook, in, out,
} dev_net(out)->ipv6.ip6table_filter);
static unsigned int
ip6t_local_out_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
#if 0
/* root is playing with raw sockets. */
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)) {
if (net_ratelimit())
printk("ip6t_hook: happy cracking.\n");
return NF_ACCEPT;
}
#endif
/* INPUT/FORWARD: */
return ip6t_do_table(skb, hook, in, out, return ip6t_do_table(skb, hook, in, out,
dev_net(out)->ipv6.ip6table_filter); dev_net(in)->ipv6.ip6table_filter);
} }
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_in_hook, .hook = ip6table_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },
{ {
.hook = ip6t_in_hook, .hook = ip6table_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6table_filter_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
......
...@@ -64,33 +64,9 @@ static const struct xt_table packet_mangler = { ...@@ -64,33 +64,9 @@ static const struct xt_table packet_mangler = {
.af = NFPROTO_IPV6, .af = NFPROTO_IPV6,
}; };
/* The work comes in here from netfilter.c. */
static unsigned int
ip6t_in_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ip6t_do_table(skb, hook, in, out,
dev_net(in)->ipv6.ip6table_mangle);
}
static unsigned int
ip6t_post_routing_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ip6t_do_table(skb, hook, in, out,
dev_net(out)->ipv6.ip6table_mangle);
}
static unsigned int static unsigned int
ip6t_local_out_hook(unsigned int hook, ip6t_local_out_hook(unsigned int hook,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
...@@ -119,7 +95,7 @@ ip6t_local_out_hook(unsigned int hook, ...@@ -119,7 +95,7 @@ ip6t_local_out_hook(unsigned int hook,
/* flowlabel and prio (includes version, which shouldn't change either */ /* flowlabel and prio (includes version, which shouldn't change either */
flowlabel = *((u_int32_t *)ipv6_hdr(skb)); flowlabel = *((u_int32_t *)ipv6_hdr(skb));
ret = ip6t_do_table(skb, hook, in, out, ret = ip6t_do_table(skb, hook, NULL, out,
dev_net(out)->ipv6.ip6table_mangle); dev_net(out)->ipv6.ip6table_mangle);
if (ret != NF_DROP && ret != NF_STOLEN && if (ret != NF_DROP && ret != NF_STOLEN &&
...@@ -132,37 +108,51 @@ ip6t_local_out_hook(unsigned int hook, ...@@ -132,37 +108,51 @@ ip6t_local_out_hook(unsigned int hook,
return ret; return ret;
} }
/* The work comes in here from netfilter.c. */
static unsigned int
ip6table_mangle_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
if (hook == NF_INET_LOCAL_OUT)
return ip6t_local_out_hook(hook, skb, out, okfn);
/* INPUT/FORWARD */
return ip6t_do_table(skb, hook, in, out,
dev_net(in)->ipv6.ip6table_mangle);
}
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_in_hook, .hook = ip6table_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_in_hook, .hook = ip6table_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_in_hook, .hook = ip6table_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6table_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_post_routing_hook, .hook = ip6table_mangle_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
......
...@@ -44,37 +44,29 @@ static const struct xt_table packet_raw = { ...@@ -44,37 +44,29 @@ static const struct xt_table packet_raw = {
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
static unsigned int static unsigned int
ip6t_pre_routing_hook(unsigned int hook, ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
struct sk_buff *skb, const struct net_device *in, const struct net_device *out,
const struct net_device *in, int (*okfn)(struct sk_buff *))
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{ {
return ip6t_do_table(skb, hook, in, out, if (hook == NF_INET_PRE_ROUTING)
dev_net(in)->ipv6.ip6table_raw); return ip6t_do_table(skb, hook, in, out,
} dev_net(in)->ipv6.ip6table_raw);
static unsigned int /* OUTPUT: */
ip6t_local_out_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ip6t_do_table(skb, hook, in, out, return ip6t_do_table(skb, hook, in, out,
dev_net(out)->ipv6.ip6table_raw); dev_net(out)->ipv6.ip6table_raw);
} }
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_pre_routing_hook, .hook = ip6table_raw_hook,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_FIRST, .priority = NF_IP6_PRI_FIRST,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6table_raw_hook,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_FIRST, .priority = NF_IP6_PRI_FIRST,
......
...@@ -64,56 +64,37 @@ static const struct xt_table security_table = { ...@@ -64,56 +64,37 @@ static const struct xt_table security_table = {
}; };
static unsigned int static unsigned int
ip6t_local_in_hook(unsigned int hook, ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
struct sk_buff *skb, const struct net_device *in,
const struct net_device *in, const struct net_device *out,
const struct net_device *out, int (*okfn)(struct sk_buff *))
int (*okfn)(struct sk_buff *))
{ {
return ip6t_do_table(skb, hook, in, out, if (hook == NF_INET_LOCAL_OUT)
dev_net(in)->ipv6.ip6table_security); return ip6t_do_table(skb, hook, in, out,
} dev_net(out)->ipv6.ip6table_security);
static unsigned int /* INPUT/FORWARD: */
ip6t_forward_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
return ip6t_do_table(skb, hook, in, out, return ip6t_do_table(skb, hook, in, out,
dev_net(in)->ipv6.ip6table_security); dev_net(in)->ipv6.ip6table_security);
} }
static unsigned int
ip6t_local_out_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
/* TBD: handle short packets via raw socket */
return ip6t_do_table(skb, hook, in, out,
dev_net(out)->ipv6.ip6table_security);
}
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_local_in_hook, .hook = ip6table_security_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_SECURITY, .priority = NF_IP6_PRI_SECURITY,
}, },
{ {
.hook = ip6t_forward_hook, .hook = ip6table_security_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_SECURITY, .priority = NF_IP6_PRI_SECURITY,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6table_security_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = NFPROTO_IPV6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment