Commit d7cf4081 authored by David S. Miller's avatar David S. Miller

netfilter: Pass nf_hook_state through nf_nat_ipv4_{in,out,fn,local_fn}().

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 238e54c9
...@@ -44,40 +44,32 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb, struct nf_conn *ct, ...@@ -44,40 +44,32 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb, struct nf_conn *ct,
unsigned int hooknum); unsigned int hooknum);
unsigned int nf_nat_ipv4_in(const struct nf_hook_ops *ops, struct sk_buff *skb, unsigned int nf_nat_ipv4_in(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)); struct nf_conn *ct));
unsigned int nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb, unsigned int nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)); struct nf_conn *ct));
unsigned int nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, unsigned int nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)); struct nf_conn *ct));
unsigned int nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, unsigned int nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)); struct nf_conn *ct));
int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, struct nf_conn *ct, int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, struct nf_conn *ct,
......
...@@ -30,45 +30,41 @@ static const struct xt_table nf_nat_ipv4_table = { ...@@ -30,45 +30,41 @@ static const struct xt_table nf_nat_ipv4_table = {
static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops, static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct) struct nf_conn *ct)
{ {
struct net *net = nf_ct_net(ct); struct net *net = nf_ct_net(ct);
return ipt_do_table(skb, ops->hooknum, in, out, net->ipv4.nat_table); return ipt_do_table(skb, ops->hooknum, state->in, state->out,
net->ipv4.nat_table);
} }
static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops, static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_fn(ops, skb, state->in, state->out, return nf_nat_ipv4_fn(ops, skb, state, iptable_nat_do_chain);
iptable_nat_do_chain);
} }
static unsigned int iptable_nat_ipv4_in(const struct nf_hook_ops *ops, static unsigned int iptable_nat_ipv4_in(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_in(ops, skb, state->in, state->out, return nf_nat_ipv4_in(ops, skb, state, iptable_nat_do_chain);
iptable_nat_do_chain);
} }
static unsigned int iptable_nat_ipv4_out(const struct nf_hook_ops *ops, static unsigned int iptable_nat_ipv4_out(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_out(ops, skb, state->in, state->out, return nf_nat_ipv4_out(ops, skb, state, iptable_nat_do_chain);
iptable_nat_do_chain);
} }
static unsigned int iptable_nat_ipv4_local_fn(const struct nf_hook_ops *ops, static unsigned int iptable_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_local_fn(ops, skb, state->in, state->out, return nf_nat_ipv4_local_fn(ops, skb, state, iptable_nat_do_chain);
iptable_nat_do_chain);
} }
static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = { static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
......
...@@ -256,11 +256,10 @@ EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation); ...@@ -256,11 +256,10 @@ EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
unsigned int unsigned int
nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct nf_hook_state *state,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)) struct nf_conn *ct))
{ {
struct nf_conn *ct; struct nf_conn *ct;
...@@ -309,7 +308,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -309,7 +308,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
if (!nf_nat_initialized(ct, maniptype)) { if (!nf_nat_initialized(ct, maniptype)) {
unsigned int ret; unsigned int ret;
ret = do_chain(ops, skb, in, out, ct); ret = do_chain(ops, skb, state, ct);
if (ret != NF_ACCEPT) if (ret != NF_ACCEPT)
return ret; return ret;
...@@ -323,7 +322,8 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -323,7 +322,8 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
pr_debug("Already setup manip %s for ct %p\n", pr_debug("Already setup manip %s for ct %p\n",
maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST", maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
ct); ct);
if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out)) if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat,
state->out))
goto oif_changed; goto oif_changed;
} }
break; break;
...@@ -332,7 +332,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -332,7 +332,7 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
/* ESTABLISHED */ /* ESTABLISHED */
NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED || NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
ctinfo == IP_CT_ESTABLISHED_REPLY); ctinfo == IP_CT_ESTABLISHED_REPLY);
if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out)) if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, state->out))
goto oif_changed; goto oif_changed;
} }
...@@ -346,17 +346,16 @@ EXPORT_SYMBOL_GPL(nf_nat_ipv4_fn); ...@@ -346,17 +346,16 @@ EXPORT_SYMBOL_GPL(nf_nat_ipv4_fn);
unsigned int unsigned int
nf_nat_ipv4_in(const struct nf_hook_ops *ops, struct sk_buff *skb, nf_nat_ipv4_in(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct nf_hook_state *state,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)) struct nf_conn *ct))
{ {
unsigned int ret; unsigned int ret;
__be32 daddr = ip_hdr(skb)->daddr; __be32 daddr = ip_hdr(skb)->daddr;
ret = nf_nat_ipv4_fn(ops, skb, in, out, do_chain); ret = nf_nat_ipv4_fn(ops, skb, state, do_chain);
if (ret != NF_DROP && ret != NF_STOLEN && if (ret != NF_DROP && ret != NF_STOLEN &&
daddr != ip_hdr(skb)->daddr) daddr != ip_hdr(skb)->daddr)
skb_dst_drop(skb); skb_dst_drop(skb);
...@@ -367,11 +366,10 @@ EXPORT_SYMBOL_GPL(nf_nat_ipv4_in); ...@@ -367,11 +366,10 @@ EXPORT_SYMBOL_GPL(nf_nat_ipv4_in);
unsigned int unsigned int
nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb, nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct nf_hook_state *state,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)) struct nf_conn *ct))
{ {
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
...@@ -386,7 +384,7 @@ nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -386,7 +384,7 @@ nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb,
ip_hdrlen(skb) < sizeof(struct iphdr)) ip_hdrlen(skb) < sizeof(struct iphdr))
return NF_ACCEPT; return NF_ACCEPT;
ret = nf_nat_ipv4_fn(ops, skb, in, out, do_chain); ret = nf_nat_ipv4_fn(ops, skb, state, do_chain);
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
if (ret != NF_DROP && ret != NF_STOLEN && if (ret != NF_DROP && ret != NF_STOLEN &&
!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
...@@ -410,11 +408,10 @@ EXPORT_SYMBOL_GPL(nf_nat_ipv4_out); ...@@ -410,11 +408,10 @@ EXPORT_SYMBOL_GPL(nf_nat_ipv4_out);
unsigned int unsigned int
nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct nf_hook_state *state,
unsigned int (*do_chain)(const struct nf_hook_ops *ops, unsigned int (*do_chain)(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct)) struct nf_conn *ct))
{ {
const struct nf_conn *ct; const struct nf_conn *ct;
...@@ -427,7 +424,7 @@ nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, struct sk_buff *skb, ...@@ -427,7 +424,7 @@ nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
ip_hdrlen(skb) < sizeof(struct iphdr)) ip_hdrlen(skb) < sizeof(struct iphdr))
return NF_ACCEPT; return NF_ACCEPT;
ret = nf_nat_ipv4_fn(ops, skb, in, out, do_chain); ret = nf_nat_ipv4_fn(ops, skb, state, do_chain);
if (ret != NF_DROP && ret != NF_STOLEN && if (ret != NF_DROP && ret != NF_STOLEN &&
(ct = nf_ct_get(skb, &ctinfo)) != NULL) { (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
......
...@@ -28,13 +28,12 @@ ...@@ -28,13 +28,12 @@
static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops, static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct net_device *in, const struct nf_hook_state *state,
const struct net_device *out,
struct nf_conn *ct) struct nf_conn *ct)
{ {
struct nft_pktinfo pkt; struct nft_pktinfo pkt;
nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out); nft_set_pktinfo_ipv4(&pkt, ops, skb, state->in, state->out);
return nft_do_chain(&pkt, ops); return nft_do_chain(&pkt, ops);
} }
...@@ -43,29 +42,28 @@ static unsigned int nft_nat_ipv4_fn(const struct nf_hook_ops *ops, ...@@ -43,29 +42,28 @@ static unsigned int nft_nat_ipv4_fn(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_fn(ops, skb, state->in, state->out, nft_nat_do_chain); return nf_nat_ipv4_fn(ops, skb, state, nft_nat_do_chain);
} }
static unsigned int nft_nat_ipv4_in(const struct nf_hook_ops *ops, static unsigned int nft_nat_ipv4_in(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_in(ops, skb, state->in, state->out, nft_nat_do_chain); return nf_nat_ipv4_in(ops, skb, state, nft_nat_do_chain);
} }
static unsigned int nft_nat_ipv4_out(const struct nf_hook_ops *ops, static unsigned int nft_nat_ipv4_out(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_out(ops, skb, state->in, state->out, nft_nat_do_chain); return nf_nat_ipv4_out(ops, skb, state, nft_nat_do_chain);
} }
static unsigned int nft_nat_ipv4_local_fn(const struct nf_hook_ops *ops, static unsigned int nft_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
struct sk_buff *skb, struct sk_buff *skb,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
return nf_nat_ipv4_local_fn(ops, skb, state->in, state->out, return nf_nat_ipv4_local_fn(ops, skb, state, nft_nat_do_chain);
nft_nat_do_chain);
} }
static const struct nf_chain_type nft_chain_nat_ipv4 = { static const struct nf_chain_type nft_chain_nat_ipv4 = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment