Skip to content

L
linux
Commit 6e23ae2a authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files
Options

[NETFILTER]: Introduce NF_INET_ hook values 

The IPv4 and IPv6 hook values are identical, yet some code tries to figure
out the "correct" value by looking at the address family. Introduce NF_INET_*
values for both IPv4 and IPv6. The old values are kept in a #ifndef __KERNEL__
section for userspace compatibility.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1bf06cd2
Hide whitespace changes
Inline Side-by-side
Showing with 321 additions and 302 deletions
include/linux/netfilter.h
View file @ 6e23ae2a
...@@ -39,6 +39,15 @@ ...@@ -39,6 +39,15 @@
#define NFC_ALTERED 0x8000 #define NFC_ALTERED 0x8000
#endif #endif
enum nf_inet_hooks {
NF_INET_PRE_ROUTING,
NF_INET_LOCAL_IN,
NF_INET_FORWARD,
NF_INET_LOCAL_OUT,
NF_INET_POST_ROUTING,
NF_INET_NUMHOOKS
};
#ifdef __KERNEL__ #ifdef __KERNEL__
#ifdef CONFIG_NETFILTER #ifdef CONFIG_NETFILTER
......
include/linux/netfilter/x_tables.h
View file @ 6e23ae2a
...@@ -265,8 +265,8 @@ struct xt_table_info ...@@ -265,8 +265,8 @@ struct xt_table_info
unsigned int initial_entries; unsigned int initial_entries;
/* Entry points and underflows */ /* Entry points and underflows */
unsigned int hook_entry[NF_IP_NUMHOOKS]; unsigned int hook_entry[NF_INET_NUMHOOKS];
unsigned int underflow[NF_IP_NUMHOOKS]; unsigned int underflow[NF_INET_NUMHOOKS];
/* ipt_entry tables: one per CPU */ /* ipt_entry tables: one per CPU */
char *entries[NR_CPUS]; char *entries[NR_CPUS];
......
include/linux/netfilter_ipv4.h
View file @ 6e23ae2a
...@@ -36,7 +36,6 @@ ...@@ -36,7 +36,6 @@
#define NFC_IP_DST_PT 0x0400 #define NFC_IP_DST_PT 0x0400
/* Something else about the proto */ /* Something else about the proto */
#define NFC_IP_PROTO_UNKNOWN 0x2000 #define NFC_IP_PROTO_UNKNOWN 0x2000
#endif /* ! __KERNEL__ */
/* IP Hooks */ /* IP Hooks */
/* After promisc drops, checksum checks. */ /* After promisc drops, checksum checks. */
...@@ -50,6 +49,7 @@ ...@@ -50,6 +49,7 @@
/* Packets about to hit the wire. */ /* Packets about to hit the wire. */
#define NF_IP_POST_ROUTING 4 #define NF_IP_POST_ROUTING 4
#define NF_IP_NUMHOOKS 5 #define NF_IP_NUMHOOKS 5
#endif /* ! __KERNEL__ */
enum nf_ip_hook_priorities { enum nf_ip_hook_priorities {
NF_IP_PRI_FIRST = INT_MIN, NF_IP_PRI_FIRST = INT_MIN,
......
include/linux/netfilter_ipv4/ip_tables.h
View file @ 6e23ae2a
...@@ -156,10 +156,10 @@ struct ipt_getinfo ...@@ -156,10 +156,10 @@ struct ipt_getinfo
unsigned int valid_hooks; unsigned int valid_hooks;
/* Hook entry points: one per netfilter hook. */ /* Hook entry points: one per netfilter hook. */
unsigned int hook_entry[NF_IP_NUMHOOKS]; unsigned int hook_entry[NF_INET_NUMHOOKS];
/* Underflow points. */ /* Underflow points. */
unsigned int underflow[NF_IP_NUMHOOKS]; unsigned int underflow[NF_INET_NUMHOOKS];
/* Number of entries */ /* Number of entries */
unsigned int num_entries; unsigned int num_entries;
...@@ -185,10 +185,10 @@ struct ipt_replace ...@@ -185,10 +185,10 @@ struct ipt_replace
unsigned int size; unsigned int size;
/* Hook entry points. */ /* Hook entry points. */
unsigned int hook_entry[NF_IP_NUMHOOKS]; unsigned int hook_entry[NF_INET_NUMHOOKS];
/* Underflow points. */ /* Underflow points. */
unsigned int underflow[NF_IP_NUMHOOKS]; unsigned int underflow[NF_INET_NUMHOOKS];
/* Information about old entries: */ /* Information about old entries: */
/* Number of counters (must be equal to current number of entries). */ /* Number of counters (must be equal to current number of entries). */
......
include/linux/netfilter_ipv6.h
View file @ 6e23ae2a
...@@ -40,8 +40,6 @@ ...@@ -40,8 +40,6 @@
#define NFC_IP6_DST_PT 0x0400 #define NFC_IP6_DST_PT 0x0400
/* Something else about the proto */ /* Something else about the proto */
#define NFC_IP6_PROTO_UNKNOWN 0x2000 #define NFC_IP6_PROTO_UNKNOWN 0x2000
#endif /* ! __KERNEL__ */
/* IP6 Hooks */ /* IP6 Hooks */
/* After promisc drops, checksum checks. */ /* After promisc drops, checksum checks. */
...@@ -55,6 +53,7 @@ ...@@ -55,6 +53,7 @@
/* Packets about to hit the wire. */ /* Packets about to hit the wire. */
#define NF_IP6_POST_ROUTING 4 #define NF_IP6_POST_ROUTING 4
#define NF_IP6_NUMHOOKS 5 #define NF_IP6_NUMHOOKS 5
#endif /* ! __KERNEL__ */
enum nf_ip6_hook_priorities { enum nf_ip6_hook_priorities {
......
include/linux/netfilter_ipv6/ip6_tables.h
View file @ 6e23ae2a
...@@ -216,10 +216,10 @@ struct ip6t_getinfo ...@@ -216,10 +216,10 @@ struct ip6t_getinfo
unsigned int valid_hooks; unsigned int valid_hooks;
/* Hook entry points: one per netfilter hook. */ /* Hook entry points: one per netfilter hook. */
unsigned int hook_entry[NF_IP6_NUMHOOKS]; unsigned int hook_entry[NF_INET_NUMHOOKS];
/* Underflow points. */ /* Underflow points. */
unsigned int underflow[NF_IP6_NUMHOOKS]; unsigned int underflow[NF_INET_NUMHOOKS];
/* Number of entries */ /* Number of entries */
unsigned int num_entries; unsigned int num_entries;
...@@ -245,10 +245,10 @@ struct ip6t_replace ...@@ -245,10 +245,10 @@ struct ip6t_replace
unsigned int size; unsigned int size;
/* Hook entry points. */ /* Hook entry points. */
unsigned int hook_entry[NF_IP6_NUMHOOKS]; unsigned int hook_entry[NF_INET_NUMHOOKS];
/* Underflow points. */ /* Underflow points. */
unsigned int underflow[NF_IP6_NUMHOOKS]; unsigned int underflow[NF_INET_NUMHOOKS];
/* Information about old entries: */ /* Information about old entries: */
/* Number of counters (must be equal to current number of entries). */ /* Number of counters (must be equal to current number of entries). */
......
include/net/netfilter/nf_nat.h
View file @ 6e23ae2a
...@@ -12,7 +12,8 @@ enum nf_nat_manip_type ...@@ -12,7 +12,8 @@ enum nf_nat_manip_type
}; };
/* SRC manip occurs POST_ROUTING or LOCAL_IN */ /* SRC manip occurs POST_ROUTING or LOCAL_IN */
#define HOOK2MANIP(hooknum) ((hooknum) != NF_IP_POST_ROUTING && (hooknum) != NF_IP_LOCAL_IN) #define HOOK2MANIP(hooknum) ((hooknum) != NF_INET_POST_ROUTING && \
(hooknum) != NF_INET_LOCAL_IN)
#define IP_NAT_RANGE_MAP_IPS 1 #define IP_NAT_RANGE_MAP_IPS 1
#define IP_NAT_RANGE_PROTO_SPECIFIED 2 #define IP_NAT_RANGE_PROTO_SPECIFIED 2
......
net/bridge/br_netfilter.c
View file @ 6e23ae2a
...@@ -511,7 +511,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook, ...@@ -511,7 +511,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
if (!setup_pre_routing(skb)) if (!setup_pre_routing(skb))
return NF_DROP; return NF_DROP;
NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL, NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
br_nf_pre_routing_finish_ipv6); br_nf_pre_routing_finish_ipv6);
return NF_STOLEN; return NF_STOLEN;
...@@ -584,7 +584,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb, ...@@ -584,7 +584,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
return NF_DROP; return NF_DROP;
store_orig_dstaddr(skb); store_orig_dstaddr(skb);
NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL, NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
br_nf_pre_routing_finish); br_nf_pre_routing_finish);
return NF_STOLEN; return NF_STOLEN;
...@@ -681,7 +681,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb, ...@@ -681,7 +681,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
nf_bridge->mask |= BRNF_BRIDGED; nf_bridge->mask |= BRNF_BRIDGED;
nf_bridge->physoutdev = skb->dev; nf_bridge->physoutdev = skb->dev;
NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in), parent, NF_HOOK(pf, NF_INET_FORWARD, skb, bridge_parent(in), parent,
br_nf_forward_finish); br_nf_forward_finish);
return NF_STOLEN; return NF_STOLEN;
...@@ -832,7 +832,7 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb, ...@@ -832,7 +832,7 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
if (nf_bridge->netoutdev) if (nf_bridge->netoutdev)
realoutdev = nf_bridge->netoutdev; realoutdev = nf_bridge->netoutdev;
#endif #endif
NF_HOOK(pf, NF_IP_POST_ROUTING, skb, NULL, realoutdev, NF_HOOK(pf, NF_INET_POST_ROUTING, skb, NULL, realoutdev,
br_nf_dev_queue_xmit); br_nf_dev_queue_xmit);
return NF_STOLEN; return NF_STOLEN;
...@@ -905,12 +905,12 @@ static struct nf_hook_ops br_nf_ops[] = { ...@@ -905,12 +905,12 @@ static struct nf_hook_ops br_nf_ops[] = {
{ .hook = ip_sabotage_in, { .hook = ip_sabotage_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_FIRST, }, .priority = NF_IP_PRI_FIRST, },
{ .hook = ip_sabotage_in, { .hook = ip_sabotage_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_FIRST, }, .priority = NF_IP6_PRI_FIRST, },
}; };
......
net/compat.c
View file @ 6e23ae2a
...@@ -325,8 +325,8 @@ struct compat_ipt_replace { ...@@ -325,8 +325,8 @@ struct compat_ipt_replace {
u32 valid_hooks; u32 valid_hooks;
u32 num_entries; u32 num_entries;
u32 size; u32 size;
u32 hook_entry[NF_IP_NUMHOOKS]; u32 hook_entry[NF_INET_NUMHOOKS];
u32 underflow[NF_IP_NUMHOOKS]; u32 underflow[NF_INET_NUMHOOKS];
u32 num_counters; u32 num_counters;
compat_uptr_t counters; /* struct ipt_counters * */ compat_uptr_t counters; /* struct ipt_counters * */
struct ipt_entry entries[0]; struct ipt_entry entries[0];
...@@ -391,7 +391,7 @@ static int do_netfilter_replace(int fd, int level, int optname, ...@@ -391,7 +391,7 @@ static int do_netfilter_replace(int fd, int level, int optname,
origsize)) origsize))
goto out; goto out;
for (i = 0; i < NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
if (__get_user(tmp32, &urepl->hook_entry[i]) || if (__get_user(tmp32, &urepl->hook_entry[i]) ||
__put_user(tmp32, &repl_nat->hook_entry[i]) || __put_user(tmp32, &repl_nat->hook_entry[i]) ||
__get_user(tmp32, &urepl->underflow[i]) || __get_user(tmp32, &urepl->underflow[i]) ||
......
net/ipv4/ip_forward.c
View file @ 6e23ae2a
...@@ -110,7 +110,7 @@ int ip_forward(struct sk_buff *skb) ...@@ -110,7 +110,7 @@ int ip_forward(struct sk_buff *skb)
skb->priority = rt_tos2priority(iph->tos); skb->priority = rt_tos2priority(iph->tos);
return NF_HOOK(PF_INET, NF_IP_FORWARD, skb, skb->dev, rt->u.dst.dev, return NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, rt->u.dst.dev,
ip_forward_finish); ip_forward_finish);
sr_failed: sr_failed:
......
net/ipv4/ip_input.c
View file @ 6e23ae2a
...@@ -268,7 +268,7 @@ int ip_local_deliver(struct sk_buff *skb) ...@@ -268,7 +268,7 @@ int ip_local_deliver(struct sk_buff *skb)
return 0; return 0;
} }
return NF_HOOK(PF_INET, NF_IP_LOCAL_IN, skb, skb->dev, NULL, return NF_HOOK(PF_INET, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
ip_local_deliver_finish); ip_local_deliver_finish);
} }
...@@ -442,7 +442,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, ...@@ -442,7 +442,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
/* Remove any debris in the socket control block */ /* Remove any debris in the socket control block */
memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
return NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL, return NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, dev, NULL,
ip_rcv_finish); ip_rcv_finish);
inhdr_error: inhdr_error:
......
net/ipv4/ip_output.c
View file @ 6e23ae2a
...@@ -97,7 +97,7 @@ int __ip_local_out(struct sk_buff *skb) ...@@ -97,7 +97,7 @@ int __ip_local_out(struct sk_buff *skb)
iph->tot_len = htons(skb->len); iph->tot_len = htons(skb->len);
ip_send_check(iph); ip_send_check(iph);
return nf_hook(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, skb->dst->dev, return nf_hook(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, skb->dst->dev,
dst_output); dst_output);
} }
...@@ -270,8 +270,8 @@ int ip_mc_output(struct sk_buff *skb) ...@@ -270,8 +270,8 @@ int ip_mc_output(struct sk_buff *skb)
) { ) {
struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC); struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
if (newskb) if (newskb)
NF_HOOK(PF_INET, NF_IP_POST_ROUTING, newskb, NULL, NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb,
newskb->dev, NULL, newskb->dev,
ip_dev_loopback_xmit); ip_dev_loopback_xmit);
} }
...@@ -286,11 +286,11 @@ int ip_mc_output(struct sk_buff *skb) ...@@ -286,11 +286,11 @@ int ip_mc_output(struct sk_buff *skb)
if (rt->rt_flags&RTCF_BROADCAST) { if (rt->rt_flags&RTCF_BROADCAST) {
struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC); struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
if (newskb) if (newskb)
NF_HOOK(PF_INET, NF_IP_POST_ROUTING, newskb, NULL, NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb, NULL,
newskb->dev, ip_dev_loopback_xmit); newskb->dev, ip_dev_loopback_xmit);
} }
return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dev, return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
ip_finish_output, ip_finish_output,
!(IPCB(skb)->flags & IPSKB_REROUTED)); !(IPCB(skb)->flags & IPSKB_REROUTED));
} }
...@@ -304,7 +304,7 @@ int ip_output(struct sk_buff *skb) ...@@ -304,7 +304,7 @@ int ip_output(struct sk_buff *skb)
skb->dev = dev; skb->dev = dev;
skb->protocol = htons(ETH_P_IP); skb->protocol = htons(ETH_P_IP);
return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev, return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, dev,
ip_finish_output, ip_finish_output,
!(IPCB(skb)->flags & IPSKB_REROUTED)); !(IPCB(skb)->flags & IPSKB_REROUTED));
} }
......
net/ipv4/ipmr.c
View file @ 6e23ae2a
...@@ -1245,7 +1245,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi) ...@@ -1245,7 +1245,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
* not mrouter) cannot join to more than one interface - it will * not mrouter) cannot join to more than one interface - it will
* result in receiving multiple packets. * result in receiving multiple packets.
*/ */
NF_HOOK(PF_INET, NF_IP_FORWARD, skb, skb->dev, dev, NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, dev,
ipmr_forward_finish); ipmr_forward_finish);
return; return;
......
net/ipv4/ipvs/ip_vs_core.c
View file @ 6e23ae2a
...@@ -481,7 +481,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, ...@@ -481,7 +481,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
/* /*
* It is hooked before NF_IP_PRI_NAT_SRC at the NF_IP_POST_ROUTING * It is hooked before NF_IP_PRI_NAT_SRC at the NF_INET_POST_ROUTING
* chain, and is used for VS/NAT. * chain, and is used for VS/NAT.
* It detects packets for VS/NAT connections and sends the packets * It detects packets for VS/NAT connections and sends the packets
* immediately. This can avoid that iptable_nat mangles the packets * immediately. This can avoid that iptable_nat mangles the packets
...@@ -679,7 +679,7 @@ static inline int is_tcp_reset(const struct sk_buff *skb) ...@@ -679,7 +679,7 @@ static inline int is_tcp_reset(const struct sk_buff *skb)
} }
/* /*
* It is hooked at the NF_IP_FORWARD chain, used only for VS/NAT. * It is hooked at the NF_INET_FORWARD chain, used only for VS/NAT.
* Check if outgoing packet belongs to the established ip_vs_conn, * Check if outgoing packet belongs to the established ip_vs_conn,
* rewrite addresses of the packet and send it on its way... * rewrite addresses of the packet and send it on its way...
*/ */
...@@ -814,7 +814,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) ...@@ -814,7 +814,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
/* reassemble IP fragments */ /* reassemble IP fragments */
if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
if (ip_vs_gather_frags(skb, hooknum == NF_IP_LOCAL_IN ? if (ip_vs_gather_frags(skb, hooknum == NF_INET_LOCAL_IN ?
IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD)) IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD))
return NF_STOLEN; return NF_STOLEN;
} }
...@@ -1003,12 +1003,12 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, ...@@ -1003,12 +1003,12 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
/* /*
* It is hooked at the NF_IP_FORWARD chain, in order to catch ICMP * It is hooked at the NF_INET_FORWARD chain, in order to catch ICMP
* related packets destined for 0.0.0.0/0. * related packets destined for 0.0.0.0/0.
* When fwmark-based virtual service is used, such as transparent * When fwmark-based virtual service is used, such as transparent
* cache cluster, TCP packets can be marked and routed to ip_vs_in, * cache cluster, TCP packets can be marked and routed to ip_vs_in,
* but ICMP destined for 0.0.0.0/0 cannot not be easily marked and * but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
* sent to ip_vs_in_icmp. So, catch them at the NF_IP_FORWARD chain * sent to ip_vs_in_icmp. So, catch them at the NF_INET_FORWARD chain
* and send them to ip_vs_in_icmp. * and send them to ip_vs_in_icmp.
*/ */
static unsigned int static unsigned int
...@@ -1032,7 +1032,7 @@ static struct nf_hook_ops ip_vs_in_ops = { ...@@ -1032,7 +1032,7 @@ static struct nf_hook_ops ip_vs_in_ops = {
.hook = ip_vs_in, .hook = ip_vs_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = 100, .priority = 100,
}; };
...@@ -1041,7 +1041,7 @@ static struct nf_hook_ops ip_vs_out_ops = { ...@@ -1041,7 +1041,7 @@ static struct nf_hook_ops ip_vs_out_ops = {
.hook = ip_vs_out, .hook = ip_vs_out,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = 100, .priority = 100,
}; };
...@@ -1051,7 +1051,7 @@ static struct nf_hook_ops ip_vs_forward_icmp_ops = { ...@@ -1051,7 +1051,7 @@ static struct nf_hook_ops ip_vs_forward_icmp_ops = {
.hook = ip_vs_forward_icmp, .hook = ip_vs_forward_icmp,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = 99, .priority = 99,
}; };
...@@ -1060,7 +1060,7 @@ static struct nf_hook_ops ip_vs_post_routing_ops = { ...@@ -1060,7 +1060,7 @@ static struct nf_hook_ops ip_vs_post_routing_ops = {
.hook = ip_vs_post_routing, .hook = ip_vs_post_routing,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_NAT_SRC-1, .priority = NF_IP_PRI_NAT_SRC-1,
}; };
......
net/ipv4/ipvs/ip_vs_xmit.c
View file @ 6e23ae2a
...@@ -129,7 +129,7 @@ ip_vs_dst_reset(struct ip_vs_dest *dest) ...@@ -129,7 +129,7 @@ ip_vs_dst_reset(struct ip_vs_dest *dest)
do { \ do { \
(skb)->ipvs_property = 1; \ (skb)->ipvs_property = 1; \
skb_forward_csum(skb); \ skb_forward_csum(skb); \
NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, (skb), NULL, \ NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, (skb), NULL, \
(rt)->u.dst.dev, dst_output); \ (rt)->u.dst.dev, dst_output); \
} while (0) } while (0)
......
net/ipv4/netfilter.c
View file @ 6e23ae2a
...@@ -23,7 +23,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) ...@@ -23,7 +23,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
addr_type = type; addr_type = type;
/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
* packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook. * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
*/ */
if (addr_type == RTN_LOCAL) { if (addr_type == RTN_LOCAL) {
fl.nl_u.ip4_u.daddr = iph->daddr; fl.nl_u.ip4_u.daddr = iph->daddr;
...@@ -126,7 +126,7 @@ static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info) ...@@ -126,7 +126,7 @@ static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
{ {
struct ip_rt_info *rt_info = nf_info_reroute(info); struct ip_rt_info *rt_info = nf_info_reroute(info);
if (info->hook == NF_IP_LOCAL_OUT) { if (info->hook == NF_INET_LOCAL_OUT) {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
rt_info->tos = iph->tos; rt_info->tos = iph->tos;
...@@ -139,7 +139,7 @@ static int nf_ip_reroute(struct sk_buff *skb, const struct nf_info *info) ...@@ -139,7 +139,7 @@ static int nf_ip_reroute(struct sk_buff *skb, const struct nf_info *info)
{ {
const struct ip_rt_info *rt_info = nf_info_reroute(info); const struct ip_rt_info *rt_info = nf_info_reroute(info);
if (info->hook == NF_IP_LOCAL_OUT) { if (info->hook == NF_INET_LOCAL_OUT) {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
if (!(iph->tos == rt_info->tos if (!(iph->tos == rt_info->tos
...@@ -158,7 +158,7 @@ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, ...@@ -158,7 +158,7 @@ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
switch (skb->ip_summed) { switch (skb->ip_summed) {
case CHECKSUM_COMPLETE: case CHECKSUM_COMPLETE:
if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN) if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
break; break;
if ((protocol == 0 && !csum_fold(skb->csum)) || if ((protocol == 0 && !csum_fold(skb->csum)) ||
!csum_tcpudp_magic(iph->saddr, iph->daddr, !csum_tcpudp_magic(iph->saddr, iph->daddr,
......
net/ipv4/netfilter/ip_tables.c
View file @ 6e23ae2a
...@@ -220,11 +220,11 @@ unconditional(const struct ipt_ip *ip) ...@@ -220,11 +220,11 @@ unconditional(const struct ipt_ip *ip)
#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \ #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE) defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
static const char *hooknames[] = { static const char *hooknames[] = {
[NF_IP_PRE_ROUTING] = "PREROUTING", [NF_INET_PRE_ROUTING] = "PREROUTING",
[NF_IP_LOCAL_IN] = "INPUT", [NF_INET_LOCAL_IN] = "INPUT",
[NF_IP_FORWARD] = "FORWARD", [NF_INET_FORWARD] = "FORWARD",
[NF_IP_LOCAL_OUT] = "OUTPUT", [NF_INET_LOCAL_OUT] = "OUTPUT",
[NF_IP_POST_ROUTING] = "POSTROUTING", [NF_INET_POST_ROUTING] = "POSTROUTING",
}; };
enum nf_ip_trace_comments { enum nf_ip_trace_comments {
...@@ -465,7 +465,7 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -465,7 +465,7 @@ mark_source_chains(struct xt_table_info *newinfo,
/* No recursion; use packet counter to save back ptrs (reset /* No recursion; use packet counter to save back ptrs (reset
to 0 as we leave), and comefrom to save source hook bitmask */ to 0 as we leave), and comefrom to save source hook bitmask */
for (hook = 0; hook < NF_IP_NUMHOOKS; hook++) { for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
unsigned int pos = newinfo->hook_entry[hook]; unsigned int pos = newinfo->hook_entry[hook];
struct ipt_entry *e struct ipt_entry *e
= (struct ipt_entry *)(entry0 + pos); = (struct ipt_entry *)(entry0 + pos);
...@@ -481,13 +481,13 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -481,13 +481,13 @@ mark_source_chains(struct xt_table_info *newinfo,
= (void *)ipt_get_target(e); = (void *)ipt_get_target(e);
int visited = e->comefrom & (1 << hook); int visited = e->comefrom & (1 << hook);
if (e->comefrom & (1 << NF_IP_NUMHOOKS)) { if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
printk("iptables: loop hook %u pos %u %08X.\n", printk("iptables: loop hook %u pos %u %08X.\n",
hook, pos, e->comefrom); hook, pos, e->comefrom);
return 0; return 0;
} }
e->comefrom e->comefrom
|= ((1 << hook) | (1 << NF_IP_NUMHOOKS)); |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
/* Unconditional return/END. */ /* Unconditional return/END. */
if ((e->target_offset == sizeof(struct ipt_entry) if ((e->target_offset == sizeof(struct ipt_entry)
...@@ -507,10 +507,10 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -507,10 +507,10 @@ mark_source_chains(struct xt_table_info *newinfo,
/* Return: backtrack through the last /* Return: backtrack through the last
big jump. */ big jump. */
do { do {
e->comefrom ^= (1<<NF_IP_NUMHOOKS); e->comefrom ^= (1<<NF_INET_NUMHOOKS);
#ifdef DEBUG_IP_FIREWALL_USER #ifdef DEBUG_IP_FIREWALL_USER
if (e->comefrom if (e->comefrom
& (1 << NF_IP_NUMHOOKS)) { & (1 << NF_INET_NUMHOOKS)) {
duprintf("Back unset " duprintf("Back unset "
"on hook %u " "on hook %u "
"rule %u\n", "rule %u\n",
...@@ -741,7 +741,7 @@ check_entry_size_and_hooks(struct ipt_entry *e, ...@@ -741,7 +741,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
} }
/* Check hooks & underflows */ /* Check hooks & underflows */
for (h = 0; h < NF_IP_NUMHOOKS; h++) { for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if ((unsigned char *)e - base == hook_entries[h]) if ((unsigned char *)e - base == hook_entries[h])
newinfo->hook_entry[h] = hook_entries[h]; newinfo->hook_entry[h] = hook_entries[h];
if ((unsigned char *)e - base == underflows[h]) if ((unsigned char *)e - base == underflows[h])
...@@ -795,7 +795,7 @@ translate_table(const char *name, ...@@ -795,7 +795,7 @@ translate_table(const char *name,
newinfo->number = number; newinfo->number = number;
/* Init all hooks to impossible value. */ /* Init all hooks to impossible value. */
for (i = 0; i < NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
newinfo->hook_entry[i] = 0xFFFFFFFF; newinfo->hook_entry[i] = 0xFFFFFFFF;
newinfo->underflow[i] = 0xFFFFFFFF; newinfo->underflow[i] = 0xFFFFFFFF;
} }
...@@ -819,7 +819,7 @@ translate_table(const char *name, ...@@ -819,7 +819,7 @@ translate_table(const char *name,
} }
/* Check hooks all assigned */ /* Check hooks all assigned */
for (i = 0; i < NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
/* Only hooks which are valid */ /* Only hooks which are valid */
if (!(valid_hooks & (1 << i))) if (!(valid_hooks & (1 << i)))
continue; continue;
...@@ -1107,7 +1107,7 @@ static int compat_calc_entry(struct ipt_entry *e, struct xt_table_info *info, ...@@ -1107,7 +1107,7 @@ static int compat_calc_entry(struct ipt_entry *e, struct xt_table_info *info,
if (ret) if (ret)
return ret; return ret;
for (i = 0; i< NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
if (info->hook_entry[i] && (e < (struct ipt_entry *) if (info->hook_entry[i] && (e < (struct ipt_entry *)
(base + info->hook_entry[i]))) (base + info->hook_entry[i])))
newinfo->hook_entry[i] -= off; newinfo->hook_entry[i] -= off;
...@@ -1130,7 +1130,7 @@ static int compat_table_info(struct xt_table_info *info, ...@@ -1130,7 +1130,7 @@ static int compat_table_info(struct xt_table_info *info,
memset(newinfo, 0, sizeof(struct xt_table_info)); memset(newinfo, 0, sizeof(struct xt_table_info));
newinfo->size = info->size; newinfo->size = info->size;
newinfo->number = info->number; newinfo->number = info->number;
for (i = 0; i < NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
newinfo->hook_entry[i] = info->hook_entry[i]; newinfo->hook_entry[i] = info->hook_entry[i];
newinfo->underflow[i] = info->underflow[i]; newinfo->underflow[i] = info->underflow[i];
} }
...@@ -1479,8 +1479,8 @@ struct compat_ipt_replace { ...@@ -1479,8 +1479,8 @@ struct compat_ipt_replace {
u32 valid_hooks; u32 valid_hooks;
u32 num_entries; u32 num_entries;
u32 size; u32 size;
u32 hook_entry[NF_IP_NUMHOOKS]; u32 hook_entry[NF_INET_NUMHOOKS];
u32 underflow[NF_IP_NUMHOOKS]; u32 underflow[NF_INET_NUMHOOKS];
u32 num_counters; u32 num_counters;
compat_uptr_t counters; /* struct ipt_counters * */ compat_uptr_t counters; /* struct ipt_counters * */
struct compat_ipt_entry entries[0]; struct compat_ipt_entry entries[0];
...@@ -1645,7 +1645,7 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e, ...@@ -1645,7 +1645,7 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
goto out; goto out;
/* Check hooks & underflows */ /* Check hooks & underflows */
for (h = 0; h < NF_IP_NUMHOOKS; h++) { for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if ((unsigned char *)e - base == hook_entries[h]) if ((unsigned char *)e - base == hook_entries[h])
newinfo->hook_entry[h] = hook_entries[h]; newinfo->hook_entry[h] = hook_entries[h];
if ((unsigned char *)e - base == underflows[h]) if ((unsigned char *)e - base == underflows[h])
...@@ -1700,7 +1700,7 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr, ...@@ -1700,7 +1700,7 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
xt_compat_target_from_user(t, dstptr, size); xt_compat_target_from_user(t, dstptr, size);
de->next_offset = e->next_offset - (origsize - *size); de->next_offset = e->next_offset - (origsize - *size);
for (h = 0; h < NF_IP_NUMHOOKS; h++) { for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if ((unsigned char *)de - base < newinfo->hook_entry[h]) if ((unsigned char *)de - base < newinfo->hook_entry[h])
newinfo->hook_entry[h] -= origsize - *size; newinfo->hook_entry[h] -= origsize - *size;
if ((unsigned char *)de - base < newinfo->underflow[h]) if ((unsigned char *)de - base < newinfo->underflow[h])
...@@ -1753,7 +1753,7 @@ translate_compat_table(const char *name, ...@@ -1753,7 +1753,7 @@ translate_compat_table(const char *name,
info->number = number; info->number = number;
/* Init all hooks to impossible value. */ /* Init all hooks to impossible value. */
for (i = 0; i < NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
info->hook_entry[i] = 0xFFFFFFFF; info->hook_entry[i] = 0xFFFFFFFF;
info->underflow[i] = 0xFFFFFFFF; info->underflow[i] = 0xFFFFFFFF;
} }
...@@ -1778,7 +1778,7 @@ translate_compat_table(const char *name, ...@@ -1778,7 +1778,7 @@ translate_compat_table(const char *name,
} }
/* Check hooks all assigned */ /* Check hooks all assigned */
for (i = 0; i < NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
/* Only hooks which are valid */ /* Only hooks which are valid */
if (!(valid_hooks & (1 << i))) if (!(valid_hooks & (1 << i)))
continue; continue;
...@@ -1800,7 +1800,7 @@ translate_compat_table(const char *name, ...@@ -1800,7 +1800,7 @@ translate_compat_table(const char *name,
goto out_unlock; goto out_unlock;
newinfo->number = number; newinfo->number = number;
for (i = 0; i < NF_IP_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
newinfo->hook_entry[i] = info->hook_entry[i]; newinfo->hook_entry[i] = info->hook_entry[i];
newinfo->underflow[i] = info->underflow[i]; newinfo->underflow[i] = info->underflow[i];
} }
......
net/ipv4/netfilter/ipt_MASQUERADE.c
View file @ 6e23ae2a
...@@ -67,7 +67,7 @@ masquerade_target(struct sk_buff *skb, ...@@ -67,7 +67,7 @@ masquerade_target(struct sk_buff *skb,
const struct rtable *rt; const struct rtable *rt;
__be32 newsrc; __be32 newsrc;
NF_CT_ASSERT(hooknum == NF_IP_POST_ROUTING); NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
nat = nfct_nat(ct); nat = nfct_nat(ct);
...@@ -172,7 +172,7 @@ static struct xt_target masquerade __read_mostly = { ...@@ -172,7 +172,7 @@ static struct xt_target masquerade __read_mostly = {
.target = masquerade_target, .target = masquerade_target,
.targetsize = sizeof(struct nf_nat_multi_range_compat), .targetsize = sizeof(struct nf_nat_multi_range_compat),
.table = "nat", .table = "nat",
.hooks = 1 << NF_IP_POST_ROUTING, .hooks = 1 << NF_INET_POST_ROUTING,
.checkentry = masquerade_check, .checkentry = masquerade_check,
.me = THIS_MODULE, .me = THIS_MODULE,
}; };
......
net/ipv4/netfilter/ipt_NETMAP.c
View file @ 6e23ae2a
...@@ -56,14 +56,14 @@ target(struct sk_buff *skb, ...@@ -56,14 +56,14 @@ target(struct sk_buff *skb,
const struct nf_nat_multi_range_compat *mr = targinfo; const struct nf_nat_multi_range_compat *mr = targinfo;
struct nf_nat_range newrange; struct nf_nat_range newrange;
NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING
|| hooknum == NF_IP_POST_ROUTING || hooknum == NF_INET_POST_ROUTING
|| hooknum == NF_IP_LOCAL_OUT); || hooknum == NF_INET_LOCAL_OUT);
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip); netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
if (hooknum == NF_IP_PRE_ROUTING || hooknum == NF_IP_LOCAL_OUT) if (hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_LOCAL_OUT)
new_ip = ip_hdr(skb)->daddr & ~netmask; new_ip = ip_hdr(skb)->daddr & ~netmask;
else else
new_ip = ip_hdr(skb)->saddr & ~netmask; new_ip = ip_hdr(skb)->saddr & ~netmask;
...@@ -84,8 +84,9 @@ static struct xt_target target_module __read_mostly = { ...@@ -84,8 +84,9 @@ static struct xt_target target_module __read_mostly = {
.target = target, .target = target,
.targetsize = sizeof(struct nf_nat_multi_range_compat), .targetsize = sizeof(struct nf_nat_multi_range_compat),
.table = "nat", .table = "nat",
.hooks = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING) | .hooks = (1 << NF_INET_PRE_ROUTING) |
(1 << NF_IP_LOCAL_OUT), (1 << NF_INET_POST_ROUTING) |
(1 << NF_INET_LOCAL_OUT),
.checkentry = check, .checkentry = check,
.me = THIS_MODULE .me = THIS_MODULE
}; };
......
net/ipv4/netfilter/ipt_REDIRECT.c
View file @ 6e23ae2a
...@@ -60,14 +60,14 @@ redirect_target(struct sk_buff *skb, ...@@ -60,14 +60,14 @@ redirect_target(struct sk_buff *skb,
const struct nf_nat_multi_range_compat *mr = targinfo; const struct nf_nat_multi_range_compat *mr = targinfo;
struct nf_nat_range newrange; struct nf_nat_range newrange;
NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING
|| hooknum == NF_IP_LOCAL_OUT); || hooknum == NF_INET_LOCAL_OUT);
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)); NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
/* Local packets: make them go to loopback */ /* Local packets: make them go to loopback */
if (hooknum == NF_IP_LOCAL_OUT) if (hooknum == NF_INET_LOCAL_OUT)
newdst = htonl(0x7F000001); newdst = htonl(0x7F000001);
else { else {
struct in_device *indev; struct in_device *indev;
...@@ -101,7 +101,7 @@ static struct xt_target redirect_reg __read_mostly = { ...@@ -101,7 +101,7 @@ static struct xt_target redirect_reg __read_mostly = {
.target = redirect_target, .target = redirect_target,
.targetsize = sizeof(struct nf_nat_multi_range_compat), .targetsize = sizeof(struct nf_nat_multi_range_compat),
.table = "nat", .table = "nat",
.hooks = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT), .hooks = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),
.checkentry = redirect_check, .checkentry = redirect_check,
.me = THIS_MODULE, .me = THIS_MODULE,
}; };
......
net/ipv4/netfilter/ipt_REJECT.c
View file @ 6e23ae2a
...@@ -123,7 +123,7 @@ static void send_reset(struct sk_buff *oldskb, int hook) ...@@ -123,7 +123,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
niph->id = 0; niph->id = 0;
addr_type = RTN_UNSPEC; addr_type = RTN_UNSPEC;
if (hook != NF_IP_FORWARD if (hook != NF_INET_FORWARD
#ifdef CONFIG_BRIDGE_NETFILTER #ifdef CONFIG_BRIDGE_NETFILTER
|| (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED) || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
#endif #endif
...@@ -234,8 +234,8 @@ static struct xt_target ipt_reject_reg __read_mostly = { ...@@ -234,8 +234,8 @@ static struct xt_target ipt_reject_reg __read_mostly = {
.target = reject, .target = reject,
.targetsize = sizeof(struct ipt_reject_info), .targetsize = sizeof(struct ipt_reject_info),
.table = "filter", .table = "filter",
.hooks = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | .hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
(1 << NF_IP_LOCAL_OUT), (1 << NF_INET_LOCAL_OUT),
.checkentry = check, .checkentry = check,
.me = THIS_MODULE, .me = THIS_MODULE,
}; };
......
net/ipv4/netfilter/ipt_SAME.c
View file @ 6e23ae2a
...@@ -119,8 +119,8 @@ same_target(struct sk_buff *skb, ...@@ -119,8 +119,8 @@ same_target(struct sk_buff *skb,
struct nf_nat_range newrange; struct nf_nat_range newrange;
const struct nf_conntrack_tuple *t; const struct nf_conntrack_tuple *t;
NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING || NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING ||
hooknum == NF_IP_POST_ROUTING); hooknum == NF_INET_POST_ROUTING);
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
...@@ -158,7 +158,8 @@ static struct xt_target same_reg __read_mostly = { ...@@ -158,7 +158,8 @@ static struct xt_target same_reg __read_mostly = {
.target = same_target, .target = same_target,
.targetsize = sizeof(struct ipt_same_info), .targetsize = sizeof(struct ipt_same_info),
.table = "nat", .table = "nat",
.hooks = (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING), .hooks = (1 << NF_INET_PRE_ROUTING) |
(1 << NF_INET_POST_ROUTING),
.checkentry = same_check, .checkentry = same_check,
.destroy = same_destroy, .destroy = same_destroy,
.me = THIS_MODULE, .me = THIS_MODULE,
......
net/ipv4/netfilter/ipt_owner.c
View file @ 6e23ae2a
...@@ -73,7 +73,8 @@ static struct xt_match owner_match __read_mostly = { ...@@ -73,7 +73,8 @@ static struct xt_match owner_match __read_mostly = {
.family = AF_INET, .family = AF_INET,
.match = match, .match = match,
.matchsize = sizeof(struct ipt_owner_info), .matchsize = sizeof(struct ipt_owner_info),
.hooks = (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING), .hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_INET_POST_ROUTING),
.checkentry = checkentry, .checkentry = checkentry,
.me = THIS_MODULE, .me = THIS_MODULE,
}; };
......
net/ipv4/netfilter/iptable_filter.c
View file @ 6e23ae2a
...@@ -19,7 +19,9 @@ MODULE_LICENSE("GPL"); ...@@ -19,7 +19,9 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("iptables filter table"); MODULE_DESCRIPTION("iptables filter table");
#define FILTER_VALID_HOOKS ((1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)) #define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \
(1 << NF_INET_FORWARD) | \
(1 << NF_INET_LOCAL_OUT))
static struct static struct
{ {
...@@ -33,14 +35,14 @@ static struct ...@@ -33,14 +35,14 @@ static struct
.num_entries = 4, .num_entries = 4,
.size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error), .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
.hook_entry = { .hook_entry = {
[NF_IP_LOCAL_IN] = 0, [NF_INET_LOCAL_IN] = 0,
[NF_IP_FORWARD] = sizeof(struct ipt_standard), [NF_INET_FORWARD] = sizeof(struct ipt_standard),
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2, [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
}, },
.underflow = { .underflow = {
[NF_IP_LOCAL_IN] = 0, [NF_INET_LOCAL_IN] = 0,
[NF_IP_FORWARD] = sizeof(struct ipt_standard), [NF_INET_FORWARD] = sizeof(struct ipt_standard),
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2, [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
}, },
}, },
.entries = { .entries = {
...@@ -94,21 +96,21 @@ static struct nf_hook_ops ipt_ops[] = { ...@@ -94,21 +96,21 @@ static struct nf_hook_ops ipt_ops[] = {
.hook = ipt_hook, .hook = ipt_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = ipt_hook, .hook = ipt_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = ipt_local_out_hook, .hook = ipt_local_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
}; };
......
net/ipv4/netfilter/iptable_mangle.c
View file @ 6e23ae2a
...@@ -21,11 +21,11 @@ MODULE_LICENSE("GPL"); ...@@ -21,11 +21,11 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("iptables mangle table"); MODULE_DESCRIPTION("iptables mangle table");
#define MANGLE_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | \ #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
(1 << NF_IP_LOCAL_IN) | \ (1 << NF_INET_LOCAL_IN) | \
(1 << NF_IP_FORWARD) | \ (1 << NF_INET_FORWARD) | \
(1 << NF_IP_LOCAL_OUT) | \ (1 << NF_INET_LOCAL_OUT) | \
(1 << NF_IP_POST_ROUTING)) (1 << NF_INET_POST_ROUTING))
/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */ /* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
static struct static struct
...@@ -40,18 +40,18 @@ static struct ...@@ -40,18 +40,18 @@ static struct
.num_entries = 6, .num_entries = 6,
.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error), .size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
.hook_entry = { .hook_entry = {
[NF_IP_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP_LOCAL_IN] = sizeof(struct ipt_standard), [NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
[NF_IP_FORWARD] = sizeof(struct ipt_standard) * 2, [NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 3, [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
[NF_IP_POST_ROUTING] = sizeof(struct ipt_standard) * 4, [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
}, },
.underflow = { .underflow = {
[NF_IP_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP_LOCAL_IN] = sizeof(struct ipt_standard), [NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
[NF_IP_FORWARD] = sizeof(struct ipt_standard) * 2, [NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 3, [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
[NF_IP_POST_ROUTING] = sizeof(struct ipt_standard) * 4, [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
}, },
}, },
.entries = { .entries = {
...@@ -133,35 +133,35 @@ static struct nf_hook_ops ipt_ops[] = { ...@@ -133,35 +133,35 @@ static struct nf_hook_ops ipt_ops[] = {
.hook = ipt_route_hook, .hook = ipt_route_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_route_hook, .hook = ipt_route_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_route_hook, .hook = ipt_route_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_local_hook, .hook = ipt_local_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_route_hook, .hook = ipt_route_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
}; };
......
net/ipv4/netfilter/iptable_raw.c
View file @ 6e23ae2a
...@@ -7,7 +7,7 @@ ...@@ -7,7 +7,7 @@
#include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv4/ip_tables.h>
#include <net/ip.h> #include <net/ip.h>
#define RAW_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT)) #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
static struct static struct
{ {
...@@ -21,12 +21,12 @@ static struct ...@@ -21,12 +21,12 @@ static struct
.num_entries = 3, .num_entries = 3,
.size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error), .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
.hook_entry = { .hook_entry = {
[NF_IP_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard)
}, },
.underflow = { .underflow = {
[NF_IP_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard)
}, },
}, },
.entries = { .entries = {
...@@ -78,14 +78,14 @@ static struct nf_hook_ops ipt_ops[] = { ...@@ -78,14 +78,14 @@ static struct nf_hook_ops ipt_ops[] = {
{ {
.hook = ipt_hook, .hook = ipt_hook,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_RAW, .priority = NF_IP_PRI_RAW,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
{ {
.hook = ipt_local_hook, .hook = ipt_local_hook,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_RAW, .priority = NF_IP_PRI_RAW,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
......
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
View file @ 6e23ae2a
...@@ -150,7 +150,7 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, ...@@ -150,7 +150,7 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
/* Gather fragments. */ /* Gather fragments. */
if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
if (nf_ct_ipv4_gather_frags(skb, if (nf_ct_ipv4_gather_frags(skb,
hooknum == NF_IP_PRE_ROUTING ? hooknum == NF_INET_PRE_ROUTING ?
IP_DEFRAG_CONNTRACK_IN : IP_DEFRAG_CONNTRACK_IN :
IP_DEFRAG_CONNTRACK_OUT)) IP_DEFRAG_CONNTRACK_OUT))
return NF_STOLEN; return NF_STOLEN;
...@@ -190,56 +190,56 @@ static struct nf_hook_ops ipv4_conntrack_ops[] = { ...@@ -190,56 +190,56 @@ static struct nf_hook_ops ipv4_conntrack_ops[] = {
.hook = ipv4_conntrack_defrag, .hook = ipv4_conntrack_defrag,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_CONNTRACK_DEFRAG, .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
}, },
{ {
.hook = ipv4_conntrack_in, .hook = ipv4_conntrack_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_CONNTRACK, .priority = NF_IP_PRI_CONNTRACK,
}, },
{ {
.hook = ipv4_conntrack_defrag, .hook = ipv4_conntrack_defrag,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_CONNTRACK_DEFRAG, .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
}, },
{ {
.hook = ipv4_conntrack_local, .hook = ipv4_conntrack_local,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_CONNTRACK, .priority = NF_IP_PRI_CONNTRACK,
}, },
{ {
.hook = ipv4_conntrack_help, .hook = ipv4_conntrack_help,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_CONNTRACK_HELPER, .priority = NF_IP_PRI_CONNTRACK_HELPER,
}, },
{ {
.hook = ipv4_conntrack_help, .hook = ipv4_conntrack_help,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_CONNTRACK_HELPER, .priority = NF_IP_PRI_CONNTRACK_HELPER,
}, },
{ {
.hook = ipv4_confirm, .hook = ipv4_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_CONNTRACK_CONFIRM, .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
}, },
{ {
.hook = ipv4_confirm, .hook = ipv4_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_CONNTRACK_CONFIRM, .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
}, },
}; };
......
net/ipv4/netfilter/nf_conntrack_proto_icmp.c
View file @ 6e23ae2a
...@@ -195,7 +195,7 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff, ...@@ -195,7 +195,7 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff,
} }
/* See ip_conntrack_proto_tcp.c */ /* See ip_conntrack_proto_tcp.c */
if (nf_conntrack_checksum && hooknum == NF_IP_PRE_ROUTING && if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_ip_checksum(skb, hooknum, dataoff, 0)) { nf_ip_checksum(skb, hooknum, dataoff, 0)) {
if (LOG_INVALID(IPPROTO_ICMP)) if (LOG_INVALID(IPPROTO_ICMP))
nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
......
net/ipv4/netfilter/nf_nat_core.c
View file @ 6e23ae2a
...@@ -213,9 +213,9 @@ find_best_ips_proto(struct nf_conntrack_tuple *tuple, ...@@ -213,9 +213,9 @@ find_best_ips_proto(struct nf_conntrack_tuple *tuple,
*var_ipp = htonl(minip + j % (maxip - minip + 1)); *var_ipp = htonl(minip + j % (maxip - minip + 1));
} }
/* Manipulate the tuple into the range given. For NF_IP_POST_ROUTING, /* Manipulate the tuple into the range given. For NF_INET_POST_ROUTING,
* we change the source to map into the range. For NF_IP_PRE_ROUTING * we change the source to map into the range. For NF_INET_PRE_ROUTING
* and NF_IP_LOCAL_OUT, we change the destination to map into the * and NF_INET_LOCAL_OUT, we change the destination to map into the
* range. It might not be possible to get a unique tuple, but we try. * range. It might not be possible to get a unique tuple, but we try.
* At worst (or if we race), we will end up with a final duplicate in * At worst (or if we race), we will end up with a final duplicate in
* __ip_conntrack_confirm and drop the packet. */ * __ip_conntrack_confirm and drop the packet. */
...@@ -293,10 +293,10 @@ nf_nat_setup_info(struct nf_conn *ct, ...@@ -293,10 +293,10 @@ nf_nat_setup_info(struct nf_conn *ct,
} }
} }
NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING || NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING ||
hooknum == NF_IP_POST_ROUTING || hooknum == NF_INET_POST_ROUTING ||
hooknum == NF_IP_LOCAL_IN || hooknum == NF_INET_LOCAL_IN ||
hooknum == NF_IP_LOCAL_OUT); hooknum == NF_INET_LOCAL_OUT);
BUG_ON(nf_nat_initialized(ct, maniptype)); BUG_ON(nf_nat_initialized(ct, maniptype));
/* What we've got will look like inverse of reply. Normally /* What we've got will look like inverse of reply. Normally
......
net/ipv4/netfilter/nf_nat_h323.c
View file @ 6e23ae2a
...@@ -391,7 +391,7 @@ static void ip_nat_q931_expect(struct nf_conn *new, ...@@ -391,7 +391,7 @@ static void ip_nat_q931_expect(struct nf_conn *new,
range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip; range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
/* hook doesn't matter, but it has to do source manip */ /* hook doesn't matter, but it has to do source manip */
nf_nat_setup_info(new, &range, NF_IP_POST_ROUTING); nf_nat_setup_info(new, &range, NF_INET_POST_ROUTING);
/* For DST manip, map port here to where it's expected. */ /* For DST manip, map port here to where it's expected. */
range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED); range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
...@@ -400,7 +400,7 @@ static void ip_nat_q931_expect(struct nf_conn *new, ...@@ -400,7 +400,7 @@ static void ip_nat_q931_expect(struct nf_conn *new,
new->master->tuplehash[!this->dir].tuple.src.u3.ip; new->master->tuplehash[!this->dir].tuple.src.u3.ip;
/* hook doesn't matter, but it has to do destination manip */ /* hook doesn't matter, but it has to do destination manip */
nf_nat_setup_info(new, &range, NF_IP_PRE_ROUTING); nf_nat_setup_info(new, &range, NF_INET_PRE_ROUTING);
} }
/****************************************************************************/ /****************************************************************************/
...@@ -481,7 +481,7 @@ static void ip_nat_callforwarding_expect(struct nf_conn *new, ...@@ -481,7 +481,7 @@ static void ip_nat_callforwarding_expect(struct nf_conn *new,
range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip; range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
/* hook doesn't matter, but it has to do source manip */ /* hook doesn't matter, but it has to do source manip */
nf_nat_setup_info(new, &range, NF_IP_POST_ROUTING); nf_nat_setup_info(new, &range, NF_INET_POST_ROUTING);
/* For DST manip, map port here to where it's expected. */ /* For DST manip, map port here to where it's expected. */
range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED); range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
...@@ -489,7 +489,7 @@ static void ip_nat_callforwarding_expect(struct nf_conn *new, ...@@ -489,7 +489,7 @@ static void ip_nat_callforwarding_expect(struct nf_conn *new,
range.min_ip = range.max_ip = this->saved_ip; range.min_ip = range.max_ip = this->saved_ip;
/* hook doesn't matter, but it has to do destination manip */ /* hook doesn't matter, but it has to do destination manip */
nf_nat_setup_info(new, &range, NF_IP_PRE_ROUTING); nf_nat_setup_info(new, &range, NF_INET_PRE_ROUTING);
} }
/****************************************************************************/ /****************************************************************************/
......
net/ipv4/netfilter/nf_nat_helper.c
View file @ 6e23ae2a
...@@ -431,7 +431,7 @@ void nf_nat_follow_master(struct nf_conn *ct, ...@@ -431,7 +431,7 @@ void nf_nat_follow_master(struct nf_conn *ct,
range.min_ip = range.max_ip range.min_ip = range.max_ip
= ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip; = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
/* hook doesn't matter, but it has to do source manip */ /* hook doesn't matter, but it has to do source manip */
nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_POST_ROUTING);
/* For DST manip, map port here to where it's expected. */ /* For DST manip, map port here to where it's expected. */
range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED); range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
...@@ -439,6 +439,6 @@ void nf_nat_follow_master(struct nf_conn *ct, ...@@ -439,6 +439,6 @@ void nf_nat_follow_master(struct nf_conn *ct,
range.min_ip = range.max_ip range.min_ip = range.max_ip
= ct->master->tuplehash[!exp->dir].tuple.src.u3.ip; = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip;
/* hook doesn't matter, but it has to do destination manip */ /* hook doesn't matter, but it has to do destination manip */
nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_PRE_ROUTING);
} }
EXPORT_SYMBOL(nf_nat_follow_master); EXPORT_SYMBOL(nf_nat_follow_master);
net/ipv4/netfilter/nf_nat_pptp.c
View file @ 6e23ae2a
...@@ -94,7 +94,7 @@ static void pptp_nat_expected(struct nf_conn *ct, ...@@ -94,7 +94,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
range.min = range.max = exp->saved_proto; range.min = range.max = exp->saved_proto;
} }
/* hook doesn't matter, but it has to do source manip */ /* hook doesn't matter, but it has to do source manip */
nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_POST_ROUTING);
/* For DST manip, map port here to where it's expected. */ /* For DST manip, map port here to where it's expected. */
range.flags = IP_NAT_RANGE_MAP_IPS; range.flags = IP_NAT_RANGE_MAP_IPS;
...@@ -105,7 +105,7 @@ static void pptp_nat_expected(struct nf_conn *ct, ...@@ -105,7 +105,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
range.min = range.max = exp->saved_proto; range.min = range.max = exp->saved_proto;
} }
/* hook doesn't matter, but it has to do destination manip */ /* hook doesn't matter, but it has to do destination manip */
nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_PRE_ROUTING);
} }
/* outbound packets == from PNS to PAC */ /* outbound packets == from PNS to PAC */
......
net/ipv4/netfilter/nf_nat_rule.c
View file @ 6e23ae2a
...@@ -24,7 +24,9 @@ ...@@ -24,7 +24,9 @@
#include <net/netfilter/nf_nat_core.h> #include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_rule.h> #include <net/netfilter/nf_nat_rule.h>
#define NAT_VALID_HOOKS ((1<<NF_IP_PRE_ROUTING) | (1<<NF_IP_POST_ROUTING) | (1<<NF_IP_LOCAL_OUT)) #define NAT_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
(1 << NF_INET_POST_ROUTING) | \
(1 << NF_INET_LOCAL_OUT))
static struct static struct
{ {
...@@ -38,14 +40,14 @@ static struct ...@@ -38,14 +40,14 @@ static struct
.num_entries = 4, .num_entries = 4,
.size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error), .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
.hook_entry = { .hook_entry = {
[NF_IP_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP_POST_ROUTING] = sizeof(struct ipt_standard), [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
}, },
.underflow = { .underflow = {
[NF_IP_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP_POST_ROUTING] = sizeof(struct ipt_standard), [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
[NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
}, },
}, },
.entries = { .entries = {
...@@ -76,7 +78,7 @@ static unsigned int ipt_snat_target(struct sk_buff *skb, ...@@ -76,7 +78,7 @@ static unsigned int ipt_snat_target(struct sk_buff *skb,
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
const struct nf_nat_multi_range_compat *mr = targinfo; const struct nf_nat_multi_range_compat *mr = targinfo;
NF_CT_ASSERT(hooknum == NF_IP_POST_ROUTING); NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
...@@ -118,15 +120,15 @@ static unsigned int ipt_dnat_target(struct sk_buff *skb, ...@@ -118,15 +120,15 @@ static unsigned int ipt_dnat_target(struct sk_buff *skb,
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
const struct nf_nat_multi_range_compat *mr = targinfo; const struct nf_nat_multi_range_compat *mr = targinfo;
NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING || NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING ||
hooknum == NF_IP_LOCAL_OUT); hooknum == NF_INET_LOCAL_OUT);
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
/* Connection must be valid and new. */ /* Connection must be valid and new. */
NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)); NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
if (hooknum == NF_IP_LOCAL_OUT && if (hooknum == NF_INET_LOCAL_OUT &&
mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)
warn_if_extra_mangle(ip_hdr(skb)->daddr, warn_if_extra_mangle(ip_hdr(skb)->daddr,
mr->range[0].min_ip); mr->range[0].min_ip);
...@@ -227,7 +229,7 @@ static struct xt_target ipt_snat_reg __read_mostly = { ...@@ -227,7 +229,7 @@ static struct xt_target ipt_snat_reg __read_mostly = {
.target = ipt_snat_target, .target = ipt_snat_target,
.targetsize = sizeof(struct nf_nat_multi_range_compat), .targetsize = sizeof(struct nf_nat_multi_range_compat),
.table = "nat", .table = "nat",
.hooks = 1 << NF_IP_POST_ROUTING, .hooks = 1 << NF_INET_POST_ROUTING,
.checkentry = ipt_snat_checkentry, .checkentry = ipt_snat_checkentry,
.family = AF_INET, .family = AF_INET,
}; };
...@@ -237,7 +239,7 @@ static struct xt_target ipt_dnat_reg __read_mostly = { ...@@ -237,7 +239,7 @@ static struct xt_target ipt_dnat_reg __read_mostly = {
.target = ipt_dnat_target, .target = ipt_dnat_target,
.targetsize = sizeof(struct nf_nat_multi_range_compat), .targetsize = sizeof(struct nf_nat_multi_range_compat),
.table = "nat", .table = "nat",
.hooks = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT), .hooks = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),
.checkentry = ipt_dnat_checkentry, .checkentry = ipt_dnat_checkentry,
.family = AF_INET, .family = AF_INET,
}; };
......
net/ipv4/netfilter/nf_nat_sip.c
View file @ 6e23ae2a
...@@ -229,14 +229,14 @@ static void ip_nat_sdp_expect(struct nf_conn *ct, ...@@ -229,14 +229,14 @@ static void ip_nat_sdp_expect(struct nf_conn *ct,
range.min_ip = range.max_ip range.min_ip = range.max_ip
= ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip; = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
/* hook doesn't matter, but it has to do source manip */ /* hook doesn't matter, but it has to do source manip */
nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_POST_ROUTING);
/* For DST manip, map port here to where it's expected. */ /* For DST manip, map port here to where it's expected. */
range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED); range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
range.min = range.max = exp->saved_proto; range.min = range.max = exp->saved_proto;
range.min_ip = range.max_ip = exp->saved_ip; range.min_ip = range.max_ip = exp->saved_ip;
/* hook doesn't matter, but it has to do destination manip */ /* hook doesn't matter, but it has to do destination manip */
nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_PRE_ROUTING);
} }
/* So, this packet has hit the connection tracking matching code. /* So, this packet has hit the connection tracking matching code.
......
net/ipv4/netfilter/nf_nat_standalone.c
View file @ 6e23ae2a
...@@ -137,7 +137,7 @@ nf_nat_fn(unsigned int hooknum, ...@@ -137,7 +137,7 @@ nf_nat_fn(unsigned int hooknum,
if (unlikely(nf_ct_is_confirmed(ct))) if (unlikely(nf_ct_is_confirmed(ct)))
/* NAT module was loaded late */ /* NAT module was loaded late */
ret = alloc_null_binding_confirmed(ct, hooknum); ret = alloc_null_binding_confirmed(ct, hooknum);
else if (hooknum == NF_IP_LOCAL_IN) else if (hooknum == NF_INET_LOCAL_IN)
/* LOCAL_IN hook doesn't have a chain! */ /* LOCAL_IN hook doesn't have a chain! */
ret = alloc_null_binding(ct, hooknum); ret = alloc_null_binding(ct, hooknum);
else else
...@@ -279,7 +279,7 @@ static struct nf_hook_ops nf_nat_ops[] = { ...@@ -279,7 +279,7 @@ static struct nf_hook_ops nf_nat_ops[] = {
.hook = nf_nat_in, .hook = nf_nat_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_NAT_DST, .priority = NF_IP_PRI_NAT_DST,
}, },
/* After packet filtering, change source */ /* After packet filtering, change source */
...@@ -287,7 +287,7 @@ static struct nf_hook_ops nf_nat_ops[] = { ...@@ -287,7 +287,7 @@ static struct nf_hook_ops nf_nat_ops[] = {
.hook = nf_nat_out, .hook = nf_nat_out,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_NAT_SRC, .priority = NF_IP_PRI_NAT_SRC,
}, },
/* After conntrack, adjust sequence number */ /* After conntrack, adjust sequence number */
...@@ -295,7 +295,7 @@ static struct nf_hook_ops nf_nat_ops[] = { ...@@ -295,7 +295,7 @@ static struct nf_hook_ops nf_nat_ops[] = {
.hook = nf_nat_adjust, .hook = nf_nat_adjust,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_NAT_SEQ_ADJUST, .priority = NF_IP_PRI_NAT_SEQ_ADJUST,
}, },
/* Before packet filtering, change destination */ /* Before packet filtering, change destination */
...@@ -303,7 +303,7 @@ static struct nf_hook_ops nf_nat_ops[] = { ...@@ -303,7 +303,7 @@ static struct nf_hook_ops nf_nat_ops[] = {
.hook = nf_nat_local_fn, .hook = nf_nat_local_fn,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_NAT_DST, .priority = NF_IP_PRI_NAT_DST,
}, },
/* After packet filtering, change source */ /* After packet filtering, change source */
...@@ -311,7 +311,7 @@ static struct nf_hook_ops nf_nat_ops[] = { ...@@ -311,7 +311,7 @@ static struct nf_hook_ops nf_nat_ops[] = {
.hook = nf_nat_fn, .hook = nf_nat_fn,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_NAT_SRC, .priority = NF_IP_PRI_NAT_SRC,
}, },
/* After conntrack, adjust sequence number */ /* After conntrack, adjust sequence number */
...@@ -319,7 +319,7 @@ static struct nf_hook_ops nf_nat_ops[] = { ...@@ -319,7 +319,7 @@ static struct nf_hook_ops nf_nat_ops[] = {
.hook = nf_nat_adjust, .hook = nf_nat_adjust,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_NAT_SEQ_ADJUST, .priority = NF_IP_PRI_NAT_SEQ_ADJUST,
}, },
}; };
......
net/ipv4/raw.c
View file @ 6e23ae2a
...@@ -321,7 +321,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length, ...@@ -321,7 +321,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
icmp_out_count(((struct icmphdr *) icmp_out_count(((struct icmphdr *)
skb_transport_header(skb))->type); skb_transport_header(skb))->type);
err = NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, rt->u.dst.dev, err = NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
dst_output); dst_output);
if (err > 0) if (err > 0)
err = inet->recverr ? net_xmit_errno(err) : 0; err = inet->recverr ? net_xmit_errno(err) : 0;
......
net/ipv4/xfrm4_input.c
View file @ 6e23ae2a
...@@ -55,7 +55,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) ...@@ -55,7 +55,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
iph->tot_len = htons(skb->len); iph->tot_len = htons(skb->len);
ip_send_check(iph); ip_send_check(iph);
NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL, NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
xfrm4_rcv_encap_finish); xfrm4_rcv_encap_finish);
return 0; return 0;
#else #else
......
net/ipv4/xfrm4_output.c
View file @ 6e23ae2a
...@@ -86,7 +86,7 @@ static int xfrm4_output_finish(struct sk_buff *skb) ...@@ -86,7 +86,7 @@ static int xfrm4_output_finish(struct sk_buff *skb)
int xfrm4_output(struct sk_buff *skb) int xfrm4_output(struct sk_buff *skb)
{ {
return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev, return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb,
xfrm4_output_finish, NULL, skb->dst->dev, xfrm4_output_finish,
!(IPCB(skb)->flags & IPSKB_REROUTED)); !(IPCB(skb)->flags & IPSKB_REROUTED));
} }
net/ipv4/xfrm4_state.c
View file @ 6e23ae2a
...@@ -66,7 +66,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = { ...@@ -66,7 +66,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
.family = AF_INET, .family = AF_INET,
.proto = IPPROTO_IPIP, .proto = IPPROTO_IPIP,
.eth_proto = htons(ETH_P_IP), .eth_proto = htons(ETH_P_IP),
.nf_post_routing = NF_IP_POST_ROUTING, .nf_post_routing = NF_INET_POST_ROUTING,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.init_flags = xfrm4_init_flags, .init_flags = xfrm4_init_flags,
.init_tempsel = __xfrm4_init_tempsel, .init_tempsel = __xfrm4_init_tempsel,
......
net/ipv6/ip6_input.c
View file @ 6e23ae2a
...@@ -134,7 +134,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt ...@@ -134,7 +134,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
rcu_read_unlock(); rcu_read_unlock();
return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish); return NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, dev, NULL,
ip6_rcv_finish);
err: err:
IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS); IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
drop: drop:
...@@ -229,7 +230,8 @@ static int ip6_input_finish(struct sk_buff *skb) ...@@ -229,7 +230,8 @@ static int ip6_input_finish(struct sk_buff *skb)
int ip6_input(struct sk_buff *skb) int ip6_input(struct sk_buff *skb)
{ {
return NF_HOOK(PF_INET6,NF_IP6_LOCAL_IN, skb, skb->dev, NULL, ip6_input_finish); return NF_HOOK(PF_INET6, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
ip6_input_finish);
} }
int ip6_mc_input(struct sk_buff *skb) int ip6_mc_input(struct sk_buff *skb)
......
net/ipv6/ip6_output.c
View file @ 6e23ae2a
...@@ -79,7 +79,7 @@ int __ip6_local_out(struct sk_buff *skb) ...@@ -79,7 +79,7 @@ int __ip6_local_out(struct sk_buff *skb)
len = 0; len = 0;
ipv6_hdr(skb)->payload_len = htons(len); ipv6_hdr(skb)->payload_len = htons(len);
return nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dst->dev, return nf_hook(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dst->dev,
dst_output); dst_output);
} }
...@@ -145,8 +145,8 @@ static int ip6_output2(struct sk_buff *skb) ...@@ -145,8 +145,8 @@ static int ip6_output2(struct sk_buff *skb)
is not supported in any case. is not supported in any case.
*/ */
if (newskb) if (newskb)
NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, newskb, NULL, NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, newskb,
newskb->dev, NULL, newskb->dev,
ip6_dev_loopback_xmit); ip6_dev_loopback_xmit);
if (ipv6_hdr(skb)->hop_limit == 0) { if (ipv6_hdr(skb)->hop_limit == 0) {
...@@ -159,7 +159,8 @@ static int ip6_output2(struct sk_buff *skb) ...@@ -159,7 +159,8 @@ static int ip6_output2(struct sk_buff *skb)
IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS); IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
} }
return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb,NULL, skb->dev,ip6_output_finish); return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
ip6_output_finish);
} }
static inline int ip6_skb_dst_mtu(struct sk_buff *skb) static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
...@@ -261,7 +262,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl, ...@@ -261,7 +262,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) { if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
IP6_INC_STATS(ip6_dst_idev(skb->dst), IP6_INC_STATS(ip6_dst_idev(skb->dst),
IPSTATS_MIB_OUTREQUESTS); IPSTATS_MIB_OUTREQUESTS);
return NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
dst_output); dst_output);
} }
...@@ -525,7 +526,8 @@ int ip6_forward(struct sk_buff *skb) ...@@ -525,7 +526,8 @@ int ip6_forward(struct sk_buff *skb)
hdr->hop_limit--; hdr->hop_limit--;
IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
return NF_HOOK(PF_INET6,NF_IP6_FORWARD, skb, skb->dev, dst->dev, ip6_forward_finish); return NF_HOOK(PF_INET6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
ip6_forward_finish);
error: error:
IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS); IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
......
net/ipv6/mcast.c
View file @ 6e23ae2a
...@@ -1448,7 +1448,7 @@ static inline int mld_dev_queue_xmit2(struct sk_buff *skb) ...@@ -1448,7 +1448,7 @@ static inline int mld_dev_queue_xmit2(struct sk_buff *skb)
static inline int mld_dev_queue_xmit(struct sk_buff *skb) static inline int mld_dev_queue_xmit(struct sk_buff *skb)
{ {
return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dev, return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
mld_dev_queue_xmit2); mld_dev_queue_xmit2);
} }
...@@ -1469,7 +1469,7 @@ static void mld_sendpack(struct sk_buff *skb) ...@@ -1469,7 +1469,7 @@ static void mld_sendpack(struct sk_buff *skb)
pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen, pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
IPPROTO_ICMPV6, csum_partial(skb_transport_header(skb), IPPROTO_ICMPV6, csum_partial(skb_transport_header(skb),
mldlen, 0)); mldlen, 0));
err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev, err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
mld_dev_queue_xmit); mld_dev_queue_xmit);
if (!err) { if (!err) {
ICMP6MSGOUT_INC_STATS_BH(idev, ICMPV6_MLD2_REPORT); ICMP6MSGOUT_INC_STATS_BH(idev, ICMPV6_MLD2_REPORT);
...@@ -1813,7 +1813,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) ...@@ -1813,7 +1813,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
idev = in6_dev_get(skb->dev); idev = in6_dev_get(skb->dev);
err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev, err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
mld_dev_queue_xmit); mld_dev_queue_xmit);
if (!err) { if (!err) {
ICMP6MSGOUT_INC_STATS(idev, type); ICMP6MSGOUT_INC_STATS(idev, type);
......
net/ipv6/ndisc.c
View file @ 6e23ae2a
...@@ -533,7 +533,8 @@ static void __ndisc_send(struct net_device *dev, ...@@ -533,7 +533,8 @@ static void __ndisc_send(struct net_device *dev,
idev = in6_dev_get(dst->dev); idev = in6_dev_get(dst->dev);
IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS); IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output); err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
dst_output);
if (!err) { if (!err) {
ICMP6MSGOUT_INC_STATS(idev, type); ICMP6MSGOUT_INC_STATS(idev, type);
ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS); ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
...@@ -1538,7 +1539,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh, ...@@ -1538,7 +1539,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
buff->dst = dst; buff->dst = dst;
idev = in6_dev_get(dst->dev); idev = in6_dev_get(dst->dev);
IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS); IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, buff, NULL, dst->dev, dst_output); err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
dst_output);
if (!err) { if (!err) {
ICMP6MSGOUT_INC_STATS(idev, NDISC_REDIRECT); ICMP6MSGOUT_INC_STATS(idev, NDISC_REDIRECT);
ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS); ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
......
net/ipv6/netfilter.c
View file @ 6e23ae2a
...@@ -60,7 +60,7 @@ static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_info *info) ...@@ -60,7 +60,7 @@ static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_info *info)
{ {
struct ip6_rt_info *rt_info = nf_info_reroute(info); struct ip6_rt_info *rt_info = nf_info_reroute(info);
if (info->hook == NF_IP6_LOCAL_OUT) { if (info->hook == NF_INET_LOCAL_OUT) {
struct ipv6hdr *iph = ipv6_hdr(skb); struct ipv6hdr *iph = ipv6_hdr(skb);
rt_info->daddr = iph->daddr; rt_info->daddr = iph->daddr;
...@@ -72,7 +72,7 @@ static int nf_ip6_reroute(struct sk_buff *skb, const struct nf_info *info) ...@@ -72,7 +72,7 @@ static int nf_ip6_reroute(struct sk_buff *skb, const struct nf_info *info)
{ {
struct ip6_rt_info *rt_info = nf_info_reroute(info); struct ip6_rt_info *rt_info = nf_info_reroute(info);
if (info->hook == NF_IP6_LOCAL_OUT) { if (info->hook == NF_INET_LOCAL_OUT) {
struct ipv6hdr *iph = ipv6_hdr(skb); struct ipv6hdr *iph = ipv6_hdr(skb);
if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) || if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
!ipv6_addr_equal(&iph->saddr, &rt_info->saddr)) !ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
...@@ -89,7 +89,7 @@ __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook, ...@@ -89,7 +89,7 @@ __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
switch (skb->ip_summed) { switch (skb->ip_summed) {
case CHECKSUM_COMPLETE: case CHECKSUM_COMPLETE:
if (hook != NF_IP6_PRE_ROUTING && hook != NF_IP6_LOCAL_IN) if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
break; break;
if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
skb->len - dataoff, protocol, skb->len - dataoff, protocol,
......
net/ipv6/netfilter/ip6_tables.c
View file @ 6e23ae2a
...@@ -258,11 +258,11 @@ unconditional(const struct ip6t_ip6 *ipv6) ...@@ -258,11 +258,11 @@ unconditional(const struct ip6t_ip6 *ipv6)
defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE) defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
/* This cries for unification! */ /* This cries for unification! */
static const char *hooknames[] = { static const char *hooknames[] = {
[NF_IP6_PRE_ROUTING] = "PREROUTING", [NF_INET_PRE_ROUTING] = "PREROUTING",
[NF_IP6_LOCAL_IN] = "INPUT", [NF_INET_LOCAL_IN] = "INPUT",
[NF_IP6_FORWARD] = "FORWARD", [NF_INET_FORWARD] = "FORWARD",
[NF_IP6_LOCAL_OUT] = "OUTPUT", [NF_INET_LOCAL_OUT] = "OUTPUT",
[NF_IP6_POST_ROUTING] = "POSTROUTING", [NF_INET_POST_ROUTING] = "POSTROUTING",
}; };
enum nf_ip_trace_comments { enum nf_ip_trace_comments {
...@@ -502,7 +502,7 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -502,7 +502,7 @@ mark_source_chains(struct xt_table_info *newinfo,
/* No recursion; use packet counter to save back ptrs (reset /* No recursion; use packet counter to save back ptrs (reset
to 0 as we leave), and comefrom to save source hook bitmask */ to 0 as we leave), and comefrom to save source hook bitmask */
for (hook = 0; hook < NF_IP6_NUMHOOKS; hook++) { for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
unsigned int pos = newinfo->hook_entry[hook]; unsigned int pos = newinfo->hook_entry[hook];
struct ip6t_entry *e struct ip6t_entry *e
= (struct ip6t_entry *)(entry0 + pos); = (struct ip6t_entry *)(entry0 + pos);
...@@ -518,13 +518,13 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -518,13 +518,13 @@ mark_source_chains(struct xt_table_info *newinfo,
struct ip6t_standard_target *t struct ip6t_standard_target *t
= (void *)ip6t_get_target(e); = (void *)ip6t_get_target(e);
if (e->comefrom & (1 << NF_IP6_NUMHOOKS)) { if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
printk("iptables: loop hook %u pos %u %08X.\n", printk("iptables: loop hook %u pos %u %08X.\n",
hook, pos, e->comefrom); hook, pos, e->comefrom);
return 0; return 0;
} }
e->comefrom e->comefrom
|= ((1 << hook) | (1 << NF_IP6_NUMHOOKS)); |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
/* Unconditional return/END. */ /* Unconditional return/END. */
if ((e->target_offset == sizeof(struct ip6t_entry) if ((e->target_offset == sizeof(struct ip6t_entry)
...@@ -544,10 +544,10 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -544,10 +544,10 @@ mark_source_chains(struct xt_table_info *newinfo,
/* Return: backtrack through the last /* Return: backtrack through the last
big jump. */ big jump. */
do { do {
e->comefrom ^= (1<<NF_IP6_NUMHOOKS); e->comefrom ^= (1<<NF_INET_NUMHOOKS);
#ifdef DEBUG_IP_FIREWALL_USER #ifdef DEBUG_IP_FIREWALL_USER
if (e->comefrom if (e->comefrom
& (1 << NF_IP6_NUMHOOKS)) { & (1 << NF_INET_NUMHOOKS)) {
duprintf("Back unset " duprintf("Back unset "
"on hook %u " "on hook %u "
"rule %u\n", "rule %u\n",
...@@ -746,7 +746,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e, ...@@ -746,7 +746,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
} }
/* Check hooks & underflows */ /* Check hooks & underflows */
for (h = 0; h < NF_IP6_NUMHOOKS; h++) { for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if ((unsigned char *)e - base == hook_entries[h]) if ((unsigned char *)e - base == hook_entries[h])
newinfo->hook_entry[h] = hook_entries[h]; newinfo->hook_entry[h] = hook_entries[h];
if ((unsigned char *)e - base == underflows[h]) if ((unsigned char *)e - base == underflows[h])
...@@ -800,7 +800,7 @@ translate_table(const char *name, ...@@ -800,7 +800,7 @@ translate_table(const char *name,
newinfo->number = number; newinfo->number = number;
/* Init all hooks to impossible value. */ /* Init all hooks to impossible value. */
for (i = 0; i < NF_IP6_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
newinfo->hook_entry[i] = 0xFFFFFFFF; newinfo->hook_entry[i] = 0xFFFFFFFF;
newinfo->underflow[i] = 0xFFFFFFFF; newinfo->underflow[i] = 0xFFFFFFFF;
} }
...@@ -824,7 +824,7 @@ translate_table(const char *name, ...@@ -824,7 +824,7 @@ translate_table(const char *name,
} }
/* Check hooks all assigned */ /* Check hooks all assigned */
for (i = 0; i < NF_IP6_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
/* Only hooks which are valid */ /* Only hooks which are valid */
if (!(valid_hooks & (1 << i))) if (!(valid_hooks & (1 << i)))
continue; continue;
......
net/ipv6/netfilter/ip6t_REJECT.c
View file @ 6e23ae2a
...@@ -164,7 +164,7 @@ static void send_reset(struct sk_buff *oldskb) ...@@ -164,7 +164,7 @@ static void send_reset(struct sk_buff *oldskb)
static inline void static inline void
send_unreach(struct sk_buff *skb_in, unsigned char code, unsigned int hooknum) send_unreach(struct sk_buff *skb_in, unsigned char code, unsigned int hooknum)
{ {
if (hooknum == NF_IP6_LOCAL_OUT && skb_in->dev == NULL) if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
skb_in->dev = init_net.loopback_dev; skb_in->dev = init_net.loopback_dev;
icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL); icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
...@@ -243,8 +243,8 @@ static struct xt_target ip6t_reject_reg __read_mostly = { ...@@ -243,8 +243,8 @@ static struct xt_target ip6t_reject_reg __read_mostly = {
.target = reject6_target, .target = reject6_target,
.targetsize = sizeof(struct ip6t_reject_info), .targetsize = sizeof(struct ip6t_reject_info),
.table = "filter", .table = "filter",
.hooks = (1 << NF_IP6_LOCAL_IN) | (1 << NF_IP6_FORWARD) | .hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
(1 << NF_IP6_LOCAL_OUT), (1 << NF_INET_LOCAL_OUT),
.checkentry = check, .checkentry = check,
.me = THIS_MODULE .me = THIS_MODULE
}; };
......
net/ipv6/netfilter/ip6t_eui64.c
View file @ 6e23ae2a
...@@ -67,8 +67,8 @@ static struct xt_match eui64_match __read_mostly = { ...@@ -67,8 +67,8 @@ static struct xt_match eui64_match __read_mostly = {
.family = AF_INET6, .family = AF_INET6,
.match = match, .match = match,
.matchsize = sizeof(int), .matchsize = sizeof(int),
.hooks = (1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_IN) | .hooks = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
(1 << NF_IP6_FORWARD), (1 << NF_INET_FORWARD),
.me = THIS_MODULE, .me = THIS_MODULE,
}; };
......
net/ipv6/netfilter/ip6t_owner.c
View file @ 6e23ae2a
...@@ -73,7 +73,8 @@ static struct xt_match owner_match __read_mostly = { ...@@ -73,7 +73,8 @@ static struct xt_match owner_match __read_mostly = {
.family = AF_INET6, .family = AF_INET6,
.match = match, .match = match,
.matchsize = sizeof(struct ip6t_owner_info), .matchsize = sizeof(struct ip6t_owner_info),
.hooks = (1 << NF_IP6_LOCAL_OUT) | (1 << NF_IP6_POST_ROUTING), .hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_INET_POST_ROUTING),
.checkentry = checkentry, .checkentry = checkentry,
.me = THIS_MODULE, .me = THIS_MODULE,
}; };
......
net/ipv6/netfilter/ip6table_filter.c
View file @ 6e23ae2a
...@@ -17,7 +17,9 @@ MODULE_LICENSE("GPL"); ...@@ -17,7 +17,9 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("ip6tables filter table"); MODULE_DESCRIPTION("ip6tables filter table");
#define FILTER_VALID_HOOKS ((1 << NF_IP6_LOCAL_IN) | (1 << NF_IP6_FORWARD) | (1 << NF_IP6_LOCAL_OUT)) #define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \
(1 << NF_INET_FORWARD) | \
(1 << NF_INET_LOCAL_OUT))
static struct static struct
{ {
...@@ -31,14 +33,14 @@ static struct ...@@ -31,14 +33,14 @@ static struct
.num_entries = 4, .num_entries = 4,
.size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error), .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
.hook_entry = { .hook_entry = {
[NF_IP6_LOCAL_IN] = 0, [NF_INET_LOCAL_IN] = 0,
[NF_IP6_FORWARD] = sizeof(struct ip6t_standard), [NF_INET_FORWARD] = sizeof(struct ip6t_standard),
[NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2 [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
}, },
.underflow = { .underflow = {
[NF_IP6_LOCAL_IN] = 0, [NF_INET_LOCAL_IN] = 0,
[NF_IP6_FORWARD] = sizeof(struct ip6t_standard), [NF_INET_FORWARD] = sizeof(struct ip6t_standard),
[NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2 [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
}, },
}, },
.entries = { .entries = {
...@@ -93,21 +95,21 @@ static struct nf_hook_ops ip6t_ops[] = { ...@@ -93,21 +95,21 @@ static struct nf_hook_ops ip6t_ops[] = {
.hook = ip6t_hook, .hook = ip6t_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },
{ {
.hook = ip6t_hook, .hook = ip6t_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6t_local_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },
}; };
......
net/ipv6/netfilter/ip6table_mangle.c
View file @ 6e23ae2a
...@@ -15,11 +15,11 @@ MODULE_LICENSE("GPL"); ...@@ -15,11 +15,11 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("ip6tables mangle table"); MODULE_DESCRIPTION("ip6tables mangle table");
#define MANGLE_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | \ #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
(1 << NF_IP6_LOCAL_IN) | \ (1 << NF_INET_LOCAL_IN) | \
(1 << NF_IP6_FORWARD) | \ (1 << NF_INET_FORWARD) | \
(1 << NF_IP6_LOCAL_OUT) | \ (1 << NF_INET_LOCAL_OUT) | \
(1 << NF_IP6_POST_ROUTING)) (1 << NF_INET_POST_ROUTING))
static struct static struct
{ {
...@@ -33,18 +33,18 @@ static struct ...@@ -33,18 +33,18 @@ static struct
.num_entries = 6, .num_entries = 6,
.size = sizeof(struct ip6t_standard) * 5 + sizeof(struct ip6t_error), .size = sizeof(struct ip6t_standard) * 5 + sizeof(struct ip6t_error),
.hook_entry = { .hook_entry = {
[NF_IP6_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP6_LOCAL_IN] = sizeof(struct ip6t_standard), [NF_INET_LOCAL_IN] = sizeof(struct ip6t_standard),
[NF_IP6_FORWARD] = sizeof(struct ip6t_standard) * 2, [NF_INET_FORWARD] = sizeof(struct ip6t_standard) * 2,
[NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 3, [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 3,
[NF_IP6_POST_ROUTING] = sizeof(struct ip6t_standard) * 4, [NF_INET_POST_ROUTING] = sizeof(struct ip6t_standard) * 4,
}, },
.underflow = { .underflow = {
[NF_IP6_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP6_LOCAL_IN] = sizeof(struct ip6t_standard), [NF_INET_LOCAL_IN] = sizeof(struct ip6t_standard),
[NF_IP6_FORWARD] = sizeof(struct ip6t_standard) * 2, [NF_INET_FORWARD] = sizeof(struct ip6t_standard) * 2,
[NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 3, [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 3,
[NF_IP6_POST_ROUTING] = sizeof(struct ip6t_standard) * 4, [NF_INET_POST_ROUTING] = sizeof(struct ip6t_standard) * 4,
}, },
}, },
.entries = { .entries = {
...@@ -125,35 +125,35 @@ static struct nf_hook_ops ip6t_ops[] = { ...@@ -125,35 +125,35 @@ static struct nf_hook_ops ip6t_ops[] = {
.hook = ip6t_route_hook, .hook = ip6t_route_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_local_hook, .hook = ip6t_local_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_route_hook, .hook = ip6t_route_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_local_hook, .hook = ip6t_local_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_route_hook, .hook = ip6t_route_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
}; };
......
net/ipv6/netfilter/ip6table_raw.c
View file @ 6e23ae2a
...@@ -6,7 +6,7 @@ ...@@ -6,7 +6,7 @@
#include <linux/module.h> #include <linux/module.h>
#include <linux/netfilter_ipv6/ip6_tables.h> #include <linux/netfilter_ipv6/ip6_tables.h>
#define RAW_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_OUT)) #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
static struct static struct
{ {
...@@ -20,12 +20,12 @@ static struct ...@@ -20,12 +20,12 @@ static struct
.num_entries = 3, .num_entries = 3,
.size = sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error), .size = sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
.hook_entry = { .hook_entry = {
[NF_IP6_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
}, },
.underflow = { .underflow = {
[NF_IP6_PRE_ROUTING] = 0, [NF_INET_PRE_ROUTING] = 0,
[NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
}, },
}, },
.entries = { .entries = {
...@@ -58,14 +58,14 @@ static struct nf_hook_ops ip6t_ops[] = { ...@@ -58,14 +58,14 @@ static struct nf_hook_ops ip6t_ops[] = {
{ {
.hook = ip6t_hook, .hook = ip6t_hook,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_FIRST, .priority = NF_IP6_PRI_FIRST,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
{ {
.hook = ip6t_hook, .hook = ip6t_hook,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_FIRST, .priority = NF_IP6_PRI_FIRST,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
......
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
View file @ 6e23ae2a
...@@ -263,42 +263,42 @@ static struct nf_hook_ops ipv6_conntrack_ops[] = { ...@@ -263,42 +263,42 @@ static struct nf_hook_ops ipv6_conntrack_ops[] = {
.hook = ipv6_defrag, .hook = ipv6_defrag,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG, .priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
}, },
{ {
.hook = ipv6_conntrack_in, .hook = ipv6_conntrack_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_CONNTRACK, .priority = NF_IP6_PRI_CONNTRACK,
}, },
{ {
.hook = ipv6_conntrack_local, .hook = ipv6_conntrack_local,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_CONNTRACK, .priority = NF_IP6_PRI_CONNTRACK,
}, },
{ {
.hook = ipv6_defrag, .hook = ipv6_defrag,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG, .priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
}, },
{ {
.hook = ipv6_confirm, .hook = ipv6_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP6_PRI_LAST, .priority = NF_IP6_PRI_LAST,
}, },
{ {
.hook = ipv6_confirm, .hook = ipv6_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_LAST-1, .priority = NF_IP6_PRI_LAST-1,
}, },
}; };
......
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
View file @ 6e23ae2a
...@@ -192,7 +192,7 @@ icmpv6_error(struct sk_buff *skb, unsigned int dataoff, ...@@ -192,7 +192,7 @@ icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
return -NF_ACCEPT; return -NF_ACCEPT;
} }
if (nf_conntrack_checksum && hooknum == NF_IP6_PRE_ROUTING && if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) { nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
"nf_ct_icmpv6: ICMPv6 checksum failed\n"); "nf_ct_icmpv6: ICMPv6 checksum failed\n");
......
net/ipv6/raw.c
View file @ 6e23ae2a
...@@ -619,7 +619,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length, ...@@ -619,7 +619,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
goto error_fault; goto error_fault;
IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS); IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, rt->u.dst.dev, err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
dst_output); dst_output);
if (err > 0) if (err > 0)
err = np->recverr ? net_xmit_errno(err) : 0; err = np->recverr ? net_xmit_errno(err) : 0;
......
net/ipv6/xfrm6_input.c
View file @ 6e23ae2a
...@@ -37,7 +37,7 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async) ...@@ -37,7 +37,7 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
ipv6_hdr(skb)->payload_len = htons(skb->len); ipv6_hdr(skb)->payload_len = htons(skb->len);
__skb_push(skb, skb->data - skb_network_header(skb)); __skb_push(skb, skb->data - skb_network_header(skb));
NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL, NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
ip6_rcv_finish); ip6_rcv_finish);
return -1; return -1;
#else #else
......
net/ipv6/xfrm6_output.c
View file @ 6e23ae2a
...@@ -89,6 +89,6 @@ static int xfrm6_output_finish(struct sk_buff *skb) ...@@ -89,6 +89,6 @@ static int xfrm6_output_finish(struct sk_buff *skb)
int xfrm6_output(struct sk_buff *skb) int xfrm6_output(struct sk_buff *skb)
{ {
return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev, return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dst->dev,
xfrm6_output_finish); xfrm6_output_finish);
} }
net/ipv6/xfrm6_state.c
View file @ 6e23ae2a
...@@ -188,7 +188,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = { ...@@ -188,7 +188,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
.family = AF_INET6, .family = AF_INET6,
.proto = IPPROTO_IPV6, .proto = IPPROTO_IPV6,
.eth_proto = htons(ETH_P_IPV6), .eth_proto = htons(ETH_P_IPV6),
.nf_post_routing = NF_IP6_POST_ROUTING, .nf_post_routing = NF_INET_POST_ROUTING,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.init_tempsel = __xfrm6_init_tempsel, .init_tempsel = __xfrm6_init_tempsel,
.tmpl_sort = __xfrm6_tmpl_sort, .tmpl_sort = __xfrm6_tmpl_sort,
......
net/netfilter/nf_conntrack_netlink.c
View file @ 6e23ae2a
...@@ -829,18 +829,18 @@ ctnetlink_change_status(struct nf_conn *ct, struct nlattr *cda[]) ...@@ -829,18 +829,18 @@ ctnetlink_change_status(struct nf_conn *ct, struct nlattr *cda[])
&range) < 0) &range) < 0)
return -EINVAL; return -EINVAL;
if (nf_nat_initialized(ct, if (nf_nat_initialized(ct,
HOOK2MANIP(NF_IP_PRE_ROUTING))) HOOK2MANIP(NF_INET_PRE_ROUTING)))
return -EEXIST; return -EEXIST;
nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_PRE_ROUTING);
} }
if (cda[CTA_NAT_SRC]) { if (cda[CTA_NAT_SRC]) {
if (nfnetlink_parse_nat(cda[CTA_NAT_SRC], ct, if (nfnetlink_parse_nat(cda[CTA_NAT_SRC], ct,
&range) < 0) &range) < 0)
return -EINVAL; return -EINVAL;
if (nf_nat_initialized(ct, if (nf_nat_initialized(ct,
HOOK2MANIP(NF_IP_POST_ROUTING))) HOOK2MANIP(NF_INET_POST_ROUTING)))
return -EEXIST; return -EEXIST;
nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); nf_nat_setup_info(ct, &range, NF_INET_POST_ROUTING);
} }
#endif #endif
} }
......
net/netfilter/nf_conntrack_proto_tcp.c
View file @ 6e23ae2a
...@@ -783,9 +783,7 @@ static int tcp_error(struct sk_buff *skb, ...@@ -783,9 +783,7 @@ static int tcp_error(struct sk_buff *skb,
* because the checksum is assumed to be correct. * because the checksum is assumed to be correct.
*/ */
/* FIXME: Source route IP option packets --RR */ /* FIXME: Source route IP option packets --RR */
if (nf_conntrack_checksum && if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) ||
(pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING)) &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) { nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
......
net/netfilter/nf_conntrack_proto_udp.c
View file @ 6e23ae2a
...@@ -128,9 +128,7 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff, ...@@ -128,9 +128,7 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
* We skip checking packets on the outgoing path * We skip checking packets on the outgoing path
* because the checksum is assumed to be correct. * because the checksum is assumed to be correct.
* FIXME: Source route IP option packets --RR */ * FIXME: Source route IP option packets --RR */
if (nf_conntrack_checksum && if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) ||
(pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING)) &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) { nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
if (LOG_INVALID(IPPROTO_UDP)) if (LOG_INVALID(IPPROTO_UDP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
......
net/netfilter/nf_conntrack_proto_udplite.c
View file @ 6e23ae2a
...@@ -133,8 +133,7 @@ static int udplite_error(struct sk_buff *skb, unsigned int dataoff, ...@@ -133,8 +133,7 @@ static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
/* Checksum invalid? Ignore. */ /* Checksum invalid? Ignore. */
if (nf_conntrack_checksum && !skb_csum_unnecessary(skb) && if (nf_conntrack_checksum && !skb_csum_unnecessary(skb) &&
((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) || hooknum == NF_INET_PRE_ROUTING) {
(pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING))) {
if (pf == PF_INET) { if (pf == PF_INET) {
struct iphdr *iph = ip_hdr(skb); struct iphdr *iph = ip_hdr(skb);
......
net/netfilter/xt_CLASSIFY.c
View file @ 6e23ae2a
...@@ -47,9 +47,9 @@ static struct xt_target xt_classify_target[] __read_mostly = { ...@@ -47,9 +47,9 @@ static struct xt_target xt_classify_target[] __read_mostly = {
.target = target, .target = target,
.targetsize = sizeof(struct xt_classify_target_info), .targetsize = sizeof(struct xt_classify_target_info),
.table = "mangle", .table = "mangle",
.hooks = (1 << NF_IP_LOCAL_OUT) | .hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_IP_FORWARD) | (1 << NF_INET_FORWARD) |
(1 << NF_IP_POST_ROUTING), (1 << NF_INET_POST_ROUTING),
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
{ {
...@@ -58,9 +58,9 @@ static struct xt_target xt_classify_target[] __read_mostly = { ...@@ -58,9 +58,9 @@ static struct xt_target xt_classify_target[] __read_mostly = {
.target = target, .target = target,
.targetsize = sizeof(struct xt_classify_target_info), .targetsize = sizeof(struct xt_classify_target_info),
.table = "mangle", .table = "mangle",
.hooks = (1 << NF_IP6_LOCAL_OUT) | .hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_IP6_FORWARD) | (1 << NF_INET_FORWARD) |
(1 << NF_IP6_POST_ROUTING), (1 << NF_INET_POST_ROUTING),
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
}; };
......
net/netfilter/xt_TCPMSS.c
View file @ 6e23ae2a
...@@ -214,9 +214,9 @@ xt_tcpmss_checkentry4(const char *tablename, ...@@ -214,9 +214,9 @@ xt_tcpmss_checkentry4(const char *tablename,
const struct ipt_entry *e = entry; const struct ipt_entry *e = entry;
if (info->mss == XT_TCPMSS_CLAMP_PMTU && if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
(hook_mask & ~((1 << NF_IP_FORWARD) | (hook_mask & ~((1 << NF_INET_FORWARD) |
(1 << NF_IP_LOCAL_OUT) | (1 << NF_INET_LOCAL_OUT) |
(1 << NF_IP_POST_ROUTING))) != 0) { (1 << NF_INET_POST_ROUTING))) != 0) {
printk("xt_TCPMSS: path-MTU clamping only supported in " printk("xt_TCPMSS: path-MTU clamping only supported in "
"FORWARD, OUTPUT and POSTROUTING hooks\n"); "FORWARD, OUTPUT and POSTROUTING hooks\n");
return false; return false;
...@@ -239,9 +239,9 @@ xt_tcpmss_checkentry6(const char *tablename, ...@@ -239,9 +239,9 @@ xt_tcpmss_checkentry6(const char *tablename,
const struct ip6t_entry *e = entry; const struct ip6t_entry *e = entry;
if (info->mss == XT_TCPMSS_CLAMP_PMTU && if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
(hook_mask & ~((1 << NF_IP6_FORWARD) | (hook_mask & ~((1 << NF_INET_FORWARD) |
(1 << NF_IP6_LOCAL_OUT) | (1 << NF_INET_LOCAL_OUT) |
(1 << NF_IP6_POST_ROUTING))) != 0) { (1 << NF_INET_POST_ROUTING))) != 0) {
printk("xt_TCPMSS: path-MTU clamping only supported in " printk("xt_TCPMSS: path-MTU clamping only supported in "
"FORWARD, OUTPUT and POSTROUTING hooks\n"); "FORWARD, OUTPUT and POSTROUTING hooks\n");
return false; return false;
......
net/netfilter/xt_mac.c
View file @ 6e23ae2a
...@@ -50,9 +50,9 @@ static struct xt_match xt_mac_match[] __read_mostly = { ...@@ -50,9 +50,9 @@ static struct xt_match xt_mac_match[] __read_mostly = {
.family = AF_INET, .family = AF_INET,
.match = match, .match = match,
.matchsize = sizeof(struct xt_mac_info), .matchsize = sizeof(struct xt_mac_info),
.hooks = (1 << NF_IP_PRE_ROUTING) | .hooks = (1 << NF_INET_PRE_ROUTING) |
(1 << NF_IP_LOCAL_IN) | (1 << NF_INET_LOCAL_IN) |
(1 << NF_IP_FORWARD), (1 << NF_INET_FORWARD),
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
{ {
...@@ -60,9 +60,9 @@ static struct xt_match xt_mac_match[] __read_mostly = { ...@@ -60,9 +60,9 @@ static struct xt_match xt_mac_match[] __read_mostly = {
.family = AF_INET6, .family = AF_INET6,
.match = match, .match = match,
.matchsize = sizeof(struct xt_mac_info), .matchsize = sizeof(struct xt_mac_info),
.hooks = (1 << NF_IP6_PRE_ROUTING) | .hooks = (1 << NF_INET_PRE_ROUTING) |
(1 << NF_IP6_LOCAL_IN) | (1 << NF_INET_LOCAL_IN) |
(1 << NF_IP6_FORWARD), (1 << NF_INET_FORWARD),
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
}; };
......
net/netfilter/xt_physdev.c
View file @ 6e23ae2a
...@@ -113,12 +113,12 @@ checkentry(const char *tablename, ...@@ -113,12 +113,12 @@ checkentry(const char *tablename,
if (info->bitmask & XT_PHYSDEV_OP_OUT && if (info->bitmask & XT_PHYSDEV_OP_OUT &&
(!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) || (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
info->invert & XT_PHYSDEV_OP_BRIDGED) && info->invert & XT_PHYSDEV_OP_BRIDGED) &&
hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) | hook_mask & ((1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
(1 << NF_IP_POST_ROUTING))) { (1 << NF_INET_POST_ROUTING))) {
printk(KERN_WARNING "physdev match: using --physdev-out in the " printk(KERN_WARNING "physdev match: using --physdev-out in the "
"OUTPUT, FORWARD and POSTROUTING chains for non-bridged " "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
"traffic is not supported anymore.\n"); "traffic is not supported anymore.\n");
if (hook_mask & (1 << NF_IP_LOCAL_OUT)) if (hook_mask & (1 << NF_INET_LOCAL_OUT))
return false; return false;
} }
return true; return true;
......
net/netfilter/xt_policy.c
View file @ 6e23ae2a
...@@ -144,14 +144,13 @@ static bool checkentry(const char *tablename, const void *ip_void, ...@@ -144,14 +144,13 @@ static bool checkentry(const char *tablename, const void *ip_void,
"outgoing policy selected\n"); "outgoing policy selected\n");
return false; return false;
} }
/* hook values are equal for IPv4 and IPv6 */ if (hook_mask & (1 << NF_INET_PRE_ROUTING | 1 << NF_INET_LOCAL_IN)
if (hook_mask & (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_IN)
&& info->flags & XT_POLICY_MATCH_OUT) { && info->flags & XT_POLICY_MATCH_OUT) {
printk(KERN_ERR "xt_policy: output policy not valid in " printk(KERN_ERR "xt_policy: output policy not valid in "
"PRE_ROUTING and INPUT\n"); "PRE_ROUTING and INPUT\n");
return false; return false;
} }
if (hook_mask & (1 << NF_IP_POST_ROUTING | 1 << NF_IP_LOCAL_OUT) if (hook_mask & (1 << NF_INET_POST_ROUTING | 1 << NF_INET_LOCAL_OUT)
&& info->flags & XT_POLICY_MATCH_IN) { && info->flags & XT_POLICY_MATCH_IN) {
printk(KERN_ERR "xt_policy: input policy not valid in " printk(KERN_ERR "xt_policy: input policy not valid in "
"POST_ROUTING and OUTPUT\n"); "POST_ROUTING and OUTPUT\n");
......
net/netfilter/xt_realm.c
View file @ 6e23ae2a
...@@ -41,8 +41,8 @@ static struct xt_match realm_match __read_mostly = { ...@@ -41,8 +41,8 @@ static struct xt_match realm_match __read_mostly = {
.name = "realm", .name = "realm",
.match = match, .match = match,
.matchsize = sizeof(struct xt_realm_info), .matchsize = sizeof(struct xt_realm_info),
.hooks = (1 << NF_IP_POST_ROUTING) | (1 << NF_IP_FORWARD) | .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
(1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_LOCAL_IN), (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
.family = AF_INET, .family = AF_INET,
.me = THIS_MODULE .me = THIS_MODULE
}; };
......
net/sched/sch_ingress.c
View file @ 6e23ae2a
...@@ -235,7 +235,7 @@ static struct nf_hook_ops ing_ops = { ...@@ -235,7 +235,7 @@ static struct nf_hook_ops ing_ops = {
.hook = ing_hook, .hook = ing_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_FILTER + 1, .priority = NF_IP_PRI_FILTER + 1,
}; };
...@@ -243,7 +243,7 @@ static struct nf_hook_ops ing6_ops = { ...@@ -243,7 +243,7 @@ static struct nf_hook_ops ing6_ops = {
.hook = ing_hook, .hook = ing_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_FILTER + 1, .priority = NF_IP6_PRI_FILTER + 1,
}; };
......
security/selinux/hooks.c
View file @ 6e23ae2a
...@@ -5281,7 +5281,7 @@ static struct nf_hook_ops selinux_ipv4_op = { ...@@ -5281,7 +5281,7 @@ static struct nf_hook_ops selinux_ipv4_op = {
.hook = selinux_ipv4_postroute_last, .hook = selinux_ipv4_postroute_last,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_SELINUX_LAST, .priority = NF_IP_PRI_SELINUX_LAST,
}; };
...@@ -5291,7 +5291,7 @@ static struct nf_hook_ops selinux_ipv6_op = { ...@@ -5291,7 +5291,7 @@ static struct nf_hook_ops selinux_ipv6_op = {
.hook = selinux_ipv6_postroute_last, .hook = selinux_ipv6_postroute_last,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = PF_INET6,
.hooknum = NF_IP6_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP6_PRI_SELINUX_LAST, .priority = NF_IP6_PRI_SELINUX_LAST,
}; };
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7