Skip to content

Commit 795aa6e

Browse files
kaberummakynes
kaber
authored and
ummakynes
committed
netfilter: pass hook ops to hookfn
Pass the hook ops to the hookfn to allow for generic hook functions. This change is required by nf_tables. Signed-off-by: Patrick McHardy <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent ccdbb6e commit 795aa6e

26 files changed

+148
-122
lines changed

‎include/linux/netfilter.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ int netfilter_init(void);
4242

4343
struct sk_buff;
4444

45-
typedef unsigned int nf_hookfn(unsigned int hooknum,
45+
struct nf_hook_ops;
46+
typedef unsigned int nf_hookfn(const struct nf_hook_ops *ops,
4647
struct sk_buff *skb,
4748
const struct net_device *in,
4849
const struct net_device *out,

‎net/bridge/br_netfilter.c

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -619,7 +619,7 @@ static int check_hbh_len(struct sk_buff *skb)
619619

620620
/* Replicate the checks that IPv6 does on packet reception and pass the packet
621621
* to ip6tables, which doesn't support NAT, so things are fairly simple. */
622-
static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
622+
static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
623623
struct sk_buff *skb,
624624
const struct net_device *in,
625625
const struct net_device *out,
@@ -669,7 +669,8 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
669669
* receiving device) to make netfilter happy, the REDIRECT
670670
* target in particular. Save the original destination IP
671671
* address to be able to detect DNAT afterwards. */
672-
static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
672+
static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops,
673+
struct sk_buff *skb,
673674
const struct net_device *in,
674675
const struct net_device *out,
675676
int (*okfn)(struct sk_buff *))
@@ -691,7 +692,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
691692
return NF_ACCEPT;
692693

693694
nf_bridge_pull_encap_header_rcsum(skb);
694-
return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
695+
return br_nf_pre_routing_ipv6(ops, skb, in, out, okfn);
695696
}
696697

697698
if (!brnf_call_iptables && !br->nf_call_iptables)
@@ -727,7 +728,8 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
727728
* took place when the packet entered the bridge), but we
728729
* register an IPv4 PRE_ROUTING 'sabotage' hook that will
729730
* prevent this from happening. */
730-
static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
731+
static unsigned int br_nf_local_in(const struct nf_hook_ops *ops,
732+
struct sk_buff *skb,
731733
const struct net_device *in,
732734
const struct net_device *out,
733735
int (*okfn)(struct sk_buff *))
@@ -765,7 +767,8 @@ static int br_nf_forward_finish(struct sk_buff *skb)
765767
* but we are still able to filter on the 'real' indev/outdev
766768
* because of the physdev module. For ARP, indev and outdev are the
767769
* bridge ports. */
768-
static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
770+
static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops,
771+
struct sk_buff *skb,
769772
const struct net_device *in,
770773
const struct net_device *out,
771774
int (*okfn)(struct sk_buff *))
@@ -818,7 +821,8 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
818821
return NF_STOLEN;
819822
}
820823

821-
static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
824+
static unsigned int br_nf_forward_arp(const struct nf_hook_ops *ops,
825+
struct sk_buff *skb,
822826
const struct net_device *in,
823827
const struct net_device *out,
824828
int (*okfn)(struct sk_buff *))
@@ -878,7 +882,8 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
878882
#endif
879883

880884
/* PF_BRIDGE/POST_ROUTING ********************************************/
881-
static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
885+
static unsigned int br_nf_post_routing(const struct nf_hook_ops *ops,
886+
struct sk_buff *skb,
882887
const struct net_device *in,
883888
const struct net_device *out,
884889
int (*okfn)(struct sk_buff *))
@@ -923,7 +928,8 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
923928
/* IP/SABOTAGE *****************************************************/
924929
/* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING
925930
* for the second time. */
926-
static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
931+
static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops,
932+
struct sk_buff *skb,
927933
const struct net_device *in,
928934
const struct net_device *out,
929935
int (*okfn)(struct sk_buff *))

‎net/bridge/netfilter/ebtable_filter.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,17 +60,21 @@ static const struct ebt_table frame_filter =
6060
};
6161

6262
static unsigned int
63-
ebt_in_hook(unsigned int hook, struct sk_buff *skb, const struct net_device *in,
64-
const struct net_device *out, int (*okfn)(struct sk_buff *))
63+
ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
64+
const struct net_device *in, const struct net_device *out,
65+
int (*okfn)(struct sk_buff *))
6566
{
66-
return ebt_do_table(hook, skb, in, out, dev_net(in)->xt.frame_filter);
67+
return ebt_do_table(ops->hooknum, skb, in, out,
68+
dev_net(in)->xt.frame_filter);
6769
}
6870

6971
static unsigned int
70-
ebt_out_hook(unsigned int hook, struct sk_buff *skb, const struct net_device *in,
71-
const struct net_device *out, int (*okfn)(struct sk_buff *))
72+
ebt_out_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
73+
const struct net_device *in, const struct net_device *out,
74+
int (*okfn)(struct sk_buff *))
7275
{
73-
return ebt_do_table(hook, skb, in, out, dev_net(out)->xt.frame_filter);
76+
return ebt_do_table(ops->hooknum, skb, in, out,
77+
dev_net(out)->xt.frame_filter);
7478
}
7579

7680
static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {

‎net/bridge/netfilter/ebtable_nat.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,17 +60,21 @@ static struct ebt_table frame_nat =
6060
};
6161

6262
static unsigned int
63-
ebt_nat_in(unsigned int hook, struct sk_buff *skb, const struct net_device *in
64-
, const struct net_device *out, int (*okfn)(struct sk_buff *))
63+
ebt_nat_in(const struct nf_hook_ops *ops, struct sk_buff *skb,
64+
const struct net_device *in, const struct net_device *out,
65+
int (*okfn)(struct sk_buff *))
6566
{
66-
return ebt_do_table(hook, skb, in, out, dev_net(in)->xt.frame_nat);
67+
return ebt_do_table(ops->hooknum, skb, in, out,
68+
dev_net(in)->xt.frame_nat);
6769
}
6870

6971
static unsigned int
70-
ebt_nat_out(unsigned int hook, struct sk_buff *skb, const struct net_device *in
71-
, const struct net_device *out, int (*okfn)(struct sk_buff *))
72+
ebt_nat_out(const struct nf_hook_ops *ops, struct sk_buff *skb,
73+
const struct net_device *in, const struct net_device *out,
74+
int (*okfn)(struct sk_buff *))
7275
{
73-
return ebt_do_table(hook, skb, in, out, dev_net(out)->xt.frame_nat);
76+
return ebt_do_table(ops->hooknum, skb, in, out,
77+
dev_net(out)->xt.frame_nat);
7478
}
7579

7680
static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {

‎net/decnet/netfilter/dn_rtmsg.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ static void dnrmg_send_peer(struct sk_buff *skb)
8787
}
8888

8989

90-
static unsigned int dnrmg_hook(unsigned int hook,
90+
static unsigned int dnrmg_hook(const struct nf_hook_ops *ops,
9191
struct sk_buff *skb,
9292
const struct net_device *in,
9393
const struct net_device *out,

‎net/ipv4/netfilter/arptable_filter.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,14 @@ static const struct xt_table packet_filter = {
2727

2828
/* The work comes in here from netfilter.c */
2929
static unsigned int
30-
arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
30+
arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
3131
const struct net_device *in, const struct net_device *out,
3232
int (*okfn)(struct sk_buff *))
3333
{
3434
const struct net *net = dev_net((in != NULL) ? in : out);
3535

36-
return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
36+
return arpt_do_table(skb, ops->hooknum, in, out,
37+
net->ipv4.arptable_filter);
3738
}
3839

3940
static struct nf_hook_ops *arpfilter_ops __read_mostly;

‎net/ipv4/netfilter/ipt_CLUSTERIP.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,7 @@ static void arp_print(struct arp_payload *payload)
483483
#endif
484484

485485
static unsigned int
486-
arp_mangle(unsigned int hook,
486+
arp_mangle(const struct nf_hook_ops *ops,
487487
struct sk_buff *skb,
488488
const struct net_device *in,
489489
const struct net_device *out,

‎net/ipv4/netfilter/ipt_SYNPROXY.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
297297
return XT_CONTINUE;
298298
}
299299

300-
static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
300+
static unsigned int ipv4_synproxy_hook(const struct nf_hook_ops *ops,
301301
struct sk_buff *skb,
302302
const struct net_device *in,
303303
const struct net_device *out,

‎net/ipv4/netfilter/iptable_filter.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,20 +33,21 @@ static const struct xt_table packet_filter = {
3333
};
3434

3535
static unsigned int
36-
iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
36+
iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
3737
const struct net_device *in, const struct net_device *out,
3838
int (*okfn)(struct sk_buff *))
3939
{
4040
const struct net *net;
4141

42-
if (hook == NF_INET_LOCAL_OUT &&
42+
if (ops->hooknum == NF_INET_LOCAL_OUT &&
4343
(skb->len < sizeof(struct iphdr) ||
4444
ip_hdrlen(skb) < sizeof(struct iphdr)))
4545
/* root is playing with raw sockets. */
4646
return NF_ACCEPT;
4747

4848
net = dev_net((in != NULL) ? in : out);
49-
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
49+
return ipt_do_table(skb, ops->hooknum, in, out,
50+
net->ipv4.iptable_filter);
5051
}
5152

5253
static struct nf_hook_ops *filter_ops __read_mostly;

‎net/ipv4/netfilter/iptable_mangle.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,19 +79,19 @@ ipt_mangle_out(struct sk_buff *skb, const struct net_device *out)
7979

8080
/* The work comes in here from netfilter.c. */
8181
static unsigned int
82-
iptable_mangle_hook(unsigned int hook,
82+
iptable_mangle_hook(const struct nf_hook_ops *ops,
8383
struct sk_buff *skb,
8484
const struct net_device *in,
8585
const struct net_device *out,
8686
int (*okfn)(struct sk_buff *))
8787
{
88-
if (hook == NF_INET_LOCAL_OUT)
88+
if (ops->hooknum == NF_INET_LOCAL_OUT)
8989
return ipt_mangle_out(skb, out);
90-
if (hook == NF_INET_POST_ROUTING)
91-
return ipt_do_table(skb, hook, in, out,
90+
if (ops->hooknum == NF_INET_POST_ROUTING)
91+
return ipt_do_table(skb, ops->hooknum, in, out,
9292
dev_net(out)->ipv4.iptable_mangle);
9393
/* PREROUTING/INPUT/FORWARD: */
94-
return ipt_do_table(skb, hook, in, out,
94+
return ipt_do_table(skb, ops->hooknum, in, out,
9595
dev_net(in)->ipv4.iptable_mangle);
9696
}
9797

‎net/ipv4/netfilter/iptable_nat.c

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
6161
}
6262

6363
static unsigned int
64-
nf_nat_ipv4_fn(unsigned int hooknum,
64+
nf_nat_ipv4_fn(const struct nf_hook_ops *ops,
6565
struct sk_buff *skb,
6666
const struct net_device *in,
6767
const struct net_device *out,
@@ -71,7 +71,7 @@ nf_nat_ipv4_fn(unsigned int hooknum,
7171
enum ip_conntrack_info ctinfo;
7272
struct nf_conn_nat *nat;
7373
/* maniptype == SRC for postrouting. */
74-
enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
74+
enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum);
7575

7676
/* We never see fragments: conntrack defrags on pre-routing
7777
* and local-out, and nf_nat_out protects post-routing.
@@ -108,7 +108,7 @@ nf_nat_ipv4_fn(unsigned int hooknum,
108108
case IP_CT_RELATED_REPLY:
109109
if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
110110
if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
111-
hooknum))
111+
ops->hooknum))
112112
return NF_DROP;
113113
else
114114
return NF_ACCEPT;
@@ -121,14 +121,14 @@ nf_nat_ipv4_fn(unsigned int hooknum,
121121
if (!nf_nat_initialized(ct, maniptype)) {
122122
unsigned int ret;
123123

124-
ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
124+
ret = nf_nat_rule_find(skb, ops->hooknum, in, out, ct);
125125
if (ret != NF_ACCEPT)
126126
return ret;
127127
} else {
128128
pr_debug("Already setup manip %s for ct %p\n",
129129
maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
130130
ct);
131-
if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
131+
if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
132132
goto oif_changed;
133133
}
134134
break;
@@ -137,19 +137,19 @@ nf_nat_ipv4_fn(unsigned int hooknum,
137137
/* ESTABLISHED */
138138
NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
139139
ctinfo == IP_CT_ESTABLISHED_REPLY);
140-
if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
140+
if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
141141
goto oif_changed;
142142
}
143143

144-
return nf_nat_packet(ct, ctinfo, hooknum, skb);
144+
return nf_nat_packet(ct, ctinfo, ops->hooknum, skb);
145145

146146
oif_changed:
147147
nf_ct_kill_acct(ct, ctinfo, skb);
148148
return NF_DROP;
149149
}
150150

151151
static unsigned int
152-
nf_nat_ipv4_in(unsigned int hooknum,
152+
nf_nat_ipv4_in(const struct nf_hook_ops *ops,
153153
struct sk_buff *skb,
154154
const struct net_device *in,
155155
const struct net_device *out,
@@ -158,7 +158,7 @@ nf_nat_ipv4_in(unsigned int hooknum,
158158
unsigned int ret;
159159
__be32 daddr = ip_hdr(skb)->daddr;
160160

161-
ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
161+
ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
162162
if (ret != NF_DROP && ret != NF_STOLEN &&
163163
daddr != ip_hdr(skb)->daddr)
164164
skb_dst_drop(skb);
@@ -167,7 +167,7 @@ nf_nat_ipv4_in(unsigned int hooknum,
167167
}
168168

169169
static unsigned int
170-
nf_nat_ipv4_out(unsigned int hooknum,
170+
nf_nat_ipv4_out(const struct nf_hook_ops *ops,
171171
struct sk_buff *skb,
172172
const struct net_device *in,
173173
const struct net_device *out,
@@ -185,7 +185,7 @@ nf_nat_ipv4_out(unsigned int hooknum,
185185
ip_hdrlen(skb) < sizeof(struct iphdr))
186186
return NF_ACCEPT;
187187

188-
ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
188+
ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
189189
#ifdef CONFIG_XFRM
190190
if (ret != NF_DROP && ret != NF_STOLEN &&
191191
!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
@@ -207,7 +207,7 @@ nf_nat_ipv4_out(unsigned int hooknum,
207207
}
208208

209209
static unsigned int
210-
nf_nat_ipv4_local_fn(unsigned int hooknum,
210+
nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
211211
struct sk_buff *skb,
212212
const struct net_device *in,
213213
const struct net_device *out,
@@ -223,7 +223,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
223223
ip_hdrlen(skb) < sizeof(struct iphdr))
224224
return NF_ACCEPT;
225225

226-
ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
226+
ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
227227
if (ret != NF_DROP && ret != NF_STOLEN &&
228228
(ct = nf_ct_get(skb, &ctinfo)) != NULL) {
229229
enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

‎net/ipv4/netfilter/iptable_raw.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,20 @@ static const struct xt_table packet_raw = {
2020

2121
/* The work comes in here from netfilter.c. */
2222
static unsigned int
23-
iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
23+
iptable_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
2424
const struct net_device *in, const struct net_device *out,
2525
int (*okfn)(struct sk_buff *))
2626
{
2727
const struct net *net;
2828

29-
if (hook == NF_INET_LOCAL_OUT &&
29+
if (ops->hooknum == NF_INET_LOCAL_OUT &&
3030
(skb->len < sizeof(struct iphdr) ||
3131
ip_hdrlen(skb) < sizeof(struct iphdr)))
3232
/* root is playing with raw sockets. */
3333
return NF_ACCEPT;
3434

3535
net = dev_net((in != NULL) ? in : out);
36-
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
36+
return ipt_do_table(skb, ops->hooknum, in, out, net->ipv4.iptable_raw);
3737
}
3838

3939
static struct nf_hook_ops *rawtable_ops __read_mostly;

‎net/ipv4/netfilter/iptable_security.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,21 +37,22 @@ static const struct xt_table security_table = {
3737
};
3838

3939
static unsigned int
40-
iptable_security_hook(unsigned int hook, struct sk_buff *skb,
40+
iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
4141
const struct net_device *in,
4242
const struct net_device *out,
4343
int (*okfn)(struct sk_buff *))
4444
{
4545
const struct net *net;
4646

47-
if (hook == NF_INET_LOCAL_OUT &&
47+
if (ops->hooknum == NF_INET_LOCAL_OUT &&
4848
(skb->len < sizeof(struct iphdr) ||
4949
ip_hdrlen(skb) < sizeof(struct iphdr)))
5050
/* Somebody is playing with raw sockets. */
5151
return NF_ACCEPT;
5252

5353
net = dev_net((in != NULL) ? in : out);
54-
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
54+
return ipt_do_table(skb, ops->hooknum, in, out,
55+
net->ipv4.iptable_security);
5556
}
5657

5758
static struct nf_hook_ops *sectbl_ops __read_mostly;

0 commit comments

Comments
 (0)