Skip to content

Commit c37a2df

Browse files
JoePerchesummakynes
JoePerches
authored and
ummakynes
committed
netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF
netfilter uses multiple FWINV #defines with identical form that hide a specific structure variable and dereference it with a invflags member. $ git grep "#define FWINV" include/linux/netfilter_bridge/ebtables.h:#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg)) net/bridge/netfilter/ebtables.c:#define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg)) net/ipv4/netfilter/arp_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(arpinfo->invflags & (invflg))) net/ipv4/netfilter/ip_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg))) net/ipv6/netfilter/ip6_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg))) net/netfilter/xt_tcpudp.c:#define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg))) Consolidate these macros into a single NF_INVF macro. Miscellanea: o Neaten the alignment around these uses o A few lines are > 80 columns for intelligibility Signed-off-by: Joe Perches <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent f150430 commit c37a2df

File tree

12 files changed

+144
-138
lines changed

12 files changed

+144
-138
lines changed

‎include/linux/netfilter/x_tables.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@
66
#include <linux/static_key.h>
77
#include <uapi/linux/netfilter/x_tables.h>
88

9+
/* Test a struct->invflags and a boolean for inequality */
10+
#define NF_INVF(ptr, flag, boolean) \
11+
((boolean) ^ !!((ptr)->invflags & (flag)))
12+
913
/**
1014
* struct xt_action_param - parameters for matches/targets
1115
*

‎include/linux/netfilter_bridge/ebtables.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,6 @@ extern unsigned int ebt_do_table(struct sk_buff *skb,
115115
const struct nf_hook_state *state,
116116
struct ebt_table *table);
117117

118-
/* Used in the kernel match() functions */
119-
#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
120118
/* True if the hook mask denotes that the rule is in a base chain,
121119
* used in the check() functions */
122120
#define BASE_CHAIN (par->hook_mask & (1 << NF_BR_NUMHOOKS))

‎net/bridge/netfilter/ebt_802_3.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,16 @@ ebt_802_3_mt(const struct sk_buff *skb, struct xt_action_param *par)
2020
__be16 type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
2121

2222
if (info->bitmask & EBT_802_3_SAP) {
23-
if (FWINV(info->sap != hdr->llc.ui.ssap, EBT_802_3_SAP))
23+
if (NF_INVF(info, EBT_802_3_SAP, info->sap != hdr->llc.ui.ssap))
2424
return false;
25-
if (FWINV(info->sap != hdr->llc.ui.dsap, EBT_802_3_SAP))
25+
if (NF_INVF(info, EBT_802_3_SAP, info->sap != hdr->llc.ui.dsap))
2626
return false;
2727
}
2828

2929
if (info->bitmask & EBT_802_3_TYPE) {
3030
if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
3131
return false;
32-
if (FWINV(info->type != type, EBT_802_3_TYPE))
32+
if (NF_INVF(info, EBT_802_3_TYPE, info->type != type))
3333
return false;
3434
}
3535

‎net/bridge/netfilter/ebt_arp.c

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,14 @@ ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
2525
ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
2626
if (ah == NULL)
2727
return false;
28-
if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
29-
ah->ar_op, EBT_ARP_OPCODE))
28+
if ((info->bitmask & EBT_ARP_OPCODE) &&
29+
NF_INVF(info, EBT_ARP_OPCODE, info->opcode != ah->ar_op))
3030
return false;
31-
if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
32-
ah->ar_hrd, EBT_ARP_HTYPE))
31+
if ((info->bitmask & EBT_ARP_HTYPE) &&
32+
NF_INVF(info, EBT_ARP_HTYPE, info->htype != ah->ar_hrd))
3333
return false;
34-
if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
35-
ah->ar_pro, EBT_ARP_PTYPE))
34+
if ((info->bitmask & EBT_ARP_PTYPE) &&
35+
NF_INVF(info, EBT_ARP_PTYPE, info->ptype != ah->ar_pro))
3636
return false;
3737

3838
if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_GRAT)) {
@@ -51,14 +51,16 @@ ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
5151
sizeof(daddr), &daddr);
5252
if (dap == NULL)
5353
return false;
54-
if (info->bitmask & EBT_ARP_SRC_IP &&
55-
FWINV(info->saddr != (*sap & info->smsk), EBT_ARP_SRC_IP))
54+
if ((info->bitmask & EBT_ARP_SRC_IP) &&
55+
NF_INVF(info, EBT_ARP_SRC_IP,
56+
info->saddr != (*sap & info->smsk)))
5657
return false;
57-
if (info->bitmask & EBT_ARP_DST_IP &&
58-
FWINV(info->daddr != (*dap & info->dmsk), EBT_ARP_DST_IP))
58+
if ((info->bitmask & EBT_ARP_DST_IP) &&
59+
NF_INVF(info, EBT_ARP_DST_IP,
60+
info->daddr != (*dap & info->dmsk)))
5961
return false;
60-
if (info->bitmask & EBT_ARP_GRAT &&
61-
FWINV(*dap != *sap, EBT_ARP_GRAT))
62+
if ((info->bitmask & EBT_ARP_GRAT) &&
63+
NF_INVF(info, EBT_ARP_GRAT, *dap != *sap))
6264
return false;
6365
}
6466

@@ -73,9 +75,9 @@ ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
7375
sizeof(_mac), &_mac);
7476
if (mp == NULL)
7577
return false;
76-
if (FWINV(!ether_addr_equal_masked(mp, info->smaddr,
77-
info->smmsk),
78-
EBT_ARP_SRC_MAC))
78+
if (NF_INVF(info, EBT_ARP_SRC_MAC,
79+
!ether_addr_equal_masked(mp, info->smaddr,
80+
info->smmsk)))
7981
return false;
8082
}
8183

@@ -85,9 +87,9 @@ ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
8587
sizeof(_mac), &_mac);
8688
if (mp == NULL)
8789
return false;
88-
if (FWINV(!ether_addr_equal_masked(mp, info->dmaddr,
89-
info->dmmsk),
90-
EBT_ARP_DST_MAC))
90+
if (NF_INVF(info, EBT_ARP_DST_MAC,
91+
!ether_addr_equal_masked(mp, info->dmaddr,
92+
info->dmmsk)))
9193
return false;
9294
}
9395
}

‎net/bridge/netfilter/ebt_ip.c

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -36,19 +36,19 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
3636
ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
3737
if (ih == NULL)
3838
return false;
39-
if (info->bitmask & EBT_IP_TOS &&
40-
FWINV(info->tos != ih->tos, EBT_IP_TOS))
39+
if ((info->bitmask & EBT_IP_TOS) &&
40+
NF_INVF(info, EBT_IP_TOS, info->tos != ih->tos))
4141
return false;
42-
if (info->bitmask & EBT_IP_SOURCE &&
43-
FWINV((ih->saddr & info->smsk) !=
44-
info->saddr, EBT_IP_SOURCE))
42+
if ((info->bitmask & EBT_IP_SOURCE) &&
43+
NF_INVF(info, EBT_IP_SOURCE,
44+
(ih->saddr & info->smsk) != info->saddr))
4545
return false;
4646
if ((info->bitmask & EBT_IP_DEST) &&
47-
FWINV((ih->daddr & info->dmsk) !=
48-
info->daddr, EBT_IP_DEST))
47+
NF_INVF(info, EBT_IP_DEST,
48+
(ih->daddr & info->dmsk) != info->daddr))
4949
return false;
5050
if (info->bitmask & EBT_IP_PROTO) {
51-
if (FWINV(info->protocol != ih->protocol, EBT_IP_PROTO))
51+
if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
5252
return false;
5353
if (!(info->bitmask & EBT_IP_DPORT) &&
5454
!(info->bitmask & EBT_IP_SPORT))
@@ -61,16 +61,16 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
6161
return false;
6262
if (info->bitmask & EBT_IP_DPORT) {
6363
u32 dst = ntohs(pptr->dst);
64-
if (FWINV(dst < info->dport[0] ||
65-
dst > info->dport[1],
66-
EBT_IP_DPORT))
64+
if (NF_INVF(info, EBT_IP_DPORT,
65+
dst < info->dport[0] ||
66+
dst > info->dport[1]))
6767
return false;
6868
}
6969
if (info->bitmask & EBT_IP_SPORT) {
7070
u32 src = ntohs(pptr->src);
71-
if (FWINV(src < info->sport[0] ||
72-
src > info->sport[1],
73-
EBT_IP_SPORT))
71+
if (NF_INVF(info, EBT_IP_SPORT,
72+
src < info->sport[0] ||
73+
src > info->sport[1]))
7474
return false;
7575
}
7676
}

‎net/bridge/netfilter/ebt_ip6.c

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -45,15 +45,18 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
4545
ih6 = skb_header_pointer(skb, 0, sizeof(_ip6h), &_ip6h);
4646
if (ih6 == NULL)
4747
return false;
48-
if (info->bitmask & EBT_IP6_TCLASS &&
49-
FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
48+
if ((info->bitmask & EBT_IP6_TCLASS) &&
49+
NF_INVF(info, EBT_IP6_TCLASS,
50+
info->tclass != ipv6_get_dsfield(ih6)))
5051
return false;
51-
if ((info->bitmask & EBT_IP6_SOURCE &&
52-
FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
53-
&info->saddr), EBT_IP6_SOURCE)) ||
54-
(info->bitmask & EBT_IP6_DEST &&
55-
FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
56-
&info->daddr), EBT_IP6_DEST)))
52+
if (((info->bitmask & EBT_IP6_SOURCE) &&
53+
NF_INVF(info, EBT_IP6_SOURCE,
54+
ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
55+
&info->saddr))) ||
56+
((info->bitmask & EBT_IP6_DEST) &&
57+
NF_INVF(info, EBT_IP6_DEST,
58+
ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
59+
&info->daddr))))
5760
return false;
5861
if (info->bitmask & EBT_IP6_PROTO) {
5962
uint8_t nexthdr = ih6->nexthdr;
@@ -63,7 +66,7 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
6366
offset_ph = ipv6_skip_exthdr(skb, sizeof(_ip6h), &nexthdr, &frag_off);
6467
if (offset_ph == -1)
6568
return false;
66-
if (FWINV(info->protocol != nexthdr, EBT_IP6_PROTO))
69+
if (NF_INVF(info, EBT_IP6_PROTO, info->protocol != nexthdr))
6770
return false;
6871
if (!(info->bitmask & (EBT_IP6_DPORT |
6972
EBT_IP6_SPORT | EBT_IP6_ICMP6)))
@@ -76,22 +79,24 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
7679
return false;
7780
if (info->bitmask & EBT_IP6_DPORT) {
7881
u16 dst = ntohs(pptr->tcpudphdr.dst);
79-
if (FWINV(dst < info->dport[0] ||
80-
dst > info->dport[1], EBT_IP6_DPORT))
82+
if (NF_INVF(info, EBT_IP6_DPORT,
83+
dst < info->dport[0] ||
84+
dst > info->dport[1]))
8185
return false;
8286
}
8387
if (info->bitmask & EBT_IP6_SPORT) {
8488
u16 src = ntohs(pptr->tcpudphdr.src);
85-
if (FWINV(src < info->sport[0] ||
86-
src > info->sport[1], EBT_IP6_SPORT))
89+
if (NF_INVF(info, EBT_IP6_SPORT,
90+
src < info->sport[0] ||
91+
src > info->sport[1]))
8792
return false;
8893
}
8994
if ((info->bitmask & EBT_IP6_ICMP6) &&
90-
FWINV(pptr->icmphdr.type < info->icmpv6_type[0] ||
91-
pptr->icmphdr.type > info->icmpv6_type[1] ||
92-
pptr->icmphdr.code < info->icmpv6_code[0] ||
93-
pptr->icmphdr.code > info->icmpv6_code[1],
94-
EBT_IP6_ICMP6))
95+
NF_INVF(info, EBT_IP6_ICMP6,
96+
pptr->icmphdr.type < info->icmpv6_type[0] ||
97+
pptr->icmphdr.type > info->icmpv6_type[1] ||
98+
pptr->icmphdr.code < info->icmpv6_code[0] ||
99+
pptr->icmphdr.code > info->icmpv6_code[1]))
95100
return false;
96101
}
97102
return true;

‎net/bridge/netfilter/ebt_stp.c

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -49,66 +49,68 @@ static bool ebt_filter_config(const struct ebt_stp_info *info,
4949

5050
c = &info->config;
5151
if ((info->bitmask & EBT_STP_FLAGS) &&
52-
FWINV(c->flags != stpc->flags, EBT_STP_FLAGS))
52+
NF_INVF(info, EBT_STP_FLAGS, c->flags != stpc->flags))
5353
return false;
5454
if (info->bitmask & EBT_STP_ROOTPRIO) {
5555
v16 = NR16(stpc->root);
56-
if (FWINV(v16 < c->root_priol || v16 > c->root_priou,
57-
EBT_STP_ROOTPRIO))
56+
if (NF_INVF(info, EBT_STP_ROOTPRIO,
57+
v16 < c->root_priol || v16 > c->root_priou))
5858
return false;
5959
}
6060
if (info->bitmask & EBT_STP_ROOTADDR) {
61-
if (FWINV(!ether_addr_equal_masked(&stpc->root[2], c->root_addr,
62-
c->root_addrmsk),
63-
EBT_STP_ROOTADDR))
61+
if (NF_INVF(info, EBT_STP_ROOTADDR,
62+
!ether_addr_equal_masked(&stpc->root[2],
63+
c->root_addr,
64+
c->root_addrmsk)))
6465
return false;
6566
}
6667
if (info->bitmask & EBT_STP_ROOTCOST) {
6768
v32 = NR32(stpc->root_cost);
68-
if (FWINV(v32 < c->root_costl || v32 > c->root_costu,
69-
EBT_STP_ROOTCOST))
69+
if (NF_INVF(info, EBT_STP_ROOTCOST,
70+
v32 < c->root_costl || v32 > c->root_costu))
7071
return false;
7172
}
7273
if (info->bitmask & EBT_STP_SENDERPRIO) {
7374
v16 = NR16(stpc->sender);
74-
if (FWINV(v16 < c->sender_priol || v16 > c->sender_priou,
75-
EBT_STP_SENDERPRIO))
75+
if (NF_INVF(info, EBT_STP_SENDERPRIO,
76+
v16 < c->sender_priol || v16 > c->sender_priou))
7677
return false;
7778
}
7879
if (info->bitmask & EBT_STP_SENDERADDR) {
79-
if (FWINV(!ether_addr_equal_masked(&stpc->sender[2],
80-
c->sender_addr,
81-
c->sender_addrmsk),
82-
EBT_STP_SENDERADDR))
80+
if (NF_INVF(info, EBT_STP_SENDERADDR,
81+
!ether_addr_equal_masked(&stpc->sender[2],
82+
c->sender_addr,
83+
c->sender_addrmsk)))
8384
return false;
8485
}
8586
if (info->bitmask & EBT_STP_PORT) {
8687
v16 = NR16(stpc->port);
87-
if (FWINV(v16 < c->portl || v16 > c->portu, EBT_STP_PORT))
88+
if (NF_INVF(info, EBT_STP_PORT,
89+
v16 < c->portl || v16 > c->portu))
8890
return false;
8991
}
9092
if (info->bitmask & EBT_STP_MSGAGE) {
9193
v16 = NR16(stpc->msg_age);
92-
if (FWINV(v16 < c->msg_agel || v16 > c->msg_ageu,
93-
EBT_STP_MSGAGE))
94+
if (NF_INVF(info, EBT_STP_MSGAGE,
95+
v16 < c->msg_agel || v16 > c->msg_ageu))
9496
return false;
9597
}
9698
if (info->bitmask & EBT_STP_MAXAGE) {
9799
v16 = NR16(stpc->max_age);
98-
if (FWINV(v16 < c->max_agel || v16 > c->max_ageu,
99-
EBT_STP_MAXAGE))
100+
if (NF_INVF(info, EBT_STP_MAXAGE,
101+
v16 < c->max_agel || v16 > c->max_ageu))
100102
return false;
101103
}
102104
if (info->bitmask & EBT_STP_HELLOTIME) {
103105
v16 = NR16(stpc->hello_time);
104-
if (FWINV(v16 < c->hello_timel || v16 > c->hello_timeu,
105-
EBT_STP_HELLOTIME))
106+
if (NF_INVF(info, EBT_STP_HELLOTIME,
107+
v16 < c->hello_timel || v16 > c->hello_timeu))
106108
return false;
107109
}
108110
if (info->bitmask & EBT_STP_FWDD) {
109111
v16 = NR16(stpc->forward_delay);
110-
if (FWINV(v16 < c->forward_delayl || v16 > c->forward_delayu,
111-
EBT_STP_FWDD))
112+
if (NF_INVF(info, EBT_STP_FWDD,
113+
v16 < c->forward_delayl || v16 > c->forward_delayu))
112114
return false;
113115
}
114116
return true;
@@ -130,8 +132,8 @@ ebt_stp_mt(const struct sk_buff *skb, struct xt_action_param *par)
130132
if (memcmp(sp, header, sizeof(header)))
131133
return false;
132134

133-
if (info->bitmask & EBT_STP_TYPE &&
134-
FWINV(info->type != sp->type, EBT_STP_TYPE))
135+
if ((info->bitmask & EBT_STP_TYPE) &&
136+
NF_INVF(info, EBT_STP_TYPE, info->type != sp->type))
135137
return false;
136138

137139
if (sp->type == BPDU_TYPE_CONFIG &&

‎net/bridge/netfilter/ebtables.c

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,6 @@ ebt_dev_check(const char *entry, const struct net_device *device)
121121
return devname[i] != entry[i] && entry[i] != 1;
122122
}
123123

124-
#define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
125124
/* process standard matches */
126125
static inline int
127126
ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
@@ -137,34 +136,36 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
137136
ethproto = h->h_proto;
138137

139138
if (e->bitmask & EBT_802_3) {
140-
if (FWINV2(eth_proto_is_802_3(ethproto), EBT_IPROTO))
139+
if (NF_INVF(e, EBT_IPROTO, eth_proto_is_802_3(ethproto)))
141140
return 1;
142141
} else if (!(e->bitmask & EBT_NOPROTO) &&
143-
FWINV2(e->ethproto != ethproto, EBT_IPROTO))
142+
NF_INVF(e, EBT_IPROTO, e->ethproto != ethproto))
144143
return 1;
145144

146-
if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
145+
if (NF_INVF(e, EBT_IIN, ebt_dev_check(e->in, in)))
147146
return 1;
148-
if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
147+
if (NF_INVF(e, EBT_IOUT, ebt_dev_check(e->out, out)))
149148
return 1;
150149
/* rcu_read_lock()ed by nf_hook_slow */
151150
if (in && (p = br_port_get_rcu(in)) != NULL &&
152-
FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
151+
NF_INVF(e, EBT_ILOGICALIN,
152+
ebt_dev_check(e->logical_in, p->br->dev)))
153153
return 1;
154154
if (out && (p = br_port_get_rcu(out)) != NULL &&
155-
FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
155+
NF_INVF(e, EBT_ILOGICALOUT,
156+
ebt_dev_check(e->logical_out, p->br->dev)))
156157
return 1;
157158

158159
if (e->bitmask & EBT_SOURCEMAC) {
159-
if (FWINV2(!ether_addr_equal_masked(h->h_source,
160-
e->sourcemac, e->sourcemsk),
161-
EBT_ISOURCE))
160+
if (NF_INVF(e, EBT_ISOURCE,
161+
!ether_addr_equal_masked(h->h_source, e->sourcemac,
162+
e->sourcemsk)))
162163
return 1;
163164
}
164165
if (e->bitmask & EBT_DESTMAC) {
165-
if (FWINV2(!ether_addr_equal_masked(h->h_dest,
166-
e->destmac, e->destmsk),
167-
EBT_IDEST))
166+
if (NF_INVF(e, EBT_IDEST,
167+
!ether_addr_equal_masked(h->h_dest, e->destmac,
168+
e->destmsk)))
168169
return 1;
169170
}
170171
return 0;

0 commit comments

Comments
 (0)