mirror of
https://github.com/torvalds/linux.git
synced 2024-10-26 06:54:41 +00:00
netfilter: implement hotdrop for Ebtables
Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
f2ff525c8d
commit
5365f8022e
|
@ -78,9 +78,10 @@ static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
|
||||||
|
|
||||||
static inline int ebt_do_match (struct ebt_entry_match *m,
|
static inline int ebt_do_match (struct ebt_entry_match *m,
|
||||||
const struct sk_buff *skb, const struct net_device *in,
|
const struct sk_buff *skb, const struct net_device *in,
|
||||||
const struct net_device *out)
|
const struct net_device *out, bool *hotdrop)
|
||||||
{
|
{
|
||||||
return m->u.match->match(skb, in, out, m->u.match, m->data, 0, 0, NULL);
|
return m->u.match->match(skb, in, out, m->u.match,
|
||||||
|
m->data, 0, 0, hotdrop);
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline int ebt_dev_check(char *entry, const struct net_device *device)
|
static inline int ebt_dev_check(char *entry, const struct net_device *device)
|
||||||
|
@ -156,6 +157,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
|
||||||
struct ebt_entries *chaininfo;
|
struct ebt_entries *chaininfo;
|
||||||
char *base;
|
char *base;
|
||||||
struct ebt_table_info *private;
|
struct ebt_table_info *private;
|
||||||
|
bool hotdrop = false;
|
||||||
|
|
||||||
read_lock_bh(&table->lock);
|
read_lock_bh(&table->lock);
|
||||||
private = table->private;
|
private = table->private;
|
||||||
|
@ -176,8 +178,13 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
|
||||||
if (ebt_basic_match(point, eth_hdr(skb), in, out))
|
if (ebt_basic_match(point, eth_hdr(skb), in, out))
|
||||||
goto letscontinue;
|
goto letscontinue;
|
||||||
|
|
||||||
if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, in, out) != 0)
|
if (EBT_MATCH_ITERATE(point, ebt_do_match, skb,
|
||||||
|
in, out, &hotdrop) != 0)
|
||||||
goto letscontinue;
|
goto letscontinue;
|
||||||
|
if (hotdrop) {
|
||||||
|
read_unlock_bh(&table->lock);
|
||||||
|
return NF_DROP;
|
||||||
|
}
|
||||||
|
|
||||||
/* increase counter */
|
/* increase counter */
|
||||||
(*(counter_base + i)).pcnt++;
|
(*(counter_base + i)).pcnt++;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user