leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: Use nf_hook_state.net

Browse Source 
Instead of saying "net = dev_net(state->in?state->in:state->out)"
just say "state->net".  As that information is now availabe,
much less confusing and much less error prone.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric W. Biederman 2015-09-15 20:04:17 -05:00 committed by David S. Miller
parent 29a26a5680
commit 9dff2c966a
21 changed files with 41 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/bridge/netfilter/ebtable_filter.c
View File

@ -61,7 +61,7 @@ ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
return ebt_do_table(ops->hooknum, skb, state->in, state->out,
dev_net(state->in)->xt.frame_filter);
state->net->xt.frame_filter);
}
static unsigned int
@ -69,7 +69,7 @@ ebt_out_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
return ebt_do_table(ops->hooknum, skb, state->in, state->out,
dev_net(state->out)->xt.frame_filter);
state->net->xt.frame_filter);
}
static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {

4
net/bridge/netfilter/ebtable_nat.c
View File

@ -61,7 +61,7 @@ ebt_nat_in(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
return ebt_do_table(ops->hooknum, skb, state->in, state->out,
dev_net(state->in)->xt.frame_nat);
state->net->xt.frame_nat);
}
static unsigned int
@ -69,7 +69,7 @@ ebt_nat_out(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
return ebt_do_table(ops->hooknum, skb, state->in, state->out,
dev_net(state->out)->xt.frame_nat);
state->net->xt.frame_nat);
}
static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {

4
net/ipv4/netfilter/arptable_filter.c
View File

@ -30,10 +30,8 @@ static unsigned int
arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
const struct net *net = dev_net(state->in ? state->in : state->out);
return arpt_do_table(skb, ops->hooknum, state,
net->ipv4.arptable_filter);
state->net->ipv4.arptable_filter);
}
static struct nf_hook_ops *arpfilter_ops __read_mostly;

8
net/ipv4/netfilter/ip_tables.c
View File

@ -246,7 +246,8 @@ get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
return 0;
}
static void trace_packet(const struct sk_buff *skb,
static void trace_packet(struct net *net,
const struct sk_buff *skb,
unsigned int hook,
const struct net_device *in,
const struct net_device *out,
@ -258,7 +259,6 @@ static void trace_packet(const struct sk_buff *skb,
const char *hookname, *chainname, *comment;
const struct ipt_entry *iter;
unsigned int rulenum = 0;
struct net *net = dev_net(in ? in : out);
root = get_entry(private->entries, private->hook_entry[hook]);
@ -378,8 +378,8 @@ ipt_do_table(struct sk_buff *skb,
#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
/* The packet is traced: log it */
if (unlikely(skb->nf_trace))
trace_packet(skb, hook, state->in, state->out,
table->name, private, e);
trace_packet(state->net, skb, hook, state->in,
state->out, table->name, private, e);
#endif
/* Standard target? */
if (!t->u.kernel.target->target) {

2
net/ipv4/netfilter/ipt_CLUSTERIP.c
View File

@ -514,7 +514,7 @@ arp_mangle(const struct nf_hook_ops *ops,
struct arphdr *arp = arp_hdr(skb);
struct arp_payload *payload;
struct clusterip_config *c;
struct net *net = dev_net(state->in ? state->in : state->out);
struct net *net = state->net;
/* we don't care about non-ethernet and non-ipv4 ARP */
if (arp->ar_hrd != htons(ARPHRD_ETHER) ||

2
net/ipv4/netfilter/ipt_SYNPROXY.c
View File

@ -303,7 +303,7 @@ static unsigned int ipv4_synproxy_hook(const struct nf_hook_ops *ops,
struct sk_buff *skb,
const struct nf_hook_state *nhs)
{
struct synproxy_net *snet = synproxy_pernet(dev_net(nhs->in ? : nhs->out));
struct synproxy_net *snet = synproxy_pernet(nhs->net);
enum ip_conntrack_info ctinfo;
struct nf_conn *ct;
struct nf_conn_synproxy *synproxy;

6
net/ipv4/netfilter/iptable_filter.c
View File

@ -36,16 +36,14 @@ static unsigned int
iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
const struct net *net;
if (ops->hooknum == NF_INET_LOCAL_OUT &&
(skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)))
/* root is playing with raw sockets. */
return NF_ACCEPT;
net = dev_net(state->in ? state->in : state->out);
return ipt_do_table(skb, ops->hooknum, state, net->ipv4.iptable_filter);
return ipt_do_table(skb, ops->hooknum, state,
state->net->ipv4.iptable_filter);
}
static struct nf_hook_ops *filter_ops __read_mostly;

7
net/ipv4/netfilter/iptable_mangle.c
View File

@ -39,7 +39,6 @@ static const struct xt_table packet_mangler = {
static unsigned int
ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
{
struct net_device *out = state->out;
unsigned int ret;
const struct iphdr *iph;
u_int8_t tos;
@ -60,7 +59,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
tos = iph->tos;
ret = ipt_do_table(skb, NF_INET_LOCAL_OUT, state,
dev_net(out)->ipv4.iptable_mangle);
state->net->ipv4.iptable_mangle);
/* Reroute for ANY change. */
if (ret != NF_DROP && ret != NF_STOLEN) {
iph = ip_hdr(skb);
@ -88,10 +87,10 @@ iptable_mangle_hook(const struct nf_hook_ops *ops,
return ipt_mangle_out(skb, state);
if (ops->hooknum == NF_INET_POST_ROUTING)
return ipt_do_table(skb, ops->hooknum, state,
dev_net(state->out)->ipv4.iptable_mangle);
state->net->ipv4.iptable_mangle);
/* PREROUTING/INPUT/FORWARD: */
return ipt_do_table(skb, ops->hooknum, state,
dev_net(state->in)->ipv4.iptable_mangle);
state->net->ipv4.iptable_mangle);
}
static struct nf_hook_ops *mangle_ops __read_mostly;

5
net/ipv4/netfilter/iptable_nat.c
View File

@ -33,9 +33,8 @@ static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,
const struct nf_hook_state *state,
struct nf_conn *ct)
{
struct net *net = nf_ct_net(ct);
return ipt_do_table(skb, ops->hooknum, state, net->ipv4.nat_table);
return ipt_do_table(skb, ops->hooknum, state,
state->net->ipv4.nat_table);
}
static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,

6
net/ipv4/netfilter/iptable_raw.c
View File

@ -23,16 +23,14 @@ static unsigned int
iptable_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
const struct net *net;
if (ops->hooknum == NF_INET_LOCAL_OUT &&
(skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)))
/* root is playing with raw sockets. */
return NF_ACCEPT;
net = dev_net(state->in ? state->in : state->out);
return ipt_do_table(skb, ops->hooknum, state, net->ipv4.iptable_raw);
return ipt_do_table(skb, ops->hooknum, state,
state->net->ipv4.iptable_raw);
}
static struct nf_hook_ops *rawtable_ops __read_mostly;

5
net/ipv4/netfilter/iptable_security.c
View File

@ -40,17 +40,14 @@ static unsigned int
iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
const struct net *net;
if (ops->hooknum == NF_INET_LOCAL_OUT &&
(skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)))
/* Somebody is playing with raw sockets. */
return NF_ACCEPT;
net = dev_net(state->in ? state->in : state->out);
return ipt_do_table(skb, ops->hooknum, state,
net->ipv4.iptable_security);
state->net->ipv4.iptable_security);
}
static struct nf_hook_ops *sectbl_ops __read_mostly;

4
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
View File

@ -147,7 +147,7 @@ static unsigned int ipv4_conntrack_in(const struct nf_hook_ops *ops,
struct sk_buff *skb,
const struct nf_hook_state *state)
{
return nf_conntrack_in(dev_net(state->in), PF_INET, ops->hooknum, skb);
return nf_conntrack_in(state->net, PF_INET, ops->hooknum, skb);
}
static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,
@ -158,7 +158,7 @@ static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops,
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr))
return NF_ACCEPT;
return nf_conntrack_in(dev_net(state->out), PF_INET, ops->hooknum, skb);
return nf_conntrack_in(state->net, PF_INET, ops->hooknum, skb);
}
/* Connection tracking may drop packets, but never alters them, so

8
net/ipv6/netfilter/ip6_tables.c
View File

@ -275,7 +275,8 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
return 0;
}
static void trace_packet(const struct sk_buff *skb,
static void trace_packet(struct net *net,
const struct sk_buff *skb,
unsigned int hook,
const struct net_device *in,
const struct net_device *out,
@ -287,7 +288,6 @@ static void trace_packet(const struct sk_buff *skb,
const char *hookname, *chainname, *comment;
const struct ip6t_entry *iter;
unsigned int rulenum = 0;
struct net *net = dev_net(in ? in : out);
root = get_entry(private->entries, private->hook_entry[hook]);
@ -401,8 +401,8 @@ ip6t_do_table(struct sk_buff *skb,
#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
/* The packet is traced: log it */
if (unlikely(skb->nf_trace))
trace_packet(skb, hook, state->in, state->out,
table->name, private, e);
trace_packet(state->net, skb, hook, state->in,
state->out, table->name, private, e);
#endif
/* Standard target? */
if (!t->u.kernel.target->target) {

2
net/ipv6/netfilter/ip6t_SYNPROXY.c
View File

@ -320,7 +320,7 @@ static unsigned int ipv6_synproxy_hook(const struct nf_hook_ops *ops,
struct sk_buff *skb,
const struct nf_hook_state *nhs)
{
struct synproxy_net *snet = synproxy_pernet(dev_net(nhs->in ? : nhs->out));
struct synproxy_net *snet = synproxy_pernet(nhs->net);
enum ip_conntrack_info ctinfo;
struct nf_conn *ct;
struct nf_conn_synproxy *synproxy;

5
net/ipv6/netfilter/ip6table_filter.c
View File

@ -35,9 +35,8 @@ static unsigned int
ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
const struct net *net = dev_net(state->in ? state->in : state->out);
return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_filter);
return ip6t_do_table(skb, ops->hooknum, state,
state->net->ipv6.ip6table_filter);
}
static struct nf_hook_ops *filter_ops __read_mostly;

6
net/ipv6/netfilter/ip6table_mangle.c
View File

@ -58,7 +58,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
flowlabel = *((u_int32_t *)ipv6_hdr(skb));
ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, state,
dev_net(state->out)->ipv6.ip6table_mangle);
state->net->ipv6.ip6table_mangle);
if (ret != NF_DROP && ret != NF_STOLEN &&
(!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@ -83,10 +83,10 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
return ip6t_mangle_out(skb, state);
if (ops->hooknum == NF_INET_POST_ROUTING)
return ip6t_do_table(skb, ops->hooknum, state,
dev_net(state->out)->ipv6.ip6table_mangle);
state->net->ipv6.ip6table_mangle);
/* INPUT/FORWARD */
return ip6t_do_table(skb, ops->hooknum, state,
dev_net(state->in)->ipv6.ip6table_mangle);
state->net->ipv6.ip6table_mangle);
}
static struct nf_hook_ops *mangle_ops __read_mostly;

5
net/ipv6/netfilter/ip6table_nat.c
View File

@ -35,9 +35,8 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,
const struct nf_hook_state *state,
struct nf_conn *ct)
{
struct net *net = nf_ct_net(ct);
return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_nat);
return ip6t_do_table(skb, ops->hooknum, state,
state->net->ipv6.ip6table_nat);
}
static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,

5
net/ipv6/netfilter/ip6table_raw.c
View File

@ -22,9 +22,8 @@ static unsigned int
ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
const struct net *net = dev_net(state->in ? state->in : state->out);
return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_raw);
return ip6t_do_table(skb, ops->hooknum, state,
state->net->ipv6.ip6table_raw);
}
static struct nf_hook_ops *rawtable_ops __read_mostly;

4
net/ipv6/netfilter/ip6table_security.c
View File

@ -39,10 +39,8 @@ static unsigned int
ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
const struct nf_hook_state *state)
{
const struct net *net = dev_net(state->in ? state->in : state->out);
return ip6t_do_table(skb, ops->hooknum, state,
net->ipv6.ip6table_security);
state->net->ipv6.ip6table_security);
}
static struct nf_hook_ops *sectbl_ops __read_mostly;

4
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
View File

@ -169,7 +169,7 @@ static unsigned int ipv6_conntrack_in(const struct nf_hook_ops *ops,
struct sk_buff *skb,
const struct nf_hook_state *state)
{
return nf_conntrack_in(dev_net(state->in), PF_INET6, ops->hooknum, skb);
return nf_conntrack_in(state->net, PF_INET6, ops->hooknum, skb);
}
static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,
@ -181,7 +181,7 @@ static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,
net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
return NF_ACCEPT;
}
return nf_conntrack_in(dev_net(state->out), PF_INET6, ops->hooknum, skb);
return nf_conntrack_in(state->net, PF_INET6, ops->hooknum, skb);
}
static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {

3
net/netfilter/nfnetlink_queue_core.c
View File

@ -670,8 +670,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
struct nfqnl_instance *queue;
struct sk_buff *skb, *segs;
int err = -ENOBUFS;
struct net *net = dev_net(entry->state.in ?
entry->state.in : entry->state.out);
struct net *net = entry->state.net;
struct nfnl_queue_net *q = nfnl_queue_pernet(net);
/* rcu_read_lock()ed by nf_hook_slow() */