diff options
author | Jan Engelhardt <jengelh@medozas.de> | 2008-10-08 05:35:18 -0400 |
---|---|---|
committer | Patrick McHardy <kaber@trash.net> | 2008-10-08 05:35:18 -0400 |
commit | f7108a20dee44e5bb037f9e48f6a207b42e6ae1c (patch) | |
tree | bfc741548cdf416a59a89d89a20ba2cbdc8e988e /net/ipv6/netfilter/ip6_tables.c | |
parent | c2df73de246ae75705af8ceed4f385b261dea108 (diff) |
netfilter: xtables: move extension arguments into compound structure (1/6)
The function signatures for Xtables extensions have grown over time.
It involves a lot of typing/replication, and also a bit of stack space
even if they are not used. Realize an NFWS2008 idea and pack them into
structs. The skb remains outside of the struct so gcc can continue to
apply its optimizations.
This patch does this for match extensions' match functions.
A few ambiguities have also been addressed. The "offset" parameter for
example has been renamed to "fragoff" (there are so many different
offsets already) and "protoff" to "thoff" (there is more than just one
protocol here, so clarify).
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/ipv6/netfilter/ip6_tables.c')
-rw-r--r-- | net/ipv6/netfilter/ip6_tables.c | 44 |
1 files changed, 17 insertions, 27 deletions
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 12c41b8d365..cf2c5370a4e 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c | |||
@@ -215,17 +215,14 @@ ip6t_error(struct sk_buff *skb, | |||
215 | 215 | ||
216 | /* Performance critical - called for every packet */ | 216 | /* Performance critical - called for every packet */ |
217 | static inline bool | 217 | static inline bool |
218 | do_match(struct ip6t_entry_match *m, | 218 | do_match(struct ip6t_entry_match *m, const struct sk_buff *skb, |
219 | const struct sk_buff *skb, | 219 | struct xt_match_param *par) |
220 | const struct net_device *in, | ||
221 | const struct net_device *out, | ||
222 | int offset, | ||
223 | unsigned int protoff, | ||
224 | bool *hotdrop) | ||
225 | { | 220 | { |
221 | par->match = m->u.kernel.match; | ||
222 | par->matchinfo = m->data; | ||
223 | |||
226 | /* Stop iteration if it doesn't match */ | 224 | /* Stop iteration if it doesn't match */ |
227 | if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data, | 225 | if (!m->u.kernel.match->match(skb, par)) |
228 | offset, protoff, hotdrop)) | ||
229 | return true; | 226 | return true; |
230 | else | 227 | else |
231 | return false; | 228 | return false; |
@@ -355,8 +352,6 @@ ip6t_do_table(struct sk_buff *skb, | |||
355 | struct xt_table *table) | 352 | struct xt_table *table) |
356 | { | 353 | { |
357 | static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); | 354 | static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); |
358 | int offset = 0; | ||
359 | unsigned int protoff = 0; | ||
360 | bool hotdrop = false; | 355 | bool hotdrop = false; |
361 | /* Initializing verdict to NF_DROP keeps gcc happy. */ | 356 | /* Initializing verdict to NF_DROP keeps gcc happy. */ |
362 | unsigned int verdict = NF_DROP; | 357 | unsigned int verdict = NF_DROP; |
@@ -364,6 +359,7 @@ ip6t_do_table(struct sk_buff *skb, | |||
364 | void *table_base; | 359 | void *table_base; |
365 | struct ip6t_entry *e, *back; | 360 | struct ip6t_entry *e, *back; |
366 | struct xt_table_info *private; | 361 | struct xt_table_info *private; |
362 | struct xt_match_param mtpar; | ||
367 | 363 | ||
368 | /* Initialization */ | 364 | /* Initialization */ |
369 | indev = in ? in->name : nulldevname; | 365 | indev = in ? in->name : nulldevname; |
@@ -374,6 +370,9 @@ ip6t_do_table(struct sk_buff *skb, | |||
374 | * things we don't know, ie. tcp syn flag or ports). If the | 370 | * things we don't know, ie. tcp syn flag or ports). If the |
375 | * rule is also a fragment-specific rule, non-fragments won't | 371 | * rule is also a fragment-specific rule, non-fragments won't |
376 | * match it. */ | 372 | * match it. */ |
373 | mtpar.hotdrop = &hotdrop; | ||
374 | mtpar.in = in; | ||
375 | mtpar.out = out; | ||
377 | 376 | ||
378 | read_lock_bh(&table->lock); | 377 | read_lock_bh(&table->lock); |
379 | IP_NF_ASSERT(table->valid_hooks & (1 << hook)); | 378 | IP_NF_ASSERT(table->valid_hooks & (1 << hook)); |
@@ -388,12 +387,10 @@ ip6t_do_table(struct sk_buff *skb, | |||
388 | IP_NF_ASSERT(e); | 387 | IP_NF_ASSERT(e); |
389 | IP_NF_ASSERT(back); | 388 | IP_NF_ASSERT(back); |
390 | if (ip6_packet_match(skb, indev, outdev, &e->ipv6, | 389 | if (ip6_packet_match(skb, indev, outdev, &e->ipv6, |
391 | &protoff, &offset, &hotdrop)) { | 390 | &mtpar.thoff, &mtpar.fragoff, &hotdrop)) { |
392 | struct ip6t_entry_target *t; | 391 | struct ip6t_entry_target *t; |
393 | 392 | ||
394 | if (IP6T_MATCH_ITERATE(e, do_match, | 393 | if (IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) |
395 | skb, in, out, | ||
396 | offset, protoff, &hotdrop) != 0) | ||
397 | goto no_match; | 394 | goto no_match; |
398 | 395 | ||
399 | ADD_COUNTER(e->counters, | 396 | ADD_COUNTER(e->counters, |
@@ -2141,30 +2138,23 @@ icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code, | |||
2141 | } | 2138 | } |
2142 | 2139 | ||
2143 | static bool | 2140 | static bool |
2144 | icmp6_match(const struct sk_buff *skb, | 2141 | icmp6_match(const struct sk_buff *skb, const struct xt_match_param *par) |
2145 | const struct net_device *in, | ||
2146 | const struct net_device *out, | ||
2147 | const struct xt_match *match, | ||
2148 | const void *matchinfo, | ||
2149 | int offset, | ||
2150 | unsigned int protoff, | ||
2151 | bool *hotdrop) | ||
2152 | { | 2142 | { |
2153 | const struct icmp6hdr *ic; | 2143 | const struct icmp6hdr *ic; |
2154 | struct icmp6hdr _icmph; | 2144 | struct icmp6hdr _icmph; |
2155 | const struct ip6t_icmp *icmpinfo = matchinfo; | 2145 | const struct ip6t_icmp *icmpinfo = par->matchinfo; |
2156 | 2146 | ||
2157 | /* Must not be a fragment. */ | 2147 | /* Must not be a fragment. */ |
2158 | if (offset) | 2148 | if (par->fragoff != 0) |
2159 | return false; | 2149 | return false; |
2160 | 2150 | ||
2161 | ic = skb_header_pointer(skb, protoff, sizeof(_icmph), &_icmph); | 2151 | ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph); |
2162 | if (ic == NULL) { | 2152 | if (ic == NULL) { |
2163 | /* We've been asked to examine this packet, and we | 2153 | /* We've been asked to examine this packet, and we |
2164 | * can't. Hence, no choice but to drop. | 2154 | * can't. Hence, no choice but to drop. |
2165 | */ | 2155 | */ |
2166 | duprintf("Dropping evil ICMP tinygram.\n"); | 2156 | duprintf("Dropping evil ICMP tinygram.\n"); |
2167 | *hotdrop = true; | 2157 | *par->hotdrop = true; |
2168 | return false; | 2158 | return false; |
2169 | } | 2159 | } |
2170 | 2160 | ||