diff options
author | Patrick McHardy <kaber@trash.net> | 2013-10-10 03:21:55 -0400 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-10-14 05:29:31 -0400 |
commit | 795aa6ef6a1aba99050735eadd0c2341b789b53b (patch) | |
tree | ba3b0ee0dadcb55962b596342d5897b02db1d234 /net/ipv4 | |
parent | ccdbb6e96beca362db876d820ac1e560ff6d9579 (diff) |
netfilter: pass hook ops to hookfn
Pass the hook ops to the hookfn to allow for generic hook
functions. This change is required by nf_tables.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4')
-rw-r--r-- | net/ipv4/netfilter/arptable_filter.c | 5 | ||||
-rw-r--r-- | net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 | ||||
-rw-r--r-- | net/ipv4/netfilter/ipt_SYNPROXY.c | 2 | ||||
-rw-r--r-- | net/ipv4/netfilter/iptable_filter.c | 7 | ||||
-rw-r--r-- | net/ipv4/netfilter/iptable_mangle.c | 10 | ||||
-rw-r--r-- | net/ipv4/netfilter/iptable_nat.c | 26 | ||||
-rw-r--r-- | net/ipv4/netfilter/iptable_raw.c | 6 | ||||
-rw-r--r-- | net/ipv4/netfilter/iptable_security.c | 7 | ||||
-rw-r--r-- | net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 12 | ||||
-rw-r--r-- | net/ipv4/netfilter/nf_defrag_ipv4.c | 6 |
10 files changed, 44 insertions, 39 deletions
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c index a865f6f94013..802ddecb30b8 100644 --- a/net/ipv4/netfilter/arptable_filter.c +++ b/net/ipv4/netfilter/arptable_filter.c | |||
@@ -27,13 +27,14 @@ static const struct xt_table packet_filter = { | |||
27 | 27 | ||
28 | /* The work comes in here from netfilter.c */ | 28 | /* The work comes in here from netfilter.c */ |
29 | static unsigned int | 29 | static unsigned int |
30 | arptable_filter_hook(unsigned int hook, struct sk_buff *skb, | 30 | arptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, |
31 | const struct net_device *in, const struct net_device *out, | 31 | const struct net_device *in, const struct net_device *out, |
32 | int (*okfn)(struct sk_buff *)) | 32 | int (*okfn)(struct sk_buff *)) |
33 | { | 33 | { |
34 | const struct net *net = dev_net((in != NULL) ? in : out); | 34 | const struct net *net = dev_net((in != NULL) ? in : out); |
35 | 35 | ||
36 | return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter); | 36 | return arpt_do_table(skb, ops->hooknum, in, out, |
37 | net->ipv4.arptable_filter); | ||
37 | } | 38 | } |
38 | 39 | ||
39 | static struct nf_hook_ops *arpfilter_ops __read_mostly; | 40 | static struct nf_hook_ops *arpfilter_ops __read_mostly; |
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c index 0b732efd32e2..a2e2b61cd7da 100644 --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c | |||
@@ -483,7 +483,7 @@ static void arp_print(struct arp_payload *payload) | |||
483 | #endif | 483 | #endif |
484 | 484 | ||
485 | static unsigned int | 485 | static unsigned int |
486 | arp_mangle(unsigned int hook, | 486 | arp_mangle(const struct nf_hook_ops *ops, |
487 | struct sk_buff *skb, | 487 | struct sk_buff *skb, |
488 | const struct net_device *in, | 488 | const struct net_device *in, |
489 | const struct net_device *out, | 489 | const struct net_device *out, |
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c index b6346bf2fde3..01cffeaa0085 100644 --- a/net/ipv4/netfilter/ipt_SYNPROXY.c +++ b/net/ipv4/netfilter/ipt_SYNPROXY.c | |||
@@ -297,7 +297,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) | |||
297 | return XT_CONTINUE; | 297 | return XT_CONTINUE; |
298 | } | 298 | } |
299 | 299 | ||
300 | static unsigned int ipv4_synproxy_hook(unsigned int hooknum, | 300 | static unsigned int ipv4_synproxy_hook(const struct nf_hook_ops *ops, |
301 | struct sk_buff *skb, | 301 | struct sk_buff *skb, |
302 | const struct net_device *in, | 302 | const struct net_device *in, |
303 | const struct net_device *out, | 303 | const struct net_device *out, |
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c index 50af5b45c050..e08a74a243a8 100644 --- a/net/ipv4/netfilter/iptable_filter.c +++ b/net/ipv4/netfilter/iptable_filter.c | |||
@@ -33,20 +33,21 @@ static const struct xt_table packet_filter = { | |||
33 | }; | 33 | }; |
34 | 34 | ||
35 | static unsigned int | 35 | static unsigned int |
36 | iptable_filter_hook(unsigned int hook, struct sk_buff *skb, | 36 | iptable_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, |
37 | const struct net_device *in, const struct net_device *out, | 37 | const struct net_device *in, const struct net_device *out, |
38 | int (*okfn)(struct sk_buff *)) | 38 | int (*okfn)(struct sk_buff *)) |
39 | { | 39 | { |
40 | const struct net *net; | 40 | const struct net *net; |
41 | 41 | ||
42 | if (hook == NF_INET_LOCAL_OUT && | 42 | if (ops->hooknum == NF_INET_LOCAL_OUT && |
43 | (skb->len < sizeof(struct iphdr) || | 43 | (skb->len < sizeof(struct iphdr) || |
44 | ip_hdrlen(skb) < sizeof(struct iphdr))) | 44 | ip_hdrlen(skb) < sizeof(struct iphdr))) |
45 | /* root is playing with raw sockets. */ | 45 | /* root is playing with raw sockets. */ |
46 | return NF_ACCEPT; | 46 | return NF_ACCEPT; |
47 | 47 | ||
48 | net = dev_net((in != NULL) ? in : out); | 48 | net = dev_net((in != NULL) ? in : out); |
49 | return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter); | 49 | return ipt_do_table(skb, ops->hooknum, in, out, |
50 | net->ipv4.iptable_filter); | ||
50 | } | 51 | } |
51 | 52 | ||
52 | static struct nf_hook_ops *filter_ops __read_mostly; | 53 | static struct nf_hook_ops *filter_ops __read_mostly; |
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c index 0d8cd82e0fad..6a5079c34bb3 100644 --- a/net/ipv4/netfilter/iptable_mangle.c +++ b/net/ipv4/netfilter/iptable_mangle.c | |||
@@ -79,19 +79,19 @@ ipt_mangle_out(struct sk_buff *skb, const struct net_device *out) | |||
79 | 79 | ||
80 | /* The work comes in here from netfilter.c. */ | 80 | /* The work comes in here from netfilter.c. */ |
81 | static unsigned int | 81 | static unsigned int |
82 | iptable_mangle_hook(unsigned int hook, | 82 | iptable_mangle_hook(const struct nf_hook_ops *ops, |
83 | struct sk_buff *skb, | 83 | struct sk_buff *skb, |
84 | const struct net_device *in, | 84 | const struct net_device *in, |
85 | const struct net_device *out, | 85 | const struct net_device *out, |
86 | int (*okfn)(struct sk_buff *)) | 86 | int (*okfn)(struct sk_buff *)) |
87 | { | 87 | { |
88 | if (hook == NF_INET_LOCAL_OUT) | 88 | if (ops->hooknum == NF_INET_LOCAL_OUT) |
89 | return ipt_mangle_out(skb, out); | 89 | return ipt_mangle_out(skb, out); |
90 | if (hook == NF_INET_POST_ROUTING) | 90 | if (ops->hooknum == NF_INET_POST_ROUTING) |
91 | return ipt_do_table(skb, hook, in, out, | 91 | return ipt_do_table(skb, ops->hooknum, in, out, |
92 | dev_net(out)->ipv4.iptable_mangle); | 92 | dev_net(out)->ipv4.iptable_mangle); |
93 | /* PREROUTING/INPUT/FORWARD: */ | 93 | /* PREROUTING/INPUT/FORWARD: */ |
94 | return ipt_do_table(skb, hook, in, out, | 94 | return ipt_do_table(skb, ops->hooknum, in, out, |
95 | dev_net(in)->ipv4.iptable_mangle); | 95 | dev_net(in)->ipv4.iptable_mangle); |
96 | } | 96 | } |
97 | 97 | ||
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c index 683bfaffed65..ee2886126e3d 100644 --- a/net/ipv4/netfilter/iptable_nat.c +++ b/net/ipv4/netfilter/iptable_nat.c | |||
@@ -61,7 +61,7 @@ static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum, | |||
61 | } | 61 | } |
62 | 62 | ||
63 | static unsigned int | 63 | static unsigned int |
64 | nf_nat_ipv4_fn(unsigned int hooknum, | 64 | nf_nat_ipv4_fn(const struct nf_hook_ops *ops, |
65 | struct sk_buff *skb, | 65 | struct sk_buff *skb, |
66 | const struct net_device *in, | 66 | const struct net_device *in, |
67 | const struct net_device *out, | 67 | const struct net_device *out, |
@@ -71,7 +71,7 @@ nf_nat_ipv4_fn(unsigned int hooknum, | |||
71 | enum ip_conntrack_info ctinfo; | 71 | enum ip_conntrack_info ctinfo; |
72 | struct nf_conn_nat *nat; | 72 | struct nf_conn_nat *nat; |
73 | /* maniptype == SRC for postrouting. */ | 73 | /* maniptype == SRC for postrouting. */ |
74 | enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum); | 74 | enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum); |
75 | 75 | ||
76 | /* We never see fragments: conntrack defrags on pre-routing | 76 | /* We never see fragments: conntrack defrags on pre-routing |
77 | * and local-out, and nf_nat_out protects post-routing. | 77 | * and local-out, and nf_nat_out protects post-routing. |
@@ -108,7 +108,7 @@ nf_nat_ipv4_fn(unsigned int hooknum, | |||
108 | case IP_CT_RELATED_REPLY: | 108 | case IP_CT_RELATED_REPLY: |
109 | if (ip_hdr(skb)->protocol == IPPROTO_ICMP) { | 109 | if (ip_hdr(skb)->protocol == IPPROTO_ICMP) { |
110 | if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, | 110 | if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, |
111 | hooknum)) | 111 | ops->hooknum)) |
112 | return NF_DROP; | 112 | return NF_DROP; |
113 | else | 113 | else |
114 | return NF_ACCEPT; | 114 | return NF_ACCEPT; |
@@ -121,14 +121,14 @@ nf_nat_ipv4_fn(unsigned int hooknum, | |||
121 | if (!nf_nat_initialized(ct, maniptype)) { | 121 | if (!nf_nat_initialized(ct, maniptype)) { |
122 | unsigned int ret; | 122 | unsigned int ret; |
123 | 123 | ||
124 | ret = nf_nat_rule_find(skb, hooknum, in, out, ct); | 124 | ret = nf_nat_rule_find(skb, ops->hooknum, in, out, ct); |
125 | if (ret != NF_ACCEPT) | 125 | if (ret != NF_ACCEPT) |
126 | return ret; | 126 | return ret; |
127 | } else { | 127 | } else { |
128 | pr_debug("Already setup manip %s for ct %p\n", | 128 | pr_debug("Already setup manip %s for ct %p\n", |
129 | maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST", | 129 | maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST", |
130 | ct); | 130 | ct); |
131 | if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) | 131 | if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out)) |
132 | goto oif_changed; | 132 | goto oif_changed; |
133 | } | 133 | } |
134 | break; | 134 | break; |
@@ -137,11 +137,11 @@ nf_nat_ipv4_fn(unsigned int hooknum, | |||
137 | /* ESTABLISHED */ | 137 | /* ESTABLISHED */ |
138 | NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED || | 138 | NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED || |
139 | ctinfo == IP_CT_ESTABLISHED_REPLY); | 139 | ctinfo == IP_CT_ESTABLISHED_REPLY); |
140 | if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) | 140 | if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out)) |
141 | goto oif_changed; | 141 | goto oif_changed; |
142 | } | 142 | } |
143 | 143 | ||
144 | return nf_nat_packet(ct, ctinfo, hooknum, skb); | 144 | return nf_nat_packet(ct, ctinfo, ops->hooknum, skb); |
145 | 145 | ||
146 | oif_changed: | 146 | oif_changed: |
147 | nf_ct_kill_acct(ct, ctinfo, skb); | 147 | nf_ct_kill_acct(ct, ctinfo, skb); |
@@ -149,7 +149,7 @@ oif_changed: | |||
149 | } | 149 | } |
150 | 150 | ||
151 | static unsigned int | 151 | static unsigned int |
152 | nf_nat_ipv4_in(unsigned int hooknum, | 152 | nf_nat_ipv4_in(const struct nf_hook_ops *ops, |
153 | struct sk_buff *skb, | 153 | struct sk_buff *skb, |
154 | const struct net_device *in, | 154 | const struct net_device *in, |
155 | const struct net_device *out, | 155 | const struct net_device *out, |
@@ -158,7 +158,7 @@ nf_nat_ipv4_in(unsigned int hooknum, | |||
158 | unsigned int ret; | 158 | unsigned int ret; |
159 | __be32 daddr = ip_hdr(skb)->daddr; | 159 | __be32 daddr = ip_hdr(skb)->daddr; |
160 | 160 | ||
161 | ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn); | 161 | ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn); |
162 | if (ret != NF_DROP && ret != NF_STOLEN && | 162 | if (ret != NF_DROP && ret != NF_STOLEN && |
163 | daddr != ip_hdr(skb)->daddr) | 163 | daddr != ip_hdr(skb)->daddr) |
164 | skb_dst_drop(skb); | 164 | skb_dst_drop(skb); |
@@ -167,7 +167,7 @@ nf_nat_ipv4_in(unsigned int hooknum, | |||
167 | } | 167 | } |
168 | 168 | ||
169 | static unsigned int | 169 | static unsigned int |
170 | nf_nat_ipv4_out(unsigned int hooknum, | 170 | nf_nat_ipv4_out(const struct nf_hook_ops *ops, |
171 | struct sk_buff *skb, | 171 | struct sk_buff *skb, |
172 | const struct net_device *in, | 172 | const struct net_device *in, |
173 | const struct net_device *out, | 173 | const struct net_device *out, |
@@ -185,7 +185,7 @@ nf_nat_ipv4_out(unsigned int hooknum, | |||
185 | ip_hdrlen(skb) < sizeof(struct iphdr)) | 185 | ip_hdrlen(skb) < sizeof(struct iphdr)) |
186 | return NF_ACCEPT; | 186 | return NF_ACCEPT; |
187 | 187 | ||
188 | ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn); | 188 | ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn); |
189 | #ifdef CONFIG_XFRM | 189 | #ifdef CONFIG_XFRM |
190 | if (ret != NF_DROP && ret != NF_STOLEN && | 190 | if (ret != NF_DROP && ret != NF_STOLEN && |
191 | !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && | 191 | !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && |
@@ -207,7 +207,7 @@ nf_nat_ipv4_out(unsigned int hooknum, | |||
207 | } | 207 | } |
208 | 208 | ||
209 | static unsigned int | 209 | static unsigned int |
210 | nf_nat_ipv4_local_fn(unsigned int hooknum, | 210 | nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, |
211 | struct sk_buff *skb, | 211 | struct sk_buff *skb, |
212 | const struct net_device *in, | 212 | const struct net_device *in, |
213 | const struct net_device *out, | 213 | const struct net_device *out, |
@@ -223,7 +223,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum, | |||
223 | ip_hdrlen(skb) < sizeof(struct iphdr)) | 223 | ip_hdrlen(skb) < sizeof(struct iphdr)) |
224 | return NF_ACCEPT; | 224 | return NF_ACCEPT; |
225 | 225 | ||
226 | ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn); | 226 | ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn); |
227 | if (ret != NF_DROP && ret != NF_STOLEN && | 227 | if (ret != NF_DROP && ret != NF_STOLEN && |
228 | (ct = nf_ct_get(skb, &ctinfo)) != NULL) { | 228 | (ct = nf_ct_get(skb, &ctinfo)) != NULL) { |
229 | enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); | 229 | enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); |
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c index 1f82aea11df6..b2f7e8f98316 100644 --- a/net/ipv4/netfilter/iptable_raw.c +++ b/net/ipv4/netfilter/iptable_raw.c | |||
@@ -20,20 +20,20 @@ static const struct xt_table packet_raw = { | |||
20 | 20 | ||
21 | /* The work comes in here from netfilter.c. */ | 21 | /* The work comes in here from netfilter.c. */ |
22 | static unsigned int | 22 | static unsigned int |
23 | iptable_raw_hook(unsigned int hook, struct sk_buff *skb, | 23 | iptable_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, |
24 | const struct net_device *in, const struct net_device *out, | 24 | const struct net_device *in, const struct net_device *out, |
25 | int (*okfn)(struct sk_buff *)) | 25 | int (*okfn)(struct sk_buff *)) |
26 | { | 26 | { |
27 | const struct net *net; | 27 | const struct net *net; |
28 | 28 | ||
29 | if (hook == NF_INET_LOCAL_OUT && | 29 | if (ops->hooknum == NF_INET_LOCAL_OUT && |
30 | (skb->len < sizeof(struct iphdr) || | 30 | (skb->len < sizeof(struct iphdr) || |
31 | ip_hdrlen(skb) < sizeof(struct iphdr))) | 31 | ip_hdrlen(skb) < sizeof(struct iphdr))) |
32 | /* root is playing with raw sockets. */ | 32 | /* root is playing with raw sockets. */ |
33 | return NF_ACCEPT; | 33 | return NF_ACCEPT; |
34 | 34 | ||
35 | net = dev_net((in != NULL) ? in : out); | 35 | net = dev_net((in != NULL) ? in : out); |
36 | return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw); | 36 | return ipt_do_table(skb, ops->hooknum, in, out, net->ipv4.iptable_raw); |
37 | } | 37 | } |
38 | 38 | ||
39 | static struct nf_hook_ops *rawtable_ops __read_mostly; | 39 | static struct nf_hook_ops *rawtable_ops __read_mostly; |
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c index f867a8d38bf7..c86647ed2078 100644 --- a/net/ipv4/netfilter/iptable_security.c +++ b/net/ipv4/netfilter/iptable_security.c | |||
@@ -37,21 +37,22 @@ static const struct xt_table security_table = { | |||
37 | }; | 37 | }; |
38 | 38 | ||
39 | static unsigned int | 39 | static unsigned int |
40 | iptable_security_hook(unsigned int hook, struct sk_buff *skb, | 40 | iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, |
41 | const struct net_device *in, | 41 | const struct net_device *in, |
42 | const struct net_device *out, | 42 | const struct net_device *out, |
43 | int (*okfn)(struct sk_buff *)) | 43 | int (*okfn)(struct sk_buff *)) |
44 | { | 44 | { |
45 | const struct net *net; | 45 | const struct net *net; |
46 | 46 | ||
47 | if (hook == NF_INET_LOCAL_OUT && | 47 | if (ops->hooknum == NF_INET_LOCAL_OUT && |
48 | (skb->len < sizeof(struct iphdr) || | 48 | (skb->len < sizeof(struct iphdr) || |
49 | ip_hdrlen(skb) < sizeof(struct iphdr))) | 49 | ip_hdrlen(skb) < sizeof(struct iphdr))) |
50 | /* Somebody is playing with raw sockets. */ | 50 | /* Somebody is playing with raw sockets. */ |
51 | return NF_ACCEPT; | 51 | return NF_ACCEPT; |
52 | 52 | ||
53 | net = dev_net((in != NULL) ? in : out); | 53 | net = dev_net((in != NULL) ? in : out); |
54 | return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security); | 54 | return ipt_do_table(skb, ops->hooknum, in, out, |
55 | net->ipv4.iptable_security); | ||
55 | } | 56 | } |
56 | 57 | ||
57 | static struct nf_hook_ops *sectbl_ops __read_mostly; | 58 | static struct nf_hook_ops *sectbl_ops __read_mostly; |
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index 86f5b34a4ed1..ecd8bec411c9 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | |||
@@ -92,7 +92,7 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, | |||
92 | return NF_ACCEPT; | 92 | return NF_ACCEPT; |
93 | } | 93 | } |
94 | 94 | ||
95 | static unsigned int ipv4_helper(unsigned int hooknum, | 95 | static unsigned int ipv4_helper(const struct nf_hook_ops *ops, |
96 | struct sk_buff *skb, | 96 | struct sk_buff *skb, |
97 | const struct net_device *in, | 97 | const struct net_device *in, |
98 | const struct net_device *out, | 98 | const struct net_device *out, |
@@ -121,7 +121,7 @@ static unsigned int ipv4_helper(unsigned int hooknum, | |||
121 | ct, ctinfo); | 121 | ct, ctinfo); |
122 | } | 122 | } |
123 | 123 | ||
124 | static unsigned int ipv4_confirm(unsigned int hooknum, | 124 | static unsigned int ipv4_confirm(const struct nf_hook_ops *ops, |
125 | struct sk_buff *skb, | 125 | struct sk_buff *skb, |
126 | const struct net_device *in, | 126 | const struct net_device *in, |
127 | const struct net_device *out, | 127 | const struct net_device *out, |
@@ -147,16 +147,16 @@ out: | |||
147 | return nf_conntrack_confirm(skb); | 147 | return nf_conntrack_confirm(skb); |
148 | } | 148 | } |
149 | 149 | ||
150 | static unsigned int ipv4_conntrack_in(unsigned int hooknum, | 150 | static unsigned int ipv4_conntrack_in(const struct nf_hook_ops *ops, |
151 | struct sk_buff *skb, | 151 | struct sk_buff *skb, |
152 | const struct net_device *in, | 152 | const struct net_device *in, |
153 | const struct net_device *out, | 153 | const struct net_device *out, |
154 | int (*okfn)(struct sk_buff *)) | 154 | int (*okfn)(struct sk_buff *)) |
155 | { | 155 | { |
156 | return nf_conntrack_in(dev_net(in), PF_INET, hooknum, skb); | 156 | return nf_conntrack_in(dev_net(in), PF_INET, ops->hooknum, skb); |
157 | } | 157 | } |
158 | 158 | ||
159 | static unsigned int ipv4_conntrack_local(unsigned int hooknum, | 159 | static unsigned int ipv4_conntrack_local(const struct nf_hook_ops *ops, |
160 | struct sk_buff *skb, | 160 | struct sk_buff *skb, |
161 | const struct net_device *in, | 161 | const struct net_device *in, |
162 | const struct net_device *out, | 162 | const struct net_device *out, |
@@ -166,7 +166,7 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum, | |||
166 | if (skb->len < sizeof(struct iphdr) || | 166 | if (skb->len < sizeof(struct iphdr) || |
167 | ip_hdrlen(skb) < sizeof(struct iphdr)) | 167 | ip_hdrlen(skb) < sizeof(struct iphdr)) |
168 | return NF_ACCEPT; | 168 | return NF_ACCEPT; |
169 | return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb); | 169 | return nf_conntrack_in(dev_net(out), PF_INET, ops->hooknum, skb); |
170 | } | 170 | } |
171 | 171 | ||
172 | /* Connection tracking may drop packets, but never alters them, so | 172 | /* Connection tracking may drop packets, but never alters them, so |
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index 742815518b0f..12e13bd82b5b 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c | |||
@@ -60,7 +60,7 @@ static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum, | |||
60 | return IP_DEFRAG_CONNTRACK_OUT + zone; | 60 | return IP_DEFRAG_CONNTRACK_OUT + zone; |
61 | } | 61 | } |
62 | 62 | ||
63 | static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, | 63 | static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops, |
64 | struct sk_buff *skb, | 64 | struct sk_buff *skb, |
65 | const struct net_device *in, | 65 | const struct net_device *in, |
66 | const struct net_device *out, | 66 | const struct net_device *out, |
@@ -83,7 +83,9 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, | |||
83 | #endif | 83 | #endif |
84 | /* Gather fragments. */ | 84 | /* Gather fragments. */ |
85 | if (ip_is_fragment(ip_hdr(skb))) { | 85 | if (ip_is_fragment(ip_hdr(skb))) { |
86 | enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb); | 86 | enum ip_defrag_users user = |
87 | nf_ct_defrag_user(ops->hooknum, skb); | ||
88 | |||
87 | if (nf_ct_ipv4_gather_frags(skb, user)) | 89 | if (nf_ct_ipv4_gather_frags(skb, user)) |
88 | return NF_STOLEN; | 90 | return NF_STOLEN; |
89 | } | 91 | } |