diff options
Diffstat (limited to 'net/ipv6')
-rw-r--r-- | net/ipv6/netfilter/ip6_tables.c | 13 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6table_filter.c | 3 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6table_mangle.c | 12 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6table_nat.c | 3 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6table_raw.c | 3 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6table_security.c | 2 |
6 files changed, 16 insertions, 20 deletions
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 83f59dc3cccc..1a732a1d3c8e 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c | |||
@@ -317,8 +317,7 @@ ip6t_next_entry(const struct ip6t_entry *entry) | |||
317 | unsigned int | 317 | unsigned int |
318 | ip6t_do_table(struct sk_buff *skb, | 318 | ip6t_do_table(struct sk_buff *skb, |
319 | unsigned int hook, | 319 | unsigned int hook, |
320 | const struct net_device *in, | 320 | const struct nf_hook_state *state, |
321 | const struct net_device *out, | ||
322 | struct xt_table *table) | 321 | struct xt_table *table) |
323 | { | 322 | { |
324 | static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); | 323 | static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); |
@@ -333,8 +332,8 @@ ip6t_do_table(struct sk_buff *skb, | |||
333 | unsigned int addend; | 332 | unsigned int addend; |
334 | 333 | ||
335 | /* Initialization */ | 334 | /* Initialization */ |
336 | indev = in ? in->name : nulldevname; | 335 | indev = state->in ? state->in->name : nulldevname; |
337 | outdev = out ? out->name : nulldevname; | 336 | outdev = state->out ? state->out->name : nulldevname; |
338 | /* We handle fragments by dealing with the first fragment as | 337 | /* We handle fragments by dealing with the first fragment as |
339 | * if it was a normal packet. All other fragments are treated | 338 | * if it was a normal packet. All other fragments are treated |
340 | * normally, except that they will NEVER match rules that ask | 339 | * normally, except that they will NEVER match rules that ask |
@@ -342,8 +341,8 @@ ip6t_do_table(struct sk_buff *skb, | |||
342 | * rule is also a fragment-specific rule, non-fragments won't | 341 | * rule is also a fragment-specific rule, non-fragments won't |
343 | * match it. */ | 342 | * match it. */ |
344 | acpar.hotdrop = false; | 343 | acpar.hotdrop = false; |
345 | acpar.in = in; | 344 | acpar.in = state->in; |
346 | acpar.out = out; | 345 | acpar.out = state->out; |
347 | acpar.family = NFPROTO_IPV6; | 346 | acpar.family = NFPROTO_IPV6; |
348 | acpar.hooknum = hook; | 347 | acpar.hooknum = hook; |
349 | 348 | ||
@@ -393,7 +392,7 @@ ip6t_do_table(struct sk_buff *skb, | |||
393 | #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) | 392 | #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) |
394 | /* The packet is traced: log it */ | 393 | /* The packet is traced: log it */ |
395 | if (unlikely(skb->nf_trace)) | 394 | if (unlikely(skb->nf_trace)) |
396 | trace_packet(skb, hook, in, out, | 395 | trace_packet(skb, hook, state->in, state->out, |
397 | table->name, private, e); | 396 | table->name, private, e); |
398 | #endif | 397 | #endif |
399 | /* Standard target? */ | 398 | /* Standard target? */ |
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c index eb9ef093454f..5c33d8abc077 100644 --- a/net/ipv6/netfilter/ip6table_filter.c +++ b/net/ipv6/netfilter/ip6table_filter.c | |||
@@ -37,8 +37,7 @@ ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, | |||
37 | { | 37 | { |
38 | const struct net *net = dev_net(state->in ? state->in : state->out); | 38 | const struct net *net = dev_net(state->in ? state->in : state->out); |
39 | 39 | ||
40 | return ip6t_do_table(skb, ops->hooknum, state->in, state->out, | 40 | return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_filter); |
41 | net->ipv6.ip6table_filter); | ||
42 | } | 41 | } |
43 | 42 | ||
44 | static struct nf_hook_ops *filter_ops __read_mostly; | 43 | static struct nf_hook_ops *filter_ops __read_mostly; |
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c index e713b8d3dbbc..b551f5b79fe2 100644 --- a/net/ipv6/netfilter/ip6table_mangle.c +++ b/net/ipv6/netfilter/ip6table_mangle.c | |||
@@ -32,7 +32,7 @@ static const struct xt_table packet_mangler = { | |||
32 | }; | 32 | }; |
33 | 33 | ||
34 | static unsigned int | 34 | static unsigned int |
35 | ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out) | 35 | ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) |
36 | { | 36 | { |
37 | unsigned int ret; | 37 | unsigned int ret; |
38 | struct in6_addr saddr, daddr; | 38 | struct in6_addr saddr, daddr; |
@@ -57,8 +57,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out) | |||
57 | /* flowlabel and prio (includes version, which shouldn't change either */ | 57 | /* flowlabel and prio (includes version, which shouldn't change either */ |
58 | flowlabel = *((u_int32_t *)ipv6_hdr(skb)); | 58 | flowlabel = *((u_int32_t *)ipv6_hdr(skb)); |
59 | 59 | ||
60 | ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, NULL, out, | 60 | ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, state, |
61 | dev_net(out)->ipv6.ip6table_mangle); | 61 | dev_net(state->out)->ipv6.ip6table_mangle); |
62 | 62 | ||
63 | if (ret != NF_DROP && ret != NF_STOLEN && | 63 | if (ret != NF_DROP && ret != NF_STOLEN && |
64 | (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) || | 64 | (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) || |
@@ -80,12 +80,12 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, | |||
80 | const struct nf_hook_state *state) | 80 | const struct nf_hook_state *state) |
81 | { | 81 | { |
82 | if (ops->hooknum == NF_INET_LOCAL_OUT) | 82 | if (ops->hooknum == NF_INET_LOCAL_OUT) |
83 | return ip6t_mangle_out(skb, state->out); | 83 | return ip6t_mangle_out(skb, state); |
84 | if (ops->hooknum == NF_INET_POST_ROUTING) | 84 | if (ops->hooknum == NF_INET_POST_ROUTING) |
85 | return ip6t_do_table(skb, ops->hooknum, state->in, state->out, | 85 | return ip6t_do_table(skb, ops->hooknum, state, |
86 | dev_net(state->out)->ipv6.ip6table_mangle); | 86 | dev_net(state->out)->ipv6.ip6table_mangle); |
87 | /* INPUT/FORWARD */ | 87 | /* INPUT/FORWARD */ |
88 | return ip6t_do_table(skb, ops->hooknum, state->in, state->out, | 88 | return ip6t_do_table(skb, ops->hooknum, state, |
89 | dev_net(state->in)->ipv6.ip6table_mangle); | 89 | dev_net(state->in)->ipv6.ip6table_mangle); |
90 | } | 90 | } |
91 | 91 | ||
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c index d78f69c7abce..c3a7f7af0ed4 100644 --- a/net/ipv6/netfilter/ip6table_nat.c +++ b/net/ipv6/netfilter/ip6table_nat.c | |||
@@ -37,8 +37,7 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops, | |||
37 | { | 37 | { |
38 | struct net *net = nf_ct_net(ct); | 38 | struct net *net = nf_ct_net(ct); |
39 | 39 | ||
40 | return ip6t_do_table(skb, ops->hooknum, state->in, state->out, | 40 | return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_nat); |
41 | net->ipv6.ip6table_nat); | ||
42 | } | 41 | } |
43 | 42 | ||
44 | static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops, | 43 | static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops, |
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c index 937908e25862..0b33caad2b69 100644 --- a/net/ipv6/netfilter/ip6table_raw.c +++ b/net/ipv6/netfilter/ip6table_raw.c | |||
@@ -24,8 +24,7 @@ ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, | |||
24 | { | 24 | { |
25 | const struct net *net = dev_net(state->in ? state->in : state->out); | 25 | const struct net *net = dev_net(state->in ? state->in : state->out); |
26 | 26 | ||
27 | return ip6t_do_table(skb, ops->hooknum, state->in, state->out, | 27 | return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_raw); |
28 | net->ipv6.ip6table_raw); | ||
29 | } | 28 | } |
30 | 29 | ||
31 | static struct nf_hook_ops *rawtable_ops __read_mostly; | 30 | static struct nf_hook_ops *rawtable_ops __read_mostly; |
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c index f33b41e8e294..fcef83c25f7b 100644 --- a/net/ipv6/netfilter/ip6table_security.c +++ b/net/ipv6/netfilter/ip6table_security.c | |||
@@ -41,7 +41,7 @@ ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, | |||
41 | { | 41 | { |
42 | const struct net *net = dev_net(state->in ? state->in : state->out); | 42 | const struct net *net = dev_net(state->in ? state->in : state->out); |
43 | 43 | ||
44 | return ip6t_do_table(skb, ops->hooknum, state->in, state->out, | 44 | return ip6t_do_table(skb, ops->hooknum, state, |
45 | net->ipv6.ip6table_security); | 45 | net->ipv6.ip6table_security); |
46 | } | 46 | } |
47 | 47 | ||