netfilter: xtables: move extension arguments into compound structure (1/6)

[mirror_ubuntu-bionic-kernel.git] / net / ipv4 / netfilter / ip_tables.c

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 4e7c719445c264c9f55dc00fa1c6ce3d4fc36671..99fdb59454fdd3524a421733c58be4d5ca074915 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -186,16 +186,14 @@ ipt_error(struct sk_buff *skb,
 
 /* Performance critical - called for every packet */
 static inline bool
-do_match(struct ipt_entry_match *m,
-             const struct sk_buff *skb,
-             const struct net_device *in,
-             const struct net_device *out,
-             int offset,
-             bool *hotdrop)
+do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
+        struct xt_match_param *par)
 {
+       par->match     = m->u.kernel.match;
+       par->matchinfo = m->data;
+
        /* Stop iteration if it doesn't match */
-       if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
-                                     offset, ip_hdrlen(skb), hotdrop))
+       if (!m->u.kernel.match->match(skb, par))
                return true;
        else
                return false;
@@ -326,7 +324,6 @@ ipt_do_table(struct sk_buff *skb,
             struct xt_table *table)
 {
        static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
-       u_int16_t offset;
        const struct iphdr *ip;
        u_int16_t datalen;
        bool hotdrop = false;
@@ -336,6 +333,7 @@ ipt_do_table(struct sk_buff *skb,
        void *table_base;
        struct ipt_entry *e, *back;
        struct xt_table_info *private;
+       struct xt_match_param mtpar;
 
        /* Initialization */
        ip = ip_hdr(skb);
@@ -348,7 +346,11 @@ ipt_do_table(struct sk_buff *skb,
         * things we don't know, ie. tcp syn flag or ports).  If the
         * rule is also a fragment-specific rule, non-fragments won't
         * match it. */
-       offset = ntohs(ip->frag_off) & IP_OFFSET;
+       mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
+       mtpar.thoff   = ip_hdrlen(skb);
+       mtpar.hotdrop = &hotdrop;
+       mtpar.in      = in;
+       mtpar.out     = out;
 
        read_lock_bh(&table->lock);
        IP_NF_ASSERT(table->valid_hooks & (1 << hook));
@@ -362,12 +364,11 @@ ipt_do_table(struct sk_buff *skb,
        do {
                IP_NF_ASSERT(e);
                IP_NF_ASSERT(back);
-               if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
+               if (ip_packet_match(ip, indev, outdev,
+                   &e->ip, mtpar.fragoff)) {
                        struct ipt_entry_target *t;
 
-                       if (IPT_MATCH_ITERATE(e, do_match,
-                                             skb, in, out,
-                                             offset, &hotdrop) != 0)
+                       if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
                                goto no_match;
 
                        ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
@@ -616,17 +617,14 @@ check_match(struct ipt_entry_match *m, const char *name,
        match = m->u.kernel.match;
        ret = xt_check_match(match, AF_INET, m->u.match_size - sizeof(*m),
                             name, hookmask, ip->proto,
-                            ip->invflags & IPT_INV_PROTO);
-       if (!ret && m->u.kernel.match->checkentry
-           && !m->u.kernel.match->checkentry(name, ip, match, m->data,
-                                             hookmask)) {
+                            ip->invflags & IPT_INV_PROTO, ip, m->data);
+       if (ret < 0) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         m->u.kernel.match->name);
-               ret = -EINVAL;
+               return ret;
        }
-       if (!ret)
-               (*i)++;
-       return ret;
+       ++*i;
+       return 0;
 }
 
 static int
@@ -668,15 +666,13 @@ static int check_target(struct ipt_entry *e, const char *name)
        target = t->u.kernel.target;
        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
                              name, e->comefrom, e->ip.proto,
-                             e->ip.invflags & IPT_INV_PROTO);
-       if (!ret && t->u.kernel.target->checkentry
-           && !t->u.kernel.target->checkentry(name, e, target, t->data,
-                                              e->comefrom)) {
+                             e->ip.invflags & IPT_INV_PROTO, e, t->data);
+       if (ret < 0) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         t->u.kernel.target->name);
-               ret = -EINVAL;
+               return ret;
        }
-       return ret;
+       return 0;
 }
 
 static int
@@ -2121,30 +2117,23 @@ icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
 }
 
 static bool
-icmp_match(const struct sk_buff *skb,
-          const struct net_device *in,
-          const struct net_device *out,
-          const struct xt_match *match,
-          const void *matchinfo,
-          int offset,
-          unsigned int protoff,
-          bool *hotdrop)
+icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
 {
        const struct icmphdr *ic;
        struct icmphdr _icmph;
-       const struct ipt_icmp *icmpinfo = matchinfo;
+       const struct ipt_icmp *icmpinfo = par->matchinfo;
 
        /* Must not be a fragment. */
-       if (offset)
+       if (par->fragoff != 0)
                return false;
 
-       ic = skb_header_pointer(skb, protoff, sizeof(_icmph), &_icmph);
+       ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
        if (ic == NULL) {
                /* We've been asked to examine this packet, and we
                 * can't.  Hence, no choice but to drop.
                 */
                duprintf("Dropping evil ICMP tinygram.\n");
-               *hotdrop = true;
+               *par->hotdrop = true;
                return false;
        }