Skip to content

Commit

Permalink
netfilter: implement NFPROTO_UNSPEC as a wildcard for extensions
Browse files Browse the repository at this point in the history 
When a match or target is looked up using xt_find_{match,target},
Xtables will also search the NFPROTO_UNSPEC module list. This allows
for protocol-independent extensions (like xt_time) to be reused from
other components (e.g. arptables, ebtables).

Extensions that take different codepaths depending on match->family
or target->family of course cannot use NFPROTO_UNSPEC within the
registration structure (e.g. xt_pkttype).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
  • Loading branch information
Jan Engelhardt authored and Patrick McHardy committed Oct 8, 2008
1 parent ee999d8 commit 55b69e9
Show file tree
Hide file tree
Showing 14 changed files with 124 additions and 269 deletions.
10 changes: 10 additions & 0 deletions net/netfilter/x_tables.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -209,6 +209,11 @@ struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
}
}
mutex_unlock(&xt[af].mutex);

if (af != NFPROTO_UNSPEC)
/* Try searching again in the family-independent list */
return xt_find_match(NFPROTO_UNSPEC, name, revision);

return ERR_PTR(err);
}
EXPORT_SYMBOL(xt_find_match);
Expand All @@ -234,6 +239,11 @@ struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
}
}
mutex_unlock(&xt[af].mutex);

if (af != NFPROTO_UNSPEC)
/* Try searching again in the family-independent list */
return xt_find_target(NFPROTO_UNSPEC, name, revision);

return ERR_PTR(err);
}
EXPORT_SYMBOL(xt_find_target);
Expand Down
38 changes: 12 additions & 26 deletions net/netfilter/xt_CLASSIFY.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,40 +37,26 @@ classify_tg(struct sk_buff *skb, const struct net_device *in,
return XT_CONTINUE;
}

static struct xt_target classify_tg_reg[] __read_mostly = {
{
.family = NFPROTO_IPV4,
.name = "CLASSIFY",
.target = classify_tg,
.targetsize = sizeof(struct xt_classify_target_info),
.table = "mangle",
.hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_INET_FORWARD) |
(1 << NF_INET_POST_ROUTING),
.me = THIS_MODULE,
},
{
.name = "CLASSIFY",
.family = NFPROTO_IPV6,
.target = classify_tg,
.targetsize = sizeof(struct xt_classify_target_info),
.table = "mangle",
.hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_INET_FORWARD) |
(1 << NF_INET_POST_ROUTING),
.me = THIS_MODULE,
},
static struct xt_target classify_tg_reg __read_mostly = {
.name = "CLASSIFY",
.revision = 0,
.family = NFPROTO_UNSPEC,
.table = "mangle",
.hooks = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
(1 << NF_INET_POST_ROUTING),
.target = classify_tg,
.targetsize = sizeof(struct xt_classify_target_info),
.me = THIS_MODULE,
};

static int __init classify_tg_init(void)
{
return xt_register_targets(classify_tg_reg,
ARRAY_SIZE(classify_tg_reg));
return xt_register_target(&classify_tg_reg);
}

static void __exit classify_tg_exit(void)
{
xt_unregister_targets(classify_tg_reg, ARRAY_SIZE(classify_tg_reg));
xt_unregister_target(&classify_tg_reg);
}

module_init(classify_tg_init);
Expand Down
10 changes: 1 addition & 9 deletions net/netfilter/xt_MARK.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -222,15 +222,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = {
{
.name = "MARK",
.revision = 2,
.family = NFPROTO_IPV4,
.target = mark_tg,
.targetsize = sizeof(struct xt_mark_tginfo2),
.me = THIS_MODULE,
},
{
.name = "MARK",
.revision = 2,
.family = NFPROTO_IPV6,
.family = NFPROTO_UNSPEC,
.target = mark_tg,
.targetsize = sizeof(struct xt_mark_tginfo2),
.me = THIS_MODULE,
Expand Down
33 changes: 11 additions & 22 deletions net/netfilter/xt_RATEEST.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -157,25 +157,15 @@ static void xt_rateest_tg_destroy(const struct xt_target *target,
xt_rateest_put(info->est);
}

static struct xt_target xt_rateest_target[] __read_mostly = {
{
.family = NFPROTO_IPV4,
.name = "RATEEST",
.target = xt_rateest_tg,
.checkentry = xt_rateest_tg_checkentry,
.destroy = xt_rateest_tg_destroy,
.targetsize = sizeof(struct xt_rateest_target_info),
.me = THIS_MODULE,
},
{
.family = NFPROTO_IPV6,
.name = "RATEEST",
.target = xt_rateest_tg,
.checkentry = xt_rateest_tg_checkentry,
.destroy = xt_rateest_tg_destroy,
.targetsize = sizeof(struct xt_rateest_target_info),
.me = THIS_MODULE,
},
static struct xt_target xt_rateest_tg_reg __read_mostly = {
.name = "RATEEST",
.revision = 0,
.family = NFPROTO_UNSPEC,
.target = xt_rateest_tg,
.checkentry = xt_rateest_tg_checkentry,
.destroy = xt_rateest_tg_destroy,
.targetsize = sizeof(struct xt_rateest_target_info),
.me = THIS_MODULE,
};

static int __init xt_rateest_tg_init(void)
Expand All @@ -186,13 +176,12 @@ static int __init xt_rateest_tg_init(void)
INIT_HLIST_HEAD(&rateest_hash[i]);

get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));
return xt_register_targets(xt_rateest_target,
ARRAY_SIZE(xt_rateest_target));
return xt_register_target(&xt_rateest_tg_reg);
}

static void __exit xt_rateest_tg_fini(void)
{
xt_unregister_targets(xt_rateest_target, ARRAY_SIZE(xt_rateest_target));
xt_unregister_target(&xt_rateest_tg_reg);
}


Expand Down
32 changes: 11 additions & 21 deletions net/netfilter/xt_SECMARK.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -125,35 +125,25 @@ static void secmark_tg_destroy(const struct xt_target *target, void *targinfo)
}
}

static struct xt_target secmark_tg_reg[] __read_mostly = {
{
.name = "SECMARK",
.family = NFPROTO_IPV4,
.checkentry = secmark_tg_check,
.destroy = secmark_tg_destroy,
.target = secmark_tg,
.targetsize = sizeof(struct xt_secmark_target_info),
.me = THIS_MODULE,
},
{
.name = "SECMARK",
.family = NFPROTO_IPV6,
.checkentry = secmark_tg_check,
.destroy = secmark_tg_destroy,
.target = secmark_tg,
.targetsize = sizeof(struct xt_secmark_target_info),
.me = THIS_MODULE,
},
static struct xt_target secmark_tg_reg __read_mostly = {
.name = "SECMARK",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = secmark_tg_check,
.destroy = secmark_tg_destroy,
.target = secmark_tg,
.targetsize = sizeof(struct xt_secmark_target_info),
.me = THIS_MODULE,
};

static int __init secmark_tg_init(void)
{
return xt_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
return xt_register_target(&secmark_tg_reg);
}

static void __exit secmark_tg_exit(void)
{
xt_unregister_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
xt_unregister_target(&secmark_tg_reg);
}

module_init(secmark_tg_init);
Expand Down
26 changes: 9 additions & 17 deletions net/netfilter/xt_TRACE.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,31 +19,23 @@ trace_tg(struct sk_buff *skb, const struct net_device *in,
return XT_CONTINUE;
}

static struct xt_target trace_tg_reg[] __read_mostly = {
{
.name = "TRACE",
.family = NFPROTO_IPV4,
.target = trace_tg,
.table = "raw",
.me = THIS_MODULE,
},
{
.name = "TRACE",
.family = NFPROTO_IPV6,
.target = trace_tg,
.table = "raw",
.me = THIS_MODULE,
},
static struct xt_target trace_tg_reg __read_mostly = {
.name = "TRACE",
.revision = 0,
.family = NFPROTO_UNSPEC,
.table = "raw",
.target = trace_tg,
.me = THIS_MODULE,
};

static int __init trace_tg_init(void)
{
return xt_register_targets(trace_tg_reg, ARRAY_SIZE(trace_tg_reg));
return xt_register_target(&trace_tg_reg);
}

static void __exit trace_tg_exit(void)
{
xt_unregister_targets(trace_tg_reg, ARRAY_SIZE(trace_tg_reg));
xt_unregister_target(&trace_tg_reg);
}

module_init(trace_tg_init);
Expand Down
40 changes: 13 additions & 27 deletions net/netfilter/xt_limit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -167,43 +167,29 @@ static int limit_mt_compat_to_user(void __user *dst, void *src)
}
#endif /* CONFIG_COMPAT */

static struct xt_match limit_mt_reg[] __read_mostly = {
{
.name = "limit",
.family = NFPROTO_IPV4,
.checkentry = limit_mt_check,
.match = limit_mt,
.matchsize = sizeof(struct xt_rateinfo),
static struct xt_match limit_mt_reg __read_mostly = {
.name = "limit",
.revision = 0,
.family = NFPROTO_UNSPEC,
.match = limit_mt,
.checkentry = limit_mt_check,
.matchsize = sizeof(struct xt_rateinfo),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_rateinfo),
.compat_from_user = limit_mt_compat_from_user,
.compat_to_user = limit_mt_compat_to_user,
.compatsize = sizeof(struct compat_xt_rateinfo),
.compat_from_user = limit_mt_compat_from_user,
.compat_to_user = limit_mt_compat_to_user,
#endif
.me = THIS_MODULE,
},
{
.name = "limit",
.family = NFPROTO_IPV6,
.checkentry = limit_mt_check,
.match = limit_mt,
.matchsize = sizeof(struct xt_rateinfo),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_rateinfo),
.compat_from_user = limit_mt_compat_from_user,
.compat_to_user = limit_mt_compat_to_user,
#endif
.me = THIS_MODULE,
},
.me = THIS_MODULE,
};

static int __init limit_mt_init(void)
{
return xt_register_matches(limit_mt_reg, ARRAY_SIZE(limit_mt_reg));
return xt_register_match(&limit_mt_reg);
}

static void __exit limit_mt_exit(void)
{
xt_unregister_matches(limit_mt_reg, ARRAY_SIZE(limit_mt_reg));
xt_unregister_match(&limit_mt_reg);
}

module_init(limit_mt_init);
Expand Down
26 changes: 2 additions & 24 deletions net/netfilter/xt_mark.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ static struct xt_match mark_mt_reg[] __read_mostly = {
{
.name = "mark",
.revision = 0,
.family = NFPROTO_IPV4,
.family = NFPROTO_UNSPEC,
.checkentry = mark_mt_check_v0,
.match = mark_mt_v0,
.matchsize = sizeof(struct xt_mark_info),
Expand All @@ -103,32 +103,10 @@ static struct xt_match mark_mt_reg[] __read_mostly = {
#endif
.me = THIS_MODULE,
},
{
.name = "mark",
.revision = 0,
.family = NFPROTO_IPV6,
.checkentry = mark_mt_check_v0,
.match = mark_mt_v0,
.matchsize = sizeof(struct xt_mark_info),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_mark_info),
.compat_from_user = mark_mt_compat_from_user_v0,
.compat_to_user = mark_mt_compat_to_user_v0,
#endif
.me = THIS_MODULE,
},
{
.name = "mark",
.revision = 1,
.family = NFPROTO_IPV4,
.match = mark_mt,
.matchsize = sizeof(struct xt_mark_mtinfo1),
.me = THIS_MODULE,
},
{
.name = "mark",
.revision = 1,
.family = NFPROTO_IPV6,
.family = NFPROTO_UNSPEC,
.match = mark_mt,
.matchsize = sizeof(struct xt_mark_mtinfo1),
.me = THIS_MODULE,
Expand Down
29 changes: 10 additions & 19 deletions net/netfilter/xt_quota.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -54,33 +54,24 @@ quota_mt_check(const char *tablename, const void *entry,
return true;
}

static struct xt_match quota_mt_reg[] __read_mostly = {
{
.name = "quota",
.family = NFPROTO_IPV4,
.checkentry = quota_mt_check,
.match = quota_mt,
.matchsize = sizeof(struct xt_quota_info),
.me = THIS_MODULE
},
{
.name = "quota",
.family = NFPROTO_IPV6,
.checkentry = quota_mt_check,
.match = quota_mt,
.matchsize = sizeof(struct xt_quota_info),
.me = THIS_MODULE
},
static struct xt_match quota_mt_reg __read_mostly = {
.name = "quota",
.revision = 0,
.family = NFPROTO_UNSPEC,
.match = quota_mt,
.checkentry = quota_mt_check,
.matchsize = sizeof(struct xt_quota_info),
.me = THIS_MODULE,
};

static int __init quota_mt_init(void)
{
return xt_register_matches(quota_mt_reg, ARRAY_SIZE(quota_mt_reg));
return xt_register_match(&quota_mt_reg);
}

static void __exit quota_mt_exit(void)
{
xt_unregister_matches(quota_mt_reg, ARRAY_SIZE(quota_mt_reg));
xt_unregister_match(&quota_mt_reg);
}

module_init(quota_mt_init);
Expand Down
Loading

0 comments on commit 55b69e9

Please sign in to comment.