Skip to content

Commit

Permalink
netfilter: xtables: cut down on static data for family-independent ex…
Browse files Browse the repository at this point in the history 
…tensions

Using ->family in struct xt_*_param, multiple struct xt_{match,target}
can be squashed together.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
  • Loading branch information
Jan Engelhardt authored and Patrick McHardy committed Oct 8, 2008
1 parent 916a917 commit 92f3b2b
Show file tree
Hide file tree
Showing 9 changed files with 104 additions and 225 deletions.
39 changes: 7 additions & 32 deletions net/netfilter/xt_CONNMARK.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -128,27 +128,27 @@ static bool connmark_tg_check_v0(const struct xt_tgchk_param *par)
printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
return false;
}
if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
printk(KERN_WARNING "can't load conntrack support for "
"proto=%u\n", par->target->family);
"proto=%u\n", par->family);
return false;
}
return true;
}

static bool connmark_tg_check(const struct xt_tgchk_param *par)
{
if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
printk(KERN_WARNING "cannot load conntrack support for "
"proto=%u\n", par->target->family);
"proto=%u\n", par->family);
return false;
}
return true;
}

static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
{
nf_ct_l3proto_module_put(par->target->family);
nf_ct_l3proto_module_put(par->family);
}

#ifdef CONFIG_COMPAT
Expand Down Expand Up @@ -186,7 +186,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
{
.name = "CONNMARK",
.revision = 0,
.family = NFPROTO_IPV4,
.family = NFPROTO_UNSPEC,
.checkentry = connmark_tg_check_v0,
.destroy = connmark_tg_destroy,
.target = connmark_tg_v0,
Expand All @@ -198,35 +198,10 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
#endif
.me = THIS_MODULE
},
{
.name = "CONNMARK",
.revision = 0,
.family = NFPROTO_IPV6,
.checkentry = connmark_tg_check_v0,
.destroy = connmark_tg_destroy,
.target = connmark_tg_v0,
.targetsize = sizeof(struct xt_connmark_target_info),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_connmark_target_info),
.compat_from_user = connmark_tg_compat_from_user_v0,
.compat_to_user = connmark_tg_compat_to_user_v0,
#endif
.me = THIS_MODULE
},
{
.name = "CONNMARK",
.revision = 1,
.family = NFPROTO_IPV4,
.checkentry = connmark_tg_check,
.target = connmark_tg,
.targetsize = sizeof(struct xt_connmark_tginfo1),
.destroy = connmark_tg_destroy,
.me = THIS_MODULE,
},
{
.name = "CONNMARK",
.revision = 1,
.family = NFPROTO_IPV6,
.family = NFPROTO_UNSPEC,
.checkentry = connmark_tg_check,
.target = connmark_tg,
.targetsize = sizeof(struct xt_connmark_tginfo1),
Expand Down
40 changes: 14 additions & 26 deletions net/netfilter/xt_CONNSECMARK.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -106,50 +106,38 @@ static bool connsecmark_tg_check(const struct xt_tgchk_param *par)
return false;
}

if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
printk(KERN_WARNING "can't load conntrack support for "
"proto=%u\n", par->target->family);
"proto=%u\n", par->family);
return false;
}
return true;
}

static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)
{
nf_ct_l3proto_module_put(par->target->family);
nf_ct_l3proto_module_put(par->family);
}

static struct xt_target connsecmark_tg_reg[] __read_mostly = {
{
.name = "CONNSECMARK",
.family = NFPROTO_IPV4,
.checkentry = connsecmark_tg_check,
.destroy = connsecmark_tg_destroy,
.target = connsecmark_tg,
.targetsize = sizeof(struct xt_connsecmark_target_info),
.me = THIS_MODULE,
},
{
.name = "CONNSECMARK",
.family = NFPROTO_IPV6,
.checkentry = connsecmark_tg_check,
.destroy = connsecmark_tg_destroy,
.target = connsecmark_tg,
.targetsize = sizeof(struct xt_connsecmark_target_info),
.me = THIS_MODULE,
},
static struct xt_target connsecmark_tg_reg __read_mostly = {
.name = "CONNSECMARK",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = connsecmark_tg_check,
.destroy = connsecmark_tg_destroy,
.target = connsecmark_tg,
.targetsize = sizeof(struct xt_connsecmark_target_info),
.me = THIS_MODULE,
};

static int __init connsecmark_tg_init(void)
{
return xt_register_targets(connsecmark_tg_reg,
ARRAY_SIZE(connsecmark_tg_reg));
return xt_register_target(&connsecmark_tg_reg);
}

static void __exit connsecmark_tg_exit(void)
{
xt_unregister_targets(connsecmark_tg_reg,
ARRAY_SIZE(connsecmark_tg_reg));
xt_unregister_target(&connsecmark_tg_reg);
}

module_init(connsecmark_tg_init);
Expand Down
31 changes: 11 additions & 20 deletions net/netfilter/xt_NFLOG.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_target_param *par)
li.u.ulog.group = info->group;
li.u.ulog.qthreshold = info->threshold;

nf_log_packet(par->target->family, par->hooknum, skb, par->in,
nf_log_packet(par->family, par->hooknum, skb, par->in,
par->out, &li, "%s", info->prefix);
return XT_CONTINUE;
}
Expand All @@ -47,33 +47,24 @@ static bool nflog_tg_check(const struct xt_tgchk_param *par)
return true;
}

static struct xt_target nflog_tg_reg[] __read_mostly = {
{
.name = "NFLOG",
.family = NFPROTO_IPV4,
.checkentry = nflog_tg_check,
.target = nflog_tg,
.targetsize = sizeof(struct xt_nflog_info),
.me = THIS_MODULE,
},
{
.name = "NFLOG",
.family = NFPROTO_IPV6,
.checkentry = nflog_tg_check,
.target = nflog_tg,
.targetsize = sizeof(struct xt_nflog_info),
.me = THIS_MODULE,
},
static struct xt_target nflog_tg_reg __read_mostly = {
.name = "NFLOG",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = nflog_tg_check,
.target = nflog_tg,
.targetsize = sizeof(struct xt_nflog_info),
.me = THIS_MODULE,
};

static int __init nflog_tg_init(void)
{
return xt_register_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));
return xt_register_target(&nflog_tg_reg);
}

static void __exit nflog_tg_exit(void)
{
xt_unregister_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));
xt_unregister_target(&nflog_tg_reg);
}

module_init(nflog_tg_init);
Expand Down
39 changes: 14 additions & 25 deletions net/netfilter/xt_connbytes.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -106,9 +106,9 @@ static bool connbytes_mt_check(const struct xt_mtchk_param *par)
sinfo->direction != XT_CONNBYTES_DIR_BOTH)
return false;

if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
printk(KERN_WARNING "can't load conntrack support for "
"proto=%u\n", par->match->family);
"proto=%u\n", par->family);
return false;
}

Expand All @@ -117,39 +117,28 @@ static bool connbytes_mt_check(const struct xt_mtchk_param *par)

static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
{
nf_ct_l3proto_module_put(par->match->family);
nf_ct_l3proto_module_put(par->family);
}

static struct xt_match connbytes_mt_reg[] __read_mostly = {
{
.name = "connbytes",
.family = NFPROTO_IPV4,
.checkentry = connbytes_mt_check,
.match = connbytes_mt,
.destroy = connbytes_mt_destroy,
.matchsize = sizeof(struct xt_connbytes_info),
.me = THIS_MODULE
},
{
.name = "connbytes",
.family = NFPROTO_IPV6,
.checkentry = connbytes_mt_check,
.match = connbytes_mt,
.destroy = connbytes_mt_destroy,
.matchsize = sizeof(struct xt_connbytes_info),
.me = THIS_MODULE
},
static struct xt_match connbytes_mt_reg __read_mostly = {
.name = "connbytes",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = connbytes_mt_check,
.match = connbytes_mt,
.destroy = connbytes_mt_destroy,
.matchsize = sizeof(struct xt_connbytes_info),
.me = THIS_MODULE,
};

static int __init connbytes_mt_init(void)
{
return xt_register_matches(connbytes_mt_reg,
ARRAY_SIZE(connbytes_mt_reg));
return xt_register_match(&connbytes_mt_reg);
}

static void __exit connbytes_mt_exit(void)
{
xt_unregister_matches(connbytes_mt_reg, ARRAY_SIZE(connbytes_mt_reg));
xt_unregister_match(&connbytes_mt_reg);
}

module_init(connbytes_mt_init);
Expand Down
47 changes: 18 additions & 29 deletions net/netfilter/xt_connlimit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -192,10 +192,10 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
if (ct != NULL)
tuple_ptr = &ct->tuplehash[0].tuple;
else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
par->match->family, &tuple))
par->family, &tuple))
goto hotdrop;

if (par->match->family == NFPROTO_IPV6) {
if (par->family == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb);
memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));
} else {
Expand Down Expand Up @@ -226,16 +226,16 @@ static bool connlimit_mt_check(const struct xt_mtchk_param *par)
struct xt_connlimit_info *info = par->matchinfo;
unsigned int i;

if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
printk(KERN_WARNING "cannot load conntrack support for "
"address family %u\n", par->match->family);
"address family %u\n", par->family);
return false;
}

/* init private data */
info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);
if (info->data == NULL) {
nf_ct_l3proto_module_put(par->match->family);
nf_ct_l3proto_module_put(par->family);
return false;
}

Expand All @@ -254,7 +254,7 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
struct list_head *hash = info->data->iphash;
unsigned int i;

nf_ct_l3proto_module_put(par->match->family);
nf_ct_l3proto_module_put(par->family);

for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
list_for_each_entry_safe(conn, tmp, &hash[i], list) {
Expand All @@ -266,41 +266,30 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
kfree(info->data);
}

static struct xt_match connlimit_mt_reg[] __read_mostly = {
{
.name = "connlimit",
.family = NFPROTO_IPV4,
.checkentry = connlimit_mt_check,
.match = connlimit_mt,
.matchsize = sizeof(struct xt_connlimit_info),
.destroy = connlimit_mt_destroy,
.me = THIS_MODULE,
},
{
.name = "connlimit",
.family = NFPROTO_IPV6,
.checkentry = connlimit_mt_check,
.match = connlimit_mt,
.matchsize = sizeof(struct xt_connlimit_info),
.destroy = connlimit_mt_destroy,
.me = THIS_MODULE,
},
static struct xt_match connlimit_mt_reg __read_mostly = {
.name = "connlimit",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = connlimit_mt_check,
.match = connlimit_mt,
.matchsize = sizeof(struct xt_connlimit_info),
.destroy = connlimit_mt_destroy,
.me = THIS_MODULE,
};

static int __init connlimit_mt_init(void)
{
return xt_register_matches(connlimit_mt_reg,
ARRAY_SIZE(connlimit_mt_reg));
return xt_register_match(&connlimit_mt_reg);
}

static void __exit connlimit_mt_exit(void)
{
xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
xt_unregister_match(&connlimit_mt_reg);
}

module_init(connlimit_mt_init);
module_exit(connlimit_mt_exit);
MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: Number of connections matching");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_connlimit");
Expand Down
Loading

0 comments on commit 92f3b2b

Please sign in to comment.