netfilter: Pass nf_hook_state through ip6t_do_table().

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index 610208b18c05819dc4cfecc0554574269157f90f..b40d2b635778372f46870d00fd06a10266359f67 100644 (file)
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -31,8 +31,7 @@ extern struct xt_table *ip6t_register_table(struct net *net,
 extern void ip6t_unregister_table(struct net *net, struct xt_table *table);
 extern unsigned int ip6t_do_table(struct sk_buff *skb,
                                  unsigned int hook,
-                                 const struct net_device *in,
-                                 const struct net_device *out,
+                                 const struct nf_hook_state *state,
                                  struct xt_table *table);
 
 /* Check for an extension */

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 83f59dc3cccc141a7a64261f27795630379c09a1..1a732a1d3c8e13c58508cef9381d2d32e5a34448 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -317,8 +317,7 @@ ip6t_next_entry(const struct ip6t_entry *entry)
 unsigned int
 ip6t_do_table(struct sk_buff *skb,
              unsigned int hook,
-             const struct net_device *in,
-             const struct net_device *out,
+             const struct nf_hook_state *state,
              struct xt_table *table)
 {
        static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
@@ -333,8 +332,8 @@ ip6t_do_table(struct sk_buff *skb,
        unsigned int addend;
 
        /* Initialization */
-       indev = in ? in->name : nulldevname;
-       outdev = out ? out->name : nulldevname;
+       indev = state->in ? state->in->name : nulldevname;
+       outdev = state->out ? state->out->name : nulldevname;
        /* We handle fragments by dealing with the first fragment as
         * if it was a normal packet.  All other fragments are treated
         * normally, except that they will NEVER match rules that ask
@@ -342,8 +341,8 @@ ip6t_do_table(struct sk_buff *skb,
         * rule is also a fragment-specific rule, non-fragments won't
         * match it. */
        acpar.hotdrop = false;
-       acpar.in      = in;
-       acpar.out     = out;
+       acpar.in      = state->in;
+       acpar.out     = state->out;
        acpar.family  = NFPROTO_IPV6;
        acpar.hooknum = hook;
 
@@ -393,7 +392,7 @@ ip6t_do_table(struct sk_buff *skb,
 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
                /* The packet is traced: log it */
                if (unlikely(skb->nf_trace))
-                       trace_packet(skb, hook, in, out,
+                       trace_packet(skb, hook, state->in, state->out,
                                     table->name, private, e);
 #endif
                /* Standard target? */

diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index eb9ef093454ff221503fd18526e2ba99a2f6bf43..5c33d8abc0774e52a99c20273f3349b0b5374fc7 100644 (file)
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -37,8 +37,7 @@ ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
 {
        const struct net *net = dev_net(state->in ? state->in : state->out);
 
-       return ip6t_do_table(skb, ops->hooknum, state->in, state->out,
-                            net->ipv6.ip6table_filter);
+       return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_filter);
 }
 
 static struct nf_hook_ops *filter_ops __read_mostly;

diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index e713b8d3dbbcd9d85f7cecd4b4ec373dee84f1d0..b551f5b79fe2b7fa62278ae1f7d9327e82795253 100644 (file)
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -32,7 +32,7 @@ static const struct xt_table packet_mangler = {
 };
 
 static unsigned int
-ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
+ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
 {
        unsigned int ret;
        struct in6_addr saddr, daddr;
@@ -57,8 +57,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
        /* flowlabel and prio (includes version, which shouldn't change either */
        flowlabel = *((u_int32_t *)ipv6_hdr(skb));
 
-       ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, NULL, out,
-                           dev_net(out)->ipv6.ip6table_mangle);
+       ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, state,
+                           dev_net(state->out)->ipv6.ip6table_mangle);
 
        if (ret != NF_DROP && ret != NF_STOLEN &&
            (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@@ -80,12 +80,12 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
                     const struct nf_hook_state *state)
 {
        if (ops->hooknum == NF_INET_LOCAL_OUT)
-               return ip6t_mangle_out(skb, state->out);
+               return ip6t_mangle_out(skb, state);
        if (ops->hooknum == NF_INET_POST_ROUTING)
-               return ip6t_do_table(skb, ops->hooknum, state->in, state->out,
+               return ip6t_do_table(skb, ops->hooknum, state,
                                     dev_net(state->out)->ipv6.ip6table_mangle);
        /* INPUT/FORWARD */
-       return ip6t_do_table(skb, ops->hooknum, state->in, state->out,
+       return ip6t_do_table(skb, ops->hooknum, state,
                             dev_net(state->in)->ipv6.ip6table_mangle);
 }
 

diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index d78f69c7abcee7caae379bdf0b575ee6aa977825..c3a7f7af0ed4d183d00a5f50307f44fa44399460 100644 (file)
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -37,8 +37,7 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,
 {
        struct net *net = nf_ct_net(ct);
 
-       return ip6t_do_table(skb, ops->hooknum, state->in, state->out,
-                            net->ipv6.ip6table_nat);
+       return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_nat);
 }
 
 static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,

diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 937908e258628768f742aefbaf29d4f23e07486f..0b33caad2b69254e29af5ff38484e37a0dc6c711 100644 (file)
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -24,8 +24,7 @@ ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
 {
        const struct net *net = dev_net(state->in ? state->in : state->out);
 
-       return ip6t_do_table(skb, ops->hooknum, state->in, state->out,
-                            net->ipv6.ip6table_raw);
+       return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_raw);
 }
 
 static struct nf_hook_ops *rawtable_ops __read_mostly;

diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index f33b41e8e294dde298c4a618cb37071d059e93f7..fcef83c25f7b3281a92a2d5be27512e057dddfff 100644 (file)
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -41,7 +41,7 @@ ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
 {
        const struct net *net = dev_net(state->in ? state->in : state->out);
 
-       return ip6t_do_table(skb, ops->hooknum, state->in, state->out,
+       return ip6t_do_table(skb, ops->hooknum, state,
                             net->ipv6.ip6table_security);
 }