UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: netns nf_conntrack: pass netns pointer to L4 protocol's ->error hook 

Again, it's deducible from skb, but we're going to use it for
nf_conntrack_checksum and statistics, so just pass it from upper layer.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Alexey Dobriyan 2008-10-08 11:35:05 +02:00 committed by Patrick McHardy
parent a702a65fc1
commit 74c51a1497
8 changed files with 26 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/netfilter/nf_conntrack_l4proto.h
View File

@ -50,7 +50,7 @@ struct nf_conntrack_l4proto
/* Called when a conntrack entry is destroyed */ /* Called when a conntrack entry is destroyed */
void (*destroy)(struct nf_conn *ct); void (*destroy)(struct nf_conn *ct);
int (*error)(struct sk_buff *skb, unsigned int dataoff, int (*error)(struct net *net, struct sk_buff *skb, unsigned int dataoff,
enum ip_conntrack_info *ctinfo, enum ip_conntrack_info *ctinfo,
u_int8_t pf, unsigned int hooknum); u_int8_t pf, unsigned int hooknum);

8
net/ipv4/netfilter/nf_conntrack_proto_icmp.c
View File

@ -123,7 +123,7 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
/* Returns conntrack if it dealt with ICMP, and filled in skb fields */ /* Returns conntrack if it dealt with ICMP, and filled in skb fields */
static int static int
icmp_error_message(struct sk_buff *skb, icmp_error_message(struct net *net, struct sk_buff *skb,
enum ip_conntrack_info *ctinfo, enum ip_conntrack_info *ctinfo,
unsigned int hooknum) unsigned int hooknum)
{ {
@ -155,7 +155,7 @@ icmp_error_message(struct sk_buff *skb,
*ctinfo = IP_CT_RELATED; *ctinfo = IP_CT_RELATED;
h = nf_conntrack_find_get(&init_net, &innertuple); h = nf_conntrack_find_get(net, &innertuple);
if (!h) { if (!h) {
pr_debug("icmp_error_message: no match\n"); pr_debug("icmp_error_message: no match\n");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -172,7 +172,7 @@ icmp_error_message(struct sk_buff *skb,
/* Small and modified version of icmp_rcv */ /* Small and modified version of icmp_rcv */
static int static int
icmp_error(struct sk_buff *skb, unsigned int dataoff, icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum) enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
{ {
const struct icmphdr *icmph; const struct icmphdr *icmph;
@ -217,7 +217,7 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff,
&& icmph->type != ICMP_REDIRECT) && icmph->type != ICMP_REDIRECT)
return NF_ACCEPT; return NF_ACCEPT;
return icmp_error_message(skb, ctinfo, hooknum); return icmp_error_message(net, skb, ctinfo, hooknum);
} }
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)

9
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
View File

@ -122,7 +122,8 @@ static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb,
} }
static int static int
icmpv6_error_message(struct sk_buff *skb, icmpv6_error_message(struct net *net,
struct sk_buff *skb,
unsigned int icmp6off, unsigned int icmp6off,
enum ip_conntrack_info *ctinfo, enum ip_conntrack_info *ctinfo,
unsigned int hooknum) unsigned int hooknum)
@ -156,7 +157,7 @@ icmpv6_error_message(struct sk_buff *skb,
*ctinfo = IP_CT_RELATED; *ctinfo = IP_CT_RELATED;
h = nf_conntrack_find_get(&init_net, &intuple); h = nf_conntrack_find_get(net, &intuple);
if (!h) { if (!h) {
pr_debug("icmpv6_error: no match\n"); pr_debug("icmpv6_error: no match\n");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -172,7 +173,7 @@ icmpv6_error_message(struct sk_buff *skb,
} }
static int static int
icmpv6_error(struct sk_buff *skb, unsigned int dataoff, icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum) enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
{ {
const struct icmp6hdr *icmp6h; const struct icmp6hdr *icmp6h;
@ -197,7 +198,7 @@ icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
if (icmp6h->icmp6_type >= 128) if (icmp6h->icmp6_type >= 128)
return NF_ACCEPT; return NF_ACCEPT;
return icmpv6_error_message(skb, dataoff, ctinfo, hooknum); return icmpv6_error_message(net, skb, dataoff, ctinfo, hooknum);
} }
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)

12
net/netfilter/nf_conntrack_core.c
View File

@ -703,11 +703,13 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
/* It may be an special packet, error, unclean... /* It may be an special packet, error, unclean...
* inverse of the return code tells to the netfilter * inverse of the return code tells to the netfilter
* core what to do with the packet. */ * core what to do with the packet. */
if (l4proto->error != NULL && if (l4proto->error != NULL) {
(ret = l4proto->error(skb, dataoff, &ctinfo, pf, hooknum)) <= 0) { ret = l4proto->error(net, skb, dataoff, &ctinfo, pf, hooknum);
NF_CT_STAT_INC_ATOMIC(error); if (ret <= 0) {
NF_CT_STAT_INC_ATOMIC(invalid); NF_CT_STAT_INC_ATOMIC(error);
return -ret; NF_CT_STAT_INC_ATOMIC(invalid);
return -ret;
}
} }
ct = resolve_normal_ct(net, skb, dataoff, pf, protonum, ct = resolve_normal_ct(net, skb, dataoff, pf, protonum,

6
net/netfilter/nf_conntrack_proto_dccp.c
View File

@ -545,9 +545,9 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
return NF_ACCEPT; return NF_ACCEPT;
} }
static int dccp_error(struct sk_buff *skb, unsigned int dataoff, static int dccp_error(struct net *net, struct sk_buff *skb,
enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int dataoff, enum ip_conntrack_info *ctinfo,
unsigned int hooknum) u_int8_t pf, unsigned int hooknum)
{ {
struct dccp_hdr _dh, *dh; struct dccp_hdr _dh, *dh;
unsigned int dccp_len = skb->len - dataoff; unsigned int dccp_len = skb->len - dataoff;

3
net/netfilter/nf_conntrack_proto_tcp.c
View File

@ -746,7 +746,8 @@ static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
}; };
/* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c. */ /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c. */
static int tcp_error(struct sk_buff *skb, static int tcp_error(struct net *net,
struct sk_buff *skb,
unsigned int dataoff, unsigned int dataoff,
enum ip_conntrack_info *ctinfo, enum ip_conntrack_info *ctinfo,
u_int8_t pf, u_int8_t pf,

2
net/netfilter/nf_conntrack_proto_udp.c
View File

@ -89,7 +89,7 @@ static bool udp_new(struct nf_conn *ct, const struct sk_buff *skb,
return true; return true;
} }
static int udp_error(struct sk_buff *skb, unsigned int dataoff, static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
enum ip_conntrack_info *ctinfo, enum ip_conntrack_info *ctinfo,
u_int8_t pf, u_int8_t pf,
unsigned int hooknum) unsigned int hooknum)

4
net/netfilter/nf_conntrack_proto_udplite.c
View File

@ -89,7 +89,9 @@ static bool udplite_new(struct nf_conn *ct, const struct sk_buff *skb,
return true; return true;
} }
static int udplite_error(struct sk_buff *skb, unsigned int dataoff, static int udplite_error(struct net *net,
struct sk_buff *skb,
unsigned int dataoff,
enum ip_conntrack_info *ctinfo, enum ip_conntrack_info *ctinfo,
u_int8_t pf, u_int8_t pf,
unsigned int hooknum) unsigned int hooknum)