UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: add missing IS_ENABLED(CONFIG_NETFILTER) checks to some header-files. 

linux/netfilter.h defines a number of struct and inline function
definitions which are only available is CONFIG_NETFILTER is enabled.
These structs and functions are used in declarations and definitions in
other header-files.  Added preprocessor checks to make sure these
headers will compile if CONFIG_NETFILTER is disabled.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Jeremy Sowden 2019-08-07 15:17:03 +01:00 committed by Pablo Neira Ayuso
parent 0abc8bf4f2
commit 78458e3e08
15 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/linux/netfilter/x_tables.h
View File

@ -35,12 +35,15 @@ struct xt_action_param {
union { union {
const void *matchinfo, *targinfo; const void *matchinfo, *targinfo;
}; };
#if IS_ENABLED(CONFIG_NETFILTER)
const struct nf_hook_state *state; const struct nf_hook_state *state;
#endif
int fragoff; int fragoff;
unsigned int thoff; unsigned int thoff;
bool hotdrop; bool hotdrop;
}; };
#if IS_ENABLED(CONFIG_NETFILTER)
static inline struct net *xt_net(const struct xt_action_param *par) static inline struct net *xt_net(const struct xt_action_param *par)
{ {
return par->state->net; return par->state->net;
@ -75,6 +78,7 @@ static inline u_int8_t xt_family(const struct xt_action_param *par)
{ {
return par->state->pf; return par->state->pf;
} }
#endif
/** /**
* struct xt_mtchk_param - parameters for match extensions' * struct xt_mtchk_param - parameters for match extensions'
@ -446,7 +450,9 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
return cnt; return cnt;
} }
#if IS_ENABLED(CONFIG_NETFILTER)
struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *); struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
#endif
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
#include <net/compat.h> #include <net/compat.h>

2
include/linux/netfilter_arp/arp_tables.h
View File

@ -49,6 +49,7 @@ struct arpt_error {
} }
extern void *arpt_alloc_initial_table(const struct xt_table *); extern void *arpt_alloc_initial_table(const struct xt_table *);
#if IS_ENABLED(CONFIG_NETFILTER)
int arpt_register_table(struct net *net, const struct xt_table *table, int arpt_register_table(struct net *net, const struct xt_table *table,
const struct arpt_replace *repl, const struct arpt_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res); const struct nf_hook_ops *ops, struct xt_table **res);
@ -57,6 +58,7 @@ void arpt_unregister_table(struct net *net, struct xt_table *table,
extern unsigned int arpt_do_table(struct sk_buff *skb, extern unsigned int arpt_do_table(struct sk_buff *skb,
const struct nf_hook_state *state, const struct nf_hook_state *state,
struct xt_table *table); struct xt_table *table);
#endif
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
#include <net/compat.h> #include <net/compat.h>

2
include/linux/netfilter_bridge/ebtables.h
View File

@ -105,6 +105,7 @@ struct ebt_table {
#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \ #define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
~(__alignof__(struct _xt_align)-1)) ~(__alignof__(struct _xt_align)-1))
#if IS_ENABLED(CONFIG_NETFILTER)
extern int ebt_register_table(struct net *net, extern int ebt_register_table(struct net *net,
const struct ebt_table *table, const struct ebt_table *table,
const struct nf_hook_ops *ops, const struct nf_hook_ops *ops,
@ -114,6 +115,7 @@ extern void ebt_unregister_table(struct net *net, struct ebt_table *table,
extern unsigned int ebt_do_table(struct sk_buff *skb, extern unsigned int ebt_do_table(struct sk_buff *skb,
const struct nf_hook_state *state, const struct nf_hook_state *state,
struct ebt_table *table); struct ebt_table *table);
#endif
/* True if the hook mask denotes that the rule is in a base chain, /* True if the hook mask denotes that the rule is in a base chain,
* used in the check() functions */ * used in the check() functions */

4
include/linux/netfilter_ipv4/ip_tables.h
View File

@ -25,11 +25,13 @@
extern void ipt_init(void) __init; extern void ipt_init(void) __init;
#if IS_ENABLED(CONFIG_NETFILTER)
int ipt_register_table(struct net *net, const struct xt_table *table, int ipt_register_table(struct net *net, const struct xt_table *table,
const struct ipt_replace *repl, const struct ipt_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res); const struct nf_hook_ops *ops, struct xt_table **res);
void ipt_unregister_table(struct net *net, struct xt_table *table, void ipt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops); const struct nf_hook_ops *ops);
#endif
/* Standard entry. */ /* Standard entry. */
struct ipt_standard { struct ipt_standard {
@ -65,9 +67,11 @@ struct ipt_error {
} }
extern void *ipt_alloc_initial_table(const struct xt_table *); extern void *ipt_alloc_initial_table(const struct xt_table *);
#if IS_ENABLED(CONFIG_NETFILTER)
extern unsigned int ipt_do_table(struct sk_buff *skb, extern unsigned int ipt_do_table(struct sk_buff *skb,
const struct nf_hook_state *state, const struct nf_hook_state *state,
struct xt_table *table); struct xt_table *table);
#endif
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
#include <net/compat.h> #include <net/compat.h>

2
include/linux/netfilter_ipv6/ip6_tables.h
View File

@ -26,6 +26,7 @@
extern void ip6t_init(void) __init; extern void ip6t_init(void) __init;
extern void *ip6t_alloc_initial_table(const struct xt_table *); extern void *ip6t_alloc_initial_table(const struct xt_table *);
#if IS_ENABLED(CONFIG_NETFILTER)
int ip6t_register_table(struct net *net, const struct xt_table *table, int ip6t_register_table(struct net *net, const struct xt_table *table,
const struct ip6t_replace *repl, const struct ip6t_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res); const struct nf_hook_ops *ops, struct xt_table **res);
@ -34,6 +35,7 @@ void ip6t_unregister_table(struct net *net, struct xt_table *table,
extern unsigned int ip6t_do_table(struct sk_buff *skb, extern unsigned int ip6t_do_table(struct sk_buff *skb,
const struct nf_hook_state *state, const struct nf_hook_state *state,
struct xt_table *table); struct xt_table *table);
#endif
/* Check for an extension */ /* Check for an extension */
static inline int static inline int

2
include/net/netfilter/br_netfilter.h
View File

@ -55,6 +55,7 @@ static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
struct net_device *setup_pre_routing(struct sk_buff *skb, struct net_device *setup_pre_routing(struct sk_buff *skb,
const struct net *net); const struct net *net);
#if IS_ENABLED(CONFIG_NETFILTER)
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
int br_validate_ipv6(struct net *net, struct sk_buff *skb); int br_validate_ipv6(struct net *net, struct sk_buff *skb);
unsigned int br_nf_pre_routing_ipv6(void *priv, unsigned int br_nf_pre_routing_ipv6(void *priv,
@ -73,5 +74,6 @@ br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, struct sk_buff *skb,
return NF_ACCEPT; return NF_ACCEPT;
} }
#endif #endif
#endif
#endif /* _BR_NETFILTER_H_ */ #endif /* _BR_NETFILTER_H_ */

2
include/net/netfilter/nf_conntrack_bridge.h
View File

@ -6,7 +6,9 @@
#include <uapi/linux/if_ether.h> #include <uapi/linux/if_ether.h>
struct nf_ct_bridge_info { struct nf_ct_bridge_info {
#if IS_ENABLED(CONFIG_NETFILTER)
struct nf_hook_ops *ops; struct nf_hook_ops *ops;
#endif
unsigned int ops_size; unsigned int ops_size;
struct module *me; struct module *me;
}; };

3
include/net/netfilter/nf_conntrack_core.h
View File

@ -20,7 +20,10 @@
/* This header is used to share core functionality between the /* This header is used to share core functionality between the
standalone connection tracking module, and the compatibility layer's use standalone connection tracking module, and the compatibility layer's use
of connection tracking. */ of connection tracking. */
#if IS_ENABLED(CONFIG_NETFILTER)
unsigned int nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state); unsigned int nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state);
#endif
int nf_conntrack_init_net(struct net *net); int nf_conntrack_init_net(struct net *net);
void nf_conntrack_cleanup_net(struct net *net); void nf_conntrack_cleanup_net(struct net *net);

2
include/net/netfilter/nf_conntrack_l4proto.h
View File

@ -75,6 +75,7 @@ bool nf_conntrack_invert_icmp_tuple(struct nf_conntrack_tuple *tuple,
bool nf_conntrack_invert_icmpv6_tuple(struct nf_conntrack_tuple *tuple, bool nf_conntrack_invert_icmpv6_tuple(struct nf_conntrack_tuple *tuple,
const struct nf_conntrack_tuple *orig); const struct nf_conntrack_tuple *orig);
#if IS_ENABLED(CONFIG_NETFILTER)
int nf_conntrack_inet_error(struct nf_conn *tmpl, struct sk_buff *skb, int nf_conntrack_inet_error(struct nf_conn *tmpl, struct sk_buff *skb,
unsigned int dataoff, unsigned int dataoff,
const struct nf_hook_state *state, const struct nf_hook_state *state,
@ -131,6 +132,7 @@ int nf_conntrack_gre_packet(struct nf_conn *ct,
unsigned int dataoff, unsigned int dataoff,
enum ip_conntrack_info ctinfo, enum ip_conntrack_info ctinfo,
const struct nf_hook_state *state); const struct nf_hook_state *state);
#endif
void nf_conntrack_generic_init_net(struct net *net); void nf_conntrack_generic_init_net(struct net *net);
void nf_conntrack_tcp_init_net(struct net *net); void nf_conntrack_tcp_init_net(struct net *net);

2
include/net/netfilter/nf_conntrack_tuple.h
View File

@ -121,6 +121,7 @@ struct nf_conntrack_tuple_hash {
struct nf_conntrack_tuple tuple; struct nf_conntrack_tuple tuple;
}; };
#if IS_ENABLED(CONFIG_NETFILTER)
static inline bool __nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1, static inline bool __nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1,
const struct nf_conntrack_tuple *t2) const struct nf_conntrack_tuple *t2)
{ {
@ -183,5 +184,6 @@ nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,
return nf_ct_tuple_src_mask_cmp(t, tuple, mask) && return nf_ct_tuple_src_mask_cmp(t, tuple, mask) &&
__nf_ct_tuple_dst_equal(t, tuple); __nf_ct_tuple_dst_equal(t, tuple);
} }
#endif
#endif /* _NF_CONNTRACK_TUPLE_H */ #endif /* _NF_CONNTRACK_TUPLE_H */

4
include/net/netfilter/nf_flow_table.h
View File

@ -17,7 +17,9 @@ struct nf_flowtable_type {
int family; int family;
int (*init)(struct nf_flowtable *ft); int (*init)(struct nf_flowtable *ft);
void (*free)(struct nf_flowtable *ft); void (*free)(struct nf_flowtable *ft);
#if IS_ENABLED(CONFIG_NETFILTER)
nf_hookfn *hook; nf_hookfn *hook;
#endif
struct module *owner; struct module *owner;
}; };
@ -115,10 +117,12 @@ struct flow_ports {
__be16 source, dest; __be16 source, dest;
}; };
#if IS_ENABLED(CONFIG_NETFILTER)
unsigned int nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, unsigned int nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
const struct nf_hook_state *state); const struct nf_hook_state *state);
unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
const struct nf_hook_state *state); const struct nf_hook_state *state);
#endif
#define MODULE_ALIAS_NF_FLOWTABLE(family) \ #define MODULE_ALIAS_NF_FLOWTABLE(family) \
MODULE_ALIAS("nf-flowtable-" __stringify(family)) MODULE_ALIAS("nf-flowtable-" __stringify(family))

4
include/net/netfilter/nf_nat.h
View File

@ -69,10 +69,12 @@ static inline bool nf_nat_oif_changed(unsigned int hooknum,
#endif #endif
} }
#if IS_ENABLED(CONFIG_NETFILTER)
int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops, int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
const struct nf_hook_ops *nat_ops, unsigned int ops_count); const struct nf_hook_ops *nat_ops, unsigned int ops_count);
void nf_nat_unregister_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops, void nf_nat_unregister_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
unsigned int ops_count); unsigned int ops_count);
#endif
unsigned int nf_nat_packet(struct nf_conn *ct, enum ip_conntrack_info ctinfo, unsigned int nf_nat_packet(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
unsigned int hooknum, struct sk_buff *skb); unsigned int hooknum, struct sk_buff *skb);
@ -92,6 +94,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, struct nf_conn *ct,
enum ip_conntrack_info ctinfo, enum ip_conntrack_info ctinfo,
unsigned int hooknum, unsigned int hdrlen); unsigned int hooknum, unsigned int hdrlen);
#if IS_ENABLED(CONFIG_NETFILTER)
int nf_nat_ipv4_register_fn(struct net *net, const struct nf_hook_ops *ops); int nf_nat_ipv4_register_fn(struct net *net, const struct nf_hook_ops *ops);
void nf_nat_ipv4_unregister_fn(struct net *net, const struct nf_hook_ops *ops); void nf_nat_ipv4_unregister_fn(struct net *net, const struct nf_hook_ops *ops);
@ -104,6 +107,7 @@ void nf_nat_inet_unregister_fn(struct net *net, const struct nf_hook_ops *ops);
unsigned int unsigned int
nf_nat_inet_fn(void *priv, struct sk_buff *skb, nf_nat_inet_fn(void *priv, struct sk_buff *skb,
const struct nf_hook_state *state); const struct nf_hook_state *state);
#endif
int nf_xfrm_me_harder(struct net *n, struct sk_buff *s, unsigned int family); int nf_xfrm_me_harder(struct net *n, struct sk_buff *s, unsigned int family);

5
include/net/netfilter/nf_queue.h
View File

@ -15,7 +15,9 @@ struct nf_queue_entry {
unsigned int id; unsigned int id;
unsigned int hook_index; /* index in hook_entries->hook[] */ unsigned int hook_index; /* index in hook_entries->hook[] */
#if IS_ENABLED(CONFIG_NETFILTER)
struct nf_hook_state state; struct nf_hook_state state;
#endif
u16 size; /* sizeof(entry) + saved route keys */ u16 size; /* sizeof(entry) + saved route keys */
/* extra space to store route keys */ /* extra space to store route keys */
@ -121,6 +123,9 @@ nfqueue_hash(const struct sk_buff *skb, u16 queue, u16 queues_total, u8 family,
return queue; return queue;
} }
#if IS_ENABLED(CONFIG_NETFILTER)
int nf_queue(struct sk_buff *skb, struct nf_hook_state *state, int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,
unsigned int index, unsigned int verdict); unsigned int index, unsigned int verdict);
#endif
#endif /* _NF_QUEUE_H */ #endif /* _NF_QUEUE_H */

4
include/net/netfilter/nf_synproxy.h
View File

@ -20,8 +20,10 @@ bool synproxy_recv_client_ack(struct net *net,
const struct tcphdr *th, const struct tcphdr *th,
struct synproxy_options *opts, u32 recv_seq); struct synproxy_options *opts, u32 recv_seq);
#if IS_ENABLED(CONFIG_NETFILTER)
unsigned int ipv4_synproxy_hook(void *priv, struct sk_buff *skb, unsigned int ipv4_synproxy_hook(void *priv, struct sk_buff *skb,
const struct nf_hook_state *nhs); const struct nf_hook_state *nhs);
#endif
int nf_synproxy_ipv4_init(struct synproxy_net *snet, struct net *net); int nf_synproxy_ipv4_init(struct synproxy_net *snet, struct net *net);
void nf_synproxy_ipv4_fini(struct synproxy_net *snet, struct net *net); void nf_synproxy_ipv4_fini(struct synproxy_net *snet, struct net *net);
@ -35,8 +37,10 @@ bool synproxy_recv_client_ack_ipv6(struct net *net, const struct sk_buff *skb,
const struct tcphdr *th, const struct tcphdr *th,
struct synproxy_options *opts, u32 recv_seq); struct synproxy_options *opts, u32 recv_seq);
#if IS_ENABLED(CONFIG_NETFILTER)
unsigned int ipv6_synproxy_hook(void *priv, struct sk_buff *skb, unsigned int ipv6_synproxy_hook(void *priv, struct sk_buff *skb,
const struct nf_hook_state *nhs); const struct nf_hook_state *nhs);
#endif
int nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net); int nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net);
void nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net); void nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net);
#else #else

8
include/net/netfilter/nf_tables.h
View File

@ -25,6 +25,7 @@ struct nft_pktinfo {
struct xt_action_param xt; struct xt_action_param xt;
}; };
#if IS_ENABLED(CONFIG_NETFILTER)
static inline struct net *nft_net(const struct nft_pktinfo *pkt) static inline struct net *nft_net(const struct nft_pktinfo *pkt)
{ {
return pkt->xt.state->net; return pkt->xt.state->net;
@ -57,6 +58,7 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
pkt->skb = skb; pkt->skb = skb;
pkt->xt.state = state; pkt->xt.state = state;
} }
#endif
static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt, static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
struct sk_buff *skb) struct sk_buff *skb)
@ -927,9 +929,11 @@ struct nft_chain_type {
int family; int family;
struct module *owner; struct module *owner;
unsigned int hook_mask; unsigned int hook_mask;
#if IS_ENABLED(CONFIG_NETFILTER)
nf_hookfn *hooks[NF_MAX_HOOKS]; nf_hookfn *hooks[NF_MAX_HOOKS];
int (*ops_register)(struct net *net, const struct nf_hook_ops *ops); int (*ops_register)(struct net *net, const struct nf_hook_ops *ops);
void (*ops_unregister)(struct net *net, const struct nf_hook_ops *ops); void (*ops_unregister)(struct net *net, const struct nf_hook_ops *ops);
#endif
}; };
int nft_chain_validate_dependency(const struct nft_chain *chain, int nft_chain_validate_dependency(const struct nft_chain *chain,
@ -955,7 +959,9 @@ struct nft_stats {
* @flow_block: flow block (for hardware offload) * @flow_block: flow block (for hardware offload)
*/ */
struct nft_base_chain { struct nft_base_chain {
#if IS_ENABLED(CONFIG_NETFILTER)
struct nf_hook_ops ops; struct nf_hook_ops ops;
#endif
const struct nft_chain_type *type; const struct nft_chain_type *type;
u8 policy; u8 policy;
u8 flags; u8 flags;
@ -1152,7 +1158,9 @@ struct nft_flowtable {
use:30; use:30;
u64 handle; u64 handle;
/* runtime data below here */ /* runtime data below here */
#if IS_ENABLED(CONFIG_NETFILTER)
struct nf_hook_ops *ops ____cacheline_aligned; struct nf_hook_ops *ops ____cacheline_aligned;
#endif
struct nf_flowtable data; struct nf_flowtable data;
}; };