netfilter: xtables: move extension arguments into compound structure (5/6)

This patch does this for target extensions' checkentry functions.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 46d0cb1ad34019b359174f228169427f6376e064..8daeb496ba7ae36a0977e63c71b4871bbced8253 100644 (file)
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -234,6 +234,23 @@ struct xt_target_param {
        const void *targinfo;
 };
 
+/**
+ * struct xt_tgchk_param - parameters for target extensions'
+ * checkentry functions
+ *
+ * @entryinfo: the family-specific rule data
+ *             (struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry)
+ *
+ * Other fields see above.
+ */
+struct xt_tgchk_param {
+       const char *table;
+       void *entryinfo;
+       const struct xt_target *target;
+       void *targinfo;
+       unsigned int hook_mask;
+};
+
 struct xt_match
 {
        struct list_head list;
@@ -291,11 +308,7 @@ struct xt_target
            hook_mask is a bitmask of hooks from which it can be
            called. */
        /* Should return true or false. */
-       bool (*checkentry)(const char *tablename,
-                          const void *entry,
-                          const struct xt_target *target,
-                          void *targinfo,
-                          unsigned int hook_mask);
+       bool (*checkentry)(const struct xt_tgchk_param *);
 
        /* Called when entry of this type deleted. */
        void (*destroy)(const struct xt_target *target, void *targinfo);
@@ -376,10 +389,8 @@ extern void xt_unregister_matches(struct xt_match *match, unsigned int n);
 
 extern int xt_check_match(struct xt_mtchk_param *, u_int8_t family,
                          unsigned int size, u_int8_t proto, bool inv_proto);
-extern int xt_check_target(const struct xt_target *target, unsigned short family,
-                          unsigned int size, const char *table, unsigned int hook,
-                          unsigned short proto, int inv_proto,
-                          const void *entry, void *targinfo);
+extern int xt_check_target(struct xt_tgchk_param *, u_int8_t family,
+                          unsigned int size, u_int8_t proto, bool inv_proto);
 
 extern struct xt_table *xt_register_table(struct net *net,
                                          struct xt_table *table,

diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 568a690f6a628a9e9db14745a1b6befa6b19246c..d45e29cd1cfb9dc35d3953edcccfaa408bf39f0f 100644 (file)
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -310,9 +310,9 @@ extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff *skb,
 #define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
 /* True if the hook mask denotes that the rule is in a base chain,
  * used in the check() functions */
-#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
+#define BASE_CHAIN (par->hook_mask & (1 << NF_BR_NUMHOOKS))
 /* Clear the bit in the hook mask that tells if the rule is on a base chain */
-#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
+#define CLEAR_BASE_CHAIN_BIT (par->hook_mask &= ~(1 << NF_BR_NUMHOOKS))
 /* True if the target is not a standard target */
 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
 

diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index fc94699f719e9b777ab037cb4516cf56dbdd97bc..76584cd72e57295ce2bbae860d78c80f9d1bd2a0 100644 (file)
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -57,20 +57,16 @@ ebt_arpreply_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return info->target;
 }
 
-static bool
-ebt_arpreply_tg_check(const char *tablename, const void *entry,
-                     const struct xt_target *target, void *data,
-                     unsigned int hookmask)
+static bool ebt_arpreply_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ebt_arpreply_info *info = data;
-       const struct ebt_entry *e = entry;
+       const struct ebt_arpreply_info *info = par->targinfo;
+       const struct ebt_entry *e = par->entryinfo;
 
        if (BASE_CHAIN && info->target == EBT_RETURN)
                return false;
        if (e->ethproto != htons(ETH_P_ARP) ||
            e->invflags & EBT_IPROTO)
                return false;
-       CLEAR_BASE_CHAIN_BIT;
        return true;
 }
 

diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index bb5d79e0beeaceccb5118c61dd7c034a9626521b..6b49ea9e31fb04f5852499f575a14f10750bf876 100644 (file)
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -26,19 +26,20 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return info->target;
 }
 
-static bool
-ebt_dnat_tg_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *data,
-                 unsigned int hookmask)
+static bool ebt_dnat_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ebt_nat_info *info = data;
+       const struct ebt_nat_info *info = par->targinfo;
+       unsigned int hook_mask;
 
        if (BASE_CHAIN && info->target == EBT_RETURN)
                return false;
-       CLEAR_BASE_CHAIN_BIT;
-       if ( (strcmp(tablename, "nat") ||
-          (hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))) &&
-          (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
+
+       hook_mask = par->hook_mask & ~(1 << NF_BR_NUMHOOKS);
+       if ((strcmp(par->table, "nat") != 0 ||
+           (hook_mask & ~((1 << NF_BR_PRE_ROUTING) |
+           (1 << NF_BR_LOCAL_OUT)))) &&
+           (strcmp(par->table, "broute") != 0 ||
+           hook_mask & ~(1 << NF_BR_BROUTING)))
                return false;
        if (INVALID_TARGET)
                return false;

diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 87de5fccb2f1056873a7463ba98cead162a5d7cd..3d33c608906aeadddaa0a0361372d34430121d97 100644 (file)
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -24,12 +24,9 @@
 
 static DEFINE_SPINLOCK(ebt_log_lock);
 
-static bool
-ebt_log_tg_check(const char *table, const void *entry,
-                const struct xt_target *target, void *data,
-                unsigned int hook_mask)
+static bool ebt_log_tg_check(const struct xt_tgchk_param *par)
 {
-       struct ebt_log_info *info = data;
+       struct ebt_log_info *info = par->targinfo;
 
        if (info->bitmask & ~EBT_LOG_MASK)
                return false;

diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index aafc456c3c3bb8bfc11973ab82d75652b33d28d8..2fee7e8e2e93ec1e89b952d747f4c4385b3333f3 100644 (file)
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -36,18 +36,14 @@ ebt_mark_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return info->target | ~EBT_VERDICT_BITS;
 }
 
-static bool
-ebt_mark_tg_check(const char *table, const void *e,
-                 const struct xt_target *target, void *data,
-                 unsigned int hookmask)
+static bool ebt_mark_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ebt_mark_t_info *info = data;
+       const struct ebt_mark_t_info *info = par->targinfo;
        int tmp;
 
        tmp = info->target | ~EBT_VERDICT_BITS;
        if (BASE_CHAIN && tmp == EBT_RETURN)
                return false;
-       CLEAR_BASE_CHAIN_BIT;
        if (tmp < -NUM_STANDARD_TARGETS || tmp >= 0)
                return false;
        tmp = info->target & ~EBT_VERDICT_BITS;

diff --git a/net/bridge/netfilter/ebt_nflog.c b/net/bridge/netfilter/ebt_nflog.c
index 6a28d994cf7d6400433f910cc4d4da22beb42685..2a63d996dd4e149f169324483e1fd7753fec3d34 100644 (file)
--- a/net/bridge/netfilter/ebt_nflog.c
+++ b/net/bridge/netfilter/ebt_nflog.c
@@ -35,12 +35,9 @@ ebt_nflog_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return EBT_CONTINUE;
 }
 
-static bool
-ebt_nflog_tg_check(const char *table, const void *e,
-                  const struct xt_target *target, void *data,
-                  unsigned int hookmask)
+static bool ebt_nflog_tg_check(const struct xt_tgchk_param *par)
 {
-       struct ebt_nflog_info *info = data;
+       struct ebt_nflog_info *info = par->targinfo;
 
        if (info->flags & ~EBT_NFLOG_MASK)
                return false;

diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 0cfe2fad94043642ec2be6782b69cc5b2f4e75b5..c8a49f7a57ba90391b1d0707bd680e1a01f15883 100644 (file)
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -32,18 +32,19 @@ ebt_redirect_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return info->target;
 }
 
-static bool
-ebt_redirect_tg_check(const char *tablename, const void *e,
-                     const struct xt_target *target, void *data,
-                     unsigned int hookmask)
+static bool ebt_redirect_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ebt_redirect_info *info = data;
+       const struct ebt_redirect_info *info = par->targinfo;
+       unsigned int hook_mask;
 
        if (BASE_CHAIN && info->target == EBT_RETURN)
                return false;
-       CLEAR_BASE_CHAIN_BIT;
-       if ( (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING)) &&
-            (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
+
+       hook_mask = par->hook_mask & ~(1 << NF_BR_NUMHOOKS);
+       if ((strcmp(par->table, "nat") != 0 ||
+           hook_mask & ~(1 << NF_BR_PRE_ROUTING)) &&
+           (strcmp(par->table, "broute") != 0 ||
+           hook_mask & ~(1 << NF_BR_BROUTING)))
                return false;
        if (INVALID_TARGET)
                return false;

diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index f55960eee996d18aba38d8a8b5ee995f6172f203..8d04d4c302bdc9303958553fb831732d05f24abb 100644 (file)
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -42,18 +42,14 @@ out:
        return info->target | ~EBT_VERDICT_BITS;
 }
 
-static bool
-ebt_snat_tg_check(const char *tablename, const void *e,
-                 const struct xt_target *target, void *data,
-                 unsigned int hookmask)
+static bool ebt_snat_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ebt_nat_info *info = data;
+       const struct ebt_nat_info *info = par->targinfo;
        int tmp;
 
        tmp = info->target | ~EBT_VERDICT_BITS;
        if (BASE_CHAIN && tmp == EBT_RETURN)
                return false;
-       CLEAR_BASE_CHAIN_BIT;
 
        if (tmp < -NUM_STANDARD_TARGETS || tmp >= 0)
                return false;

diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index bfedf12cbf4180758fb75ae2904c203ce481e3ef..2c6d6823e703dd62d226a30b740c50fab79615c7 100644 (file)
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -254,12 +254,9 @@ ebt_ulog_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return EBT_CONTINUE;
 }
 
-static bool
-ebt_ulog_tg_check(const char *table, const void *entry,
-                 const struct xt_target *target, void *data,
-                 unsigned int hookmask)
+static bool ebt_ulog_tg_check(const struct xt_tgchk_param *par)
 {
-       struct ebt_ulog_info *uloginfo = data;
+       struct ebt_ulog_info *uloginfo = par->targinfo;
 
        if (uloginfo->nlgroup > 31)
                return false;

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index a1156bab4a034c8963f44f2b34e513e03b5eff7d..cf823c21c166696179c18b89b7f719a513d91978 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -363,9 +363,10 @@ ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 }
 
 static inline int
-ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
-   const char *name, unsigned int hookmask, unsigned int *cnt)
+ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
+                 unsigned int *cnt)
 {
+       const struct ebt_entry *e = par->entryinfo;
        struct xt_target *watcher;
        size_t left = ((char *)e + e->target_offset) - (char *)w;
        int ret;
@@ -383,9 +384,10 @@ ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
                return -ENOENT;
        w->u.watcher = watcher;
 
-       ret = xt_check_target(watcher, NFPROTO_BRIDGE, w->watcher_size,
-             name, hookmask, e->ethproto, e->invflags & EBT_IPROTO,
-             e, w->data);
+       par->target   = watcher;
+       par->targinfo = w->data;
+       ret = xt_check_target(par, NFPROTO_BRIDGE, w->watcher_size,
+             e->ethproto, e->invflags & EBT_IPROTO);
        if (ret < 0) {
                module_put(watcher->me);
                return ret;
@@ -619,6 +621,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
        size_t gap;
        int ret;
        struct xt_mtchk_param mtpar;
+       struct xt_tgchk_param tgpar;
 
        /* don't mess with the struct ebt_entries */
        if (e->bitmask == 0)
@@ -660,14 +663,14 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
        }
        i = 0;
 
-       mtpar.table     = name;
-       mtpar.entryinfo = e;
-       mtpar.hook_mask = hookmask;
+       mtpar.table     = tgpar.table     = name;
+       mtpar.entryinfo = tgpar.entryinfo = e;
+       mtpar.hook_mask = tgpar.hook_mask = hookmask;
        ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
        if (ret != 0)
                goto cleanup_matches;
        j = 0;
-       ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
+       ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
        if (ret != 0)
                goto cleanup_watchers;
        t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
@@ -703,9 +706,10 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
                goto cleanup_watchers;
        }
 
-       ret = xt_check_target(target, NFPROTO_BRIDGE, t->target_size,
-             name, hookmask, e->ethproto, e->invflags & EBT_IPROTO,
-             e, t->data);
+       tgpar.target   = target;
+       tgpar.targinfo = t->data;
+       ret = xt_check_target(&tgpar, NFPROTO_BRIDGE, t->target_size,
+             e->ethproto, e->invflags & EBT_IPROTO);
        if (ret < 0) {
                module_put(target->me);
                goto cleanup_watchers;

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 5b631ad74b5fd03db9b2f25fff0515cd434e51dd..b3238d0101ccb918d82eeeef560f70d333b9eab5 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -457,16 +457,18 @@ static inline int check_entry(struct arpt_entry *e, const char *name)
 
 static inline int check_target(struct arpt_entry *e, const char *name)
 {
-       struct arpt_entry_target *t;
-       struct xt_target *target;
+       struct arpt_entry_target *t = arpt_get_target(e);
        int ret;
-
-       t = arpt_get_target(e);
-       target = t->u.kernel.target;
-
-       ret = xt_check_target(target, NFPROTO_ARP,
-                             t->u.target_size - sizeof(*t),
-                             name, e->comefrom, 0, 0, e, t->data);
+       struct xt_tgchk_param par = {
+               .table     = name,
+               .entryinfo = e,
+               .target    = t->u.kernel.target,
+               .targinfo  = t->data,
+               .hook_mask = e->comefrom,
+       };
+
+       ret = xt_check_target(&par, NFPROTO_ARP,
+             t->u.target_size - sizeof(*t), 0, false);
        if (ret < 0) {
                duprintf("arp_tables: check failed for `%s'.\n",
                         t->u.kernel.target->name);

diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index 0bf81b35369419b19a8c98ef86a7e76359b7b28c..b0d5b1d0a7693726cf07bf521c559f0e45c20c5b 100644 (file)
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -54,11 +54,9 @@ target(struct sk_buff *skb, const struct xt_target_param *par)
        return mangle->target;
 }
 
-static bool
-checkentry(const char *tablename, const void *e, const struct xt_target *target,
-          void *targinfo, unsigned int hook_mask)
+static bool checkentry(const struct xt_tgchk_param *par)
 {
-       const struct arpt_mangle *mangle = targinfo;
+       const struct arpt_mangle *mangle = par->targinfo;
 
        if (mangle->flags & ~ARPT_MANGLE_MASK ||
            !(mangle->flags & ARPT_MANGLE_MASK))

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 0f8ecf3902299edb64032132e0c5ae863af1c17c..e592c54d499227bdf7e7b7df0bf30277e592ad8d 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -655,15 +655,18 @@ err:
 
 static int check_target(struct ipt_entry *e, const char *name)
 {
-       struct ipt_entry_target *t;
-       struct xt_target *target;
+       struct ipt_entry_target *t = ipt_get_target(e);
+       struct xt_tgchk_param par = {
+               .table     = name,
+               .entryinfo = e,
+               .target    = t->u.kernel.target,
+               .targinfo  = t->data,
+               .hook_mask = e->comefrom,
+       };
        int ret;
 
-       t = ipt_get_target(e);
-       target = t->u.kernel.target;
-       ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
-                             name, e->comefrom, e->ip.proto,
-                             e->ip.invflags & IPT_INV_PROTO, e, t->data);
+       ret = xt_check_target(&par, NFPROTO_IPV4, t->u.target_size - sizeof(*t),
+             e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
        if (ret < 0) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         t->u.kernel.target->name);

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 67e8aa8f34f29c0f1037611c53850d2d5d4b6428..6c7254e025615691390289614b393333bb856e58 100644 (file)
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -347,13 +347,10 @@ clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-clusterip_tg_check(const char *tablename, const void *e_void,
-                   const struct xt_target *target, void *targinfo,
-                   unsigned int hook_mask)
+static bool clusterip_tg_check(const struct xt_tgchk_param *par)
 {
-       struct ipt_clusterip_tgt_info *cipinfo = targinfo;
-       const struct ipt_entry *e = e_void;
+       struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
+       const struct ipt_entry *e = par->entryinfo;
 
        struct clusterip_config *config;
 
@@ -404,9 +401,9 @@ clusterip_tg_check(const char *tablename, const void *e_void,
        }
        cipinfo->config = config;
 
-       if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+       if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
                printk(KERN_WARNING "can't load conntrack support for "
-                                   "proto=%u\n", target->family);
+                                   "proto=%u\n", par->target->family);
                return false;
        }
 

diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index e37f181e8298af7540f57f0780e7eba88fd63725..f7e2fa0974dcc022a8ef683be0a0d7ab1ad57ce6 100644 (file)
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -93,13 +93,10 @@ ecn_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-ecn_tg_check(const char *tablename, const void *e_void,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool ecn_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ipt_ECN_info *einfo = targinfo;
-       const struct ipt_entry *e = e_void;
+       const struct ipt_ECN_info *einfo = par->targinfo;
+       const struct ipt_entry *e = par->entryinfo;
 
        if (einfo->operation & IPT_ECN_OP_MASK) {
                printk(KERN_WARNING "ECN: unsupported ECN operation %x\n",

diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index e9942aed35ae1bfba285605390182b3435448896..fc6ce04a3e35a809049a340edbc3e10470e5f28e 100644 (file)
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -440,12 +440,9 @@ log_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-log_tg_check(const char *tablename, const void *e,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool log_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ipt_log_info *loginfo = targinfo;
+       const struct ipt_log_info *loginfo = par->targinfo;
 
        if (loginfo->level >= 8) {
                pr_debug("LOG: level %u >= 8\n", loginfo->level);

diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index e0d9d49b79ee8d1d43b01cfcccd0a0ee4046f50a..f389f60cb105856f690faefd235a852e699c66ae 100644 (file)
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -31,12 +31,9 @@ MODULE_DESCRIPTION("Xtables: automatic-address SNAT");
 static DEFINE_RWLOCK(masq_lock);
 
 /* FIXME: Multiple targets. --RR */
-static bool
-masquerade_tg_check(const char *tablename, const void *e,
-                    const struct xt_target *target, void *targinfo,
-                    unsigned int hook_mask)
+static bool masquerade_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct nf_nat_multi_range_compat *mr = targinfo;
+       const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
        if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
                pr_debug("masquerade_check: bad MAP_IPS.\n");

diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index cf18f23b3460bc78444f6d564f7d5939794784b0..7c29582d4ec8cfcf84cf7d49eff6e03d1000c9d3 100644 (file)
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -22,12 +22,9 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Svenning Soerensen <svenning@post5.tele.dk>");
 MODULE_DESCRIPTION("Xtables: 1:1 NAT mapping of IPv4 subnets");
 
-static bool
-netmap_tg_check(const char *tablename, const void *e,
-                const struct xt_target *target, void *targinfo,
-                unsigned int hook_mask)
+static bool netmap_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct nf_nat_multi_range_compat *mr = targinfo;
+       const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
        if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
                pr_debug("NETMAP:check: bad MAP_IPS.\n");

diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 23adb09ddfb4fa87b97267735e66d9bda363248b..698e5e78685b18139180c8807ad28f619c43e0fd 100644 (file)
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -26,12 +26,9 @@ MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: Connection redirection to localhost");
 
 /* FIXME: Take multiple ranges --RR */
-static bool
-redirect_tg_check(const char *tablename, const void *e,
-                  const struct xt_target *target, void *targinfo,
-                  unsigned int hook_mask)
+static bool redirect_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct nf_nat_multi_range_compat *mr = targinfo;
+       const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
        if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
                pr_debug("redirect_check: bad MAP_IPS.\n");

diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index b36071bb10777cb1e362ef3c3d756229948385d0..0b4b6e0ff2b983985b5b6e3e7a695c6c731d1941 100644 (file)
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -175,13 +175,10 @@ reject_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return NF_DROP;
 }
 
-static bool
-reject_tg_check(const char *tablename, const void *e_void,
-                const struct xt_target *target, void *targinfo,
-                unsigned int hook_mask)
+static bool reject_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ipt_reject_info *rejinfo = targinfo;
-       const struct ipt_entry *e = e_void;
+       const struct ipt_reject_info *rejinfo = par->targinfo;
+       const struct ipt_entry *e = par->entryinfo;
 
        if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
                printk("ipt_REJECT: ECHOREPLY no longer supported.\n");

diff --git a/net/ipv4/netfilter/ipt_TTL.c b/net/ipv4/netfilter/ipt_TTL.c
index 05cbfd2f7470b2045c7eefa97cc7abe27f0da205..6d76aae90cc0e4260cd8238412247cec0c1ac33c 100644 (file)
--- a/net/ipv4/netfilter/ipt_TTL.c
+++ b/net/ipv4/netfilter/ipt_TTL.c
@@ -59,12 +59,9 @@ ttl_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-ttl_tg_check(const char *tablename, const void *e,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool ttl_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ipt_TTL_info *info = targinfo;
+       const struct ipt_TTL_info *info = par->targinfo;
 
        if (info->mode > IPT_TTL_MAXMODE) {
                printk(KERN_WARNING "ipt_TTL: invalid or unknown Mode %u\n",

diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 46c0df0dc2dc6a5ed8721fb3f348a35273f19d7c..18a2826b57c6f2c7e16cd2c091ca68db772b61f6 100644 (file)
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -313,12 +313,9 @@ static void ipt_logfn(u_int8_t pf,
        ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
 }
 
-static bool
-ulog_tg_check(const char *tablename, const void *e,
-              const struct xt_target *target, void *targinfo,
-              unsigned int hookmask)
+static bool ulog_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ipt_ulog_info *loginfo = targinfo;
+       const struct ipt_ulog_info *loginfo = par->targinfo;
 
        if (loginfo->prefix[sizeof(loginfo->prefix) - 1] != '\0') {
                pr_debug("ipt_ULOG: prefix term %i\n",

diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 83170ff131f984d3ec8f4e436654922e8efe6da9..bea54a685109ed3b6fa1fe3f621fb7522ceb2de8 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -128,13 +128,9 @@ ipt_dnat_target(struct sk_buff *skb, const struct xt_target_param *par)
        return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);
 }
 
-static bool ipt_snat_checkentry(const char *tablename,
-                               const void *entry,
-                               const struct xt_target *target,
-                               void *targinfo,
-                               unsigned int hook_mask)
+static bool ipt_snat_checkentry(const struct xt_tgchk_param *par)
 {
-       const struct nf_nat_multi_range_compat *mr = targinfo;
+       const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
        /* Must be a valid range */
        if (mr->rangesize != 1) {
@@ -144,13 +140,9 @@ static bool ipt_snat_checkentry(const char *tablename,
        return true;
 }
 
-static bool ipt_dnat_checkentry(const char *tablename,
-                               const void *entry,
-                               const struct xt_target *target,
-                               void *targinfo,
-                               unsigned int hook_mask)
+static bool ipt_dnat_checkentry(const struct xt_tgchk_param *par)
 {
-       const struct nf_nat_multi_range_compat *mr = targinfo;
+       const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
        /* Must be a valid range */
        if (mr->rangesize != 1) {

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index ee0986cdbd667eaa625925a715cc86150e497943..ca14fb8bd3620b2a53de7e0d0f186d6a92ebc7ea 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -679,15 +679,19 @@ err:
 
 static int check_target(struct ip6t_entry *e, const char *name)
 {
-       struct ip6t_entry_target *t;
-       struct xt_target *target;
+       struct ip6t_entry_target *t = ip6t_get_target(e);
+       struct xt_tgchk_param par = {
+               .table     = name,
+               .entryinfo = e,
+               .target    = t->u.kernel.target,
+               .targinfo  = t->data,
+               .hook_mask = e->comefrom,
+       };
        int ret;
 
        t = ip6t_get_target(e);
-       target = t->u.kernel.target;
-       ret = xt_check_target(target, AF_INET6, t->u.target_size - sizeof(*t),
-                             name, e->comefrom, e->ipv6.proto,
-                             e->ipv6.invflags & IP6T_INV_PROTO, e, t->data);
+       ret = xt_check_target(&par, NFPROTO_IPV6, t->u.target_size - sizeof(*t),
+             e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
        if (ret < 0) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         t->u.kernel.target->name);

diff --git a/net/ipv6/netfilter/ip6t_HL.c b/net/ipv6/netfilter/ip6t_HL.c
index ac759a54f2c665756e8ae798c3ee7d8f7f32d7d7..27b5adf670a2f933932c3c9d1fc254a1d015fc16 100644 (file)
--- a/net/ipv6/netfilter/ip6t_HL.c
+++ b/net/ipv6/netfilter/ip6t_HL.c
@@ -54,12 +54,9 @@ hl_tg6(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-hl_tg6_check(const char *tablename, const void *entry,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool hl_tg6_check(const struct xt_tgchk_param *par)
 {
-       const struct ip6t_HL_info *info = targinfo;
+       const struct ip6t_HL_info *info = par->targinfo;
 
        if (info->mode > IP6T_HL_MAXMODE) {
                printk(KERN_WARNING "ip6t_HL: invalid or unknown Mode %u\n",

diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index a31d3ecd1fc9fff09faf40e139646070b10e67ee..caa441d0956755e0e59f8aa62c8572d61b2eb89c 100644 (file)
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -453,12 +453,9 @@ log_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 }
 
 
-static bool
-log_tg6_check(const char *tablename, const void *entry,
-              const struct xt_target *target, void *targinfo,
-              unsigned int hook_mask)
+static bool log_tg6_check(const struct xt_tgchk_param *par)
 {
-       const struct ip6t_log_info *loginfo = targinfo;
+       const struct ip6t_log_info *loginfo = par->targinfo;
 
        if (loginfo->level >= 8) {
                pr_debug("LOG: level %u >= 8\n", loginfo->level);

diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 1d5f3a70ed0922c0fb2aee333119f7c56df143e4..0981b4ccb8b1c2c20ec4592dd6d0fc27b24f5514 100644 (file)
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -213,13 +213,10 @@ reject_tg6(struct sk_buff *skb, const struct xt_target_param *par)
        return NF_DROP;
 }
 
-static bool
-reject_tg6_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool reject_tg6_check(const struct xt_tgchk_param *par)
 {
-       const struct ip6t_reject_info *rejinfo = targinfo;
-       const struct ip6t_entry *e = entry;
+       const struct ip6t_reject_info *rejinfo = par->targinfo;
+       const struct ip6t_entry *e = par->entryinfo;
 
        if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
                printk("ip6t_REJECT: ECHOREPLY is not supported.\n");

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 817ab14f7cd6dde26a649dca7036754767f1fa83..f29513cd1399987809619b84081ef4113d1a92a6 100644 (file)
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -471,35 +471,35 @@ int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
 EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
 #endif /* CONFIG_COMPAT */
 
-int xt_check_target(const struct xt_target *target, unsigned short family,
-                   unsigned int size, const char *table, unsigned int hook_mask,
-                   unsigned short proto, int inv_proto, const void *entry,
-                   void *targinfo)
+int xt_check_target(struct xt_tgchk_param *par, u_int8_t family,
+                   unsigned int size, u_int8_t proto, bool inv_proto)
 {
-       if (XT_ALIGN(target->targetsize) != size) {
+       if (XT_ALIGN(par->target->targetsize) != size) {
                printk("%s_tables: %s target: invalid size %Zu != %u\n",
-                      xt_prefix[family], target->name,
-                      XT_ALIGN(target->targetsize), size);
+                      xt_prefix[family], par->target->name,
+                      XT_ALIGN(par->target->targetsize), size);
                return -EINVAL;
        }
-       if (target->table && strcmp(target->table, table)) {
+       if (par->target->table != NULL &&
+           strcmp(par->target->table, par->table) != 0) {
                printk("%s_tables: %s target: only valid in %s table, not %s\n",
-                      xt_prefix[family], target->name, target->table, table);
+                      xt_prefix[family], par->target->name,
+                      par->target->table, par->table);
                return -EINVAL;
        }
-       if (target->hooks && (hook_mask & ~target->hooks) != 0) {
+       if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
                printk("%s_tables: %s target: bad hook_mask %#x/%#x\n",
-                      xt_prefix[family], target->name, hook_mask,
-                      target->hooks);
+                      xt_prefix[family], par->target->name, par->hook_mask,
+                      par->target->hooks);
                return -EINVAL;
        }
-       if (target->proto && (target->proto != proto || inv_proto)) {
+       if (par->target->proto && (par->target->proto != proto || inv_proto)) {
                printk("%s_tables: %s target: only valid for protocol %u\n",
-                      xt_prefix[family], target->name, target->proto);
+                      xt_prefix[family], par->target->name,
+                      par->target->proto);
                return -EINVAL;
        }
-       if (target->checkentry != NULL &&
-           !target->checkentry(table, entry, target, targinfo, hook_mask))
+       if (par->target->checkentry != NULL && !par->target->checkentry(par))
                return -EINVAL;
        return 0;
 }

diff --git a/net/netfilter/xt_CONNMARK.c b/net/netfilter/xt_CONNMARK.c
index 95ed267328a737bff2f683a7ee23786669a5ac0e..8fc9f35e67dffc0400d256311de9cd8cdad80959 100644 (file)
--- a/net/netfilter/xt_CONNMARK.c
+++ b/net/netfilter/xt_CONNMARK.c
@@ -112,18 +112,15 @@ connmark_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-connmark_tg_check_v0(const char *tablename, const void *entry,
-                     const struct xt_target *target, void *targinfo,
-                     unsigned int hook_mask)
+static bool connmark_tg_check_v0(const struct xt_tgchk_param *par)
 {
-       const struct xt_connmark_target_info *matchinfo = targinfo;
+       const struct xt_connmark_target_info *matchinfo = par->targinfo;
 
        if (matchinfo->mode == XT_CONNMARK_RESTORE) {
-               if (strcmp(tablename, "mangle") != 0) {
+               if (strcmp(par->table, "mangle") != 0) {
                        printk(KERN_WARNING "CONNMARK: restore can only be "
                               "called from \"mangle\" table, not \"%s\"\n",
-                              tablename);
+                              par->table);
                        return false;
                }
        }
@@ -131,22 +128,19 @@ connmark_tg_check_v0(const char *tablename, const void *entry,
                printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
                return false;
        }
-       if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+       if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
                printk(KERN_WARNING "can't load conntrack support for "
-                                   "proto=%u\n", target->family);
+                                   "proto=%u\n", par->target->family);
                return false;
        }
        return true;
 }
 
-static bool
-connmark_tg_check(const char *tablename, const void *entry,
-                  const struct xt_target *target, void *targinfo,
-                  unsigned int hook_mask)
+static bool connmark_tg_check(const struct xt_tgchk_param *par)
 {
-       if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+       if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
                printk(KERN_WARNING "cannot load conntrack support for "
-                      "proto=%u\n", target->family);
+                      "proto=%u\n", par->target->family);
                return false;
        }
        return true;

diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index 2211a2cef2804688723d181776d54ce5bc375da3..2041a3d4b4d82b32c1b66117f28f7af61c0cf6a7 100644 (file)
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -85,16 +85,14 @@ connsecmark_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-connsecmark_tg_check(const char *tablename, const void *entry,
-                     const struct xt_target *target, void *targinfo,
-                     unsigned int hook_mask)
+static bool connsecmark_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct xt_connsecmark_target_info *info = targinfo;
+       const struct xt_connsecmark_target_info *info = par->targinfo;
 
-       if (strcmp(tablename, "mangle") && strcmp(tablename, "security")) {
+       if (strcmp(par->table, "mangle") != 0 &&
+           strcmp(par->table, "security") != 0) {
                printk(KERN_INFO PFX "target only valid in the \'mangle\' "
-                      "or \'security\' tables, not \'%s\'.\n", tablename);
+                      "or \'security\' tables, not \'%s\'.\n", par->table);
                return false;
        }
 
@@ -108,9 +106,9 @@ connsecmark_tg_check(const char *tablename, const void *entry,
                return false;
        }
 
-       if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+       if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
                printk(KERN_WARNING "can't load conntrack support for "
-                                   "proto=%u\n", target->family);
+                                   "proto=%u\n", par->target->family);
                return false;
        }
        return true;

diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index c78e80afdf3dd3fcdbd2420f0aca87c8a97aa033..6a347e768f862ed9a9621dfc23f27cf40b648ad2 100644 (file)
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -61,15 +61,12 @@ dscp_tg6(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-dscp_tg_check(const char *tablename, const void *e_void,
-              const struct xt_target *target, void *targinfo,
-              unsigned int hook_mask)
+static bool dscp_tg_check(const struct xt_tgchk_param *par)
 {
-       const u_int8_t dscp = ((struct xt_DSCP_info *)targinfo)->dscp;
+       const struct xt_DSCP_info *info = par->targinfo;
 
-       if (dscp > XT_DSCP_MAX) {
-               printk(KERN_WARNING "DSCP: dscp %x out of range\n", dscp);
+       if (info->dscp > XT_DSCP_MAX) {
+               printk(KERN_WARNING "DSCP: dscp %x out of range\n", info->dscp);
                return false;
        }
        return true;
@@ -95,12 +92,10 @@ tos_tg_v0(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-tos_tg_check_v0(const char *tablename, const void *e_void,
-                const struct xt_target *target, void *targinfo,
-                unsigned int hook_mask)
+static bool tos_tg_check_v0(const struct xt_tgchk_param *par)
 {
-       const u_int8_t tos = ((struct ipt_tos_target_info *)targinfo)->tos;
+       const struct ipt_tos_target_info *info = par->targinfo;
+       const uint8_t tos = info->tos;
 
        if (tos != IPTOS_LOWDELAY && tos != IPTOS_THROUGHPUT &&
            tos != IPTOS_RELIABILITY && tos != IPTOS_MINCOST &&

diff --git a/net/netfilter/xt_MARK.c b/net/netfilter/xt_MARK.c
index 27d03f396117a77a0ec38697e49bd1a20f8517f5..123ee0ba78c656ac5a0da1b6a95aff2bd09337f0 100644 (file)
--- a/net/netfilter/xt_MARK.c
+++ b/net/netfilter/xt_MARK.c
@@ -66,12 +66,9 @@ mark_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-mark_tg_check_v0(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool mark_tg_check_v0(const struct xt_tgchk_param *par)
 {
-       const struct xt_mark_target_info *markinfo = targinfo;
+       const struct xt_mark_target_info *markinfo = par->targinfo;
 
        if (markinfo->mark > 0xffffffff) {
                printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
@@ -80,12 +77,9 @@ mark_tg_check_v0(const char *tablename, const void *entry,
        return true;
 }
 
-static bool
-mark_tg_check_v1(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool mark_tg_check_v1(const struct xt_tgchk_param *par)
 {
-       const struct xt_mark_target_info_v1 *markinfo = targinfo;
+       const struct xt_mark_target_info_v1 *markinfo = par->targinfo;
 
        if (markinfo->mode != XT_MARK_SET
            && markinfo->mode != XT_MARK_AND

diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index 3218ad63bd1d9d43f1864ad1ba9c65438697ce91..56ee4f118b59557a38be1f67ddb4fb944793c806 100644 (file)
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -36,12 +36,9 @@ nflog_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-nflog_tg_check(const char *tablename, const void *entry,
-               const struct xt_target *target, void *targetinfo,
-               unsigned int hookmask)
+static bool nflog_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct xt_nflog_info *info = targetinfo;
+       const struct xt_nflog_info *info = par->targinfo;
 
        if (info->flags & ~XT_NFLOG_MASK)
                return false;

diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 92e33524f78491780927118ee011575855cedeac..edf4ab1f30ff94765f0104b05ad52e29f7333019 100644 (file)
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -84,14 +84,9 @@ xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return XT_CONTINUE;
 }
 
-static bool
-xt_rateest_tg_checkentry(const char *tablename,
-                        const void *entry,
-                        const struct xt_target *target,
-                        void *targinfo,
-                        unsigned int hook_mask)
+static bool xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
 {
-       struct xt_rateest_target_info *info = targinfo;
+       struct xt_rateest_target_info *info = par->targinfo;
        struct xt_rateest *est;
        struct {
                struct nlattr           opt;

diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index ad05214e380900dd2f409bbd434b5ff9fa693597..e5777227192cd536cc64daaf750c7abd51827f20 100644 (file)
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -80,16 +80,14 @@ static bool checkentry_selinux(struct xt_secmark_target_info *info)
        return true;
 }
 
-static bool
-secmark_tg_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool secmark_tg_check(const struct xt_tgchk_param *par)
 {
-       struct xt_secmark_target_info *info = targinfo;
+       struct xt_secmark_target_info *info = par->targinfo;
 
-       if (strcmp(tablename, "mangle") && strcmp(tablename, "security")) {
+       if (strcmp(par->table, "mangle") != 0 &&
+           strcmp(par->table, "security") != 0) {
                printk(KERN_INFO PFX "target only valid in the \'mangle\' "
-                      "or \'security\' tables, not \'%s\'.\n", tablename);
+                      "or \'security\' tables, not \'%s\'.\n", par->table);
                return false;
        }
 

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index e08762d9b0ffc8ea527026b8facf48c5541be57c..4f3b1f8087958e51b6a0161c848fa142335eb2e8 100644 (file)
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -237,16 +237,13 @@ static inline bool find_syn_match(const struct xt_entry_match *m)
        return false;
 }
 
-static bool
-tcpmss_tg4_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
 {
-       const struct xt_tcpmss_info *info = targinfo;
-       const struct ipt_entry *e = entry;
+       const struct xt_tcpmss_info *info = par->targinfo;
+       const struct ipt_entry *e = par->entryinfo;
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
-           (hook_mask & ~((1 << NF_INET_FORWARD) |
+           (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                           (1 << NF_INET_LOCAL_OUT) |
                           (1 << NF_INET_POST_ROUTING))) != 0) {
                printk("xt_TCPMSS: path-MTU clamping only supported in "
@@ -260,16 +257,13 @@ tcpmss_tg4_check(const char *tablename, const void *entry,
 }
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-static bool
-tcpmss_tg6_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
 {
-       const struct xt_tcpmss_info *info = targinfo;
-       const struct ip6t_entry *e = entry;
+       const struct xt_tcpmss_info *info = par->targinfo;
+       const struct ip6t_entry *e = par->entryinfo;
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
-           (hook_mask & ~((1 << NF_INET_FORWARD) |
+           (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                           (1 << NF_INET_LOCAL_OUT) |
                           (1 << NF_INET_POST_ROUTING))) != 0) {
                printk("xt_TCPMSS: path-MTU clamping only supported in "

diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index f08c49ea4bdc5d5fb4d8b1867d48014257c23303..1340c2fa3621e54f651d4a66b25edd79007e93c2 100644 (file)
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -59,14 +59,9 @@ tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par)
        return NF_DROP;
 }
 
-static bool
-tproxy_tg_check(const char *tablename,
-               const void *entry,
-               const struct xt_target *target,
-               void *targetinfo,
-               unsigned int hook_mask)
+static bool tproxy_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct ipt_ip *i = entry;
+       const struct ipt_ip *i = par->entryinfo;
 
        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
            && !(i->invflags & IPT_INV_PROTO))

diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 89791a56429a4725fec05042e30313a831511aaa..a54dc3f8234f3554f8c946abc651bada7d91c986 100644 (file)
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -40,6 +40,7 @@ static struct tcf_hashinfo ipt_hash_info = {
 
 static int ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
 {
+       struct xt_tgchk_param par;
        struct xt_target *target;
        int ret = 0;
 
@@ -49,9 +50,14 @@ static int ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int
                return -ENOENT;
 
        t->u.kernel.target = target;
-
-       ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
-                             table, hook, 0, 0, NULL, t->data);
+       par.table     = table;
+       par.entryinfo = NULL;
+       par.target    = target;
+       par.targinfo  = t->data;
+       par.hook_mask = hook;
+
+       ret = xt_check_target(&par, NFPROTO_IPV4,
+             t->u.target_size - sizeof(*t), 0, false);
        if (ret < 0) {
                module_put(t->u.kernel.target->me);
                return ret;