提交 98e86403 编写于 作者: J Jan Engelhardt

netfilter: xtables: consolidate open-coded logic

Signed-off-by: NJan Engelhardt <jengelh@medozas.de>
上级 4f2f6f23
......@@ -142,6 +142,12 @@ static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
return 0;
}
static inline __pure
struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
{
return (void *)entry + entry->next_offset;
}
/* Do some firewalling */
unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out,
......@@ -249,8 +255,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
/* jump to a udc */
cs[sp].n = i + 1;
cs[sp].chaininfo = chaininfo;
cs[sp].e = (struct ebt_entry *)
(((char *)point) + point->next_offset);
cs[sp].e = ebt_next_entry(point);
i = 0;
chaininfo = (struct ebt_entries *) (base + verdict);
#ifdef CONFIG_NETFILTER_DEBUG
......@@ -266,8 +271,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
sp++;
continue;
letscontinue:
point = (struct ebt_entry *)
(((char *)point) + point->next_offset);
point = ebt_next_entry(point);
i++;
}
......@@ -787,7 +791,7 @@ static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s
/* this can't be 0, so the loop test is correct */
cl_s[i].cs.n = pos + 1;
pos = 0;
cl_s[i].cs.e = ((void *)e + e->next_offset);
cl_s[i].cs.e = ebt_next_entry(e);
e = (struct ebt_entry *)(hlp2->data);
nentries = hlp2->nentries;
cl_s[i].from = chain_nr;
......@@ -797,7 +801,7 @@ static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s
continue;
}
letscontinue:
e = (void *)e + e->next_offset;
e = ebt_next_entry(e);
pos++;
}
return 0;
......
......@@ -231,6 +231,12 @@ static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
return (struct arpt_entry *)(base + offset);
}
static inline __pure
struct arpt_entry *arpt_next_entry(const struct arpt_entry *entry)
{
return (void *)entry + entry->next_offset;
}
unsigned int arpt_do_table(struct sk_buff *skb,
unsigned int hook,
const struct net_device *in,
......@@ -295,10 +301,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
continue;
}
if (table_base + v
!= (void *)e + e->next_offset) {
!= arpt_next_entry(e)) {
/* Save old back ptr in next entry */
struct arpt_entry *next
= (void *)e + e->next_offset;
= arpt_next_entry(e);
next->comefrom =
(void *)back - table_base;
......@@ -320,13 +326,13 @@ unsigned int arpt_do_table(struct sk_buff *skb,
arp = arp_hdr(skb);
if (verdict == ARPT_CONTINUE)
e = (void *)e + e->next_offset;
e = arpt_next_entry(e);
else
/* Verdict */
break;
}
} else {
e = (void *)e + e->next_offset;
e = arpt_next_entry(e);
}
} while (!hotdrop);
xt_info_rdunlock_bh();
......
......@@ -297,6 +297,12 @@ static void trace_packet(struct sk_buff *skb,
}
#endif
static inline __pure
struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
{
return (void *)entry + entry->next_offset;
}
/* Returns one of the generic firewall policies, like NF_ACCEPT. */
unsigned int
ipt_do_table(struct sk_buff *skb,
......@@ -385,11 +391,11 @@ ipt_do_table(struct sk_buff *skb,
back->comefrom);
continue;
}
if (table_base + v != (void *)e + e->next_offset
if (table_base + v != ipt_next_entry(e)
&& !(e->ip.flags & IPT_F_GOTO)) {
/* Save old back ptr in next entry */
struct ipt_entry *next
= (void *)e + e->next_offset;
= ipt_next_entry(e);
next->comefrom
= (void *)back - table_base;
/* set back pointer to next entry */
......@@ -424,7 +430,7 @@ ipt_do_table(struct sk_buff *skb,
datalen = skb->len - ip->ihl * 4;
if (verdict == IPT_CONTINUE)
e = (void *)e + e->next_offset;
e = ipt_next_entry(e);
else
/* Verdict */
break;
......@@ -432,7 +438,7 @@ ipt_do_table(struct sk_buff *skb,
} else {
no_match:
e = (void *)e + e->next_offset;
e = ipt_next_entry(e);
}
} while (!hotdrop);
xt_info_rdunlock_bh();
......
......@@ -329,6 +329,12 @@ static void trace_packet(struct sk_buff *skb,
}
#endif
static inline __pure struct ip6t_entry *
ip6t_next_entry(const struct ip6t_entry *entry)
{
return (void *)entry + entry->next_offset;
}
/* Returns one of the generic firewall policies, like NF_ACCEPT. */
unsigned int
ip6t_do_table(struct sk_buff *skb,
......@@ -414,11 +420,11 @@ ip6t_do_table(struct sk_buff *skb,
back->comefrom);
continue;
}
if (table_base + v != (void *)e + e->next_offset
if (table_base + v != ip6t_next_entry(e)
&& !(e->ipv6.flags & IP6T_F_GOTO)) {
/* Save old back ptr in next entry */
struct ip6t_entry *next
= (void *)e + e->next_offset;
= ip6t_next_entry(e);
next->comefrom
= (void *)back - table_base;
/* set back pointer to next entry */
......@@ -451,7 +457,7 @@ ip6t_do_table(struct sk_buff *skb,
= 0x57acc001;
#endif
if (verdict == IP6T_CONTINUE)
e = (void *)e + e->next_offset;
e = ip6t_next_entry(e);
else
/* Verdict */
break;
......@@ -459,7 +465,7 @@ ip6t_do_table(struct sk_buff *skb,
} else {
no_match:
e = (void *)e + e->next_offset;
e = ip6t_next_entry(e);
}
} while (!hotdrop);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册