Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
Linux-御风守护者
linux
提交
243bf6e2
L
linux
项目概览
Linux-御风守护者
/
linux
与 Fork 源项目一致
从无法访问的项目Fork
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
L
linux
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
243bf6e2
编写于
10月 13, 2010
作者:
J
Jan Engelhardt
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
netfilter: xtables: resolve indirect macros 3/3
上级
87a2e70d
变更
8
隐藏空白更改
内联
并排
Showing
8 changed file
with
94 addition
and
131 deletion
+94
-131
include/linux/netfilter_arp/arp_tables.h
include/linux/netfilter_arp/arp_tables.h
+10
-23
include/linux/netfilter_ipv4/ip_tables.h
include/linux/netfilter_ipv4/ip_tables.h
+32
-37
include/linux/netfilter_ipv6/ip6_tables.h
include/linux/netfilter_ipv6/ip6_tables.h
+25
-44
net/ipv4/netfilter/arp_tables.c
net/ipv4/netfilter/arp_tables.c
+7
-7
net/ipv4/netfilter/arpt_mangle.c
net/ipv4/netfilter/arpt_mangle.c
+1
-1
net/ipv4/netfilter/ip_tables.c
net/ipv4/netfilter/ip_tables.c
+9
-9
net/ipv6/netfilter/ip6_tables.c
net/ipv6/netfilter/ip6_tables.c
+9
-9
net/sched/act_ipt.c
net/sched/act_ipt.c
+1
-1
未找到文件。
include/linux/netfilter_arp/arp_tables.h
浏览文件 @
243bf6e2
...
...
@@ -26,6 +26,14 @@
#define ARPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
#define arpt_entry_target xt_entry_target
#define arpt_standard_target xt_standard_target
#define ARPT_CONTINUE XT_CONTINUE
#define ARPT_RETURN XT_RETURN
#define arpt_counters_info xt_counters_info
#define arpt_counters xt_counters
#define ARPT_STANDARD_TARGET XT_STANDARD_TARGET
#define ARPT_ERROR_TARGET XT_ERROR_TARGET
#define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
XT_ENTRY_ITERATE(struct arpt_entry, entries, size, fn, ## args)
#endif
#define ARPT_DEV_ADDR_LEN_MAX 16
...
...
@@ -126,12 +134,6 @@ struct arpt_entry
#define ARPT_SO_GET_REVISION_TARGET (ARPT_BASE_CTL + 3)
#define ARPT_SO_GET_MAX (ARPT_SO_GET_REVISION_TARGET)
/* CONTINUE verdict for targets */
#define ARPT_CONTINUE XT_CONTINUE
/* For standard target */
#define ARPT_RETURN XT_RETURN
/* The argument to ARPT_SO_GET_INFO */
struct
arpt_getinfo
{
/* Which table: caller fills this in. */
...
...
@@ -185,10 +187,6 @@ struct arpt_replace {
struct
arpt_entry
entries
[
0
];
};
/* The argument to ARPT_SO_ADD_COUNTERS. */
#define arpt_counters_info xt_counters_info
#define arpt_counters xt_counters
/* The argument to ARPT_SO_GET_ENTRIES. */
struct
arpt_get_entries
{
/* Which table: user fills this in. */
...
...
@@ -201,23 +199,12 @@ struct arpt_get_entries {
struct
arpt_entry
entrytable
[
0
];
};
/* Standard return verdict, or do jump. */
#define ARPT_STANDARD_TARGET XT_STANDARD_TARGET
/* Error verdict. */
#define ARPT_ERROR_TARGET XT_ERROR_TARGET
/* Helper functions */
static
__inline__
struct
xt_entry_target
*
arpt_get_target
(
struct
arpt_entry
*
e
)
{
return
(
void
*
)
e
+
e
->
target_offset
;
}
#ifndef __KERNEL__
/* fn returns 0 to continue iteration */
#define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
XT_ENTRY_ITERATE(struct arpt_entry, entries, size, fn, ## args)
#endif
/*
* Main firewall chains definitions and global var's definitions.
*/
...
...
@@ -248,7 +235,7 @@ struct arpt_error {
#define ARPT_STANDARD_INIT(__verdict) \
{ \
.entry = ARPT_ENTRY_INIT(sizeof(struct arpt_standard)), \
.target = XT_TARGET_INIT(
ARP
T_STANDARD_TARGET, \
.target = XT_TARGET_INIT(
X
T_STANDARD_TARGET, \
sizeof(struct xt_standard_target)), \
.target.verdict = -(__verdict) - 1, \
}
...
...
@@ -256,7 +243,7 @@ struct arpt_error {
#define ARPT_ERROR_INIT \
{ \
.entry = ARPT_ENTRY_INIT(sizeof(struct arpt_error)), \
.target = XT_TARGET_INIT(
ARP
T_ERROR_TARGET, \
.target = XT_TARGET_INIT(
X
T_ERROR_TARGET, \
sizeof(struct arpt_error_target)), \
.target.errorname = "ERROR", \
}
...
...
include/linux/netfilter_ipv4/ip_tables.h
浏览文件 @
243bf6e2
...
...
@@ -38,6 +38,36 @@
#define ipt_entry_target xt_entry_target
#define ipt_standard_target xt_standard_target
#define ipt_counters xt_counters
#define IPT_CONTINUE XT_CONTINUE
#define IPT_RETURN XT_RETURN
/* This group is older than old (iptables < v1.4.0-rc1~89) */
#include <linux/netfilter/xt_tcpudp.h>
#define ipt_udp xt_udp
#define ipt_tcp xt_tcp
#define IPT_TCP_INV_SRCPT XT_TCP_INV_SRCPT
#define IPT_TCP_INV_DSTPT XT_TCP_INV_DSTPT
#define IPT_TCP_INV_FLAGS XT_TCP_INV_FLAGS
#define IPT_TCP_INV_OPTION XT_TCP_INV_OPTION
#define IPT_TCP_INV_MASK XT_TCP_INV_MASK
#define IPT_UDP_INV_SRCPT XT_UDP_INV_SRCPT
#define IPT_UDP_INV_DSTPT XT_UDP_INV_DSTPT
#define IPT_UDP_INV_MASK XT_UDP_INV_MASK
/* The argument to IPT_SO_ADD_COUNTERS. */
#define ipt_counters_info xt_counters_info
/* Standard return verdict, or do jump. */
#define IPT_STANDARD_TARGET XT_STANDARD_TARGET
/* Error verdict. */
#define IPT_ERROR_TARGET XT_ERROR_TARGET
/* fn returns 0 to continue iteration */
#define IPT_MATCH_ITERATE(e, fn, args...) \
XT_MATCH_ITERATE(struct ipt_entry, e, fn, ## args)
/* fn returns 0 to continue iteration */
#define IPT_ENTRY_ITERATE(entries, size, fn, args...) \
XT_ENTRY_ITERATE(struct ipt_entry, entries, size, fn, ## args)
#endif
/* Yes, Virginia, you have to zero the padding. */
...
...
@@ -116,23 +146,6 @@ struct ipt_entry {
#define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3)
#define IPT_SO_GET_MAX IPT_SO_GET_REVISION_TARGET
#define IPT_CONTINUE XT_CONTINUE
#define IPT_RETURN XT_RETURN
#include <linux/netfilter/xt_tcpudp.h>
#define ipt_udp xt_udp
#define ipt_tcp xt_tcp
#define IPT_TCP_INV_SRCPT XT_TCP_INV_SRCPT
#define IPT_TCP_INV_DSTPT XT_TCP_INV_DSTPT
#define IPT_TCP_INV_FLAGS XT_TCP_INV_FLAGS
#define IPT_TCP_INV_OPTION XT_TCP_INV_OPTION
#define IPT_TCP_INV_MASK XT_TCP_INV_MASK
#define IPT_UDP_INV_SRCPT XT_UDP_INV_SRCPT
#define IPT_UDP_INV_DSTPT XT_UDP_INV_DSTPT
#define IPT_UDP_INV_MASK XT_UDP_INV_MASK
/* ICMP matching stuff */
struct
ipt_icmp
{
u_int8_t
type
;
/* type to match */
...
...
@@ -196,9 +209,6 @@ struct ipt_replace {
struct
ipt_entry
entries
[
0
];
};
/* The argument to IPT_SO_ADD_COUNTERS. */
#define ipt_counters_info xt_counters_info
/* The argument to IPT_SO_GET_ENTRIES. */
struct
ipt_get_entries
{
/* Which table: user fills this in. */
...
...
@@ -211,11 +221,6 @@ struct ipt_get_entries {
struct
ipt_entry
entrytable
[
0
];
};
/* Standard return verdict, or do jump. */
#define IPT_STANDARD_TARGET XT_STANDARD_TARGET
/* Error verdict. */
#define IPT_ERROR_TARGET XT_ERROR_TARGET
/* Helper functions */
static
__inline__
struct
xt_entry_target
*
ipt_get_target
(
struct
ipt_entry
*
e
)
...
...
@@ -223,16 +228,6 @@ ipt_get_target(struct ipt_entry *e)
return
(
void
*
)
e
+
e
->
target_offset
;
}
#ifndef __KERNEL__
/* fn returns 0 to continue iteration */
#define IPT_MATCH_ITERATE(e, fn, args...) \
XT_MATCH_ITERATE(struct ipt_entry, e, fn, ## args)
/* fn returns 0 to continue iteration */
#define IPT_ENTRY_ITERATE(entries, size, fn, args...) \
XT_ENTRY_ITERATE(struct ipt_entry, entries, size, fn, ## args)
#endif
/*
* Main firewall chains definitions and global var's definitions.
*/
...
...
@@ -271,7 +266,7 @@ struct ipt_error {
#define IPT_STANDARD_INIT(__verdict) \
{ \
.entry = IPT_ENTRY_INIT(sizeof(struct ipt_standard)), \
.target = XT_TARGET_INIT(
IP
T_STANDARD_TARGET, \
.target = XT_TARGET_INIT(
X
T_STANDARD_TARGET, \
sizeof(struct xt_standard_target)), \
.target.verdict = -(__verdict) - 1, \
}
...
...
@@ -279,7 +274,7 @@ struct ipt_error {
#define IPT_ERROR_INIT \
{ \
.entry = IPT_ENTRY_INIT(sizeof(struct ipt_error)), \
.target = XT_TARGET_INIT(
IP
T_ERROR_TARGET, \
.target = XT_TARGET_INIT(
X
T_ERROR_TARGET, \
sizeof(struct ipt_error_target)), \
.target.errorname = "ERROR", \
}
...
...
include/linux/netfilter_ipv6/ip6_tables.h
浏览文件 @
243bf6e2
...
...
@@ -38,6 +38,29 @@
#define ip6t_entry_target xt_entry_target
#define ip6t_standard_target xt_standard_target
#define ip6t_counters xt_counters
#define IP6T_CONTINUE XT_CONTINUE
#define IP6T_RETURN XT_RETURN
/* Pre-iptables-1.4.0 */
#include <linux/netfilter/xt_tcpudp.h>
#define ip6t_tcp xt_tcp
#define ip6t_udp xt_udp
#define IP6T_TCP_INV_SRCPT XT_TCP_INV_SRCPT
#define IP6T_TCP_INV_DSTPT XT_TCP_INV_DSTPT
#define IP6T_TCP_INV_FLAGS XT_TCP_INV_FLAGS
#define IP6T_TCP_INV_OPTION XT_TCP_INV_OPTION
#define IP6T_TCP_INV_MASK XT_TCP_INV_MASK
#define IP6T_UDP_INV_SRCPT XT_UDP_INV_SRCPT
#define IP6T_UDP_INV_DSTPT XT_UDP_INV_DSTPT
#define IP6T_UDP_INV_MASK XT_UDP_INV_MASK
#define ip6t_counters_info xt_counters_info
#define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
#define IP6T_ERROR_TARGET XT_ERROR_TARGET
#define IP6T_MATCH_ITERATE(e, fn, args...) \
XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
#define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
#endif
/* Yes, Virginia, you have to zero the padding. */
...
...
@@ -133,7 +156,7 @@ struct ip6t_error {
#define IP6T_STANDARD_INIT(__verdict) \
{ \
.entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_standard)), \
.target = XT_TARGET_INIT(
IP6
T_STANDARD_TARGET, \
.target = XT_TARGET_INIT(
X
T_STANDARD_TARGET, \
sizeof(struct xt_standard_target)), \
.target.verdict = -(__verdict) - 1, \
}
...
...
@@ -141,7 +164,7 @@ struct ip6t_error {
#define IP6T_ERROR_INIT \
{ \
.entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_error)), \
.target = XT_TARGET_INIT(
IP6
T_ERROR_TARGET, \
.target = XT_TARGET_INIT(
X
T_ERROR_TARGET, \
sizeof(struct ip6t_error_target)), \
.target.errorname = "ERROR", \
}
...
...
@@ -165,30 +188,6 @@ struct ip6t_error {
#define IP6T_SO_GET_REVISION_TARGET (IP6T_BASE_CTL + 5)
#define IP6T_SO_GET_MAX IP6T_SO_GET_REVISION_TARGET
/* CONTINUE verdict for targets */
#define IP6T_CONTINUE XT_CONTINUE
/* For standard target */
#define IP6T_RETURN XT_RETURN
/* TCP/UDP matching stuff */
#include <linux/netfilter/xt_tcpudp.h>
#define ip6t_tcp xt_tcp
#define ip6t_udp xt_udp
/* Values for "inv" field in struct ipt_tcp. */
#define IP6T_TCP_INV_SRCPT XT_TCP_INV_SRCPT
#define IP6T_TCP_INV_DSTPT XT_TCP_INV_DSTPT
#define IP6T_TCP_INV_FLAGS XT_TCP_INV_FLAGS
#define IP6T_TCP_INV_OPTION XT_TCP_INV_OPTION
#define IP6T_TCP_INV_MASK XT_TCP_INV_MASK
/* Values for "invflags" field in struct ipt_udp. */
#define IP6T_UDP_INV_SRCPT XT_UDP_INV_SRCPT
#define IP6T_UDP_INV_DSTPT XT_UDP_INV_DSTPT
#define IP6T_UDP_INV_MASK XT_UDP_INV_MASK
/* ICMP matching stuff */
struct
ip6t_icmp
{
u_int8_t
type
;
/* type to match */
...
...
@@ -252,9 +251,6 @@ struct ip6t_replace {
struct
ip6t_entry
entries
[
0
];
};
/* The argument to IP6T_SO_ADD_COUNTERS. */
#define ip6t_counters_info xt_counters_info
/* The argument to IP6T_SO_GET_ENTRIES. */
struct
ip6t_get_entries
{
/* Which table: user fills this in. */
...
...
@@ -267,11 +263,6 @@ struct ip6t_get_entries {
struct
ip6t_entry
entrytable
[
0
];
};
/* Standard return verdict, or do jump. */
#define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
/* Error verdict. */
#define IP6T_ERROR_TARGET XT_ERROR_TARGET
/* Helper functions */
static
__inline__
struct
xt_entry_target
*
ip6t_get_target
(
struct
ip6t_entry
*
e
)
...
...
@@ -279,16 +270,6 @@ ip6t_get_target(struct ip6t_entry *e)
return
(
void
*
)
e
+
e
->
target_offset
;
}
#ifndef __KERNEL__
/* fn returns 0 to continue iteration */
#define IP6T_MATCH_ITERATE(e, fn, args...) \
XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
/* fn returns 0 to continue iteration */
#define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
#endif
/*
* Main firewall chains definitions and global var's definitions.
*/
...
...
net/ipv4/netfilter/arp_tables.c
浏览文件 @
243bf6e2
...
...
@@ -300,7 +300,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
v
=
((
struct
xt_standard_target
*
)
t
)
->
verdict
;
if
(
v
<
0
)
{
/* Pop from stack? */
if
(
v
!=
ARP
T_RETURN
)
{
if
(
v
!=
X
T_RETURN
)
{
verdict
=
(
unsigned
)(
-
v
)
-
1
;
break
;
}
...
...
@@ -332,7 +332,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
/* Target might have changed stuff. */
arp
=
arp_hdr
(
skb
);
if
(
verdict
==
ARP
T_CONTINUE
)
if
(
verdict
==
X
T_CONTINUE
)
e
=
arpt_next_entry
(
e
);
else
/* Verdict */
...
...
@@ -392,13 +392,13 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
/* Unconditional return/END. */
if
((
e
->
target_offset
==
sizeof
(
struct
arpt_entry
)
&&
(
strcmp
(
t
->
target
.
u
.
user
.
name
,
ARP
T_STANDARD_TARGET
)
==
0
)
&&
X
T_STANDARD_TARGET
)
==
0
)
&&
t
->
verdict
<
0
&&
unconditional
(
&
e
->
arp
))
||
visited
)
{
unsigned
int
oldpos
,
size
;
if
((
strcmp
(
t
->
target
.
u
.
user
.
name
,
ARP
T_STANDARD_TARGET
)
==
0
)
&&
X
T_STANDARD_TARGET
)
==
0
)
&&
t
->
verdict
<
-
NF_MAX_VERDICT
-
1
)
{
duprintf
(
"mark_source_chains: bad "
"negative verdict (%i)
\n
"
,
...
...
@@ -433,7 +433,7 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
int
newpos
=
t
->
verdict
;
if
(
strcmp
(
t
->
target
.
u
.
user
.
name
,
ARP
T_STANDARD_TARGET
)
==
0
&&
X
T_STANDARD_TARGET
)
==
0
&&
newpos
>=
0
)
{
if
(
newpos
>
newinfo
->
size
-
sizeof
(
struct
arpt_entry
))
{
...
...
@@ -1828,7 +1828,7 @@ void arpt_unregister_table(struct xt_table *table)
/* The built-in targets: standard (NULL) and error. */
static
struct
xt_target
arpt_builtin_tg
[]
__read_mostly
=
{
{
.
name
=
ARP
T_STANDARD_TARGET
,
.
name
=
X
T_STANDARD_TARGET
,
.
targetsize
=
sizeof
(
int
),
.
family
=
NFPROTO_ARP
,
#ifdef CONFIG_COMPAT
...
...
@@ -1838,7 +1838,7 @@ static struct xt_target arpt_builtin_tg[] __read_mostly = {
#endif
},
{
.
name
=
ARP
T_ERROR_TARGET
,
.
name
=
X
T_ERROR_TARGET
,
.
target
=
arpt_error
,
.
targetsize
=
XT_FUNCTION_MAXNAMELEN
,
.
family
=
NFPROTO_ARP
,
...
...
net/ipv4/netfilter/arpt_mangle.c
浏览文件 @
243bf6e2
...
...
@@ -63,7 +63,7 @@ static int checkentry(const struct xt_tgchk_param *par)
return
false
;
if
(
mangle
->
target
!=
NF_DROP
&&
mangle
->
target
!=
NF_ACCEPT
&&
mangle
->
target
!=
ARP
T_CONTINUE
)
mangle
->
target
!=
X
T_CONTINUE
)
return
false
;
return
true
;
}
...
...
net/ipv4/netfilter/ip_tables.c
浏览文件 @
243bf6e2
...
...
@@ -232,7 +232,7 @@ get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
{
const
struct
xt_standard_target
*
t
=
(
void
*
)
ipt_get_target_c
(
s
);
if
(
strcmp
(
t
->
target
.
u
.
kernel
.
target
->
name
,
IP
T_ERROR_TARGET
)
==
0
)
{
if
(
strcmp
(
t
->
target
.
u
.
kernel
.
target
->
name
,
X
T_ERROR_TARGET
)
==
0
)
{
/* Head of user chain: ERROR target with chainname */
*
chainname
=
t
->
target
.
data
;
(
*
rulenum
)
=
0
;
...
...
@@ -241,7 +241,7 @@ get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
if
(
s
->
target_offset
==
sizeof
(
struct
ipt_entry
)
&&
strcmp
(
t
->
target
.
u
.
kernel
.
target
->
name
,
IP
T_STANDARD_TARGET
)
==
0
&&
X
T_STANDARD_TARGET
)
==
0
&&
t
->
verdict
<
0
&&
unconditional
(
&
s
->
ip
))
{
/* Tail of chains: STANDARD target (return/policy) */
...
...
@@ -383,7 +383,7 @@ ipt_do_table(struct sk_buff *skb,
v
=
((
struct
xt_standard_target
*
)
t
)
->
verdict
;
if
(
v
<
0
)
{
/* Pop from stack? */
if
(
v
!=
IP
T_RETURN
)
{
if
(
v
!=
X
T_RETURN
)
{
verdict
=
(
unsigned
)(
-
v
)
-
1
;
break
;
}
...
...
@@ -421,7 +421,7 @@ ipt_do_table(struct sk_buff *skb,
verdict
=
t
->
u
.
kernel
.
target
->
target
(
skb
,
&
acpar
);
/* Target might have changed stuff. */
ip
=
ip_hdr
(
skb
);
if
(
verdict
==
IP
T_CONTINUE
)
if
(
verdict
==
X
T_CONTINUE
)
e
=
ipt_next_entry
(
e
);
else
/* Verdict */
...
...
@@ -475,13 +475,13 @@ mark_source_chains(const struct xt_table_info *newinfo,
/* Unconditional return/END. */
if
((
e
->
target_offset
==
sizeof
(
struct
ipt_entry
)
&&
(
strcmp
(
t
->
target
.
u
.
user
.
name
,
IP
T_STANDARD_TARGET
)
==
0
)
&&
X
T_STANDARD_TARGET
)
==
0
)
&&
t
->
verdict
<
0
&&
unconditional
(
&
e
->
ip
))
||
visited
)
{
unsigned
int
oldpos
,
size
;
if
((
strcmp
(
t
->
target
.
u
.
user
.
name
,
IP
T_STANDARD_TARGET
)
==
0
)
&&
X
T_STANDARD_TARGET
)
==
0
)
&&
t
->
verdict
<
-
NF_MAX_VERDICT
-
1
)
{
duprintf
(
"mark_source_chains: bad "
"negative verdict (%i)
\n
"
,
...
...
@@ -524,7 +524,7 @@ mark_source_chains(const struct xt_table_info *newinfo,
int
newpos
=
t
->
verdict
;
if
(
strcmp
(
t
->
target
.
u
.
user
.
name
,
IP
T_STANDARD_TARGET
)
==
0
&&
X
T_STANDARD_TARGET
)
==
0
&&
newpos
>=
0
)
{
if
(
newpos
>
newinfo
->
size
-
sizeof
(
struct
ipt_entry
))
{
...
...
@@ -2176,7 +2176,7 @@ static int icmp_checkentry(const struct xt_mtchk_param *par)
static
struct
xt_target
ipt_builtin_tg
[]
__read_mostly
=
{
{
.
name
=
IP
T_STANDARD_TARGET
,
.
name
=
X
T_STANDARD_TARGET
,
.
targetsize
=
sizeof
(
int
),
.
family
=
NFPROTO_IPV4
,
#ifdef CONFIG_COMPAT
...
...
@@ -2186,7 +2186,7 @@ static struct xt_target ipt_builtin_tg[] __read_mostly = {
#endif
},
{
.
name
=
IP
T_ERROR_TARGET
,
.
name
=
X
T_ERROR_TARGET
,
.
target
=
ipt_error
,
.
targetsize
=
XT_FUNCTION_MAXNAMELEN
,
.
family
=
NFPROTO_IPV4
,
...
...
net/ipv6/netfilter/ip6_tables.c
浏览文件 @
243bf6e2
...
...
@@ -262,7 +262,7 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
{
const
struct
xt_standard_target
*
t
=
(
void
*
)
ip6t_get_target_c
(
s
);
if
(
strcmp
(
t
->
target
.
u
.
kernel
.
target
->
name
,
IP6
T_ERROR_TARGET
)
==
0
)
{
if
(
strcmp
(
t
->
target
.
u
.
kernel
.
target
->
name
,
X
T_ERROR_TARGET
)
==
0
)
{
/* Head of user chain: ERROR target with chainname */
*
chainname
=
t
->
target
.
data
;
(
*
rulenum
)
=
0
;
...
...
@@ -271,7 +271,7 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
if
(
s
->
target_offset
==
sizeof
(
struct
ip6t_entry
)
&&
strcmp
(
t
->
target
.
u
.
kernel
.
target
->
name
,
IP6
T_STANDARD_TARGET
)
==
0
&&
X
T_STANDARD_TARGET
)
==
0
&&
t
->
verdict
<
0
&&
unconditional
(
&
s
->
ipv6
))
{
/* Tail of chains: STANDARD target (return/policy) */
...
...
@@ -406,7 +406,7 @@ ip6t_do_table(struct sk_buff *skb,
v
=
((
struct
xt_standard_target
*
)
t
)
->
verdict
;
if
(
v
<
0
)
{
/* Pop from stack? */
if
(
v
!=
IP6
T_RETURN
)
{
if
(
v
!=
X
T_RETURN
)
{
verdict
=
(
unsigned
)(
-
v
)
-
1
;
break
;
}
...
...
@@ -434,7 +434,7 @@ ip6t_do_table(struct sk_buff *skb,
acpar
.
targinfo
=
t
->
data
;
verdict
=
t
->
u
.
kernel
.
target
->
target
(
skb
,
&
acpar
);
if
(
verdict
==
IP6
T_CONTINUE
)
if
(
verdict
==
X
T_CONTINUE
)
e
=
ip6t_next_entry
(
e
);
else
/* Verdict */
...
...
@@ -488,13 +488,13 @@ mark_source_chains(const struct xt_table_info *newinfo,
/* Unconditional return/END. */
if
((
e
->
target_offset
==
sizeof
(
struct
ip6t_entry
)
&&
(
strcmp
(
t
->
target
.
u
.
user
.
name
,
IP6
T_STANDARD_TARGET
)
==
0
)
&&
X
T_STANDARD_TARGET
)
==
0
)
&&
t
->
verdict
<
0
&&
unconditional
(
&
e
->
ipv6
))
||
visited
)
{
unsigned
int
oldpos
,
size
;
if
((
strcmp
(
t
->
target
.
u
.
user
.
name
,
IP6
T_STANDARD_TARGET
)
==
0
)
&&
X
T_STANDARD_TARGET
)
==
0
)
&&
t
->
verdict
<
-
NF_MAX_VERDICT
-
1
)
{
duprintf
(
"mark_source_chains: bad "
"negative verdict (%i)
\n
"
,
...
...
@@ -537,7 +537,7 @@ mark_source_chains(const struct xt_table_info *newinfo,
int
newpos
=
t
->
verdict
;
if
(
strcmp
(
t
->
target
.
u
.
user
.
name
,
IP6
T_STANDARD_TARGET
)
==
0
&&
X
T_STANDARD_TARGET
)
==
0
&&
newpos
>=
0
)
{
if
(
newpos
>
newinfo
->
size
-
sizeof
(
struct
ip6t_entry
))
{
...
...
@@ -2191,7 +2191,7 @@ static int icmp6_checkentry(const struct xt_mtchk_param *par)
/* The built-in targets: standard (NULL) and error. */
static
struct
xt_target
ip6t_builtin_tg
[]
__read_mostly
=
{
{
.
name
=
IP6
T_STANDARD_TARGET
,
.
name
=
X
T_STANDARD_TARGET
,
.
targetsize
=
sizeof
(
int
),
.
family
=
NFPROTO_IPV6
,
#ifdef CONFIG_COMPAT
...
...
@@ -2201,7 +2201,7 @@ static struct xt_target ip6t_builtin_tg[] __read_mostly = {
#endif
},
{
.
name
=
IP6
T_ERROR_TARGET
,
.
name
=
X
T_ERROR_TARGET
,
.
target
=
ip6t_error
,
.
targetsize
=
XT_FUNCTION_MAXNAMELEN
,
.
family
=
NFPROTO_IPV6
,
...
...
net/sched/act_ipt.c
浏览文件 @
243bf6e2
...
...
@@ -230,7 +230,7 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
result
=
TC_ACT_SHOT
;
ipt
->
tcf_qstats
.
drops
++
;
break
;
case
IP
T_CONTINUE
:
case
X
T_CONTINUE
:
result
=
TC_ACT_PIPE
;
break
;
default:
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录