[IPSEC]: Move all calls to xfrm_audit_state_icvfail to xfrm_input

[safe/jmp/linux-2.6] / net / ipv6 / netfilter / ip6t_ipv6header.c

diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
index 063032a..ae497e7 100644 (file)
--- a/net/ipv6/netfilter/ip6t_ipv6header.c
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c
@@ -1,7 +1,7 @@
 /* ipv6header match - matches IPv6 packets based
    on whether they contain certain headers */
 
-/* Original idea: Brad Chapman 
+/* Original idea: Brad Chapman
  * Rewritten by: Andras Kis-Szabo <kisza@sch.bme.hu> */
 
 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
@@ -18,6 +18,7 @@
 #include <net/checksum.h>
 #include <net/ipv6.h>
 
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_ipv6header.h>
 
@@ -25,14 +26,11 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("IPv6 headers match");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
-static int
-ipv6header_match(const struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                const void *matchinfo,
-                int offset,
-                unsigned int protoff,
-                int *hotdrop)
+static bool
+ipv6header_mt6(const struct sk_buff *skb, const struct net_device *in,
+               const struct net_device *out, const struct xt_match *match,
+               const void *matchinfo, int offset, unsigned int protoff,
+               bool *hotdrop)
 {
        const struct ip6t_ipv6header_info *info = matchinfo;
        unsigned int temp;
@@ -43,7 +41,7 @@ ipv6header_match(const struct sk_buff *skb,
        /* Make sure this isn't an evil packet */
 
        /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
+       nexthdr = ipv6_hdr(skb)->nexthdr;
        /* pointer to the 1st exthdr */
        ptr = sizeof(struct ipv6hdr);
        /* available length */
@@ -56,7 +54,7 @@ ipv6header_match(const struct sk_buff *skb,
 
                /* Is there enough space for the next ext header? */
                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                       return 0;
+                       return false;
                /* No more exthdr -> evaluate */
                if (nexthdr == NEXTHDR_NONE) {
                        temp |= MASK_NONE;
@@ -72,9 +70,9 @@ ipv6header_match(const struct sk_buff *skb,
                BUG_ON(hp == NULL);
 
                /* Calculate the header length */
-               if (nexthdr == NEXTHDR_FRAGMENT) {
+               if (nexthdr == NEXTHDR_FRAGMENT)
                        hdrlen = 8;
-               } else if (nexthdr == NEXTHDR_AUTH)
+               else if (nexthdr == NEXTHDR_AUTH)
                        hdrlen = (hp->hdrlen + 2) << 2;
                else
                        hdrlen = ipv6_optlen(hp);
@@ -97,7 +95,7 @@ ipv6header_match(const struct sk_buff *skb,
                        temp |= MASK_DSTOPTS;
                        break;
                default:
-                       return 0;
+                       return false;
                        break;
                }
 
@@ -108,7 +106,7 @@ ipv6header_match(const struct sk_buff *skb,
                        break;
        }
 
-       if ((nexthdr != NEXTHDR_NONE) && (nexthdr != NEXTHDR_ESP))
+       if (nexthdr != NEXTHDR_NONE && nexthdr != NEXTHDR_ESP)
                temp |= MASK_PROTO;
 
        if (info->modeflag)
@@ -122,41 +120,40 @@ ipv6header_match(const struct sk_buff *skb,
        }
 }
 
-static int
-ipv6header_checkentry(const char *tablename,
-                     const void *ip,
-                     void *matchinfo,
-                     unsigned int matchsize,
-                     unsigned int hook_mask)
+static bool
+ipv6header_mt6_check(const char *tablename, const void *ip,
+                     const struct xt_match *match, void *matchinfo,
+                     unsigned int hook_mask)
 {
        const struct ip6t_ipv6header_info *info = matchinfo;
 
        /* invflags is 0 or 0xff in hard mode */
        if ((!info->modeflag) && info->invflags != 0x00 &&
            info->invflags != 0xFF)
-               return 0;
+               return false;
 
-       return 1;
+       return true;
 }
 
-static struct ip6t_match ip6t_ipv6header_match = {
+static struct xt_match ipv6header_mt6_reg __read_mostly = {
        .name           = "ipv6header",
-       .match          = &ipv6header_match,
+       .family         = AF_INET6,
+       .match          = ipv6header_mt6,
        .matchsize      = sizeof(struct ip6t_ipv6header_info),
-       .checkentry     = &ipv6header_checkentry,
+       .checkentry     = ipv6header_mt6_check,
        .destroy        = NULL,
        .me             = THIS_MODULE,
 };
 
-static int __init ipv6header_init(void)
+static int __init ipv6header_mt6_init(void)
 {
-       return ip6t_register_match(&ip6t_ipv6header_match);
+       return xt_register_match(&ipv6header_mt6_reg);
 }
 
-static void __exit ipv6header_exit(void)
+static void __exit ipv6header_mt6_exit(void)
 {
-       ip6t_unregister_match(&ip6t_ipv6header_match);
+       xt_unregister_match(&ipv6header_mt6_reg);
 }
 
-module_init(ipv6header_init);
-module_exit(ipv6header_exit);
+module_init(ipv6header_mt6_init);
+module_exit(ipv6header_mt6_exit);