Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

[safe/jmp/linux-2.6] / net / netfilter / xt_policy.c

diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index 46ee7e8..4cbfebd 100644 (file)
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -13,37 +13,38 @@
 #include <linux/init.h>
 #include <net/xfrm.h>
 
+#include <linux/netfilter.h>
 #include <linux/netfilter/xt_policy.h>
 #include <linux/netfilter/x_tables.h>
 
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_DESCRIPTION("Xtables IPsec policy matching module");
+MODULE_DESCRIPTION("Xtables: IPsec policy match");
 MODULE_LICENSE("GPL");
 
 static inline bool
-xt_addr_cmp(const union xt_policy_addr *a1, const union xt_policy_addr *m,
-           const union xt_policy_addr *a2, unsigned short family)
+xt_addr_cmp(const union nf_inet_addr *a1, const union nf_inet_addr *m,
+           const union nf_inet_addr *a2, unsigned short family)
 {
        switch (family) {
-       case AF_INET:
-               return !((a1->a4.s_addr ^ a2->a4.s_addr) & m->a4.s_addr);
-       case AF_INET6:
-               return !ipv6_masked_addr_cmp(&a1->a6, &m->a6, &a2->a6);
+       case NFPROTO_IPV4:
+               return ((a1->ip ^ a2->ip) & m->ip) == 0;
+       case NFPROTO_IPV6:
+               return ipv6_masked_addr_cmp(&a1->in6, &m->in6, &a2->in6) == 0;
        }
        return false;
 }
 
-static inline bool
+static bool
 match_xfrm_state(const struct xfrm_state *x, const struct xt_policy_elem *e,
                 unsigned short family)
 {
 #define MATCH_ADDR(x,y,z)      (!e->match.x ||                        \
-                                (xt_addr_cmp(&e->x, &e->y, (z), family) \
+                                (xt_addr_cmp(&e->x, &e->y, (const union nf_inet_addr *)(z), family) \
                                  ^ e->invert.x))
 #define MATCH(x,y)             (!e->match.x || ((e->x == (y)) ^ e->invert.x))
 
-       return MATCH_ADDR(saddr, smask, (union xt_policy_addr *)&x->props.saddr) &&
-              MATCH_ADDR(daddr, dmask, (union xt_policy_addr *)&x->id.daddr) &&
+       return MATCH_ADDR(saddr, smask, &x->props.saddr) &&
+              MATCH_ADDR(daddr, dmask, &x->id.daddr) &&
               MATCH(proto, x->id.proto) &&
               MATCH(mode, x->props.mode) &&
               MATCH(spi, x->id.spi) &&
@@ -85,7 +86,7 @@ match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info,
                 unsigned short family)
 {
        const struct xt_policy_elem *e;
-       const struct dst_entry *dst = skb->dst;
+       const struct dst_entry *dst = skb_dst(skb);
        int strict = info->flags & XT_POLICY_MATCH_STRICT;
        int i, pos;
 
@@ -109,18 +110,15 @@ match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info,
 }
 
 static bool
-policy_mt(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+policy_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-       const struct xt_policy_info *info = matchinfo;
+       const struct xt_policy_info *info = par->matchinfo;
        int ret;
 
        if (info->flags & XT_POLICY_MATCH_IN)
-               ret = match_policy_in(skb, info, match->family);
+               ret = match_policy_in(skb, info, par->match->family);
        else
-               ret = match_policy_out(skb, info, match->family);
+               ret = match_policy_out(skb, info, par->match->family);
 
        if (ret < 0)
                ret = info->flags & XT_POLICY_MATCH_NONE ? true : false;
@@ -130,26 +128,23 @@ policy_mt(const struct sk_buff *skb, const struct net_device *in,
        return ret;
 }
 
-static bool
-policy_mt_check(const char *tablename, const void *ip_void,
-                const struct xt_match *match, void *matchinfo,
-                unsigned int hook_mask)
+static bool policy_mt_check(const struct xt_mtchk_param *par)
 {
-       struct xt_policy_info *info = matchinfo;
+       const struct xt_policy_info *info = par->matchinfo;
 
        if (!(info->flags & (XT_POLICY_MATCH_IN|XT_POLICY_MATCH_OUT))) {
                printk(KERN_ERR "xt_policy: neither incoming nor "
                                "outgoing policy selected\n");
                return false;
        }
-       if (hook_mask & (1 << NF_INET_PRE_ROUTING | 1 << NF_INET_LOCAL_IN)
-           && info->flags & XT_POLICY_MATCH_OUT) {
+       if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
+           (1 << NF_INET_LOCAL_IN)) && info->flags & XT_POLICY_MATCH_OUT) {
                printk(KERN_ERR "xt_policy: output policy not valid in "
                                "PRE_ROUTING and INPUT\n");
                return false;
        }
-       if (hook_mask & (1 << NF_INET_POST_ROUTING | 1 << NF_INET_LOCAL_OUT)
-           && info->flags & XT_POLICY_MATCH_IN) {
+       if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
+           (1 << NF_INET_LOCAL_OUT)) && info->flags & XT_POLICY_MATCH_IN) {
                printk(KERN_ERR "xt_policy: input policy not valid in "
                                "POST_ROUTING and OUTPUT\n");
                return false;
@@ -164,7 +159,7 @@ policy_mt_check(const char *tablename, const void *ip_void,
 static struct xt_match policy_mt_reg[] __read_mostly = {
        {
                .name           = "policy",
-               .family         = AF_INET,
+               .family         = NFPROTO_IPV4,
                .checkentry     = policy_mt_check,
                .match          = policy_mt,
                .matchsize      = sizeof(struct xt_policy_info),
@@ -172,7 +167,7 @@ static struct xt_match policy_mt_reg[] __read_mostly = {
        },
        {
                .name           = "policy",
-               .family         = AF_INET6,
+               .family         = NFPROTO_IPV6,
                .checkentry     = policy_mt_check,
                .match          = policy_mt,
                .matchsize      = sizeof(struct xt_policy_info),