netfilter: xtables: add struct xt_mtchk_param::net

[safe/jmp/linux-2.6] / net / ipv4 / netfilter / ip_tables.c

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 0b43fd7..a069d72 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -89,9 +89,9 @@ ip_packet_match(const struct iphdr *ip,
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 
        if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
-                 IPT_INV_SRCIP)
-           || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-                    IPT_INV_DSTIP)) {
+                 IPT_INV_SRCIP) ||
+           FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+                 IPT_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");
 
                dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
@@ -122,8 +122,8 @@ ip_packet_match(const struct iphdr *ip,
        }
 
        /* Check specific protocol */
-       if (ipinfo->proto
-           && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
+       if (ipinfo->proto &&
+           FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
                dprintf("Packet protocol %hi does not match %hi.%s\n",
                        ip->protocol, ipinfo->proto,
                        ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
@@ -246,11 +246,11 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
        } else if (s == e) {
                (*rulenum)++;
 
-               if (s->target_offset == sizeof(struct ipt_entry)
-                  && strcmp(t->target.u.kernel.target->name,
-                            IPT_STANDARD_TARGET) == 0
-                  && t->verdict < 0
-                  && unconditional(&s->ip)) {
+               if (s->target_offset == sizeof(struct ipt_entry) &&
+                   strcmp(t->target.u.kernel.target->name,
+                          IPT_STANDARD_TARGET) == 0 &&
+                  t->verdict < 0 &&
+                  unconditional(&s->ip)) {
                        /* Tail of chains: STANDARD target (return/policy) */
                        *comment = *chainname == hookname
                                ? comments[NF_IP_TRACE_COMMENT_POLICY]
@@ -388,8 +388,8 @@ ipt_do_table(struct sk_buff *skb,
                                back = get_entry(table_base, back->comefrom);
                                continue;
                        }
-                       if (table_base + v != ipt_next_entry(e)
-                           && !(e->ip.flags & IPT_F_GOTO)) {
+                       if (table_base + v != ipt_next_entry(e) &&
+                           !(e->ip.flags & IPT_F_GOTO)) {
                                /* Save old back ptr in next entry */
                                struct ipt_entry *next = ipt_next_entry(e);
                                next->comefrom = (void *)back - table_base;
@@ -473,11 +473,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                        e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                        /* Unconditional return/END. */
-                       if ((e->target_offset == sizeof(struct ipt_entry)
-                           && (strcmp(t->target.u.user.name,
-                                      IPT_STANDARD_TARGET) == 0)
-                           && t->verdict < 0
-                           && unconditional(&e->ip)) || visited) {
+                       if ((e->target_offset == sizeof(struct ipt_entry) &&
+                            (strcmp(t->target.u.user.name,
+                                    IPT_STANDARD_TARGET) == 0) &&
+                            t->verdict < 0 && unconditional(&e->ip)) ||
+                           visited) {
                                unsigned int oldpos, size;
 
                                if ((strcmp(t->target.u.user.name,
@@ -524,8 +524,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                int newpos = t->verdict;
 
                                if (strcmp(t->target.u.user.name,
-                                          IPT_STANDARD_TARGET) == 0
-                                   && newpos >= 0) {
+                                          IPT_STANDARD_TARGET) == 0 &&
+                                   newpos >= 0) {
                                        if (newpos > newinfo->size -
                                                sizeof(struct ipt_entry)) {
                                                duprintf("mark_source_chains: "
@@ -661,8 +661,8 @@ static int check_target(struct ipt_entry *e, const char *name)
 }
 
 static int
-find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
-                unsigned int *i)
+find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
+                unsigned int size, unsigned int *i)
 {
        struct ipt_entry_target *t;
        struct xt_target *target;
@@ -675,6 +675,7 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
                return ret;
 
        j = 0;
+       mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
        mtpar.hook_mask = e->comefrom;
@@ -735,8 +736,8 @@ check_entry_size_and_hooks(struct ipt_entry *e,
 {
        unsigned int h;
 
-       if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
-           || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+       if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
+           (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
                duprintf("Bad offset %p\n", e);
                return -EINVAL;
        }
@@ -798,7 +799,8 @@ cleanup_entry(struct ipt_entry *e, unsigned int *i)
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
-translate_table(const char *name,
+translate_table(struct net *net,
+               const char *name,
                unsigned int valid_hooks,
                struct xt_table_info *newinfo,
                void *entry0,
@@ -860,7 +862,7 @@ translate_table(const char *name,
        /* Finally, each sanity check must pass */
        i = 0;
        ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                               find_check_entry, name, size, &i);
+                               find_check_entry, net, name, size, &i);
 
        if (ret != 0) {
                IPT_ENTRY_ITERATE(entry0, newinfo->size,
@@ -1303,7 +1305,7 @@ do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
 
-       ret = translate_table(tmp.name, tmp.valid_hooks,
+       ret = translate_table(net, tmp.name, tmp.valid_hooks,
                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
                              tmp.hook_entry, tmp.underflow);
        if (ret != 0)
@@ -1548,8 +1550,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
        int ret, off, h;
 
        duprintf("check_compat_entry_size_and_hooks %p\n", e);
-       if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
-           || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+       if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
+           (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
                duprintf("Bad offset %p, limit = %p\n", e, limit);
                return -EINVAL;
        }
@@ -1655,7 +1657,7 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
 }
 
 static int
-compat_check_entry(struct ipt_entry *e, const char *name,
+compat_check_entry(struct ipt_entry *e, struct net *net, const char *name,
                                     unsigned int *i)
 {
        struct xt_mtchk_param mtpar;
@@ -1663,6 +1665,7 @@ compat_check_entry(struct ipt_entry *e, const char *name,
        int ret;
 
        j = 0;
+       mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
        mtpar.hook_mask = e->comefrom;
@@ -1684,7 +1687,8 @@ compat_check_entry(struct ipt_entry *e, const char *name,
 }
 
 static int
-translate_compat_table(const char *name,
+translate_compat_table(struct net *net,
+                      const char *name,
                       unsigned int valid_hooks,
                       struct xt_table_info **pinfo,
                       void **pentry0,
@@ -1773,7 +1777,7 @@ translate_compat_table(const char *name,
 
        i = 0;
        ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                               name, &i);
+                               net, name, &i);
        if (ret) {
                j -= i;
                COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
@@ -1833,7 +1837,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
 
-       ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+       ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
                                     &newinfo, &loc_cpu_entry, tmp.size,
                                     tmp.num_entries, tmp.hook_entry,
                                     tmp.underflow);
@@ -2065,7 +2069,8 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        return ret;
 }
 
-struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
+struct xt_table *ipt_register_table(struct net *net,
+                                   const struct xt_table *table,
                                    const struct ipt_replace *repl)
 {
        int ret;
@@ -2085,7 +2090,7 @@ struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
        loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
        memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-       ret = translate_table(table->name, table->valid_hooks,
+       ret = translate_table(net, table->name, table->valid_hooks,
                              newinfo, loc_cpu_entry, repl->size,
                              repl->num_entries,
                              repl->hook_entry,