[NETFILTER]: Introduce NF_INET_ hook values

[safe/jmp/linux-2.6] / net / ipv4 / netfilter / ipt_REJECT.c

diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 9041e07..d55b262 100644 (file)
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -31,12 +31,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("iptables REJECT target module");
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 /* Send RST reply */
 static void send_reset(struct sk_buff *oldskb, int hook)
 {
@@ -96,7 +90,6 @@ static void send_reset(struct sk_buff *oldskb, int hook)
        /* Truncate to length (no data) */
        tcph->doff = sizeof(struct tcphdr)/4;
        skb_trim(nskb, ip_hdrlen(nskb) + sizeof(struct tcphdr));
-       niph->tot_len = htons(nskb->len);
 
        if (tcph->ack) {
                needs_ack = 0;
@@ -122,7 +115,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
        tcph->check = 0;
        tcph->check = tcp_v4_check(sizeof(struct tcphdr),
                                   niph->saddr, niph->daddr,
-                                  csum_partial((char *)tcph,
+                                  csum_partial(tcph,
                                                sizeof(struct tcphdr), 0));
 
        /* Set DF, id = 0 */
@@ -130,14 +123,14 @@ static void send_reset(struct sk_buff *oldskb, int hook)
        niph->id = 0;
 
        addr_type = RTN_UNSPEC;
-       if (hook != NF_IP_FORWARD
+       if (hook != NF_INET_FORWARD
 #ifdef CONFIG_BRIDGE_NETFILTER
            || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
 #endif
           )
                addr_type = RTN_LOCAL;
 
-       if (ip_route_me_harder(&nskb, addr_type))
+       if (ip_route_me_harder(nskb, addr_type))
                goto free_nskb;
 
        nskb->ip_summed = CHECKSUM_NONE;
@@ -145,18 +138,13 @@ static void send_reset(struct sk_buff *oldskb, int hook)
        /* Adjust IP TTL */
        niph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
 
-       /* Adjust IP checksum */
-       niph->check = 0;
-       niph->check = ip_fast_csum(skb_network_header(nskb), niph->ihl);
-
        /* "Never happens" */
        if (nskb->len > dst_mtu(nskb->dst))
                goto free_nskb;
 
        nf_ct_attach(nskb, oldskb);
 
-       NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, nskb, NULL, nskb->dst->dev,
-               dst_output);
+       ip_local_out(nskb);
        return;
 
  free_nskb:
@@ -168,7 +156,7 @@ static inline void send_unreach(struct sk_buff *skb_in, int code)
        icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
 }
 
-static unsigned int reject(struct sk_buff **pskb,
+static unsigned int reject(struct sk_buff *skb,
                           const struct net_device *in,
                           const struct net_device *out,
                           unsigned int hooknum,
@@ -179,7 +167,7 @@ static unsigned int reject(struct sk_buff **pskb,
 
        /* Our naive response construction doesn't deal with IP
           options, and probably shouldn't try. */
-       if (ip_hdrlen(*pskb) != sizeof(struct iphdr))
+       if (ip_hdrlen(skb) != sizeof(struct iphdr))
                return NF_DROP;
 
        /* WARNING: This code causes reentry within iptables.
@@ -187,28 +175,28 @@ static unsigned int reject(struct sk_buff **pskb,
           must return an absolute verdict. --RR */
        switch (reject->with) {
        case IPT_ICMP_NET_UNREACHABLE:
-               send_unreach(*pskb, ICMP_NET_UNREACH);
+               send_unreach(skb, ICMP_NET_UNREACH);
                break;
        case IPT_ICMP_HOST_UNREACHABLE:
-               send_unreach(*pskb, ICMP_HOST_UNREACH);
+               send_unreach(skb, ICMP_HOST_UNREACH);
                break;
        case IPT_ICMP_PROT_UNREACHABLE:
-               send_unreach(*pskb, ICMP_PROT_UNREACH);
+               send_unreach(skb, ICMP_PROT_UNREACH);
                break;
        case IPT_ICMP_PORT_UNREACHABLE:
-               send_unreach(*pskb, ICMP_PORT_UNREACH);
+               send_unreach(skb, ICMP_PORT_UNREACH);
                break;
        case IPT_ICMP_NET_PROHIBITED:
-               send_unreach(*pskb, ICMP_NET_ANO);
+               send_unreach(skb, ICMP_NET_ANO);
                break;
        case IPT_ICMP_HOST_PROHIBITED:
-               send_unreach(*pskb, ICMP_HOST_ANO);
+               send_unreach(skb, ICMP_HOST_ANO);
                break;
        case IPT_ICMP_ADMIN_PROHIBITED:
-               send_unreach(*pskb, ICMP_PKT_FILTERED);
+               send_unreach(skb, ICMP_PKT_FILTERED);
                break;
        case IPT_TCP_RESET:
-               send_reset(*pskb, hooknum);
+               send_reset(skb, hooknum);
        case IPT_ICMP_ECHOREPLY:
                /* Doesn't happen. */
                break;
@@ -217,37 +205,37 @@ static unsigned int reject(struct sk_buff **pskb,
        return NF_DROP;
 }
 
-static int check(const char *tablename,
-                const void *e_void,
-                const struct xt_target *target,
-                void *targinfo,
-                unsigned int hook_mask)
+static bool check(const char *tablename,
+                 const void *e_void,
+                 const struct xt_target *target,
+                 void *targinfo,
+                 unsigned int hook_mask)
 {
        const struct ipt_reject_info *rejinfo = targinfo;
        const struct ipt_entry *e = e_void;
 
        if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
-               printk("REJECT: ECHOREPLY no longer supported.\n");
-               return 0;
+               printk("ipt_REJECT: ECHOREPLY no longer supported.\n");
+               return false;
        } else if (rejinfo->with == IPT_TCP_RESET) {
                /* Must specify that it's a TCP packet */
                if (e->ip.proto != IPPROTO_TCP
                    || (e->ip.invflags & XT_INV_PROTO)) {
-                       DEBUGP("REJECT: TCP_RESET invalid for non-tcp\n");
-                       return 0;
+                       printk("ipt_REJECT: TCP_RESET invalid for non-tcp\n");
+                       return false;
                }
        }
-       return 1;
+       return true;
 }
 
-static struct xt_target ipt_reject_reg = {
+static struct xt_target ipt_reject_reg __read_mostly = {
        .name           = "REJECT",
        .family         = AF_INET,
        .target         = reject,
        .targetsize     = sizeof(struct ipt_reject_info),
        .table          = "filter",
-       .hooks          = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) |
-                         (1 << NF_IP_LOCAL_OUT),
+       .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
+                         (1 << NF_INET_LOCAL_OUT),
        .checkentry     = check,
        .me             = THIS_MODULE,
 };