[NETFILTER]: x_tables: mark matches and targets __read_mostly

[safe/jmp/linux-2.6] / net / ipv4 / netfilter / nf_nat_rule.c

diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index de25d63..080393a 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -46,80 +46,23 @@ static struct
                .hook_entry = {
                        [NF_IP_PRE_ROUTING] = 0,
                        [NF_IP_POST_ROUTING] = sizeof(struct ipt_standard),
-                       [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 },
+                       [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
+               },
                .underflow = {
                        [NF_IP_PRE_ROUTING] = 0,
                        [NF_IP_POST_ROUTING] = sizeof(struct ipt_standard),
-                       [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 },
+                       [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
+               },
        },
        .entries = {
-               /* PRE_ROUTING */
-               {
-                       .entry = {
-                               .target_offset = sizeof(struct ipt_entry),
-                               .next_offset = sizeof(struct ipt_standard),
-                       },
-                       .target = {
-                               .target = {
-                                       .u = {
-                                               .target_size = IPT_ALIGN(sizeof(struct ipt_standard_target)),
-                                       },
-                               },
-                               .verdict = -NF_ACCEPT - 1,
-                       },
-               },
-               /* POST_ROUTING */
-               {
-                       .entry = {
-                               .target_offset = sizeof(struct ipt_entry),
-                               .next_offset = sizeof(struct ipt_standard),
-                       },
-                       .target = {
-                               .target = {
-                                       .u = {
-                                               .target_size = IPT_ALIGN(sizeof(struct ipt_standard_target)),
-                                       },
-                               },
-                               .verdict = -NF_ACCEPT - 1,
-                       },
-               },
-               /* LOCAL_OUT */
-               {
-                       .entry = {
-                               .target_offset = sizeof(struct ipt_entry),
-                               .next_offset = sizeof(struct ipt_standard),
-                       },
-                       .target = {
-                               .target = {
-                                       .u = {
-                                               .target_size = IPT_ALIGN(sizeof(struct ipt_standard_target)),
-                                       },
-                               },
-                               .verdict = -NF_ACCEPT - 1,
-                       },
-               },
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
        },
-       /* ERROR */
-       .term = {
-               .entry = {
-                       .target_offset = sizeof(struct ipt_entry),
-                       .next_offset = sizeof(struct ipt_error),
-               },
-               .target = {
-                       .target = {
-                               .u = {
-                                       .user = {
-                                               .target_size = IPT_ALIGN(sizeof(struct ipt_error_target)),
-                                               .name = IPT_ERROR_TARGET,
-                                       },
-                               },
-                       },
-                       .errorname = "ERROR",
-               },
-       }
+       .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct ipt_table nat_table = {
+static struct xt_table nat_table = {
        .name           = "nat",
        .valid_hooks    = NAT_VALID_HOOKS,
        .lock           = RW_LOCK_UNLOCKED,
@@ -145,7 +88,7 @@ static unsigned int ipt_snat_target(struct sk_buff **pskb,
 
        /* Connection must be valid and new. */
        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
-                           ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
+                           ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
        NF_CT_ASSERT(out);
 
        return nf_nat_setup_info(ct, &mr->range[0], hooknum);
@@ -191,52 +134,46 @@ static unsigned int ipt_dnat_target(struct sk_buff **pskb,
 
        if (hooknum == NF_IP_LOCAL_OUT &&
            mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)
-               warn_if_extra_mangle((*pskb)->nh.iph->daddr,
+               warn_if_extra_mangle(ip_hdr(*pskb)->daddr,
                                     mr->range[0].min_ip);
 
        return nf_nat_setup_info(ct, &mr->range[0], hooknum);
 }
 
-static int ipt_snat_checkentry(const char *tablename,
-                              const void *entry,
-                              const struct xt_target *target,
-                              void *targinfo,
-                              unsigned int hook_mask)
+static bool ipt_snat_checkentry(const char *tablename,
+                               const void *entry,
+                               const struct xt_target *target,
+                               void *targinfo,
+                               unsigned int hook_mask)
 {
        struct nf_nat_multi_range_compat *mr = targinfo;
 
        /* Must be a valid range */
        if (mr->rangesize != 1) {
                printk("SNAT: multiple ranges no longer supported\n");
-               return 0;
+               return false;
        }
-       return 1;
+       return true;
 }
 
-static int ipt_dnat_checkentry(const char *tablename,
-                              const void *entry,
-                              const struct xt_target *target,
-                              void *targinfo,
-                              unsigned int hook_mask)
+static bool ipt_dnat_checkentry(const char *tablename,
+                               const void *entry,
+                               const struct xt_target *target,
+                               void *targinfo,
+                               unsigned int hook_mask)
 {
        struct nf_nat_multi_range_compat *mr = targinfo;
 
        /* Must be a valid range */
        if (mr->rangesize != 1) {
                printk("DNAT: multiple ranges no longer supported\n");
-               return 0;
+               return false;
        }
-       if (mr->range[0].flags & IP_NAT_RANGE_PROTO_RANDOM) {
-               printk("DNAT: port randomization not supported\n");
-               return 0;
-       }
-       return 1;
+       return true;
 }
 
-inline unsigned int
-alloc_null_binding(struct nf_conn *ct,
-                  struct nf_nat_info *info,
-                  unsigned int hooknum)
+unsigned int
+alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 {
        /* Force range to this IP; let proto decide mapping for
           per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
@@ -255,9 +192,7 @@ alloc_null_binding(struct nf_conn *ct,
 }
 
 unsigned int
-alloc_null_binding_confirmed(struct nf_conn *ct,
-                             struct nf_nat_info *info,
-                             unsigned int hooknum)
+alloc_null_binding_confirmed(struct nf_conn *ct, unsigned int hooknum)
 {
        __be32 ip
                = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
@@ -279,8 +214,7 @@ int nf_nat_rule_find(struct sk_buff **pskb,
                     unsigned int hooknum,
                     const struct net_device *in,
                     const struct net_device *out,
-                    struct nf_conn *ct,
-                    struct nf_nat_info *info)
+                    struct nf_conn *ct)
 {
        int ret;
 
@@ -289,12 +223,12 @@ int nf_nat_rule_find(struct sk_buff **pskb,
        if (ret == NF_ACCEPT) {
                if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
                        /* NUL mapping */
-                       ret = alloc_null_binding(ct, info, hooknum);
+                       ret = alloc_null_binding(ct, hooknum);
        }
        return ret;
 }
 
-static struct xt_target ipt_snat_reg = {
+static struct xt_target ipt_snat_reg __read_mostly = {
        .name           = "SNAT",
        .target         = ipt_snat_target,
        .targetsize     = sizeof(struct nf_nat_multi_range_compat),
@@ -304,7 +238,7 @@ static struct xt_target ipt_snat_reg = {
        .family         = AF_INET,
 };
 
-static struct xt_target ipt_dnat_reg = {
+static struct xt_target ipt_dnat_reg __read_mostly = {
        .name           = "DNAT",
        .target         = ipt_dnat_target,
        .targetsize     = sizeof(struct nf_nat_multi_range_compat),