netfilter: nf_tables: kill nft_pktinfo.ops

- Add nft_pktinfo.pf to replace ops->pf
- Add nft_pktinfo.hook to replace ops->hooknum

This simplifies the code, makes it more readable, and likely reduces
cache line misses.  Maintainability is enhanced as the details of
nft_hook_ops are of no concern to the recpients of nft_pktinfo.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index aa8bee72c9d34288cd121ebd5ddd1e3ad7a7bf40..c0899f97ff8d62cbd05fb3147f7361615ca0101c 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -16,7 +16,8 @@ struct nft_pktinfo {
        struct sk_buff                  *skb;
        const struct net_device         *in;
        const struct net_device         *out;
-       const struct nf_hook_ops        *ops;
+       u8                              pf;
+       u8                              hook;
        u8                              nhoff;
        u8                              thoff;
        u8                              tprot;
@@ -25,16 +26,14 @@ struct nft_pktinfo {
 };
 
 static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
-                                  const struct nf_hook_ops *ops,
                                   struct sk_buff *skb,
                                   const struct nf_hook_state *state)
 {
        pkt->skb = skb;
        pkt->in = pkt->xt.in = state->in;
        pkt->out = pkt->xt.out = state->out;
-       pkt->ops = ops;
-       pkt->xt.hooknum = ops->hooknum;
-       pkt->xt.family = ops->pf;
+       pkt->hook = pkt->xt.hooknum = state->hook;
+       pkt->pf = pkt->xt.family = state->pf;
 }
 
 /**

diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
index 2df7f96902ee96edaa9a85f7c96c254220b5e12d..ca6ef6bf775ef544bce93b892ee156d449a62f9e 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv4.h
+++ b/include/net/netfilter/nf_tables_ipv4.h
@@ -6,13 +6,12 @@
 
 static inline void
 nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
-                    const struct nf_hook_ops *ops,
                     struct sk_buff *skb,
                     const struct nf_hook_state *state)
 {
        struct iphdr *ip;
 
-       nft_set_pktinfo(pkt, ops, skb, state);
+       nft_set_pktinfo(pkt, skb, state);
 
        ip = ip_hdr(pkt->skb);
        pkt->tprot = ip->protocol;

diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index 97db2e3a5e657c4b67fdbcfd9b609aea390e1ec0..8ad39a6a5fe18703be7808b5ed4d92cf186bafd6 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -6,14 +6,13 @@
 
 static inline int
 nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
-                    const struct nf_hook_ops *ops,
                     struct sk_buff *skb,
                     const struct nf_hook_state *state)
 {
        int protohdr, thoff = 0;
        unsigned short frag_off;
 
-       nft_set_pktinfo(pkt, ops, skb, state);
+       nft_set_pktinfo(pkt, skb, state);
 
        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
        /* If malformed, drop it */

diff --git a/net/bridge/netfilter/nf_tables_bridge.c b/net/bridge/netfilter/nf_tables_bridge.c
index a343e62442b1304eca4e23abeb2a3df92283552e..318d825e420727bef25df481d8e48342b6f139fa 100644 (file)
--- a/net/bridge/netfilter/nf_tables_bridge.c
+++ b/net/bridge/netfilter/nf_tables_bridge.c
@@ -65,27 +65,25 @@ int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
 EXPORT_SYMBOL_GPL(nft_bridge_ip6hdr_validate);
 
 static inline void nft_bridge_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
-                                              const struct nf_hook_ops *ops,
                                               struct sk_buff *skb,
                                               const struct nf_hook_state *state)
 {
        if (nft_bridge_iphdr_validate(skb))
-               nft_set_pktinfo_ipv4(pkt, ops, skb, state);
+               nft_set_pktinfo_ipv4(pkt, skb, state);
        else
-               nft_set_pktinfo(pkt, ops, skb, state);
+               nft_set_pktinfo(pkt, skb, state);
 }
 
 static inline void nft_bridge_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
-                                              const struct nf_hook_ops *ops,
                                               struct sk_buff *skb,
                                               const struct nf_hook_state *state)
 {
 #if IS_ENABLED(CONFIG_IPV6)
        if (nft_bridge_ip6hdr_validate(skb) &&
-           nft_set_pktinfo_ipv6(pkt, ops, skb, state) == 0)
+           nft_set_pktinfo_ipv6(pkt, skb, state) == 0)
                return;
 #endif
-       nft_set_pktinfo(pkt, ops, skb, state);
+       nft_set_pktinfo(pkt, skb, state);
 }
 
 static unsigned int
@@ -97,13 +95,13 @@ nft_do_chain_bridge(const struct nf_hook_ops *ops,
 
        switch (eth_hdr(skb)->h_proto) {
        case htons(ETH_P_IP):
-               nft_bridge_set_pktinfo_ipv4(&pkt, ops, skb, state);
+               nft_bridge_set_pktinfo_ipv4(&pkt, skb, state);
                break;
        case htons(ETH_P_IPV6):
-               nft_bridge_set_pktinfo_ipv6(&pkt, ops, skb, state);
+               nft_bridge_set_pktinfo_ipv6(&pkt, skb, state);
                break;
        default:
-               nft_set_pktinfo(&pkt, ops, skb, state);
+               nft_set_pktinfo(&pkt, skb, state);
                break;
        }
 

diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index 858d848564ee93a4fa51534a8db512652e93c792..cee92612b2ccfa1ee1af70cc018b888c08ad7e50 100644 (file)
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -273,16 +273,16 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,
                switch (priv->type) {
                case NFT_REJECT_ICMP_UNREACH:
                        nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
-                                                     pkt->ops->hooknum,
+                                                     pkt->hook,
                                                      priv->icmp_code);
                        break;
                case NFT_REJECT_TCP_RST:
                        nft_reject_br_send_v4_tcp_reset(pkt->skb, pkt->in,
-                                                       pkt->ops->hooknum);
+                                                       pkt->hook);
                        break;
                case NFT_REJECT_ICMPX_UNREACH:
                        nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
-                                                     pkt->ops->hooknum,
+                                                     pkt->hook,
                                                      nft_reject_icmp_code(priv->icmp_code));
                        break;
                }
@@ -291,16 +291,16 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,
                switch (priv->type) {
                case NFT_REJECT_ICMP_UNREACH:
                        nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,
-                                                     pkt->ops->hooknum,
+                                                     pkt->hook,
                                                      priv->icmp_code);
                        break;
                case NFT_REJECT_TCP_RST:
                        nft_reject_br_send_v6_tcp_reset(net, pkt->skb, pkt->in,
-                                                       pkt->ops->hooknum);
+                                                       pkt->hook);
                        break;
                case NFT_REJECT_ICMPX_UNREACH:
                        nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,
-                                                     pkt->ops->hooknum,
+                                                     pkt->hook,
                                                      nft_reject_icmpv6_code(priv->icmp_code));
                        break;
                }

diff --git a/net/ipv4/netfilter/nf_tables_arp.c b/net/ipv4/netfilter/nf_tables_arp.c
index 8412268bbad1852851c6fc3d5337d463d1ff1c51..883bbf83fe093616017f60ffb326b3f0c350d828 100644 (file)
--- a/net/ipv4/netfilter/nf_tables_arp.c
+++ b/net/ipv4/netfilter/nf_tables_arp.c
@@ -21,7 +21,7 @@ nft_do_chain_arp(const struct nf_hook_ops *ops,
 {
        struct nft_pktinfo pkt;
 
-       nft_set_pktinfo(&pkt, ops, skb, state);
+       nft_set_pktinfo(&pkt, skb, state);
 
        return nft_do_chain(&pkt, ops);
 }

diff --git a/net/ipv4/netfilter/nf_tables_ipv4.c b/net/ipv4/netfilter/nf_tables_ipv4.c
index aa180d3a69a5a196e65fdc46cad267944ef6c5cc..805be5c9fcc3ba42e8bdf7640c73d1a663d289d6 100644 (file)
--- a/net/ipv4/netfilter/nf_tables_ipv4.c
+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
@@ -24,7 +24,7 @@ static unsigned int nft_do_chain_ipv4(const struct nf_hook_ops *ops,
 {
        struct nft_pktinfo pkt;
 
-       nft_set_pktinfo_ipv4(&pkt, ops, skb, state);
+       nft_set_pktinfo_ipv4(&pkt, skb, state);
 
        return nft_do_chain(&pkt, ops);
 }

diff --git a/net/ipv4/netfilter/nft_chain_nat_ipv4.c b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
index bf5c30ae14e4e768b61dd758be2acef6e8a0aa86..c3ffecf28d3867bcd9f2e33cdb52aa941016881b 100644 (file)
--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
@@ -33,7 +33,7 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops,
 {
        struct nft_pktinfo pkt;
 
-       nft_set_pktinfo_ipv4(&pkt, ops, skb, state);
+       nft_set_pktinfo_ipv4(&pkt, skb, state);
 
        return nft_do_chain(&pkt, ops);
 }

diff --git a/net/ipv4/netfilter/nft_chain_route_ipv4.c b/net/ipv4/netfilter/nft_chain_route_ipv4.c
index e335b0afdaf33405f05804e72bcadf48cac5c3ea..2a1e3d8a3e4305724d76dffd0d9c22b73f0876dc 100644 (file)
--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
@@ -37,7 +37,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
            ip_hdrlen(skb) < sizeof(struct iphdr))
                return NF_ACCEPT;
 
-       nft_set_pktinfo_ipv4(&pkt, ops, skb, state);
+       nft_set_pktinfo_ipv4(&pkt, skb, state);
 
        mark = skb->mark;
        iph = ip_hdr(skb);

diff --git a/net/ipv4/netfilter/nft_dup_ipv4.c b/net/ipv4/netfilter/nft_dup_ipv4.c
index b45932d43b69f31245886626f82635b1e7b53bbb..30bcf820e8bd131efed82ea0c78d4cdce27d0e01 100644 (file)
--- a/net/ipv4/netfilter/nft_dup_ipv4.c
+++ b/net/ipv4/netfilter/nft_dup_ipv4.c
@@ -30,7 +30,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr,
        };
        int oif = regs->data[priv->sreg_dev];
 
-       nf_dup_ipv4(pkt->skb, pkt->ops->hooknum, &gw, oif);
+       nf_dup_ipv4(pkt->skb, pkt->hook, &gw, oif);
 }
 
 static int nft_dup_ipv4_init(const struct nft_ctx *ctx,

diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index 40e414c4ca56b49909fcde487dead284e5463990..b72ffc58e2556994eba4b79f69a1630c6177d248 100644 (file)
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -26,7 +26,7 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
        memset(&range, 0, sizeof(range));
        range.flags = priv->flags;
 
-       regs->verdict.code = nf_nat_masquerade_ipv4(pkt->skb, pkt->ops->hooknum,
+       regs->verdict.code = nf_nat_masquerade_ipv4(pkt->skb, pkt->hook,
                                                    &range, pkt->out);
 }
 

diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
index d8d795df9c13c562880a6f1d074226984e5400de..c09d4381427ea91d522fc6fd6ff961541f24956a 100644 (file)
--- a/net/ipv4/netfilter/nft_redir_ipv4.c
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
@@ -36,7 +36,7 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr,
        mr.range[0].flags |= priv->flags;
 
        regs->verdict.code = nf_nat_redirect_ipv4(pkt->skb, &mr,
-                                                 pkt->ops->hooknum);
+                                                 pkt->hook);
 }
 
 static struct nft_expr_type nft_redir_ipv4_type;

diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index b07e58b51158514496ce7b136e04eca3266058ce..c1582e03b628f973e667ac06b5506f92be436b2f 100644 (file)
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -27,11 +27,10 @@ static void nft_reject_ipv4_eval(const struct nft_expr *expr,
 
        switch (priv->type) {
        case NFT_REJECT_ICMP_UNREACH:
-               nf_send_unreach(pkt->skb, priv->icmp_code,
-                               pkt->ops->hooknum);
+               nf_send_unreach(pkt->skb, priv->icmp_code, pkt->hook);
                break;
        case NFT_REJECT_TCP_RST:
-               nf_send_reset(pkt->skb, pkt->ops->hooknum);
+               nf_send_reset(pkt->skb, pkt->hook);
                break;
        default:
                break;

diff --git a/net/ipv6/netfilter/nf_tables_ipv6.c b/net/ipv6/netfilter/nf_tables_ipv6.c
index c8148ba76d1a765e1ee2ba190961045fad033c6b..41340b794f9b8c199ff989bb36a4cbbb6b09105d 100644 (file)
--- a/net/ipv6/netfilter/nf_tables_ipv6.c
+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
@@ -23,7 +23,7 @@ static unsigned int nft_do_chain_ipv6(const struct nf_hook_ops *ops,
        struct nft_pktinfo pkt;
 
        /* malformed packet, drop it */
-       if (nft_set_pktinfo_ipv6(&pkt, ops, skb, state) < 0)
+       if (nft_set_pktinfo_ipv6(&pkt, skb, state) < 0)
                return NF_DROP;
 
        return nft_do_chain(&pkt, ops);

diff --git a/net/ipv6/netfilter/nft_chain_nat_ipv6.c b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
index 951bb458b7bd53968f76b6e8431f12214a05b88a..e96feaefeb14b57c7879b24261d098ce4fd7b87e 100644 (file)
--- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c
+++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
@@ -31,7 +31,7 @@ static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops,
 {
        struct nft_pktinfo pkt;
 
-       nft_set_pktinfo_ipv6(&pkt, ops, skb, state);
+       nft_set_pktinfo_ipv6(&pkt, skb, state);
 
        return nft_do_chain(&pkt, ops);
 }

diff --git a/net/ipv6/netfilter/nft_chain_route_ipv6.c b/net/ipv6/netfilter/nft_chain_route_ipv6.c
index 0dafdaac5e175062b8c81665834390a8aabe5171..d1bcd2ed7bcc3664ed2b851985f30386d56189b4 100644 (file)
--- a/net/ipv6/netfilter/nft_chain_route_ipv6.c
+++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c
@@ -33,7 +33,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
        u32 mark, flowlabel;
 
        /* malformed packet, drop it */
-       if (nft_set_pktinfo_ipv6(&pkt, ops, skb, state) < 0)
+       if (nft_set_pktinfo_ipv6(&pkt, skb, state) < 0)
                return NF_DROP;
 
        /* save source/dest address, mark, hoplimit, flowlabel, priority */

diff --git a/net/ipv6/netfilter/nft_dup_ipv6.c b/net/ipv6/netfilter/nft_dup_ipv6.c
index 0eaa4f65fdea78d795ef3b841df8a35429fe3c82..c81204faf15d9fbb9b5577b86e63e4cf0b5c54c8 100644 (file)
--- a/net/ipv6/netfilter/nft_dup_ipv6.c
+++ b/net/ipv6/netfilter/nft_dup_ipv6.c
@@ -28,7 +28,7 @@ static void nft_dup_ipv6_eval(const struct nft_expr *expr,
        struct in6_addr *gw = (struct in6_addr *)&regs->data[priv->sreg_addr];
        int oif = regs->data[priv->sreg_dev];
 
-       nf_dup_ipv6(pkt->skb, pkt->ops->hooknum, gw, oif);
+       nf_dup_ipv6(pkt->skb, pkt->hook, gw, oif);
 }
 
 static int nft_dup_ipv6_init(const struct nft_ctx *ctx,

diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
index effd393bd51790ff09c241a4fe207b1fb5f8c19b..aca44e89a88133575b3435f82d71ed5c05e98649 100644 (file)
--- a/net/ipv6/netfilter/nft_redir_ipv6.c
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -35,8 +35,7 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr,
 
        range.flags |= priv->flags;
 
-       regs->verdict.code = nf_nat_redirect_ipv6(pkt->skb, &range,
-                                                 pkt->ops->hooknum);
+       regs->verdict.code = nf_nat_redirect_ipv6(pkt->skb, &range, pkt->hook);
 }
 
 static struct nft_expr_type nft_redir_ipv6_type;

diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
index d0d1540ecf870a83182354aa64bad36eac354e1b..ffcac7d5da43aa08025b04d69144836e5c67a407 100644 (file)
--- a/net/ipv6/netfilter/nft_reject_ipv6.c
+++ b/net/ipv6/netfilter/nft_reject_ipv6.c
@@ -28,11 +28,10 @@ static void nft_reject_ipv6_eval(const struct nft_expr *expr,
 
        switch (priv->type) {
        case NFT_REJECT_ICMP_UNREACH:
-               nf_send_unreach6(net, pkt->skb, priv->icmp_code,
-                                pkt->ops->hooknum);
+               nf_send_unreach6(net, pkt->skb, priv->icmp_code, pkt->hook);
                break;
        case NFT_REJECT_TCP_RST:
-               nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
+               nf_send_reset6(net, pkt->skb, pkt->hook);
                break;
        default:
                break;

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 05d0b03530f6b21418d69c0c0f51916228d26b94..539083099c0d42642c12796d641bf3659f7fa44c 100644 (file)
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -50,7 +50,7 @@ static void __nft_trace_packet(const struct nft_pktinfo *pkt,
 {
        struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-       nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
+       nf_log_trace(net, pkt->pf, pkt->hook, pkt->skb, pkt->in,
                     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
                     chain->table->name, chain->name, comments[type],
                     rulenum);

diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index 2cae4d4a03b77c0a08b1d0f29900b5f06082572c..db416a3396e9222bf7184b15e0939408a44e0cde 100644 (file)
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -17,13 +17,13 @@
 
 static inline void
 nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
-                           const struct nf_hook_ops *ops, struct sk_buff *skb,
+                           struct sk_buff *skb,
                            const struct nf_hook_state *state)
 {
        struct iphdr *iph, _iph;
        u32 len, thoff;
 
-       nft_set_pktinfo(pkt, ops, skb, state);
+       nft_set_pktinfo(pkt, skb, state);
 
        iph = skb_header_pointer(skb, skb_network_offset(skb), sizeof(*iph),
                                 &_iph);
@@ -48,7 +48,6 @@ nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
 
 static inline void
 __nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
-                             const struct nf_hook_ops *ops,
                              struct sk_buff *skb,
                              const struct nf_hook_state *state)
 {
@@ -82,12 +81,11 @@ __nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
 }
 
 static inline void nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
-                                              const struct nf_hook_ops *ops,
                                               struct sk_buff *skb,
                                               const struct nf_hook_state *state)
 {
-       nft_set_pktinfo(pkt, ops, skb, state);
-       __nft_netdev_set_pktinfo_ipv6(pkt, ops, skb, state);
+       nft_set_pktinfo(pkt, skb, state);
+       __nft_netdev_set_pktinfo_ipv6(pkt, skb, state);
 }
 
 static unsigned int
@@ -98,13 +96,13 @@ nft_do_chain_netdev(const struct nf_hook_ops *ops, struct sk_buff *skb,
 
        switch (eth_hdr(skb)->h_proto) {
        case htons(ETH_P_IP):
-               nft_netdev_set_pktinfo_ipv4(&pkt, ops, skb, state);
+               nft_netdev_set_pktinfo_ipv4(&pkt, skb, state);
                break;
        case htons(ETH_P_IPV6):
-               nft_netdev_set_pktinfo_ipv6(&pkt, ops, skb, state);
+               nft_netdev_set_pktinfo_ipv6(&pkt, skb, state);
                break;
        default:
-               nft_set_pktinfo(&pkt, ops, skb, state);
+               nft_set_pktinfo(&pkt, skb, state);
                break;
        }
 

diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index a13d6a386d635f00b5715d1b71ba9b0819203544..c7c7df85f0b73ff236e0c211aa2ae99cb9b5b88a 100644 (file)
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -33,7 +33,7 @@ static void nft_log_eval(const struct nft_expr *expr,
        const struct nft_log *priv = nft_expr_priv(expr);
        struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-       nf_log_packet(net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in,
+       nf_log_packet(net, pkt->pf, pkt->hook, pkt->skb, pkt->in,
                      pkt->out, &priv->loginfo, "%s", priv->prefix);
 }
 

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index cb2f13ebb5a66cdf5fd9498ddfe8949f38741803..e4ad2c24bc4122e6470966f75da7b92f8273ba51 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -42,7 +42,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                *(__be16 *)dest = skb->protocol;
                break;
        case NFT_META_NFPROTO:
-               *dest = pkt->ops->pf;
+               *dest = pkt->pf;
                break;
        case NFT_META_L4PROTO:
                *dest = pkt->tprot;
@@ -135,7 +135,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                        break;
                }
 
-               switch (pkt->ops->pf) {
+               switch (pkt->pf) {
                case NFPROTO_IPV4:
                        if (ipv4_is_multicast(ip_hdr(skb)->daddr))
                                *dest = PACKET_MULTICAST;

diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
index 96805d21d618b7be7f0b802e4738d4d2afa6de7f..61d216eb79175ac2a699190b04eb5d447ed66759 100644 (file)
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -42,7 +42,7 @@ static void nft_queue_eval(const struct nft_expr *expr,
                        queue = priv->queuenum + cpu % priv->queues_total;
                } else {
                        queue = nfqueue_hash(pkt->skb, queue,
-                                            priv->queues_total, pkt->ops->pf,
+                                            priv->queues_total, pkt->pf,
                                             jhash_initval);
                }
        }

diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 635dbba93d013244038cbdbb48bbe9549f622304..dea6750af6ffedc809afafa46463b58717a819ae 100644 (file)
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -24,20 +24,20 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
        struct nft_reject *priv = nft_expr_priv(expr);
        struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
 
-       switch (pkt->ops->pf) {
+       switch (pkt->pf) {
        case NFPROTO_IPV4:
                switch (priv->type) {
                case NFT_REJECT_ICMP_UNREACH:
                        nf_send_unreach(pkt->skb, priv->icmp_code,
-                                       pkt->ops->hooknum);
+                                       pkt->hook);
                        break;
                case NFT_REJECT_TCP_RST:
-                       nf_send_reset(pkt->skb, pkt->ops->hooknum);
+                       nf_send_reset(pkt->skb, pkt->hook);
                        break;
                case NFT_REJECT_ICMPX_UNREACH:
                        nf_send_unreach(pkt->skb,
                                        nft_reject_icmp_code(priv->icmp_code),
-                                       pkt->ops->hooknum);
+                                       pkt->hook);
                        break;
                }
                break;
@@ -45,15 +45,15 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
                switch (priv->type) {
                case NFT_REJECT_ICMP_UNREACH:
                        nf_send_unreach6(net, pkt->skb, priv->icmp_code,
-                                        pkt->ops->hooknum);
+                                        pkt->hook);
                        break;
                case NFT_REJECT_TCP_RST:
-                       nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
+                       nf_send_reset6(net, pkt->skb, pkt->hook);
                        break;
                case NFT_REJECT_ICMPX_UNREACH:
                        nf_send_unreach6(net, pkt->skb,
                                         nft_reject_icmpv6_code(priv->icmp_code),
-                                        pkt->ops->hooknum);
+                                        pkt->hook);
                        break;
                }
                break;