netfilter: nf_tables: add hook ops to struct nft_pktinfo

Multi-family tables need the AF from the hook ops. Add a pointer to the
hook ops and replace usage of the hooknum member in struct nft_pktinfo.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 5a91abfc0c30dec50c6f83c2d6568429a676c1c5..c9e63167f9a211a951b0d22ac9f5f7c25f53adba 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -13,7 +13,7 @@ struct nft_pktinfo {
        struct sk_buff                  *skb;
        const struct net_device         *in;
        const struct net_device         *out;
-       u8                              hooknum;
+       const struct nf_hook_ops        *ops;
        u8                              nhoff;
        u8                              thoff;
        /* for x_tables compatibility */
@@ -29,7 +29,8 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
        pkt->skb = skb;
        pkt->in = pkt->xt.in = in;
        pkt->out = pkt->xt.out = out;
-       pkt->hooknum = pkt->xt.hooknum = ops->hooknum;
+       pkt->ops = ops;
+       pkt->xt.hooknum = ops->hooknum;
        pkt->xt.family = ops->pf;
 }
 

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index e8fcc343c2b9d3dba82ac16264ec53a18fb376b3..5aae31772ff7bb891a1a0abe2b1588fbd47602d2 100644 (file)
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -109,7 +109,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt,
 {
        struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-       nf_log_packet(net, pkt->xt.family, pkt->hooknum, pkt->skb, pkt->in,
+       nf_log_packet(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
                      pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
                      chain->table->name, chain->name, comments[type],
                      rulenum);

diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 57cad072a13e50886ba1a2fa1da2c778953d8203..5af790123ad865dbb88c9e172ed4b9beb8590e01 100644 (file)
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -33,7 +33,7 @@ static void nft_log_eval(const struct nft_expr *expr,
        const struct nft_log *priv = nft_expr_priv(expr);
        struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-       nf_log_packet(net, priv->family, pkt->hooknum, pkt->skb, pkt->in,
+       nf_log_packet(net, priv->family, pkt->ops->hooknum, pkt->skb, pkt->in,
                      pkt->out, &priv->loginfo, "%s", priv->prefix);
 }
 

diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index 7ae63cdad959285f9c74e87a839ee635f7c98ab1..5e204711d7049781052095ca317a4efd944ea07a 100644 (file)
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -44,15 +44,15 @@ static void nft_reject_eval(const struct nft_expr *expr,
 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
                else if (priv->family == NFPROTO_IPV6)
                        nf_send_unreach6(net, pkt->skb, priv->icmp_code,
-                                     pkt->hooknum);
+                                     pkt->ops->hooknum);
 #endif
                break;
        case NFT_REJECT_TCP_RST:
                if (priv->family == NFPROTO_IPV4)
-                       nf_send_reset(pkt->skb, pkt->hooknum);
+                       nf_send_reset(pkt->skb, pkt->ops->hooknum);
 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
                else if (priv->family == NFPROTO_IPV6)
-                       nf_send_reset6(net, pkt->skb, pkt->hooknum);
+                       nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
 #endif
                break;
        }