Skip to content

Commit c4b0e77

Browse files
Florian Westphaldavem330
Florian Westphal
authored and
davem330
committed
netfilter: avoid using skb->nf_bridge directly
This pointer is going to be removed soon, so use the existing helpers in more places to avoid noise when the removal happens. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 8239d57 commit c4b0e77

File tree

9 files changed

+103
-66
lines changed

9 files changed

+103
-66
lines changed

‎include/linux/netfilter_bridge.h‎

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,43 +17,58 @@ static inline void br_drop_fake_rtable(struct sk_buff *skb)
1717
skb_dst_drop(skb);
1818
}
1919

20+
static inline struct nf_bridge_info *
21+
nf_bridge_info_get(const struct sk_buff *skb)
22+
{
23+
return skb->nf_bridge;
24+
}
25+
26+
static inline bool nf_bridge_info_exists(const struct sk_buff *skb)
27+
{
28+
return skb->nf_bridge != NULL;
29+
}
30+
2031
static inline int nf_bridge_get_physinif(const struct sk_buff *skb)
2132
{
22-
struct nf_bridge_info *nf_bridge;
33+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
2334

24-
if (skb->nf_bridge == NULL)
35+
if (!nf_bridge)
2536
return 0;
2637

27-
nf_bridge = skb->nf_bridge;
2838
return nf_bridge->physindev ? nf_bridge->physindev->ifindex : 0;
2939
}
3040

3141
static inline int nf_bridge_get_physoutif(const struct sk_buff *skb)
3242
{
33-
struct nf_bridge_info *nf_bridge;
43+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
3444

35-
if (skb->nf_bridge == NULL)
45+
if (!nf_bridge)
3646
return 0;
3747

38-
nf_bridge = skb->nf_bridge;
3948
return nf_bridge->physoutdev ? nf_bridge->physoutdev->ifindex : 0;
4049
}
4150

4251
static inline struct net_device *
4352
nf_bridge_get_physindev(const struct sk_buff *skb)
4453
{
45-
return skb->nf_bridge ? skb->nf_bridge->physindev : NULL;
54+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
55+
56+
return nf_bridge ? nf_bridge->physindev : NULL;
4657
}
4758

4859
static inline struct net_device *
4960
nf_bridge_get_physoutdev(const struct sk_buff *skb)
5061
{
51-
return skb->nf_bridge ? skb->nf_bridge->physoutdev : NULL;
62+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
63+
64+
return nf_bridge ? nf_bridge->physoutdev : NULL;
5265
}
5366

5467
static inline bool nf_bridge_in_prerouting(const struct sk_buff *skb)
5568
{
56-
return skb->nf_bridge && skb->nf_bridge->in_prerouting;
69+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
70+
71+
return nf_bridge && nf_bridge->in_prerouting;
5772
}
5873
#else
5974
#define br_drop_fake_rtable(skb) do { } while (0)

‎include/net/netfilter/br_netfilter.h‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,6 @@ int br_nf_hook_thresh(unsigned int hook, struct net *net, struct sock *sk,
2222
int (*okfn)(struct net *, struct sock *,
2323
struct sk_buff *));
2424

25-
static inline struct nf_bridge_info *
26-
nf_bridge_info_get(const struct sk_buff *skb)
27-
{
28-
return skb->nf_bridge;
29-
}
30-
3125
unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb);
3226

3327
static inline void nf_bridge_push_encap_header(struct sk_buff *skb)

‎net/bridge/br_netfilter_hooks.c‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,9 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
247247

248248
void nf_bridge_update_protocol(struct sk_buff *skb)
249249
{
250-
switch (skb->nf_bridge->orig_proto) {
250+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
251+
252+
switch (nf_bridge->orig_proto) {
251253
case BRNF_PROTO_8021Q:
252254
skb->protocol = htons(ETH_P_8021Q);
253255
break;
@@ -569,7 +571,8 @@ static unsigned int br_nf_forward_ip(void *priv,
569571
struct net_device *parent;
570572
u_int8_t pf;
571573

572-
if (!skb->nf_bridge)
574+
nf_bridge = nf_bridge_info_get(skb);
575+
if (!nf_bridge)
573576
return NF_ACCEPT;
574577

575578
/* Need exclusive nf_bridge_info since we might have multiple
@@ -701,7 +704,9 @@ br_nf_ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
701704

702705
static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
703706
{
704-
if (skb->nf_bridge->orig_proto == BRNF_PROTO_PPPOE)
707+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
708+
709+
if (nf_bridge->orig_proto == BRNF_PROTO_PPPOE)
705710
return PPPOE_SES_HLEN;
706711
return 0;
707712
}
@@ -839,7 +844,9 @@ static unsigned int ip_sabotage_in(void *priv,
839844
struct sk_buff *skb,
840845
const struct nf_hook_state *state)
841846
{
842-
if (skb->nf_bridge && !skb->nf_bridge->in_prerouting &&
847+
struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
848+
849+
if (nf_bridge && !nf_bridge->in_prerouting &&
843850
!netif_is_l3_master(skb->dev)) {
844851
state->okfn(state->net, state->sk, skb);
845852
return NF_STOLEN;
@@ -877,7 +884,9 @@ static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb)
877884

878885
static int br_nf_dev_xmit(struct sk_buff *skb)
879886
{
880-
if (skb->nf_bridge && skb->nf_bridge->bridged_dnat) {
887+
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
888+
889+
if (nf_bridge && nf_bridge->bridged_dnat) {
881890
br_nf_pre_routing_finish_bridge_slow(skb);
882891
return 1;
883892
}

‎net/ipv4/netfilter/nf_reject_ipv4.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put);
102102
/* Send RST reply */
103103
void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
104104
{
105+
struct net_device *br_indev __maybe_unused;
105106
struct sk_buff *nskb;
106107
struct iphdr *niph;
107108
const struct tcphdr *oth;
@@ -147,10 +148,11 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
147148
* build the eth header using the original destination's MAC as the
148149
* source, and send the RST packet directly.
149150
*/
150-
if (oldskb->nf_bridge) {
151+
br_indev = nf_bridge_get_physindev(oldskb);
152+
if (br_indev) {
151153
struct ethhdr *oeth = eth_hdr(oldskb);
152154

153-
nskb->dev = nf_bridge_get_physindev(oldskb);
155+
nskb->dev = br_indev;
154156
niph->tot_len = htons(nskb->len);
155157
ip_send_check(niph);
156158
if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),

‎net/ipv6/netfilter/nf_reject_ipv6.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_put);
131131

132132
void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
133133
{
134+
struct net_device *br_indev __maybe_unused;
134135
struct sk_buff *nskb;
135136
struct tcphdr _otcph;
136137
const struct tcphdr *otcph;
@@ -197,15 +198,18 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
197198
* build the eth header using the original destination's MAC as the
198199
* source, and send the RST packet directly.
199200
*/
200-
if (oldskb->nf_bridge) {
201+
br_indev = nf_bridge_get_physindev(oldskb);
202+
if (br_indev) {
201203
struct ethhdr *oeth = eth_hdr(oldskb);
202204

203-
nskb->dev = nf_bridge_get_physindev(oldskb);
205+
nskb->dev = br_indev;
204206
nskb->protocol = htons(ETH_P_IPV6);
205207
ip6h->payload_len = htons(sizeof(struct tcphdr));
206208
if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),
207-
oeth->h_source, oeth->h_dest, nskb->len) < 0)
209+
oeth->h_source, oeth->h_dest, nskb->len) < 0) {
210+
kfree_skb(nskb);
208211
return;
212+
}
209213
dev_queue_xmit(nskb);
210214
} else
211215
#endif

‎net/netfilter/nf_log_common.c‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -156,22 +156,20 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf,
156156
const struct net_device *out,
157157
const struct nf_loginfo *loginfo, const char *prefix)
158158
{
159+
const struct net_device *physoutdev __maybe_unused;
160+
const struct net_device *physindev __maybe_unused;
161+
159162
nf_log_buf_add(m, KERN_SOH "%c%sIN=%s OUT=%s ",
160163
'0' + loginfo->u.log.level, prefix,
161164
in ? in->name : "",
162165
out ? out->name : "");
163166
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
164-
if (skb->nf_bridge) {
165-
const struct net_device *physindev;
166-
const struct net_device *physoutdev;
167-
168-
physindev = nf_bridge_get_physindev(skb);
169-
if (physindev && in != physindev)
170-
nf_log_buf_add(m, "PHYSIN=%s ", physindev->name);
171-
physoutdev = nf_bridge_get_physoutdev(skb);
172-
if (physoutdev && out != physoutdev)
173-
nf_log_buf_add(m, "PHYSOUT=%s ", physoutdev->name);
174-
}
167+
physindev = nf_bridge_get_physindev(skb);
168+
if (physindev && in != physindev)
169+
nf_log_buf_add(m, "PHYSIN=%s ", physindev->name);
170+
physoutdev = nf_bridge_get_physoutdev(skb);
171+
if (physoutdev && out != physoutdev)
172+
nf_log_buf_add(m, "PHYSOUT=%s ", physoutdev->name);
175173
#endif
176174
}
177175
EXPORT_SYMBOL_GPL(nf_log_dump_packet_common);

‎net/netfilter/nf_queue.c‎

Lines changed: 33 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,24 @@ void nf_unregister_queue_handler(struct net *net)
4646
}
4747
EXPORT_SYMBOL(nf_unregister_queue_handler);
4848

49+
static void nf_queue_entry_release_br_nf_refs(struct sk_buff *skb)
50+
{
51+
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
52+
struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
53+
54+
if (nf_bridge) {
55+
struct net_device *physdev;
56+
57+
physdev = nf_bridge_get_physindev(skb);
58+
if (physdev)
59+
dev_put(physdev);
60+
physdev = nf_bridge_get_physoutdev(skb);
61+
if (physdev)
62+
dev_put(physdev);
63+
}
64+
#endif
65+
}
66+
4967
void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
5068
{
5169
struct nf_hook_state *state = &entry->state;
@@ -57,20 +75,28 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
5775
dev_put(state->out);
5876
if (state->sk)
5977
sock_put(state->sk);
78+
79+
nf_queue_entry_release_br_nf_refs(entry->skb);
80+
}
81+
EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
82+
83+
static void nf_queue_entry_get_br_nf_refs(struct sk_buff *skb)
84+
{
6085
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
61-
if (entry->skb->nf_bridge) {
86+
struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
87+
88+
if (nf_bridge) {
6289
struct net_device *physdev;
6390

64-
physdev = nf_bridge_get_physindev(entry->skb);
91+
physdev = nf_bridge_get_physindev(skb);
6592
if (physdev)
66-
dev_put(physdev);
67-
physdev = nf_bridge_get_physoutdev(entry->skb);
93+
dev_hold(physdev);
94+
physdev = nf_bridge_get_physoutdev(skb);
6895
if (physdev)
69-
dev_put(physdev);
96+
dev_hold(physdev);
7097
}
7198
#endif
7299
}
73-
EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
74100

75101
/* Bump dev refs so they don't vanish while packet is out */
76102
void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
@@ -83,18 +109,8 @@ void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
83109
dev_hold(state->out);
84110
if (state->sk)
85111
sock_hold(state->sk);
86-
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
87-
if (entry->skb->nf_bridge) {
88-
struct net_device *physdev;
89112

90-
physdev = nf_bridge_get_physindev(entry->skb);
91-
if (physdev)
92-
dev_hold(physdev);
93-
physdev = nf_bridge_get_physoutdev(entry->skb);
94-
if (physdev)
95-
dev_hold(physdev);
96-
}
97-
#endif
113+
nf_queue_entry_get_br_nf_refs(entry->skb);
98114
}
99115
EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
100116

‎net/netfilter/nfnetlink_queue.c‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -727,13 +727,13 @@ nf_queue_entry_dup(struct nf_queue_entry *e)
727727
*/
728728
static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
729729
{
730-
if (skb->nf_bridge)
730+
if (nf_bridge_info_get(skb))
731731
__skb_push(skb, skb->network_header - skb->mac_header);
732732
}
733733

734734
static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
735735
{
736-
if (skb->nf_bridge)
736+
if (nf_bridge_info_get(skb))
737737
__skb_pull(skb, skb->network_header - skb->mac_header);
738738
}
739739
#else
@@ -904,23 +904,22 @@ nfqnl_set_mode(struct nfqnl_instance *queue,
904904
static int
905905
dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
906906
{
907+
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
908+
int physinif, physoutif;
909+
910+
physinif = nf_bridge_get_physinif(entry->skb);
911+
physoutif = nf_bridge_get_physoutif(entry->skb);
912+
913+
if (physinif == ifindex || physoutif == ifindex)
914+
return 1;
915+
#endif
907916
if (entry->state.in)
908917
if (entry->state.in->ifindex == ifindex)
909918
return 1;
910919
if (entry->state.out)
911920
if (entry->state.out->ifindex == ifindex)
912921
return 1;
913-
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
914-
if (entry->skb->nf_bridge) {
915-
int physinif, physoutif;
916922

917-
physinif = nf_bridge_get_physinif(entry->skb);
918-
physoutif = nf_bridge_get_physoutif(entry->skb);
919-
920-
if (physinif == ifindex || physoutif == ifindex)
921-
return 1;
922-
}
923-
#endif
924923
return 0;
925924
}
926925

‎net/netfilter/xt_physdev.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ physdev_mt(const struct sk_buff *skb, struct xt_action_param *par)
3333
/* Not a bridged IP packet or no info available yet:
3434
* LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
3535
* the destination device will be a bridge. */
36-
if (!skb->nf_bridge) {
36+
if (!nf_bridge_info_exists(skb)) {
3737
/* Return MATCH if the invert flags of the used options are on */
3838
if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
3939
!(info->invert & XT_PHYSDEV_OP_BRIDGED))

0 commit comments

Comments
 (0)