Commit 7e9c6eeb authored by Jan Engelhardt's avatar Jan Engelhardt Committed by Patrick McHardy
Browse files

netfilter: Introduce NFPROTO_* constants 



The netfilter subsystem only supports a handful of protocols (much
less than PF_*) and even non-PF protocols like ARP and
pseudo-protocols like PF_BRIDGE. By creating NFPROTO_*, we can earn a
few memory savings on arrays that previously were always PF_MAX-sized
and keep the pseudo-protocols to ourselves.

Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 079aa88f

include/linux/netfilter.h

+12 −2
Original line number Diff line number Diff line
@@ -52,6 +52,16 @@ enum nf_inet_hooks { 
	NF_INET_NUMHOOKS

};



enum {

	NFPROTO_UNSPEC =  0,

	NFPROTO_IPV4   =  2,

	NFPROTO_ARP    =  3,

	NFPROTO_BRIDGE =  7,

	NFPROTO_IPV6   = 10,

	NFPROTO_DECNET = 12,

	NFPROTO_NUMPROTO,

};



union nf_inet_addr {

	__u32		all[4];

	__be32		ip;
@@ -138,7 +148,7 @@ extern struct ctl_path nf_net_netfilter_sysctl_path[]; 
extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[];

#endif /* CONFIG_SYSCTL */



extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];

extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];



int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,

		 struct net_device *indev, struct net_device *outdev,
@@ -247,7 +257,7 @@ struct nf_afinfo { 
	int		route_key_size;

};



extern const struct nf_afinfo *nf_afinfo[NPROTO];

extern const struct nf_afinfo *nf_afinfo[NFPROTO_NUMPROTO];

static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)

{

	return rcu_dereference(nf_afinfo[family]);

net/netfilter/core.c

+3 −3
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ 


static DEFINE_MUTEX(afinfo_mutex);



const struct nf_afinfo *nf_afinfo[NPROTO] __read_mostly;

const struct nf_afinfo *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;

EXPORT_SYMBOL(nf_afinfo);



int nf_register_afinfo(const struct nf_afinfo *afinfo)
@@ -51,7 +51,7 @@ void nf_unregister_afinfo(const struct nf_afinfo *afinfo) 
}

EXPORT_SYMBOL_GPL(nf_unregister_afinfo);



struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS] __read_mostly;

struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;

EXPORT_SYMBOL(nf_hooks);

static DEFINE_MUTEX(nf_hook_mutex);
@@ -264,7 +264,7 @@ EXPORT_SYMBOL(proc_net_netfilter); 
void __init netfilter_init(void)

{

	int i, h;

	for (i = 0; i < NPROTO; i++) {

	for (i = 0; i < ARRAY_SIZE(nf_hooks); i++) {

		for (h = 0; h < NF_MAX_HOOKS; h++)

			INIT_LIST_HEAD(&nf_hooks[i][h]);

	}

net/netfilter/nf_log.c

+6 −6
Original line number Diff line number Diff line
@@ -15,7 +15,7 @@ 


#define NF_LOG_PREFIXLEN		128



static const struct nf_logger *nf_loggers[NPROTO] __read_mostly;

static const struct nf_logger *nf_loggers[NFPROTO_NUMPROTO] __read_mostly;

static DEFINE_MUTEX(nf_log_mutex);



/* return EBUSY if somebody else is registered, EEXIST if the same logger
@@ -24,7 +24,7 @@ int nf_log_register(u_int8_t pf, const struct nf_logger *logger) 
{

	int ret;



	if (pf >= NPROTO)

	if (pf >= ARRAY_SIZE(nf_loggers))

		return -EINVAL;



	/* Any setup of logging members must be done before
@@ -47,7 +47,7 @@ EXPORT_SYMBOL(nf_log_register); 


void nf_log_unregister_pf(u_int8_t pf)

{

	if (pf >= NPROTO)

	if (pf >= ARRAY_SIZE(nf_loggers))

		return;

	mutex_lock(&nf_log_mutex);

	rcu_assign_pointer(nf_loggers[pf], NULL);
@@ -63,7 +63,7 @@ void nf_log_unregister(const struct nf_logger *logger) 
	int i;



	mutex_lock(&nf_log_mutex);

	for (i = 0; i < NPROTO; i++) {

	for (i = 0; i < ARRAY_SIZE(nf_loggers); i++) {

		if (nf_loggers[i] == logger)

			rcu_assign_pointer(nf_loggers[i], NULL);

	}
@@ -103,7 +103,7 @@ static void *seq_start(struct seq_file *seq, loff_t *pos) 
{

	rcu_read_lock();



	if (*pos >= NPROTO)

	if (*pos >= ARRAY_SIZE(nf_loggers))

		return NULL;



	return pos;
@@ -113,7 +113,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 
{

	(*pos)++;



	if (*pos >= NPROTO)

	if (*pos >= ARRAY_SIZE(nf_loggers))

		return NULL;



	return pos;

net/netfilter/nf_queue.c

+6 −6
Original line number Diff line number Diff line
@@ -16,7 +16,7 @@ 
 * long term mutex.  The handler must provide an an outfn() to accept packets

 * for queueing and must reinject all packets it receives, no matter what.

 */

static const struct nf_queue_handler *queue_handler[NPROTO];

static const struct nf_queue_handler *queue_handler[NFPROTO_NUMPROTO] __read_mostly;



static DEFINE_MUTEX(queue_handler_mutex);
@@ -26,7 +26,7 @@ int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) 
{

	int ret;



	if (pf >= NPROTO)

	if (pf >= ARRAY_SIZE(queue_handler))

		return -EINVAL;



	mutex_lock(&queue_handler_mutex);
@@ -47,7 +47,7 @@ EXPORT_SYMBOL(nf_register_queue_handler); 
/* The caller must flush their queue before this */

int nf_unregister_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)

{

	if (pf >= NPROTO)

	if (pf >= ARRAY_SIZE(queue_handler))

		return -EINVAL;



	mutex_lock(&queue_handler_mutex);
@@ -70,7 +70,7 @@ void nf_unregister_queue_handlers(const struct nf_queue_handler *qh) 
	u_int8_t pf;



	mutex_lock(&queue_handler_mutex);

	for (pf = 0; pf < NPROTO; pf++)  {

	for (pf = 0; pf < ARRAY_SIZE(queue_handler); pf++)  {

		if (queue_handler[pf] == qh)

			rcu_assign_pointer(queue_handler[pf], NULL);

	}
@@ -285,7 +285,7 @@ EXPORT_SYMBOL(nf_reinject); 
#ifdef CONFIG_PROC_FS

static void *seq_start(struct seq_file *seq, loff_t *pos)

{

	if (*pos >= NPROTO)

	if (*pos >= ARRAY_SIZE(queue_handler))

		return NULL;



	return pos;
@@ -295,7 +295,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 
{

	(*pos)++;



	if (*pos >= NPROTO)

	if (*pos >= ARRAY_SIZE(queue_handler))

		return NULL;



	return pos;

net/netfilter/x_tables.c

+10 −8
Original line number Diff line number Diff line
@@ -58,10 +58,12 @@ static struct xt_af *xt; 
#define duprintf(format, args...)

#endif



static const char *const xt_prefix[NPROTO] = {

	[AF_INET]	= "ip",

	[AF_INET6]	= "ip6",

	[NF_ARP]	= "arp",

static const char *const xt_prefix[NFPROTO_NUMPROTO] = {

	[NFPROTO_UNSPEC] = "x",

	[NFPROTO_IPV4]   = "ip",

	[NFPROTO_ARP]    = "arp",

	[NFPROTO_BRIDGE] = "eb",

	[NFPROTO_IPV6]   = "ip6",

};



/* Registration hooks for targets. */
@@ -932,7 +934,7 @@ int xt_proto_init(struct net *net, u_int8_t af) 
	struct proc_dir_entry *proc;

#endif



	if (af >= NPROTO)

	if (af >= ARRAY_SIZE(xt_prefix))

		return -EINVAL;
@@ -1001,7 +1003,7 @@ static int __net_init xt_net_init(struct net *net) 
{

	int i;



	for (i = 0; i < NPROTO; i++)

	for (i = 0; i < NFPROTO_NUMPROTO; i++)

		INIT_LIST_HEAD(&net->xt.tables[i]);

	return 0;

}
@@ -1014,11 +1016,11 @@ static int __init xt_init(void) 
{

	int i, rv;



	xt = kmalloc(sizeof(struct xt_af) * NPROTO, GFP_KERNEL);

	xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);

	if (!xt)

		return -ENOMEM;



	for (i = 0; i < NPROTO; i++) {

	for (i = 0; i < NFPROTO_NUMPROTO; i++) {

		mutex_init(&xt[i].mutex);

#ifdef CONFIG_COMPAT

		mutex_init(&xt[i].compat_mutex);

CRA Git | Maintained and supported by SUSTech CRA and CCSE