Commit 8d6e5557 authored by Máté Eckl's avatar Máté Eckl Committed by Pablo Neira Ayuso
Browse files

netfilter: Decrease code duplication regarding transparent socket option 



There is a function in include/net/netfilter/nf_socket.h to decide if a
socket has IP(V6)_TRANSPARENT socket option set or not. However this
does the same as inet_sk_transparent() in include/net/tcp.h

include/net/tcp.h:1733
/* This helper checks if socket has IP_TRANSPARENT set */
static inline bool inet_sk_transparent(const struct sock *sk)
{
	switch (sk->sk_state) {
	case TCP_TIME_WAIT:
		return inet_twsk(sk)->tw_transparent;
	case TCP_NEW_SYN_RECV:
		return inet_rsk(inet_reqsk(sk))->no_srccheck;
	}
	return inet_sk(sk)->transparent;
}

tproxy_sk_is_transparent has also been refactored to use this function
instead of reimplementing it.

Signed-off-by: default avatarMáté Eckl <ecklm94@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 1ffdd8e1

include/net/netfilter/nf_socket.h

+0 −13
Original line number Diff line number Diff line
@@ -3,19 +3,6 @@ 
#define _NF_SOCK_H_



#include <net/sock.h>

#include <net/inet_timewait_sock.h>



static inline bool nf_sk_is_transparent(struct sock *sk)

{

	switch (sk->sk_state) {

	case TCP_TIME_WAIT:

		return inet_twsk(sk)->tw_transparent;

	case TCP_NEW_SYN_RECV:

		return inet_rsk(inet_reqsk(sk))->no_srccheck;

	default:

		return inet_sk(sk)->transparent;

	}

}



struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,

				  const struct net_device *indev);

net/netfilter/nft_socket.c

+2 −1
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ 
#include <net/netfilter/nf_tables_core.h>

#include <net/netfilter/nf_socket.h>

#include <net/inet_sock.h>

#include <net/tcp.h>



struct nft_socket {

	enum nft_socket_keys		key:8;
@@ -48,7 +49,7 @@ static void nft_socket_eval(const struct nft_expr *expr, 


	switch(priv->key) {

	case NFT_SOCKET_TRANSPARENT:

		nft_reg_store8(dest, nf_sk_is_transparent(sk));

		nft_reg_store8(dest, inet_sk_transparent(sk));

		break;

	default:

		WARN_ON(1);

net/netfilter/xt_TPROXY.c

+2 −13
Original line number Diff line number Diff line
@@ -42,19 +42,8 @@ enum nf_tproxy_lookup_t { 


static bool tproxy_sk_is_transparent(struct sock *sk)

{

	switch (sk->sk_state) {

	case TCP_TIME_WAIT:

		if (inet_twsk(sk)->tw_transparent)

	if (inet_sk_transparent(sk))

		return true;

		break;

	case TCP_NEW_SYN_RECV:

		if (inet_rsk(inet_reqsk(sk))->no_srccheck)

			return true;

		break;

	default:

		if (inet_sk(sk)->transparent)

			return true;

	}



	sock_gen_put(sk);

	return false;

net/netfilter/xt_socket.c

+2 −2
Original line number Diff line number Diff line
@@ -73,7 +73,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, 
		 * if XT_SOCKET_TRANSPARENT is used

		 */

		if (info->flags & XT_SOCKET_TRANSPARENT)

			transparent = nf_sk_is_transparent(sk);

			transparent = inet_sk_transparent(sk);



		if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&

		    transparent && sk_fullsock(sk))
@@ -130,7 +130,7 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par) 
		 * if XT_SOCKET_TRANSPARENT is used

		 */

		if (info->flags & XT_SOCKET_TRANSPARENT)

			transparent = nf_sk_is_transparent(sk);

			transparent = inet_sk_transparent(sk);



		if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&

		    transparent && sk_fullsock(sk))

CRA Git | Maintained and supported by SUSTech CRA and CCSE