Merge branch 'linus' into x86/memory-corruption-check

[linux-2.6-omap-h63xx.git] / net / ipv6 / netfilter / ip6t_REJECT.c

diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index baf829075f6fcfd081a7df1472cbe8bcfdedb7d1..0981b4ccb8b1c2c20ec4592dd6d0fc27b24f5514 100644 (file)
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -35,13 +35,14 @@ MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
 MODULE_LICENSE("GPL");
 
 /* Send RST reply */
-static void send_reset(struct sk_buff *oldskb)
+static void send_reset(struct net *net, struct sk_buff *oldskb)
 {
        struct sk_buff *nskb;
        struct tcphdr otcph, *tcph;
        unsigned int otcplen, hh_len;
        int tcphoff, needs_ack;
-       struct ipv6hdr *oip6h = ipv6_hdr(oldskb), *ip6h;
+       const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
+       struct ipv6hdr *ip6h;
        struct dst_entry *dst = NULL;
        u8 proto;
        struct flowi fl;
@@ -93,7 +94,7 @@ static void send_reset(struct sk_buff *oldskb)
        fl.fl_ip_sport = otcph.dest;
        fl.fl_ip_dport = otcph.source;
        security_skb_classify_flow(oldskb, &fl);
-       dst = ip6_route_output(&init_net, NULL, &fl);
+       dst = ip6_route_output(net, NULL, &fl);
        if (dst == NULL)
                return;
        if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
@@ -162,20 +163,20 @@ static void send_reset(struct sk_buff *oldskb)
 }
 
 static inline void
-send_unreach(struct sk_buff *skb_in, unsigned char code, unsigned int hooknum)
+send_unreach(struct net *net, struct sk_buff *skb_in, unsigned char code,
+            unsigned int hooknum)
 {
        if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
-               skb_in->dev = init_net.loopback_dev;
+               skb_in->dev = net->loopback_dev;
 
        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
 }
 
 static unsigned int
-reject_tg6(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+reject_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
-       const struct ip6t_reject_info *reject = targinfo;
+       const struct ip6t_reject_info *reject = par->targinfo;
+       struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
 
        pr_debug("%s: medium point\n", __func__);
        /* WARNING: This code causes reentry within ip6tables.
@@ -183,25 +184,25 @@ reject_tg6(struct sk_buff *skb, const struct net_device *in,
           must return an absolute verdict. --RR */
        switch (reject->with) {
        case IP6T_ICMP6_NO_ROUTE:
-               send_unreach(skb, ICMPV6_NOROUTE, hooknum);
+               send_unreach(net, skb, ICMPV6_NOROUTE, par->hooknum);
                break;
        case IP6T_ICMP6_ADM_PROHIBITED:
-               send_unreach(skb, ICMPV6_ADM_PROHIBITED, hooknum);
+               send_unreach(net, skb, ICMPV6_ADM_PROHIBITED, par->hooknum);
                break;
        case IP6T_ICMP6_NOT_NEIGHBOUR:
-               send_unreach(skb, ICMPV6_NOT_NEIGHBOUR, hooknum);
+               send_unreach(net, skb, ICMPV6_NOT_NEIGHBOUR, par->hooknum);
                break;
        case IP6T_ICMP6_ADDR_UNREACH:
-               send_unreach(skb, ICMPV6_ADDR_UNREACH, hooknum);
+               send_unreach(net, skb, ICMPV6_ADDR_UNREACH, par->hooknum);
                break;
        case IP6T_ICMP6_PORT_UNREACH:
-               send_unreach(skb, ICMPV6_PORT_UNREACH, hooknum);
+               send_unreach(net, skb, ICMPV6_PORT_UNREACH, par->hooknum);
                break;
        case IP6T_ICMP6_ECHOREPLY:
                /* Do nothing */
                break;
        case IP6T_TCP_RESET:
-               send_reset(skb);
+               send_reset(net, skb);
                break;
        default:
                if (net_ratelimit())
@@ -212,13 +213,10 @@ reject_tg6(struct sk_buff *skb, const struct net_device *in,
        return NF_DROP;
 }
 
-static bool
-reject_tg6_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool reject_tg6_check(const struct xt_tgchk_param *par)
 {
-       const struct ip6t_reject_info *rejinfo = targinfo;
-       const struct ip6t_entry *e = entry;
+       const struct ip6t_reject_info *rejinfo = par->targinfo;
+       const struct ip6t_entry *e = par->entryinfo;
 
        if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
                printk("ip6t_REJECT: ECHOREPLY is not supported.\n");
@@ -236,7 +234,7 @@ reject_tg6_check(const char *tablename, const void *entry,
 
 static struct xt_target reject_tg6_reg __read_mostly = {
        .name           = "REJECT",
-       .family         = AF_INET6,
+       .family         = NFPROTO_IPV6,
        .target         = reject_tg6,
        .targetsize     = sizeof(struct ip6t_reject_info),
        .table          = "filter",