Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

[linux-2.6-omap-h63xx.git] / net / ipv4 / netfilter / iptable_raw.c

diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 18c3d4c9ff51e23ecd8ffece105407d7fed94e91..5de6e57ac55c20ebd3f0ca8bd16310d15b52a640 100644 (file)
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -5,6 +5,7 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <net/ip.h>
 
 #define RAW_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))
 
@@ -21,62 +22,18 @@ static struct
                .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
                .hook_entry = {
                        [NF_IP_PRE_ROUTING] = 0,
-                       [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) },
+                       [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard)
+               },
                .underflow = {
                        [NF_IP_PRE_ROUTING] = 0,
-                       [NF_IP_LOCAL_OUT]  = sizeof(struct ipt_standard) },
+                       [NF_IP_LOCAL_OUT]  = sizeof(struct ipt_standard)
+               },
        },
        .entries = {
-            /* PRE_ROUTING */
-            {
-                    .entry = {
-                            .target_offset = sizeof(struct ipt_entry),
-                            .next_offset = sizeof(struct ipt_standard),
-                    },
-                    .target = {
-                         .target = {
-                                 .u = {
-                                         .target_size = IPT_ALIGN(sizeof(struct ipt_standard_target)),
-                                 },
-                         },
-                         .verdict = -NF_ACCEPT - 1,
-                    },
-            },
-
-            /* LOCAL_OUT */
-            {
-                    .entry = {
-                            .target_offset = sizeof(struct ipt_entry),
-                            .next_offset = sizeof(struct ipt_standard),
-                    },
-                    .target = {
-                            .target = {
-                                    .u = {
-                                            .target_size = IPT_ALIGN(sizeof(struct ipt_standard_target)),
-                                    },
-                            },
-                            .verdict = -NF_ACCEPT - 1,
-                    },
-            },
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
        },
-       /* ERROR */
-       .term = {
-               .entry = {
-                       .target_offset = sizeof(struct ipt_entry),
-                       .next_offset = sizeof(struct ipt_error),
-               },
-               .target = {
-                       .target = {
-                               .u = {
-                                       .user = {
-                                               .target_size = IPT_ALIGN(sizeof(struct ipt_error_target)),
-                                               .name = IPT_ERROR_TARGET,
-                                       },
-                               },
-                       },
-                       .errorname = "ERROR",
-               },
-       }
+       .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
 static struct xt_table packet_raw = {
@@ -90,12 +47,30 @@ static struct xt_table packet_raw = {
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ipt_hook(unsigned int hook,
-        struct sk_buff **pskb,
+        struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-       return ipt_do_table(pskb, hook, in, out, &packet_raw);
+       return ipt_do_table(skb, hook, in, out, &packet_raw);
+}
+
+static unsigned int
+ipt_local_hook(unsigned int hook,
+              struct sk_buff *skb,
+              const struct net_device *in,
+              const struct net_device *out,
+              int (*okfn)(struct sk_buff *))
+{
+       /* root is playing with raw sockets. */
+       if (skb->len < sizeof(struct iphdr) ||
+           ip_hdrlen(skb) < sizeof(struct iphdr)) {
+               if (net_ratelimit())
+                       printk("iptable_raw: ignoring short SOCK_RAW"
+                              "packet.\n");
+               return NF_ACCEPT;
+       }
+       return ipt_do_table(skb, hook, in, out, &packet_raw);
 }
 
 /* 'raw' is the very first table. */
@@ -108,7 +83,7 @@ static struct nf_hook_ops ipt_ops[] = {
                .owner = THIS_MODULE,
        },
        {
-               .hook = ipt_hook,
+               .hook = ipt_local_hook,
                .pf = PF_INET,
                .hooknum = NF_IP_LOCAL_OUT,
                .priority = NF_IP_PRI_RAW,