netfilter: add dummy members to Ebtables code to ease transition to Xtables

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 097432b94c556cde0293406466392264d582634a..82f854bf37e75239479e7bc8c11d2652ab2f921a 100644 (file)
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -214,6 +214,8 @@ struct ebt_match
           const struct ebt_entry *e, void *matchdata, unsigned int datalen);
        void (*destroy)(void *matchdata, unsigned int datalen);
        unsigned int matchsize;
+       u_int8_t revision;
+       u_int8_t family;
        struct module *me;
 };
 
@@ -228,6 +230,8 @@ struct ebt_watcher
           const struct ebt_entry *e, void *watcherdata, unsigned int datalen);
        void (*destroy)(void *watcherdata, unsigned int datalen);
        unsigned int targetsize;
+       u_int8_t revision;
+       u_int8_t family;
        struct module *me;
 };
 
@@ -243,6 +247,8 @@ struct ebt_target
           const struct ebt_entry *e, void *targetdata, unsigned int datalen);
        void (*destroy)(void *targetdata, unsigned int datalen);
        unsigned int targetsize;
+       u_int8_t revision;
+       u_int8_t family;
        struct module *me;
 };
 

diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index 8ebe62b9bcc1eb65223aae9e57e500e217401155..f9876f2275743bd5824b674e62008245c86969e5 100644 (file)
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -51,6 +51,8 @@ static bool ebt_802_3_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match filter_802_3 __read_mostly = {
        .name           = EBT_802_3_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_802_3,
        .check          = ebt_802_3_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_802_3_info)),

diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index bfdc67bcbfafbff920dba89cbd2b748ef98b45e2..568c890887b5277d5681024770f7453293fb053d 100644 (file)
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -211,6 +211,8 @@ ebt_among_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match filter_among __read_mostly = {
        .name           = EBT_AMONG_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_among,
        .check          = ebt_among_check,
        .matchsize      = -1, /* special case */

diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index f1f0bcf5524abc4a765cbb3cc43566085011db86..4a5226cbab89107bd66c6785c3a6fb16a9795ec9 100644 (file)
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -117,6 +117,8 @@ static bool ebt_arp_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match filter_arp __read_mostly = {
        .name           = EBT_ARP_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_arp,
        .check          = ebt_arp_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_arp_info)),

diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index b444cf835f1e268eacfa915bdb59f17c72585f50..7ab16556800eecba340467145317fa75ab99d1a2 100644 (file)
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -76,6 +76,8 @@ static bool ebt_target_reply_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_target reply_target __read_mostly = {
        .name           = EBT_ARPREPLY_TARGET,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .target         = ebt_target_reply,
        .check          = ebt_target_reply_check,
        .targetsize     = XT_ALIGN(sizeof(struct ebt_arpreply_info)),

diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index d58b9e32338e6ac4c35da19f644179a4769802b2..64838e2835a0667adc87cf4c80be1779e4f423b0 100644 (file)
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -46,6 +46,8 @@ static bool ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_target dnat __read_mostly = {
        .name           = EBT_DNAT_TARGET,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .target         = ebt_target_dnat,
        .check          = ebt_target_dnat_check,
        .targetsize     = XT_ALIGN(sizeof(struct ebt_nat_info)),

diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index 018782f044c4c31b276be0d93357a04db3e3367c..0bef6f7bc83f61a6ea219958333c41d4f1867145 100644 (file)
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -108,6 +108,8 @@ static bool ebt_ip_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match filter_ip __read_mostly = {
        .name           = EBT_IP_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_ip,
        .check          = ebt_ip_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_ip_info)),

diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 7fc3928e3fb51ca650a8c63465f1eef482b3e3ad..afcabe205b8fb71917772c920e1b690573d0cbb8 100644 (file)
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -121,6 +121,8 @@ static bool ebt_ip6_check(const char *tablename, unsigned int hookmask,
 static struct ebt_match filter_ip6 =
 {
        .name           = EBT_IP6_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_ip6,
        .check          = ebt_ip6_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_ip6_info)),

diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index 925065a22a65fd84c56c649ad1ee06ee907ec241..9ca0a2564c8d4c004aaebc593f8a6835b85bec01 100644 (file)
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -88,6 +88,8 @@ static bool ebt_limit_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match ebt_limit_reg __read_mostly = {
        .name           = EBT_LIMIT_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_limit_match,
        .check          = ebt_limit_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_limit_info)),

diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 2705d7a2a9b541a9be2b1bb89783ad1504fbb0c2..c2e1c357025e808d4fcdaac8840aeb0155230123 100644 (file)
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -215,6 +215,8 @@ static unsigned int ebt_log(const struct sk_buff *skb, unsigned int hooknr,
 static struct ebt_watcher log =
 {
        .name           = EBT_LOG_WATCHER,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .watcher        = ebt_log,
        .check          = ebt_log_check,
        .targetsize     = XT_ALIGN(sizeof(struct ebt_log_info)),

diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index e4b91d8e2c6c00dbf805feba1c35091690293b30..910721a1267308283be7296db92f0e6952e4f724 100644 (file)
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -58,6 +58,8 @@ static bool ebt_target_mark_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_target mark_target __read_mostly = {
        .name           = EBT_MARK_TARGET,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .target         = ebt_target_mark,
        .check          = ebt_target_mark_check,
        .targetsize     = XT_ALIGN(sizeof(struct ebt_mark_t_info)),

diff --git a/net/bridge/netfilter/ebt_mark_m.c b/net/bridge/netfilter/ebt_mark_m.c
index ec16c0e2868aa41561ca3e257930fd5a2926de89..6512ad9b40979a442ca312947443c518330d0904 100644 (file)
--- a/net/bridge/netfilter/ebt_mark_m.c
+++ b/net/bridge/netfilter/ebt_mark_m.c
@@ -39,6 +39,8 @@ static bool ebt_mark_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match filter_mark __read_mostly = {
        .name           = EBT_MARK_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_mark,
        .check          = ebt_mark_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_mark_m_info)),

diff --git a/net/bridge/netfilter/ebt_nflog.c b/net/bridge/netfilter/ebt_nflog.c
index 2c75023b3260f49c8c48e72b7474497d69c23d25..aa0410c69a600bc6b044df69f8905707cffb8e3d 100644 (file)
--- a/net/bridge/netfilter/ebt_nflog.c
+++ b/net/bridge/netfilter/ebt_nflog.c
@@ -52,6 +52,8 @@ static bool ebt_nflog_check(const char *tablename,
 
 static struct ebt_watcher nflog __read_mostly = {
        .name = EBT_NFLOG_WATCHER,
+       .revision = 0,
+       .family = NFPROTO_BRIDGE,
        .watcher = ebt_nflog,
        .check = ebt_nflog_check,
        .targetsize = XT_ALIGN(sizeof(struct ebt_nflog_info)),

diff --git a/net/bridge/netfilter/ebt_pkttype.c b/net/bridge/netfilter/ebt_pkttype.c
index 74b44328436629e98c631e23a4dcdcb653645c6b..a9acecc88e9e265e47598fd5484c3078ebb1e616 100644 (file)
--- a/net/bridge/netfilter/ebt_pkttype.c
+++ b/net/bridge/netfilter/ebt_pkttype.c
@@ -36,6 +36,8 @@ static bool ebt_pkttype_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match filter_pkttype __read_mostly = {
        .name           = EBT_PKTTYPE_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_pkttype,
        .check          = ebt_pkttype_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_pkttype_info)),

diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 7bf1390ad97bb3ace030ebf923211e6c036d72ae..4c628108bcdabd5f13d55939513ea4c6ad978262 100644 (file)
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -52,6 +52,8 @@ static bool ebt_target_redirect_check(const char *tablename, unsigned int hookma
 
 static struct ebt_target redirect_target __read_mostly = {
        .name           = EBT_REDIRECT_TARGET,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .target         = ebt_target_redirect,
        .check          = ebt_target_redirect_check,
        .targetsize     = XT_ALIGN(sizeof(struct ebt_redirect_info)),

diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index d13f05d2620efe4b3bee01c69268f9f24ea2f16b..0e83de781c0c0a1e5fcf71b1844d6ea61b1c465a 100644 (file)
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -68,6 +68,8 @@ static bool ebt_target_snat_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_target snat __read_mostly = {
        .name           = EBT_SNAT_TARGET,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .target         = ebt_target_snat,
        .check          = ebt_target_snat_check,
        .targetsize     = XT_ALIGN(sizeof(struct ebt_nat_info)),

diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index 7618206639ed3a1692f2e014574fd4b52df7a7c6..e6d8f0c140a456201b30501e63197ae424679298 100644 (file)
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -174,6 +174,8 @@ static bool ebt_stp_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_match filter_stp __read_mostly = {
        .name           = EBT_STP_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_stp,
        .check          = ebt_stp_check,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_stp_info)),

diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 5f86f555f6d144d5ba30c71a5d49ec034a849cf8..076b44590f16b1c8cbf982afcdc918cf137d18c3 100644 (file)
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -274,6 +274,8 @@ static bool ebt_ulog_check(const char *tablename, unsigned int hookmask,
 
 static struct ebt_watcher ulog __read_mostly = {
        .name           = EBT_ULOG_WATCHER,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .watcher        = ebt_ulog,
        .check          = ebt_ulog_check,
        .targetsize     = XT_ALIGN(sizeof(struct ebt_ulog_info)),

diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index 8cc4257a1aded3e8fb4d6e49df3a0bdf1078479c..9e3a39ae46609b58a24ba203f805e44c31b21655 100644 (file)
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -164,6 +164,8 @@ ebt_check_vlan(const char *tablename,
 
 static struct ebt_match filter_vlan __read_mostly = {
        .name           = EBT_VLAN_MATCH,
+       .revision       = 0,
+       .family         = NFPROTO_BRIDGE,
        .match          = ebt_filter_vlan,
        .check          = ebt_check_vlan,
        .matchsize      = XT_ALIGN(sizeof(struct ebt_vlan_info)),

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index fe4995277296c58efa1067b0bb1e213695368103..bc4b3f4f37c4a9197dd0f124e99cb282a77b7b38 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -61,7 +61,9 @@ static LIST_HEAD(ebt_matches);
 static LIST_HEAD(ebt_watchers);
 
 static struct ebt_target ebt_standard_target = {
-       .name = "standard",
+       .name       = "standard",
+       .revision   = 0,
+       .family     = NFPROTO_BRIDGE,
 };
 
 static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
@@ -352,6 +354,17 @@ ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
                return -ENOENT;
        }
        mutex_unlock(&ebt_mutex);
+       if (match->family != NFPROTO_BRIDGE) {
+               printk(KERN_WARNING "ebtables: %s match: not for ebtables?\n",
+                      match->name);
+               goto out;
+       }
+       if (match->revision != 0) {
+               printk(KERN_WARNING "ebtables: %s match: ebtables is not "
+                      "supporting revisions at this time\n",
+                      match->name);
+               goto out;
+       }
        if (XT_ALIGN(match->matchsize) != m->match_size &&
            match->matchsize != -1) {
                /*
@@ -361,17 +374,18 @@ ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
                printk(KERN_WARNING "ebtables: %s match: "
                       "invalid size %Zu != %u\n",
                       match->name, XT_ALIGN(match->matchsize), m->match_size);
-               module_put(match->me);
-               return -EINVAL;
+               goto out;
        }
        if (match->check &&
            !match->check(name, hookmask, e, m->data, m->match_size)) {
                BUGPRINT("match->check failed\n");
-               module_put(match->me);
-               return -EINVAL;
+               goto out;
        }
        (*cnt)++;
        return 0;
+ out:
+       module_put(match->me);
+       return -EINVAL;
 }
 
 static inline int
@@ -394,22 +408,34 @@ ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
                return -ENOENT;
        }
        mutex_unlock(&ebt_mutex);
+       if (watcher->family != NFPROTO_BRIDGE) {
+               printk(KERN_WARNING "ebtables: %s watcher: not for ebtables?\n",
+                      watcher->name);
+               goto out;
+       }
+       if (watcher->revision != 0) {
+               printk(KERN_WARNING "ebtables: %s watcher: ebtables is not "
+                      "supporting revisions at this time\n",
+                      watcher->name);
+               goto out;
+       }
        if (XT_ALIGN(watcher->targetsize) != w->watcher_size) {
                printk(KERN_WARNING "ebtables: %s watcher: "
                       "invalid size %Zu != %u\n",
                       watcher->name, XT_ALIGN(watcher->targetsize),
                       w->watcher_size);
-               module_put(watcher->me);
-               return -EINVAL;
+               goto out;
        }
        if (watcher->check &&
            !watcher->check(name, hookmask, e, w->data, w->watcher_size)) {
                BUGPRINT("watcher->check failed\n");
-               module_put(watcher->me);
-               return -EINVAL;
+               goto out;
        }
        (*cnt)++;
        return 0;
+ out:
+       module_put(watcher->me);
+       return -EINVAL;
 }
 
 static int ebt_verify_pointers(struct ebt_replace *repl,
@@ -690,6 +716,20 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
        }
        mutex_unlock(&ebt_mutex);
 
+       if (target->family != NFPROTO_BRIDGE) {
+               printk(KERN_WARNING "ebtables: %s target: not for ebtables?\n",
+                      target->name);
+               ret = -EINVAL;
+               goto cleanup_watchers;
+       }
+       if (target->revision != 0) {
+               printk(KERN_WARNING "ebtables: %s target: ebtables is not "
+                      "supporting revisions at this time\n",
+                      target->name);
+               ret = -EINVAL;
+               goto cleanup_watchers;
+       }
+
        t->u.target = target;
        if (t->u.target == &ebt_standard_target) {
                if (gap < sizeof(struct ebt_standard_target)) {