Merge branch 'e1000-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik...

[pandora-kernel.git] / net / ipv6 / netfilter / ip6_tables.c

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 99502c5..9aa6240 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -7,15 +7,6 @@
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
- *
- * 19 Jan 2002 Harald Welte <laforge@gnumonks.org>
- *     - increase module usage count as soon as we have rules inside
- *       a table
- * 06 Jun 2002 Andras Kis-Szabo <kisza@sch.bme.hu>
- *      - new extension header parser code
- * 15 Oct 2005 Harald Welte <laforge@netfilter.org>
- *     - Unification of {ip,ip6}_tables into x_tables
- *     - Removed tcp and udp code, since it's not ipv6 specific
  */
 
 #include <linux/capability.h>
@@ -92,16 +83,16 @@ do {                                                                \
 #endif
 
 /* Check for an extension */
-int 
+int
 ip6t_ext_hdr(u8 nexthdr)
 {
-        return ( (nexthdr == IPPROTO_HOPOPTS)   ||
-                 (nexthdr == IPPROTO_ROUTING)   ||
-                 (nexthdr == IPPROTO_FRAGMENT)  ||
-                 (nexthdr == IPPROTO_ESP)       ||
-                 (nexthdr == IPPROTO_AH)        ||
-                 (nexthdr == IPPROTO_NONE)      ||
-                 (nexthdr == IPPROTO_DSTOPTS) );
+       return ( (nexthdr == IPPROTO_HOPOPTS)   ||
+                (nexthdr == IPPROTO_ROUTING)   ||
+                (nexthdr == IPPROTO_FRAGMENT)  ||
+                (nexthdr == IPPROTO_ESP)       ||
+                (nexthdr == IPPROTO_AH)        ||
+                (nexthdr == IPPROTO_NONE)      ||
+                (nexthdr == IPPROTO_DSTOPTS) );
 }
 
 /* Returns whether matches rule or not. */
@@ -115,14 +106,14 @@ ip6_packet_match(const struct sk_buff *skb,
 {
        size_t i;
        unsigned long ret;
-       const struct ipv6hdr *ipv6 = skb->nh.ipv6h;
+       const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
 
 #define FWINV(bool,invflg) ((bool) ^ !!(ip6info->invflags & invflg))
 
        if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
-                                      &ip6info->src), IP6T_INV_SRCIP)
+                                      &ip6info->src), IP6T_INV_SRCIP)
            || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
-                                         &ip6info->dst), IP6T_INV_DSTIP)) {
+                                         &ip6info->dst), IP6T_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");
 /*
                dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
@@ -177,7 +168,7 @@ ip6_packet_match(const struct sk_buff *skb,
                *fragoff = _frag_off;
 
                dprintf("Packet protocol %hi ?= %s%hi.\n",
-                               protohdr, 
+                               protohdr,
                                ip6info->invflags & IP6T_INV_PROTO ? "!":"",
                                ip6info->proto);
 
@@ -197,7 +188,7 @@ ip6_packet_match(const struct sk_buff *skb,
 }
 
 /* should be ip6 safe */
-static inline int 
+static inline int
 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 {
        if (ipv6->flags & ~IP6T_F_MASK) {
@@ -301,7 +292,7 @@ ip6t_do_table(struct sk_buff **pskb,
                                goto no_match;
 
                        ADD_COUNTER(e->counters,
-                                   ntohs((*pskb)->nh.ipv6h->payload_len)
+                                   ntohs(ipv6_hdr(*pskb)->payload_len)
                                    + IPV6_HDR_LEN,
                                    1);
 
@@ -337,7 +328,7 @@ ip6t_do_table(struct sk_buff **pskb,
                                e = get_entry(table_base, v);
                        } else {
                                /* Targets which reenter must return
-                                   abs. verdicts */
+                                  abs. verdicts */
 #ifdef CONFIG_NETFILTER_DEBUG
                                ((struct ip6t_entry *)table_base)->comefrom
                                        = 0xeeeeeeec;
@@ -530,14 +521,14 @@ check_match(struct ip6t_entry_match *m,
            unsigned int hookmask,
            unsigned int *i)
 {
-       struct ip6t_match *match;
+       struct xt_match *match;
        int ret;
 
        match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
-                                       m->u.user.revision),
+                                       m->u.user.revision),
                                        "ip6t_%s", m->u.user.name);
        if (IS_ERR(match) || !match) {
-               duprintf("check_match: `%s' not found\n", m->u.user.name);
+               duprintf("check_match: `%s' not found\n", m->u.user.name);
                return match ? PTR_ERR(match) : -ENOENT;
        }
        m->u.kernel.match = match;
@@ -564,14 +555,14 @@ err:
        return ret;
 }
 
-static struct ip6t_target ip6t_standard_target;
+static struct xt_target ip6t_standard_target;
 
 static inline int
 check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
            unsigned int *i)
 {
        struct ip6t_entry_target *t;
-       struct ip6t_target *target;
+       struct xt_target *target;
        int ret;
        unsigned int j;
 
@@ -661,7 +652,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
        }
 
        /* FIXME: underflows must be unconditional, standard verdicts
-           < 0 (not IP6T_RETURN). --RR */
+          < 0 (not IP6T_RETURN). --RR */
 
        /* Clear counters and comefrom */
        e->counters = ((struct xt_counters) { 0, 0 });
@@ -1003,8 +994,8 @@ do_replace(void __user *user, unsigned int len)
        /* Update module usage count based on number of rules */
        duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
                oldinfo->number, oldinfo->initial_entries, newinfo->number);
-       if ((oldinfo->number > oldinfo->initial_entries) || 
-           (newinfo->number <= oldinfo->initial_entries)) 
+       if ((oldinfo->number > oldinfo->initial_entries) ||
+           (newinfo->number <= oldinfo->initial_entries))
                module_put(t->me);
        if ((oldinfo->number > oldinfo->initial_entries) &&
            (newinfo->number <= oldinfo->initial_entries))
@@ -1348,13 +1339,13 @@ icmp6_checkentry(const char *tablename,
 }
 
 /* The built-in targets: standard (NULL) and error. */
-static struct ip6t_target ip6t_standard_target = {
+static struct xt_target ip6t_standard_target = {
        .name           = IP6T_STANDARD_TARGET,
        .targetsize     = sizeof(int),
        .family         = AF_INET6,
 };
 
-static struct ip6t_target ip6t_error_target = {
+static struct xt_target ip6t_error_target = {
        .name           = IP6T_ERROR_TARGET,
        .target         = ip6t_error,
        .targetsize     = IP6T_FUNCTION_MAXNAMELEN,
@@ -1371,7 +1362,7 @@ static struct nf_sockopt_ops ip6t_sockopts = {
        .get            = do_ip6t_get_ctl,
 };
 
-static struct ip6t_match icmp6_matchstruct = {
+static struct xt_match icmp6_matchstruct = {
        .name           = "icmp6",
        .match          = &icmp6_match,
        .matchsize      = sizeof(struct ip6t_icmp),
@@ -1448,8 +1439,8 @@ static void __exit ip6_tables_fini(void)
 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                  int target, unsigned short *fragoff)
 {
-       unsigned int start = (u8*)(skb->nh.ipv6h + 1) - skb->data;
-       u8 nexthdr = skb->nh.ipv6h->nexthdr;
+       unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+       u8 nexthdr = ipv6_hdr(skb)->nexthdr;
        unsigned int len = skb->len - start;
 
        if (fragoff)
@@ -1492,9 +1483,9 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                        }
                        hdrlen = 8;
                } else if (nexthdr == NEXTHDR_AUTH)
-                       hdrlen = (hp->hdrlen + 2) << 2; 
+                       hdrlen = (hp->hdrlen + 2) << 2;
                else
-                       hdrlen = ipv6_optlen(hp); 
+                       hdrlen = ipv6_optlen(hp);
 
                nexthdr = hp->nexthdr;
                len -= hdrlen;