xtables: move icmp/icmpv6 logic to xt_tcpudp

[platform/kernel/linux-starfive.git] / net / ipv4 / netfilter / ip_tables.c

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index da59980..7da1df4 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -14,7 +14,6 @@
 #include <linux/vmalloc.h>
 #include <linux/netdevice.h>
 #include <linux/module.h>
-#include <linux/icmp.h>
 #include <net/ip.h>
 #include <net/compat.h>
 #include <linux/uaccess.h>
@@ -31,7 +30,6 @@
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("IPv4 packet filter");
-MODULE_ALIAS("ipt_icmp");
 
 void *ipt_alloc_initial_table(const struct xt_table *info)
 {
@@ -1799,52 +1797,6 @@ void ipt_unregister_table_exit(struct net *net, const char *name)
                __ipt_unregister_table(net, table);
 }
 
-/* Returns 1 if the type and code is matched by the range, 0 otherwise */
-static inline bool
-icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
-                    u_int8_t type, u_int8_t code,
-                    bool invert)
-{
-       return ((test_type == 0xFF) ||
-               (type == test_type && code >= min_code && code <= max_code))
-               ^ invert;
-}
-
-static bool
-icmp_match(const struct sk_buff *skb, struct xt_action_param *par)
-{
-       const struct icmphdr *ic;
-       struct icmphdr _icmph;
-       const struct ipt_icmp *icmpinfo = par->matchinfo;
-
-       /* Must not be a fragment. */
-       if (par->fragoff != 0)
-               return false;
-
-       ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
-       if (ic == NULL) {
-               /* We've been asked to examine this packet, and we
-                * can't.  Hence, no choice but to drop.
-                */
-               par->hotdrop = true;
-               return false;
-       }
-
-       return icmp_type_code_match(icmpinfo->type,
-                                   icmpinfo->code[0],
-                                   icmpinfo->code[1],
-                                   ic->type, ic->code,
-                                   !!(icmpinfo->invflags&IPT_ICMP_INV));
-}
-
-static int icmp_checkentry(const struct xt_mtchk_param *par)
-{
-       const struct ipt_icmp *icmpinfo = par->matchinfo;
-
-       /* Must specify no unknown invflags */
-       return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
-}
-
 static struct xt_target ipt_builtin_tg[] __read_mostly = {
        {
                .name             = XT_STANDARD_TARGET,
@@ -1875,18 +1827,6 @@ static struct nf_sockopt_ops ipt_sockopts = {
        .owner          = THIS_MODULE,
 };
 
-static struct xt_match ipt_builtin_mt[] __read_mostly = {
-       {
-               .name       = "icmp",
-               .match      = icmp_match,
-               .matchsize  = sizeof(struct ipt_icmp),
-               .checkentry = icmp_checkentry,
-               .proto      = IPPROTO_ICMP,
-               .family     = NFPROTO_IPV4,
-               .me         = THIS_MODULE,
-       },
-};
-
 static int __net_init ip_tables_net_init(struct net *net)
 {
        return xt_proto_init(net, NFPROTO_IPV4);
@@ -1914,19 +1854,14 @@ static int __init ip_tables_init(void)
        ret = xt_register_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
        if (ret < 0)
                goto err2;
-       ret = xt_register_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
-       if (ret < 0)
-               goto err4;
 
        /* Register setsockopt */
        ret = nf_register_sockopt(&ipt_sockopts);
        if (ret < 0)
-               goto err5;
+               goto err4;
 
        return 0;
 
-err5:
-       xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
 err4:
        xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
 err2:
@@ -1939,7 +1874,6 @@ static void __exit ip_tables_fini(void)
 {
        nf_unregister_sockopt(&ipt_sockopts);
 
-       xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
        xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
        unregister_pernet_subsys(&ip_tables_net_ops);
 }