netfilter: nf_tables: convert pktinfo->tprot_set to flags field

[ Upstream commit b5bdc6f9c24db9a0adf8bd00c0e935b184654f00 ]

Generalize boolean field to store more flags on the pktinfo structure.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 2af1c2c..d005f87 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -21,10 +21,14 @@ struct module;
 
 #define NFT_JUMP_STACK_SIZE    16
 
+enum {
+       NFT_PKTINFO_L4PROTO     = (1 << 0),
+};
+
 struct nft_pktinfo {
        struct sk_buff                  *skb;
        const struct nf_hook_state      *state;
-       bool                            tprot_set;
+       u8                              flags;
        u8                              tprot;
        u16                             fragoff;
        unsigned int                    thoff;
@@ -75,7 +79,7 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
 
 static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt)
 {
-       pkt->tprot_set = false;
+       pkt->flags = 0;
        pkt->tprot = 0;
        pkt->thoff = 0;
        pkt->fragoff = 0;

diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
index eb4c094..c4a6147 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv4.h
+++ b/include/net/netfilter/nf_tables_ipv4.h
@@ -10,7 +10,7 @@ static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt)
        struct iphdr *ip;
 
        ip = ip_hdr(pkt->skb);
-       pkt->tprot_set = true;
+       pkt->flags = NFT_PKTINFO_L4PROTO;
        pkt->tprot = ip->protocol;
        pkt->thoff = ip_hdrlen(pkt->skb);
        pkt->fragoff = ntohs(ip->frag_off) & IP_OFFSET;
@@ -36,7 +36,7 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
        else if (len < thoff)
                return -1;
 
-       pkt->tprot_set = true;
+       pkt->flags = NFT_PKTINFO_L4PROTO;
        pkt->tprot = iph->protocol;
        pkt->thoff = thoff;
        pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;
@@ -71,7 +71,7 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt)
                goto inhdr_error;
        }
 
-       pkt->tprot_set = true;
+       pkt->flags = NFT_PKTINFO_L4PROTO;
        pkt->tprot = iph->protocol;
        pkt->thoff = thoff;
        pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;
@@ -82,4 +82,5 @@ inhdr_error:
        __IP_INC_STATS(nft_net(pkt), IPSTATS_MIB_INHDRERRORS);
        return -1;
 }
+
 #endif

diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index 7595e02..ec7eaea 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -18,7 +18,7 @@ static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt)
                return;
        }
 
-       pkt->tprot_set = true;
+       pkt->flags = NFT_PKTINFO_L4PROTO;
        pkt->tprot = protohdr;
        pkt->thoff = thoff;
        pkt->fragoff = frag_off;
@@ -50,7 +50,7 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt)
        if (protohdr < 0)
                return -1;
 
-       pkt->tprot_set = true;
+       pkt->flags = NFT_PKTINFO_L4PROTO;
        pkt->tprot = protohdr;
        pkt->thoff = thoff;
        pkt->fragoff = frag_off;
@@ -96,7 +96,7 @@ static inline int nft_set_pktinfo_ipv6_ingress(struct nft_pktinfo *pkt)
        if (protohdr < 0)
                goto inhdr_error;
 
-       pkt->tprot_set = true;
+       pkt->flags = NFT_PKTINFO_L4PROTO;
        pkt->tprot = protohdr;
        pkt->thoff = thoff;
        pkt->fragoff = frag_off;

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 907e848..d4d8f61 100644 (file)
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -79,7 +79,7 @@ static bool nft_payload_fast_eval(const struct nft_expr *expr,
        if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
                ptr = skb_network_header(skb);
        else {
-               if (!pkt->tprot_set)
+               if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
                        return false;
                ptr = skb_network_header(skb) + nft_thoff(pkt);
        }

diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c
index e4fe2f0..84a7dea 100644 (file)
--- a/net/netfilter/nf_tables_trace.c
+++ b/net/netfilter/nf_tables_trace.c
@@ -113,13 +113,13 @@ static int nf_trace_fill_pkt_info(struct sk_buff *nlskb,
        int off = skb_network_offset(skb);
        unsigned int len, nh_end;
 
-       nh_end = pkt->tprot_set ? nft_thoff(pkt) : skb->len;
+       nh_end = pkt->flags & NFT_PKTINFO_L4PROTO ? nft_thoff(pkt) : skb->len;
        len = min_t(unsigned int, nh_end - skb_network_offset(skb),
                    NFT_TRACETYPE_NETWORK_HSIZE);
        if (trace_fill_header(nlskb, NFTA_TRACE_NETWORK_HEADER, skb, off, len))
                return -1;
 
-       if (pkt->tprot_set) {
+       if (pkt->flags & NFT_PKTINFO_L4PROTO) {
                len = min_t(unsigned int, skb->len - nft_thoff(pkt),
                            NFT_TRACETYPE_TRANSPORT_HSIZE);
                if (trace_fill_header(nlskb, NFTA_TRACE_TRANSPORT_HEADER, skb,

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 44d9b38..14412f6 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -321,7 +321,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                nft_reg_store8(dest, nft_pf(pkt));
                break;
        case NFT_META_L4PROTO:
-               if (!pkt->tprot_set)
+               if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
                        goto err;
                nft_reg_store8(dest, pkt->tprot);
                break;

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 132875c..c3ccfff 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -108,7 +108,7 @@ void nft_payload_eval(const struct nft_expr *expr,
                offset = skb_network_offset(skb);
                break;
        case NFT_PAYLOAD_TRANSPORT_HEADER:
-               if (!pkt->tprot_set)
+               if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
                        goto err;
                offset = nft_thoff(pkt);
                break;
@@ -613,7 +613,7 @@ static void nft_payload_set_eval(const struct nft_expr *expr,
                offset = skb_network_offset(skb);
                break;
        case NFT_PAYLOAD_TRANSPORT_HEADER:
-               if (!pkt->tprot_set)
+               if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
                        goto err;
                offset = nft_thoff(pkt);
                break;