Commit 3bf32761 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: add and use nf_fwd_netdev_egress

... so we can use current skb instead of working with a clone.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent df122f58
...@@ -2,5 +2,6 @@ ...@@ -2,5 +2,6 @@
#define _NF_DUP_NETDEV_H_ #define _NF_DUP_NETDEV_H_
void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif); void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
#endif #endif
...@@ -14,6 +14,29 @@ ...@@ -14,6 +14,29 @@
#include <linux/netfilter/nf_tables.h> #include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h> #include <net/netfilter/nf_tables.h>
static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev)
{
if (skb_mac_header_was_set(skb))
skb_push(skb, skb->mac_len);
skb->dev = dev;
dev_queue_xmit(skb);
}
void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif)
{
struct net_device *dev;
dev = dev_get_by_index_rcu(nft_net(pkt), oif);
if (!dev) {
kfree_skb(pkt->skb);
return;
}
nf_do_netdev_egress(pkt->skb, dev);
}
EXPORT_SYMBOL_GPL(nf_fwd_netdev_egress);
void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif) void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif)
{ {
struct net_device *dev; struct net_device *dev;
...@@ -24,14 +47,8 @@ void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif) ...@@ -24,14 +47,8 @@ void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif)
return; return;
skb = skb_clone(pkt->skb, GFP_ATOMIC); skb = skb_clone(pkt->skb, GFP_ATOMIC);
if (skb == NULL) if (skb)
return; nf_do_netdev_egress(skb, dev);
if (skb_mac_header_was_set(skb))
skb_push(skb, skb->mac_len);
skb->dev = dev;
dev_queue_xmit(skb);
} }
EXPORT_SYMBOL_GPL(nf_dup_netdev_egress); EXPORT_SYMBOL_GPL(nf_dup_netdev_egress);
......
...@@ -26,8 +26,8 @@ static void nft_fwd_netdev_eval(const struct nft_expr *expr, ...@@ -26,8 +26,8 @@ static void nft_fwd_netdev_eval(const struct nft_expr *expr,
struct nft_fwd_netdev *priv = nft_expr_priv(expr); struct nft_fwd_netdev *priv = nft_expr_priv(expr);
int oif = regs->data[priv->sreg_dev]; int oif = regs->data[priv->sreg_dev];
nf_dup_netdev_egress(pkt, oif); nf_fwd_netdev_egress(pkt, oif);
regs->verdict.code = NF_DROP; regs->verdict.code = NF_STOLEN;
} }
static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = { static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment