Commit 1cbf9098 authored by David Wilder's avatar David Wilder Committed by Pablo Neira Ayuso

netfilter: iptables: Split ipt_unregister_table() into pre_exit and exit helpers.

The pre_exit will un-register the underlying hook and .exit will do the
table freeing. The netns core does an unconditional synchronize_rcu after
the pre_exit hooks insuring no packets are in flight that have picked up
the pointer before completing the un-register.

Fixes: b9e69e12 ("netfilter: xtables: don't hook tables by default")
Signed-off-by: default avatarDavid Wilder <dwilder@us.ibm.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 4cacc395
...@@ -25,6 +25,12 @@ ...@@ -25,6 +25,12 @@
int ipt_register_table(struct net *net, const struct xt_table *table, int ipt_register_table(struct net *net, const struct xt_table *table,
const struct ipt_replace *repl, const struct ipt_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res); const struct nf_hook_ops *ops, struct xt_table **res);
void ipt_unregister_table_pre_exit(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops);
void ipt_unregister_table_exit(struct net *net, struct xt_table *table);
void ipt_unregister_table(struct net *net, struct xt_table *table, void ipt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops); const struct nf_hook_ops *ops);
......
...@@ -1797,11 +1797,22 @@ int ipt_register_table(struct net *net, const struct xt_table *table, ...@@ -1797,11 +1797,22 @@ int ipt_register_table(struct net *net, const struct xt_table *table,
return ret; return ret;
} }
void ipt_unregister_table_pre_exit(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops)
{
nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
}
void ipt_unregister_table_exit(struct net *net, struct xt_table *table)
{
__ipt_unregister_table(net, table);
}
void ipt_unregister_table(struct net *net, struct xt_table *table, void ipt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops) const struct nf_hook_ops *ops)
{ {
if (ops) if (ops)
nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks)); ipt_unregister_table_pre_exit(net, table, ops);
__ipt_unregister_table(net, table); __ipt_unregister_table(net, table);
} }
...@@ -1958,6 +1969,8 @@ static void __exit ip_tables_fini(void) ...@@ -1958,6 +1969,8 @@ static void __exit ip_tables_fini(void)
EXPORT_SYMBOL(ipt_register_table); EXPORT_SYMBOL(ipt_register_table);
EXPORT_SYMBOL(ipt_unregister_table); EXPORT_SYMBOL(ipt_unregister_table);
EXPORT_SYMBOL(ipt_unregister_table_pre_exit);
EXPORT_SYMBOL(ipt_unregister_table_exit);
EXPORT_SYMBOL(ipt_do_table); EXPORT_SYMBOL(ipt_do_table);
module_init(ip_tables_init); module_init(ip_tables_init);
module_exit(ip_tables_fini); module_exit(ip_tables_fini);
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment