Commit a67dd266 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: xtables: prepare for on-demand hook register

This change prepares for upcoming on-demand xtables hook registration.

We change the protoypes of the register/unregister functions.
A followup patch will then add nf_hook_register/unregister calls
to the iptables one.

Once a hook is registered packets will be picked up, so all assignments
of the form

net->ipv4.iptable_$table = new_table

have to be moved to ip(6)t_register_table, else we can see NULL
net->ipv4.iptable_$table later.

This patch doesn't change functionality; without this the actual change
simply gets too big.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5f547391
......@@ -48,10 +48,11 @@ struct arpt_error {
}
extern void *arpt_alloc_initial_table(const struct xt_table *);
extern struct xt_table *arpt_register_table(struct net *net,
const struct xt_table *table,
const struct arpt_replace *repl);
extern void arpt_unregister_table(struct xt_table *table);
int arpt_register_table(struct net *net, const struct xt_table *table,
const struct arpt_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res);
void arpt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops);
extern unsigned int arpt_do_table(struct sk_buff *skb,
const struct nf_hook_state *state,
struct xt_table *table);
......
......@@ -24,10 +24,11 @@
extern void ipt_init(void) __init;
extern struct xt_table *ipt_register_table(struct net *net,
const struct xt_table *table,
const struct ipt_replace *repl);
extern void ipt_unregister_table(struct net *net, struct xt_table *table);
int ipt_register_table(struct net *net, const struct xt_table *table,
const struct ipt_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res);
void ipt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops);
/* Standard entry. */
struct ipt_standard {
......
......@@ -25,10 +25,11 @@
extern void ip6t_init(void) __init;
extern void *ip6t_alloc_initial_table(const struct xt_table *);
extern struct xt_table *ip6t_register_table(struct net *net,
const struct xt_table *table,
const struct ip6t_replace *repl);
extern void ip6t_unregister_table(struct net *net, struct xt_table *table);
int ip6t_register_table(struct net *net, const struct xt_table *table,
const struct ip6t_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res);
void ip6t_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops);
extern unsigned int ip6t_do_table(struct sk_buff *skb,
const struct nf_hook_state *state,
struct xt_table *table);
......
......@@ -1780,9 +1780,11 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
return ret;
}
struct xt_table *arpt_register_table(struct net *net,
const struct xt_table *table,
const struct arpt_replace *repl)
int arpt_register_table(struct net *net,
const struct xt_table *table,
const struct arpt_replace *repl,
const struct nf_hook_ops *ops,
struct xt_table **res)
{
int ret;
struct xt_table_info *newinfo;
......@@ -1791,10 +1793,8 @@ struct xt_table *arpt_register_table(struct net *net,
struct xt_table *new_table;
newinfo = xt_alloc_table_info(repl->size);
if (!newinfo) {
ret = -ENOMEM;
goto out;
}
if (!newinfo)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
memcpy(loc_cpu_entry, repl->entries, repl->size);
......@@ -1809,15 +1809,18 @@ struct xt_table *arpt_register_table(struct net *net,
ret = PTR_ERR(new_table);
goto out_free;
}
return new_table;
WRITE_ONCE(*res, new_table);
return ret;
out_free:
xt_free_table_info(newinfo);
out:
return ERR_PTR(ret);
return ret;
}
void arpt_unregister_table(struct xt_table *table)
void arpt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops)
{
struct xt_table_info *private;
void *loc_cpu_entry;
......
......@@ -38,19 +38,20 @@ static struct nf_hook_ops *arpfilter_ops __read_mostly;
static int __net_init arptable_filter_net_init(struct net *net)
{
struct arpt_replace *repl;
int err;
repl = arpt_alloc_initial_table(&packet_filter);
if (repl == NULL)
return -ENOMEM;
net->ipv4.arptable_filter =
arpt_register_table(net, &packet_filter, repl);
err = arpt_register_table(net, &packet_filter, repl, arpfilter_ops,
&net->ipv4.arptable_filter);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv4.arptable_filter);
return err;
}
static void __net_exit arptable_filter_net_exit(struct net *net)
{
arpt_unregister_table(net->ipv4.arptable_filter);
arpt_unregister_table(net, net->ipv4.arptable_filter, arpfilter_ops);
}
static struct pernet_operations arptable_filter_net_ops = {
......
......@@ -2062,9 +2062,9 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
return ret;
}
struct xt_table *ipt_register_table(struct net *net,
const struct xt_table *table,
const struct ipt_replace *repl)
int ipt_register_table(struct net *net, const struct xt_table *table,
const struct ipt_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res)
{
int ret;
struct xt_table_info *newinfo;
......@@ -2073,10 +2073,8 @@ struct xt_table *ipt_register_table(struct net *net,
struct xt_table *new_table;
newinfo = xt_alloc_table_info(repl->size);
if (!newinfo) {
ret = -ENOMEM;
goto out;
}
if (!newinfo)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
memcpy(loc_cpu_entry, repl->entries, repl->size);
......@@ -2091,15 +2089,16 @@ struct xt_table *ipt_register_table(struct net *net,
goto out_free;
}
return new_table;
WRITE_ONCE(*res, new_table);
return ret;
out_free:
xt_free_table_info(newinfo);
out:
return ERR_PTR(ret);
return ret;
}
void ipt_unregister_table(struct net *net, struct xt_table *table)
void ipt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops)
{
struct xt_table_info *private;
void *loc_cpu_entry;
......
......@@ -54,6 +54,7 @@ module_param(forward, bool, 0000);
static int __net_init iptable_filter_net_init(struct net *net)
{
struct ipt_replace *repl;
int err;
repl = ipt_alloc_initial_table(&packet_filter);
if (repl == NULL)
......@@ -62,15 +63,15 @@ static int __net_init iptable_filter_net_init(struct net *net)
((struct ipt_standard *)repl->entries)[1].target.verdict =
forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
net->ipv4.iptable_filter =
ipt_register_table(net, &packet_filter, repl);
err = ipt_register_table(net, &packet_filter, repl, filter_ops,
&net->ipv4.iptable_filter);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv4.iptable_filter);
return err;
}
static void __net_exit iptable_filter_net_exit(struct net *net)
{
ipt_unregister_table(net, net->ipv4.iptable_filter);
ipt_unregister_table(net, net->ipv4.iptable_filter, filter_ops);
}
static struct pernet_operations iptable_filter_net_ops = {
......
......@@ -96,19 +96,20 @@ static struct nf_hook_ops *mangle_ops __read_mostly;
static int __net_init iptable_mangle_net_init(struct net *net)
{
struct ipt_replace *repl;
int ret;
repl = ipt_alloc_initial_table(&packet_mangler);
if (repl == NULL)
return -ENOMEM;
net->ipv4.iptable_mangle =
ipt_register_table(net, &packet_mangler, repl);
ret = ipt_register_table(net, &packet_mangler, repl, mangle_ops,
&net->ipv4.iptable_mangle);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv4.iptable_mangle);
return ret;
}
static void __net_exit iptable_mangle_net_exit(struct net *net)
{
ipt_unregister_table(net, net->ipv4.iptable_mangle);
ipt_unregister_table(net, net->ipv4.iptable_mangle, mangle_ops);
}
static struct pernet_operations iptable_mangle_net_ops = {
......
......@@ -98,18 +98,20 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
static int __net_init iptable_nat_net_init(struct net *net)
{
struct ipt_replace *repl;
int ret;
repl = ipt_alloc_initial_table(&nf_nat_ipv4_table);
if (repl == NULL)
return -ENOMEM;
net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl);
ret = ipt_register_table(net, &nf_nat_ipv4_table, repl,
nf_nat_ipv4_ops, &net->ipv4.nat_table);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv4.nat_table);
return ret;
}
static void __net_exit iptable_nat_net_exit(struct net *net)
{
ipt_unregister_table(net, net->ipv4.nat_table);
ipt_unregister_table(net, net->ipv4.nat_table, nf_nat_ipv4_ops);
}
static struct pernet_operations iptable_nat_net_ops = {
......
......@@ -37,19 +37,20 @@ static struct nf_hook_ops *rawtable_ops __read_mostly;
static int __net_init iptable_raw_net_init(struct net *net)
{
struct ipt_replace *repl;
int ret;
repl = ipt_alloc_initial_table(&packet_raw);
if (repl == NULL)
return -ENOMEM;
net->ipv4.iptable_raw =
ipt_register_table(net, &packet_raw, repl);
ret = ipt_register_table(net, &packet_raw, repl, rawtable_ops,
&net->ipv4.iptable_raw);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv4.iptable_raw);
return ret;
}
static void __net_exit iptable_raw_net_exit(struct net *net)
{
ipt_unregister_table(net, net->ipv4.iptable_raw);
ipt_unregister_table(net, net->ipv4.iptable_raw, rawtable_ops);
}
static struct pernet_operations iptable_raw_net_ops = {
......
......@@ -54,19 +54,20 @@ static struct nf_hook_ops *sectbl_ops __read_mostly;
static int __net_init iptable_security_net_init(struct net *net)
{
struct ipt_replace *repl;
int ret;
repl = ipt_alloc_initial_table(&security_table);
if (repl == NULL)
return -ENOMEM;
net->ipv4.iptable_security =
ipt_register_table(net, &security_table, repl);
ret = ipt_register_table(net, &security_table, repl, sectbl_ops,
&net->ipv4.iptable_security);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv4.iptable_security);
return ret;
}
static void __net_exit iptable_security_net_exit(struct net *net)
{
ipt_unregister_table(net, net->ipv4.iptable_security);
ipt_unregister_table(net, net->ipv4.iptable_security, sectbl_ops);
}
static struct pernet_operations iptable_security_net_ops = {
......
......@@ -2071,9 +2071,10 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
return ret;
}
struct xt_table *ip6t_register_table(struct net *net,
const struct xt_table *table,
const struct ip6t_replace *repl)
int ip6t_register_table(struct net *net, const struct xt_table *table,
const struct ip6t_replace *repl,
const struct nf_hook_ops *ops,
struct xt_table **res)
{
int ret;
struct xt_table_info *newinfo;
......@@ -2082,10 +2083,8 @@ struct xt_table *ip6t_register_table(struct net *net,
struct xt_table *new_table;
newinfo = xt_alloc_table_info(repl->size);
if (!newinfo) {
ret = -ENOMEM;
goto out;
}
if (!newinfo)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
memcpy(loc_cpu_entry, repl->entries, repl->size);
......@@ -2099,15 +2098,17 @@ struct xt_table *ip6t_register_table(struct net *net,
ret = PTR_ERR(new_table);
goto out_free;
}
return new_table;
WRITE_ONCE(*res, new_table);
return ret;
out_free:
xt_free_table_info(newinfo);
out:
return ERR_PTR(ret);
return ret;
}
void ip6t_unregister_table(struct net *net, struct xt_table *table)
void ip6t_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops)
{
struct xt_table_info *private;
void *loc_cpu_entry;
......
......@@ -47,6 +47,7 @@ module_param(forward, bool, 0000);
static int __net_init ip6table_filter_net_init(struct net *net)
{
struct ip6t_replace *repl;
int err;
repl = ip6t_alloc_initial_table(&packet_filter);
if (repl == NULL)
......@@ -55,15 +56,15 @@ static int __net_init ip6table_filter_net_init(struct net *net)
((struct ip6t_standard *)repl->entries)[1].target.verdict =
forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
net->ipv6.ip6table_filter =
ip6t_register_table(net, &packet_filter, repl);
err = ip6t_register_table(net, &packet_filter, repl, filter_ops,
&net->ipv6.ip6table_filter);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_filter);
return err;
}
static void __net_exit ip6table_filter_net_exit(struct net *net)
{
ip6t_unregister_table(net, net->ipv6.ip6table_filter);
ip6t_unregister_table(net, net->ipv6.ip6table_filter, filter_ops);
}
static struct pernet_operations ip6table_filter_net_ops = {
......
......@@ -91,19 +91,20 @@ static struct nf_hook_ops *mangle_ops __read_mostly;
static int __net_init ip6table_mangle_net_init(struct net *net)
{
struct ip6t_replace *repl;
int ret;
repl = ip6t_alloc_initial_table(&packet_mangler);
if (repl == NULL)
return -ENOMEM;
net->ipv6.ip6table_mangle =
ip6t_register_table(net, &packet_mangler, repl);
ret = ip6t_register_table(net, &packet_mangler, repl, mangle_ops,
&net->ipv6.ip6table_mangle);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_mangle);
return ret;
}
static void __net_exit ip6table_mangle_net_exit(struct net *net)
{
ip6t_unregister_table(net, net->ipv6.ip6table_mangle);
ip6t_unregister_table(net, net->ipv6.ip6table_mangle, mangle_ops);
}
static struct pernet_operations ip6table_mangle_net_ops = {
......
......@@ -100,18 +100,20 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
static int __net_init ip6table_nat_net_init(struct net *net)
{
struct ip6t_replace *repl;
int ret;
repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
if (repl == NULL)
return -ENOMEM;
net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
ret = ip6t_register_table(net, &nf_nat_ipv6_table, repl,
nf_nat_ipv6_ops, &net->ipv6.ip6table_nat);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_nat);
return ret;
}
static void __net_exit ip6table_nat_net_exit(struct net *net)
{
ip6t_unregister_table(net, net->ipv6.ip6table_nat);
ip6t_unregister_table(net, net->ipv6.ip6table_nat, nf_nat_ipv6_ops);
}
static struct pernet_operations ip6table_nat_net_ops = {
......
......@@ -30,19 +30,20 @@ static struct nf_hook_ops *rawtable_ops __read_mostly;
static int __net_init ip6table_raw_net_init(struct net *net)
{
struct ip6t_replace *repl;
int ret;
repl = ip6t_alloc_initial_table(&packet_raw);
if (repl == NULL)
return -ENOMEM;
net->ipv6.ip6table_raw =
ip6t_register_table(net, &packet_raw, repl);
ret = ip6t_register_table(net, &packet_raw, repl, rawtable_ops,
&net->ipv6.ip6table_raw);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_raw);
return ret;
}
static void __net_exit ip6table_raw_net_exit(struct net *net)
{
ip6t_unregister_table(net, net->ipv6.ip6table_raw);
ip6t_unregister_table(net, net->ipv6.ip6table_raw, rawtable_ops);
}
static struct pernet_operations ip6table_raw_net_ops = {
......
......@@ -47,19 +47,20 @@ static struct nf_hook_ops *sectbl_ops __read_mostly;
static int __net_init ip6table_security_net_init(struct net *net)
{
struct ip6t_replace *repl;
int ret;
repl = ip6t_alloc_initial_table(&security_table);
if (repl == NULL)
return -ENOMEM;
net->ipv6.ip6table_security =
ip6t_register_table(net, &security_table, repl);
ret = ip6t_register_table(net, &security_table, repl, sectbl_ops,
&net->ipv6.ip6table_security);
kfree(repl);
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_security);
return ret;
}
static void __net_exit ip6table_security_net_exit(struct net *net)
{
ip6t_unregister_table(net, net->ipv6.ip6table_security);
ip6t_unregister_table(net, net->ipv6.ip6table_security, sectbl_ops);
}
static struct pernet_operations ip6table_security_net_ops = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment