openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: nf_tables: move struct net pointer to base chain 

The network namespace is only needed for base chains to get at the
gencursor. Also convert to possible_net_t.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Patrick McHardy 2015-03-21 15:19:15 +00:00 committed by Pablo Neira Ayuso
parent 0144a81ccc
commit 5ebb335dcb
3 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/net/netfilter/nf_tables.h
View File

@ -449,7 +449,6 @@ enum nft_chain_flags {
* *
* @rules: list of rules in the chain * @rules: list of rules in the chain
* @list: used internally * @list: used internally
* @net: net namespace that this chain belongs to
* @table: table that this chain belongs to * @table: table that this chain belongs to
* @handle: chain handle * @handle: chain handle
* @use: number of jump references to this chain * @use: number of jump references to this chain
@ -460,7 +459,6 @@ enum nft_chain_flags {
struct nft_chain { struct nft_chain {
struct list_head rules; struct list_head rules;
struct list_head list; struct list_head list;
struct net *net;
struct nft_table *table; struct nft_table *table;
u64 handle; u64 handle;
u32 use; u32 use;
@ -512,6 +510,7 @@ struct nft_stats {
* struct nft_base_chain - nf_tables base chain * struct nft_base_chain - nf_tables base chain
* *
* @ops: netfilter hook ops * @ops: netfilter hook ops
* @pnet: net namespace that this chain belongs to
* @type: chain type * @type: chain type
* @policy: default policy * @policy: default policy
* @stats: per-cpu chain stats * @stats: per-cpu chain stats
@ -519,6 +518,7 @@ struct nft_stats {
*/ */
struct nft_base_chain { struct nft_base_chain {
struct nf_hook_ops ops[NFT_HOOK_OPS_MAX]; struct nf_hook_ops ops[NFT_HOOK_OPS_MAX];
possible_net_t pnet;
const struct nf_chain_type *type; const struct nf_chain_type *type;
u8 policy; u8 policy;
struct nft_stats __percpu *stats; struct nft_stats __percpu *stats;

2
net/netfilter/nf_tables_api.c
View File

@ -1354,6 +1354,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
rcu_assign_pointer(basechain->stats, stats); rcu_assign_pointer(basechain->stats, stats);
} }
write_pnet(&basechain->pnet, net);
basechain->type = type; basechain->type = type;
chain = &basechain->chain; chain = &basechain->chain;
@ -1381,7 +1382,6 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
INIT_LIST_HEAD(&chain->rules); INIT_LIST_HEAD(&chain->rules);
chain->handle = nf_tables_alloc_handle(table); chain->handle = nf_tables_alloc_handle(table);
chain->net = net;
chain->table = table; chain->table = table;
nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN); nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);

3
net/netfilter/nf_tables_core.c
View File

@ -112,6 +112,7 @@ unsigned int
nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops) nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops)
{ {
const struct nft_chain *chain = ops->priv, *basechain = chain; const struct nft_chain *chain = ops->priv, *basechain = chain;
const struct net *net = read_pnet(&nft_base_chain(basechain)->pnet);
const struct nft_rule *rule; const struct nft_rule *rule;
const struct nft_expr *expr, *last; const struct nft_expr *expr, *last;
struct nft_data data[NFT_REG_MAX + 1]; struct nft_data data[NFT_REG_MAX + 1];
@ -123,7 +124,7 @@ nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops)
* Cache cursor to avoid problems in case that the cursor is updated * Cache cursor to avoid problems in case that the cursor is updated
* while traversing the ruleset. * while traversing the ruleset.
*/ */
unsigned int gencursor = ACCESS_ONCE(chain->net->nft.gencursor); unsigned int gencursor = ACCESS_ONCE(net->nft.gencursor);
do_chain: do_chain:
rulenum = 0; rulenum = 0;