mirror of https://gitee.com/openkylin/linux.git
netfilter: xtables: prepare for on-demand hook register
This change prepares for upcoming on-demand xtables hook registration. We change the protoypes of the register/unregister functions. A followup patch will then add nf_hook_register/unregister calls to the iptables one. Once a hook is registered packets will be picked up, so all assignments of the form net->ipv4.iptable_$table = new_table have to be moved to ip(6)t_register_table, else we can see NULL net->ipv4.iptable_$table later. This patch doesn't change functionality; without this the actual change simply gets too big. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
5f547391f5
commit
a67dd266ad
|
@ -48,10 +48,11 @@ struct arpt_error {
|
|||
}
|
||||
|
||||
extern void *arpt_alloc_initial_table(const struct xt_table *);
|
||||
extern struct xt_table *arpt_register_table(struct net *net,
|
||||
const struct xt_table *table,
|
||||
const struct arpt_replace *repl);
|
||||
extern void arpt_unregister_table(struct xt_table *table);
|
||||
int arpt_register_table(struct net *net, const struct xt_table *table,
|
||||
const struct arpt_replace *repl,
|
||||
const struct nf_hook_ops *ops, struct xt_table **res);
|
||||
void arpt_unregister_table(struct net *net, struct xt_table *table,
|
||||
const struct nf_hook_ops *ops);
|
||||
extern unsigned int arpt_do_table(struct sk_buff *skb,
|
||||
const struct nf_hook_state *state,
|
||||
struct xt_table *table);
|
||||
|
|
|
@ -24,10 +24,11 @@
|
|||
|
||||
extern void ipt_init(void) __init;
|
||||
|
||||
extern struct xt_table *ipt_register_table(struct net *net,
|
||||
const struct xt_table *table,
|
||||
const struct ipt_replace *repl);
|
||||
extern void ipt_unregister_table(struct net *net, struct xt_table *table);
|
||||
int ipt_register_table(struct net *net, const struct xt_table *table,
|
||||
const struct ipt_replace *repl,
|
||||
const struct nf_hook_ops *ops, struct xt_table **res);
|
||||
void ipt_unregister_table(struct net *net, struct xt_table *table,
|
||||
const struct nf_hook_ops *ops);
|
||||
|
||||
/* Standard entry. */
|
||||
struct ipt_standard {
|
||||
|
|
|
@ -25,10 +25,11 @@
|
|||
extern void ip6t_init(void) __init;
|
||||
|
||||
extern void *ip6t_alloc_initial_table(const struct xt_table *);
|
||||
extern struct xt_table *ip6t_register_table(struct net *net,
|
||||
const struct xt_table *table,
|
||||
const struct ip6t_replace *repl);
|
||||
extern void ip6t_unregister_table(struct net *net, struct xt_table *table);
|
||||
int ip6t_register_table(struct net *net, const struct xt_table *table,
|
||||
const struct ip6t_replace *repl,
|
||||
const struct nf_hook_ops *ops, struct xt_table **res);
|
||||
void ip6t_unregister_table(struct net *net, struct xt_table *table,
|
||||
const struct nf_hook_ops *ops);
|
||||
extern unsigned int ip6t_do_table(struct sk_buff *skb,
|
||||
const struct nf_hook_state *state,
|
||||
struct xt_table *table);
|
||||
|
|
|
@ -1780,9 +1780,11 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
|
|||
return ret;
|
||||
}
|
||||
|
||||
struct xt_table *arpt_register_table(struct net *net,
|
||||
const struct xt_table *table,
|
||||
const struct arpt_replace *repl)
|
||||
int arpt_register_table(struct net *net,
|
||||
const struct xt_table *table,
|
||||
const struct arpt_replace *repl,
|
||||
const struct nf_hook_ops *ops,
|
||||
struct xt_table **res)
|
||||
{
|
||||
int ret;
|
||||
struct xt_table_info *newinfo;
|
||||
|
@ -1791,10 +1793,8 @@ struct xt_table *arpt_register_table(struct net *net,
|
|||
struct xt_table *new_table;
|
||||
|
||||
newinfo = xt_alloc_table_info(repl->size);
|
||||
if (!newinfo) {
|
||||
ret = -ENOMEM;
|
||||
goto out;
|
||||
}
|
||||
if (!newinfo)
|
||||
return -ENOMEM;
|
||||
|
||||
loc_cpu_entry = newinfo->entries;
|
||||
memcpy(loc_cpu_entry, repl->entries, repl->size);
|
||||
|
@ -1809,15 +1809,18 @@ struct xt_table *arpt_register_table(struct net *net,
|
|||
ret = PTR_ERR(new_table);
|
||||
goto out_free;
|
||||
}
|
||||
return new_table;
|
||||
|
||||
WRITE_ONCE(*res, new_table);
|
||||
|
||||
return ret;
|
||||
|
||||
out_free:
|
||||
xt_free_table_info(newinfo);
|
||||
out:
|
||||
return ERR_PTR(ret);
|
||||
return ret;
|
||||
}
|
||||
|
||||
void arpt_unregister_table(struct xt_table *table)
|
||||
void arpt_unregister_table(struct net *net, struct xt_table *table,
|
||||
const struct nf_hook_ops *ops)
|
||||
{
|
||||
struct xt_table_info *private;
|
||||
void *loc_cpu_entry;
|
||||
|
|
|
@ -38,19 +38,20 @@ static struct nf_hook_ops *arpfilter_ops __read_mostly;
|
|||
static int __net_init arptable_filter_net_init(struct net *net)
|
||||
{
|
||||
struct arpt_replace *repl;
|
||||
|
||||
int err;
|
||||
|
||||
repl = arpt_alloc_initial_table(&packet_filter);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv4.arptable_filter =
|
||||
arpt_register_table(net, &packet_filter, repl);
|
||||
err = arpt_register_table(net, &packet_filter, repl, arpfilter_ops,
|
||||
&net->ipv4.arptable_filter);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv4.arptable_filter);
|
||||
return err;
|
||||
}
|
||||
|
||||
static void __net_exit arptable_filter_net_exit(struct net *net)
|
||||
{
|
||||
arpt_unregister_table(net->ipv4.arptable_filter);
|
||||
arpt_unregister_table(net, net->ipv4.arptable_filter, arpfilter_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations arptable_filter_net_ops = {
|
||||
|
|
|
@ -2062,9 +2062,9 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
|
|||
return ret;
|
||||
}
|
||||
|
||||
struct xt_table *ipt_register_table(struct net *net,
|
||||
const struct xt_table *table,
|
||||
const struct ipt_replace *repl)
|
||||
int ipt_register_table(struct net *net, const struct xt_table *table,
|
||||
const struct ipt_replace *repl,
|
||||
const struct nf_hook_ops *ops, struct xt_table **res)
|
||||
{
|
||||
int ret;
|
||||
struct xt_table_info *newinfo;
|
||||
|
@ -2073,10 +2073,8 @@ struct xt_table *ipt_register_table(struct net *net,
|
|||
struct xt_table *new_table;
|
||||
|
||||
newinfo = xt_alloc_table_info(repl->size);
|
||||
if (!newinfo) {
|
||||
ret = -ENOMEM;
|
||||
goto out;
|
||||
}
|
||||
if (!newinfo)
|
||||
return -ENOMEM;
|
||||
|
||||
loc_cpu_entry = newinfo->entries;
|
||||
memcpy(loc_cpu_entry, repl->entries, repl->size);
|
||||
|
@ -2091,15 +2089,16 @@ struct xt_table *ipt_register_table(struct net *net,
|
|||
goto out_free;
|
||||
}
|
||||
|
||||
return new_table;
|
||||
WRITE_ONCE(*res, new_table);
|
||||
return ret;
|
||||
|
||||
out_free:
|
||||
xt_free_table_info(newinfo);
|
||||
out:
|
||||
return ERR_PTR(ret);
|
||||
return ret;
|
||||
}
|
||||
|
||||
void ipt_unregister_table(struct net *net, struct xt_table *table)
|
||||
void ipt_unregister_table(struct net *net, struct xt_table *table,
|
||||
const struct nf_hook_ops *ops)
|
||||
{
|
||||
struct xt_table_info *private;
|
||||
void *loc_cpu_entry;
|
||||
|
|
|
@ -54,6 +54,7 @@ module_param(forward, bool, 0000);
|
|||
static int __net_init iptable_filter_net_init(struct net *net)
|
||||
{
|
||||
struct ipt_replace *repl;
|
||||
int err;
|
||||
|
||||
repl = ipt_alloc_initial_table(&packet_filter);
|
||||
if (repl == NULL)
|
||||
|
@ -62,15 +63,15 @@ static int __net_init iptable_filter_net_init(struct net *net)
|
|||
((struct ipt_standard *)repl->entries)[1].target.verdict =
|
||||
forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
|
||||
|
||||
net->ipv4.iptable_filter =
|
||||
ipt_register_table(net, &packet_filter, repl);
|
||||
err = ipt_register_table(net, &packet_filter, repl, filter_ops,
|
||||
&net->ipv4.iptable_filter);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv4.iptable_filter);
|
||||
return err;
|
||||
}
|
||||
|
||||
static void __net_exit iptable_filter_net_exit(struct net *net)
|
||||
{
|
||||
ipt_unregister_table(net, net->ipv4.iptable_filter);
|
||||
ipt_unregister_table(net, net->ipv4.iptable_filter, filter_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations iptable_filter_net_ops = {
|
||||
|
|
|
@ -96,19 +96,20 @@ static struct nf_hook_ops *mangle_ops __read_mostly;
|
|||
static int __net_init iptable_mangle_net_init(struct net *net)
|
||||
{
|
||||
struct ipt_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ipt_alloc_initial_table(&packet_mangler);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv4.iptable_mangle =
|
||||
ipt_register_table(net, &packet_mangler, repl);
|
||||
ret = ipt_register_table(net, &packet_mangler, repl, mangle_ops,
|
||||
&net->ipv4.iptable_mangle);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv4.iptable_mangle);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit iptable_mangle_net_exit(struct net *net)
|
||||
{
|
||||
ipt_unregister_table(net, net->ipv4.iptable_mangle);
|
||||
ipt_unregister_table(net, net->ipv4.iptable_mangle, mangle_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations iptable_mangle_net_ops = {
|
||||
|
|
|
@ -98,18 +98,20 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
|
|||
static int __net_init iptable_nat_net_init(struct net *net)
|
||||
{
|
||||
struct ipt_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ipt_alloc_initial_table(&nf_nat_ipv4_table);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl);
|
||||
ret = ipt_register_table(net, &nf_nat_ipv4_table, repl,
|
||||
nf_nat_ipv4_ops, &net->ipv4.nat_table);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv4.nat_table);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit iptable_nat_net_exit(struct net *net)
|
||||
{
|
||||
ipt_unregister_table(net, net->ipv4.nat_table);
|
||||
ipt_unregister_table(net, net->ipv4.nat_table, nf_nat_ipv4_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations iptable_nat_net_ops = {
|
||||
|
|
|
@ -37,19 +37,20 @@ static struct nf_hook_ops *rawtable_ops __read_mostly;
|
|||
static int __net_init iptable_raw_net_init(struct net *net)
|
||||
{
|
||||
struct ipt_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ipt_alloc_initial_table(&packet_raw);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv4.iptable_raw =
|
||||
ipt_register_table(net, &packet_raw, repl);
|
||||
ret = ipt_register_table(net, &packet_raw, repl, rawtable_ops,
|
||||
&net->ipv4.iptable_raw);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv4.iptable_raw);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit iptable_raw_net_exit(struct net *net)
|
||||
{
|
||||
ipt_unregister_table(net, net->ipv4.iptable_raw);
|
||||
ipt_unregister_table(net, net->ipv4.iptable_raw, rawtable_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations iptable_raw_net_ops = {
|
||||
|
|
|
@ -54,19 +54,20 @@ static struct nf_hook_ops *sectbl_ops __read_mostly;
|
|||
static int __net_init iptable_security_net_init(struct net *net)
|
||||
{
|
||||
struct ipt_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ipt_alloc_initial_table(&security_table);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv4.iptable_security =
|
||||
ipt_register_table(net, &security_table, repl);
|
||||
ret = ipt_register_table(net, &security_table, repl, sectbl_ops,
|
||||
&net->ipv4.iptable_security);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv4.iptable_security);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit iptable_security_net_exit(struct net *net)
|
||||
{
|
||||
ipt_unregister_table(net, net->ipv4.iptable_security);
|
||||
ipt_unregister_table(net, net->ipv4.iptable_security, sectbl_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations iptable_security_net_ops = {
|
||||
|
|
|
@ -2071,9 +2071,10 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
|
|||
return ret;
|
||||
}
|
||||
|
||||
struct xt_table *ip6t_register_table(struct net *net,
|
||||
const struct xt_table *table,
|
||||
const struct ip6t_replace *repl)
|
||||
int ip6t_register_table(struct net *net, const struct xt_table *table,
|
||||
const struct ip6t_replace *repl,
|
||||
const struct nf_hook_ops *ops,
|
||||
struct xt_table **res)
|
||||
{
|
||||
int ret;
|
||||
struct xt_table_info *newinfo;
|
||||
|
@ -2082,10 +2083,8 @@ struct xt_table *ip6t_register_table(struct net *net,
|
|||
struct xt_table *new_table;
|
||||
|
||||
newinfo = xt_alloc_table_info(repl->size);
|
||||
if (!newinfo) {
|
||||
ret = -ENOMEM;
|
||||
goto out;
|
||||
}
|
||||
if (!newinfo)
|
||||
return -ENOMEM;
|
||||
|
||||
loc_cpu_entry = newinfo->entries;
|
||||
memcpy(loc_cpu_entry, repl->entries, repl->size);
|
||||
|
@ -2099,15 +2098,17 @@ struct xt_table *ip6t_register_table(struct net *net,
|
|||
ret = PTR_ERR(new_table);
|
||||
goto out_free;
|
||||
}
|
||||
return new_table;
|
||||
|
||||
WRITE_ONCE(*res, new_table);
|
||||
return ret;
|
||||
|
||||
out_free:
|
||||
xt_free_table_info(newinfo);
|
||||
out:
|
||||
return ERR_PTR(ret);
|
||||
return ret;
|
||||
}
|
||||
|
||||
void ip6t_unregister_table(struct net *net, struct xt_table *table)
|
||||
void ip6t_unregister_table(struct net *net, struct xt_table *table,
|
||||
const struct nf_hook_ops *ops)
|
||||
{
|
||||
struct xt_table_info *private;
|
||||
void *loc_cpu_entry;
|
||||
|
|
|
@ -47,6 +47,7 @@ module_param(forward, bool, 0000);
|
|||
static int __net_init ip6table_filter_net_init(struct net *net)
|
||||
{
|
||||
struct ip6t_replace *repl;
|
||||
int err;
|
||||
|
||||
repl = ip6t_alloc_initial_table(&packet_filter);
|
||||
if (repl == NULL)
|
||||
|
@ -55,15 +56,15 @@ static int __net_init ip6table_filter_net_init(struct net *net)
|
|||
((struct ip6t_standard *)repl->entries)[1].target.verdict =
|
||||
forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
|
||||
|
||||
net->ipv6.ip6table_filter =
|
||||
ip6t_register_table(net, &packet_filter, repl);
|
||||
err = ip6t_register_table(net, &packet_filter, repl, filter_ops,
|
||||
&net->ipv6.ip6table_filter);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_filter);
|
||||
return err;
|
||||
}
|
||||
|
||||
static void __net_exit ip6table_filter_net_exit(struct net *net)
|
||||
{
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_filter);
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_filter, filter_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations ip6table_filter_net_ops = {
|
||||
|
|
|
@ -91,19 +91,20 @@ static struct nf_hook_ops *mangle_ops __read_mostly;
|
|||
static int __net_init ip6table_mangle_net_init(struct net *net)
|
||||
{
|
||||
struct ip6t_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ip6t_alloc_initial_table(&packet_mangler);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv6.ip6table_mangle =
|
||||
ip6t_register_table(net, &packet_mangler, repl);
|
||||
ret = ip6t_register_table(net, &packet_mangler, repl, mangle_ops,
|
||||
&net->ipv6.ip6table_mangle);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_mangle);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit ip6table_mangle_net_exit(struct net *net)
|
||||
{
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_mangle);
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_mangle, mangle_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations ip6table_mangle_net_ops = {
|
||||
|
|
|
@ -100,18 +100,20 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
|
|||
static int __net_init ip6table_nat_net_init(struct net *net)
|
||||
{
|
||||
struct ip6t_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
|
||||
ret = ip6t_register_table(net, &nf_nat_ipv6_table, repl,
|
||||
nf_nat_ipv6_ops, &net->ipv6.ip6table_nat);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_nat);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit ip6table_nat_net_exit(struct net *net)
|
||||
{
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_nat);
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_nat, nf_nat_ipv6_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations ip6table_nat_net_ops = {
|
||||
|
|
|
@ -30,19 +30,20 @@ static struct nf_hook_ops *rawtable_ops __read_mostly;
|
|||
static int __net_init ip6table_raw_net_init(struct net *net)
|
||||
{
|
||||
struct ip6t_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ip6t_alloc_initial_table(&packet_raw);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv6.ip6table_raw =
|
||||
ip6t_register_table(net, &packet_raw, repl);
|
||||
ret = ip6t_register_table(net, &packet_raw, repl, rawtable_ops,
|
||||
&net->ipv6.ip6table_raw);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_raw);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit ip6table_raw_net_exit(struct net *net)
|
||||
{
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_raw);
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_raw, rawtable_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations ip6table_raw_net_ops = {
|
||||
|
|
|
@ -47,19 +47,20 @@ static struct nf_hook_ops *sectbl_ops __read_mostly;
|
|||
static int __net_init ip6table_security_net_init(struct net *net)
|
||||
{
|
||||
struct ip6t_replace *repl;
|
||||
int ret;
|
||||
|
||||
repl = ip6t_alloc_initial_table(&security_table);
|
||||
if (repl == NULL)
|
||||
return -ENOMEM;
|
||||
net->ipv6.ip6table_security =
|
||||
ip6t_register_table(net, &security_table, repl);
|
||||
ret = ip6t_register_table(net, &security_table, repl, sectbl_ops,
|
||||
&net->ipv6.ip6table_security);
|
||||
kfree(repl);
|
||||
return PTR_ERR_OR_ZERO(net->ipv6.ip6table_security);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __net_exit ip6table_security_net_exit(struct net *net)
|
||||
{
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_security);
|
||||
ip6t_unregister_table(net, net->ipv6.ip6table_security, sectbl_ops);
|
||||
}
|
||||
|
||||
static struct pernet_operations ip6table_security_net_ops = {
|
||||
|
|
Loading…
Reference in New Issue