From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 20/26] netfilter: nf_tables: get rid of NFT_BASECHAIN_DISABLED
Date: Wed, 6 Jul 2016 16:24:02 +0200 [thread overview]
Message-ID: <1467815048-2240-21-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1467815048-2240-1-git-send-email-pablo@netfilter.org>
This flag was introduced to restore rulesets from the new netdev
family, but since 5ebe0b0eec9d6f7 ("netfilter: nf_tables: destroy
basechain and rules on netdevice removal") the ruleset is released
once the netdev is gone.
This also removes nft_register_basechain() and
nft_unregister_basechain() since they have no clients anymore after
this rework.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables.h | 1 -
net/netfilter/nf_tables_api.c | 62 ++++++++++++++++-----------------------
2 files changed, 25 insertions(+), 38 deletions(-)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 07a5ba4..1ea19a6 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -798,7 +798,6 @@ struct nft_stats {
};
#define NFT_HOOK_OPS_MAX 2
-#define NFT_BASECHAIN_DISABLED (1 << 0)
/**
* struct nft_base_chain - nf_tables base chain
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3316bce..92c9fae 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -131,29 +131,8 @@ static void nft_trans_destroy(struct nft_trans *trans)
kfree(trans);
}
-static int nft_register_basechain(struct nft_base_chain *basechain,
- unsigned int hook_nops)
-{
- struct net *net = read_pnet(&basechain->pnet);
-
- if (basechain->flags & NFT_BASECHAIN_DISABLED)
- return 0;
-
- return nf_register_net_hooks(net, basechain->ops, hook_nops);
-}
-
-static void nft_unregister_basechain(struct nft_base_chain *basechain,
- unsigned int hook_nops)
-{
- struct net *net = read_pnet(&basechain->pnet);
-
- if (basechain->flags & NFT_BASECHAIN_DISABLED)
- return;
-
- nf_unregister_net_hooks(net, basechain->ops, hook_nops);
-}
-
-static int nf_tables_register_hooks(const struct nft_table *table,
+static int nf_tables_register_hooks(struct net *net,
+ const struct nft_table *table,
struct nft_chain *chain,
unsigned int hook_nops)
{
@@ -161,10 +140,12 @@ static int nf_tables_register_hooks(const struct nft_table *table,
!(chain->flags & NFT_BASE_CHAIN))
return 0;
- return nft_register_basechain(nft_base_chain(chain), hook_nops);
+ return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
+ hook_nops);
}
-static void nf_tables_unregister_hooks(const struct nft_table *table,
+static void nf_tables_unregister_hooks(struct net *net,
+ const struct nft_table *table,
struct nft_chain *chain,
unsigned int hook_nops)
{
@@ -172,7 +153,7 @@ static void nf_tables_unregister_hooks(const struct nft_table *table,
!(chain->flags & NFT_BASE_CHAIN))
return;
- nft_unregister_basechain(nft_base_chain(chain), hook_nops);
+ nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
}
static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
@@ -569,7 +550,8 @@ static int nf_tables_table_enable(struct net *net,
if (!(chain->flags & NFT_BASE_CHAIN))
continue;
- err = nft_register_basechain(nft_base_chain(chain), afi->nops);
+ err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
+ afi->nops);
if (err < 0)
goto err;
@@ -586,7 +568,8 @@ err:
if (i-- <= 0)
break;
- nft_unregister_basechain(nft_base_chain(chain), afi->nops);
+ nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
+ afi->nops);
}
return err;
}
@@ -600,9 +583,11 @@ static void nf_tables_table_disable(struct net *net,
list_for_each_entry(chain, &table->chains, list) {
if (!nft_is_active_next(net, chain))
continue;
- if (chain->flags & NFT_BASE_CHAIN)
- nft_unregister_basechain(nft_base_chain(chain),
- afi->nops);
+ if (!(chain->flags & NFT_BASE_CHAIN))
+ continue;
+
+ nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
+ afi->nops);
}
}
@@ -1451,7 +1436,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
chain->table = table;
nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
- err = nf_tables_register_hooks(table, chain, afi->nops);
+ err = nf_tables_register_hooks(net, table, chain, afi->nops);
if (err < 0)
goto err1;
@@ -1464,7 +1449,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
list_add_tail_rcu(&chain->list, &table->chains);
return 0;
err2:
- nf_tables_unregister_hooks(table, chain, afi->nops);
+ nf_tables_unregister_hooks(net, table, chain, afi->nops);
err1:
nf_tables_chain_destroy(chain);
return err;
@@ -3995,7 +3980,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
case NFT_MSG_DELCHAIN:
list_del_rcu(&trans->ctx.chain->list);
nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
- nf_tables_unregister_hooks(trans->ctx.table,
+ nf_tables_unregister_hooks(trans->ctx.net,
+ trans->ctx.table,
trans->ctx.chain,
trans->ctx.afi->nops);
break;
@@ -4120,7 +4106,8 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
} else {
trans->ctx.table->use--;
list_del_rcu(&trans->ctx.chain->list);
- nf_tables_unregister_hooks(trans->ctx.table,
+ nf_tables_unregister_hooks(trans->ctx.net,
+ trans->ctx.table,
trans->ctx.chain,
trans->ctx.afi->nops);
}
@@ -4662,7 +4649,7 @@ int __nft_release_basechain(struct nft_ctx *ctx)
BUG_ON(!(ctx->chain->flags & NFT_BASE_CHAIN));
- nf_tables_unregister_hooks(ctx->chain->table, ctx->chain,
+ nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
ctx->afi->nops);
list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
list_del(&rule->list);
@@ -4691,7 +4678,8 @@ static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
list_for_each_entry_safe(table, nt, &afi->tables, list) {
list_for_each_entry(chain, &table->chains, list)
- nf_tables_unregister_hooks(table, chain, afi->nops);
+ nf_tables_unregister_hooks(net, table, chain,
+ afi->nops);
/* No packets are walking on these chains anymore. */
ctx.table = table;
list_for_each_entry(chain, &table->chains, list) {
--
2.1.4
next prev parent reply other threads:[~2016-07-06 14:26 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-06 14:23 [PATCH 00/26] Netfilter updates for net-next Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 01/26] bridge: netfilter: checkpatch data type fixes Pablo Neira Ayuso
2016-07-06 21:32 ` Stephen Hemminger
2016-07-06 14:23 ` [PATCH 02/26] netfilter: helper: avoid extra expectation iterations on unregister Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 03/26] netfilter: x_tables: fix possible ZERO_SIZE_PTR pointer dereferencing error Pablo Neira Ayuso
2016-07-06 18:11 ` Sergei Shtylyov
2016-07-06 14:23 ` [PATCH 04/26] netfilter: nf_log: handle NFPROTO_INET properly in nf_logger_[find_get|put] Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 05/26] netfilter: xt_TRACE: add explicitly nf_logger_find_get call Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 06/26] netfilter: conntrack: align nf_conn on cacheline boundary Pablo Neira Ayuso
2016-07-06 14:45 ` David Laight
2016-07-06 15:01 ` Florian Westphal
2016-07-06 14:23 ` [PATCH 07/26] netfilter: make comparision helpers stub functions in ZONES=n case Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 08/26] netfilter: nf_log: Remove NULL check Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 09/26] netfilter: move zone info into struct nf_conn Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 10/26] netfilter: Allow xt_owner in any user namespace Pablo Neira Ayuso
2017-10-18 23:00 ` [10/26] " Andrei Vagin
2016-07-06 14:23 ` [PATCH 11/26] netfilter: nf_reject_ipv4: don't send tcp RST if the packet is non-TCP Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 12/26] netfilter: xt_NFLOG: nflog-range does not truncate packets Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 13/26] netfilter: nf_tables: add generic macros to check for generation mask Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 14/26] netfilter: nf_tables: add generation mask to tables Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 15/26] netfilter: nf_tables: add generation mask to chains Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 16/26] netfilter: nf_tables: add generation mask to sets Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 17/26] netfilter: nft_rbtree: check for next generation when deactivating elements Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 18/26] netfilter: nft_hash: support deletion of inactive elements Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 19/26] netfilter: conntrack: allow increasing bucket size via sysctl too Pablo Neira Ayuso
2016-07-06 14:24 ` Pablo Neira Ayuso [this message]
2016-07-06 14:24 ` [PATCH 21/26] netfilter: nf_tables: add support for inverted logic in nft_lookup Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 22/26] netfilter: x_tables: simplify ip{6}table_mangle_hook() Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 23/26] etherdevice.h & bridge: netfilter: Add and use ether_addr_equal_masked Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 24/26] netfilter: Remove references to obsolete CONFIG_IP_ROUTE_FWMARK Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 25/26] netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 26/26] netfilter: nf_log: fix error on write NONE to logger choice sysctl Pablo Neira Ayuso
2016-07-06 16:15 ` [PATCH 00/26] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1467815048-2240-21-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).