From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 39/53] ebtables: remove nf_hook_register usage
Date: Mon, 1 May 2017 12:47:06 +0200 [thread overview]
Message-ID: <1493635640-24325-40-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1493635640-24325-1-git-send-email-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Similar to ip_register_table, pass nf_hook_ops to ebt_register_table().
This allows to handle hook registration also via pernet_ops and allows
us to avoid use of legacy register_hook api.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/linux/netfilter_bridge/ebtables.h | 6 ++-
net/bridge/netfilter/ebtable_broute.c | 4 +-
net/bridge/netfilter/ebtable_filter.c | 15 ++------
net/bridge/netfilter/ebtable_nat.c | 15 ++------
net/bridge/netfilter/ebtables.c | 61 +++++++++++++++++++------------
5 files changed, 50 insertions(+), 51 deletions(-)
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 984b2112c77b..a30efb437e6d 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -109,8 +109,10 @@ struct ebt_table {
#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
~(__alignof__(struct _xt_align)-1))
extern struct ebt_table *ebt_register_table(struct net *net,
- const struct ebt_table *table);
-extern void ebt_unregister_table(struct net *net, struct ebt_table *table);
+ const struct ebt_table *table,
+ const struct nf_hook_ops *);
+extern void ebt_unregister_table(struct net *net, struct ebt_table *table,
+ const struct nf_hook_ops *);
extern unsigned int ebt_do_table(struct sk_buff *skb,
const struct nf_hook_state *state,
struct ebt_table *table);
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index 8fe36dc3aab2..2585b100ebbb 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -65,13 +65,13 @@ static int ebt_broute(struct sk_buff *skb)
static int __net_init broute_net_init(struct net *net)
{
- net->xt.broute_table = ebt_register_table(net, &broute_table);
+ net->xt.broute_table = ebt_register_table(net, &broute_table, NULL);
return PTR_ERR_OR_ZERO(net->xt.broute_table);
}
static void __net_exit broute_net_exit(struct net *net)
{
- ebt_unregister_table(net, net->xt.broute_table);
+ ebt_unregister_table(net, net->xt.broute_table, NULL);
}
static struct pernet_operations broute_net_ops = {
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 593a1bdc079e..f22ef7c21913 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -93,13 +93,13 @@ static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
static int __net_init frame_filter_net_init(struct net *net)
{
- net->xt.frame_filter = ebt_register_table(net, &frame_filter);
+ net->xt.frame_filter = ebt_register_table(net, &frame_filter, ebt_ops_filter);
return PTR_ERR_OR_ZERO(net->xt.frame_filter);
}
static void __net_exit frame_filter_net_exit(struct net *net)
{
- ebt_unregister_table(net, net->xt.frame_filter);
+ ebt_unregister_table(net, net->xt.frame_filter, ebt_ops_filter);
}
static struct pernet_operations frame_filter_net_ops = {
@@ -109,20 +109,11 @@ static struct pernet_operations frame_filter_net_ops = {
static int __init ebtable_filter_init(void)
{
- int ret;
-
- ret = register_pernet_subsys(&frame_filter_net_ops);
- if (ret < 0)
- return ret;
- ret = nf_register_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter));
- if (ret < 0)
- unregister_pernet_subsys(&frame_filter_net_ops);
- return ret;
+ return register_pernet_subsys(&frame_filter_net_ops);
}
static void __exit ebtable_filter_fini(void)
{
- nf_unregister_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter));
unregister_pernet_subsys(&frame_filter_net_ops);
}
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index eb33919821ee..2f7a4f314406 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -93,13 +93,13 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
static int __net_init frame_nat_net_init(struct net *net)
{
- net->xt.frame_nat = ebt_register_table(net, &frame_nat);
+ net->xt.frame_nat = ebt_register_table(net, &frame_nat, ebt_ops_nat);
return PTR_ERR_OR_ZERO(net->xt.frame_nat);
}
static void __net_exit frame_nat_net_exit(struct net *net)
{
- ebt_unregister_table(net, net->xt.frame_nat);
+ ebt_unregister_table(net, net->xt.frame_nat, ebt_ops_nat);
}
static struct pernet_operations frame_nat_net_ops = {
@@ -109,20 +109,11 @@ static struct pernet_operations frame_nat_net_ops = {
static int __init ebtable_nat_init(void)
{
- int ret;
-
- ret = register_pernet_subsys(&frame_nat_net_ops);
- if (ret < 0)
- return ret;
- ret = nf_register_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
- if (ret < 0)
- unregister_pernet_subsys(&frame_nat_net_ops);
- return ret;
+ return register_pernet_subsys(&frame_nat_net_ops);
}
static void __exit ebtable_nat_fini(void)
{
- nf_unregister_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
unregister_pernet_subsys(&frame_nat_net_ops);
}
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index bdc629eb0207..9ec0c9f908fa 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1157,8 +1157,30 @@ static int do_replace(struct net *net, const void __user *user,
return ret;
}
+static void __ebt_unregister_table(struct net *net, struct ebt_table *table)
+{
+ int i;
+
+ mutex_lock(&ebt_mutex);
+ list_del(&table->list);
+ mutex_unlock(&ebt_mutex);
+ EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
+ ebt_cleanup_entry, net, NULL);
+ if (table->private->nentries)
+ module_put(table->me);
+ vfree(table->private->entries);
+ if (table->private->chainstack) {
+ for_each_possible_cpu(i)
+ vfree(table->private->chainstack[i]);
+ vfree(table->private->chainstack);
+ }
+ vfree(table->private);
+ kfree(table);
+}
+
struct ebt_table *
-ebt_register_table(struct net *net, const struct ebt_table *input_table)
+ebt_register_table(struct net *net, const struct ebt_table *input_table,
+ const struct nf_hook_ops *ops)
{
struct ebt_table_info *newinfo;
struct ebt_table *t, *table;
@@ -1238,6 +1260,16 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
}
list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
mutex_unlock(&ebt_mutex);
+
+ if (!ops)
+ return table;
+
+ ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
+ if (ret) {
+ __ebt_unregister_table(net, table);
+ return ERR_PTR(ret);
+ }
+
return table;
free_unlock:
mutex_unlock(&ebt_mutex);
@@ -1256,29 +1288,12 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
return ERR_PTR(ret);
}
-void ebt_unregister_table(struct net *net, struct ebt_table *table)
+void ebt_unregister_table(struct net *net, struct ebt_table *table,
+ const struct nf_hook_ops *ops)
{
- int i;
-
- if (!table) {
- BUGPRINT("Request to unregister NULL table!!!\n");
- return;
- }
- mutex_lock(&ebt_mutex);
- list_del(&table->list);
- mutex_unlock(&ebt_mutex);
- EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
- ebt_cleanup_entry, net, NULL);
- if (table->private->nentries)
- module_put(table->me);
- vfree(table->private->entries);
- if (table->private->chainstack) {
- for_each_possible_cpu(i)
- vfree(table->private->chainstack[i]);
- vfree(table->private->chainstack);
- }
- vfree(table->private);
- kfree(table);
+ if (ops)
+ nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
+ __ebt_unregister_table(net, table);
}
/* userspace just supplied us with counters */
--
2.1.4
next prev parent reply other threads:[~2017-05-01 10:47 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-01 10:46 [PATCH 00/53] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 01/53] netfilter: ipvs: don't check for presence of nat extension Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 02/53] netfilter: ipvs: Replace kzalloc with kcalloc Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 03/53] ipvs: remove unused variable Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 04/53] netfilter: nf_tables: add nft_is_base_chain() helper Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 05/53] netfilter: expect: Make sure the max_expected limit is effective Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 06/53] netfilter: nf_ct_expect: Add nf_ct_remove_expect() Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 07/53] netfilter: nat: nf_nat_mangle_{udp,tcp}_packet returns boolean Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 08/53] netfilter: nat: avoid use of nf_conn_nat extension Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 09/53] netfilter: ctnetlink: Expectations must have a conntrack helper area Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 10/53] netfilter: Add nfnl_msg_type() helper function Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 11/53] netfilter: Remove unnecessary cast on void pointer Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 12/53] netfilter: Use seq_puts()/seq_putc() where possible Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 13/53] net: netfilter: Use list_{next/prev}_entry instead of list_entry Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 14/53] netfilter: Remove exceptional & on function name Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 15/53] netfilter: ip6_tables: Remove unneccessary comments Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 16/53] netfilter: udplite: Remove duplicated udplite4/6 declaration Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 17/53] netfilter: nat: remove rcu_read_lock in __nf_nat_decode_session Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 18/53] netfilter: nf_tables: remove double return statement Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 19/53] netfilter: nf_conntrack: remove double assignment Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 20/53] ipset: remove unused function __ip_set_get_netlink Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 21/53] netfilter: nf_nat: Fix return NF_DROP in nfnetlink_parse_nat_setup Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 22/53] netfilter: ecache: Refine the nf_ct_deliver_cached_events Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 23/53] netfilter: kill the fake untracked conntrack objects Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 24/53] netfilter: remove nf_ct_is_untracked Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 25/53] netfilter: nft_ct: allow to set ctnetlink event types of a connection Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 26/53] netfilter: conntrack: move helper struct to nf_conntrack_helper.h Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 27/53] netfilter: helper: add build-time asserts for helper data size Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 28/53] netfilter: nfnetlink_cthelper: reject too large userspace allocation requests Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 29/53] netfilter: helpers: remove data_len usage for inkernel helpers Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 30/53] netfilter: remove last traces of variable-sized extensions Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 31/53] netfilter: conntrack: use u8 for extension sizes again Pablo Neira Ayuso
2017-05-01 10:46 ` [PATCH 32/53] netfilter: allow early drop of assured conntracks Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 33/53] nefilter: eache: reduce struct size from 32 to 24 byte Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 34/53] netfilter: ipvs: fix incorrect conflict resolution Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 35/53] netfilter: tcp: Use TCP_MAX_WSCALE instead of literal 14 Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 36/53] netfilter: synproxy: only register hooks when needed Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 37/53] ipvs: convert to use pernet nf_hook api Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 38/53] netfilter: decnet: only register hooks in init namespace Pablo Neira Ayuso
2017-05-01 10:47 ` Pablo Neira Ayuso [this message]
2017-05-01 10:47 ` [PATCH 40/53] netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 41/53] netfilter: conntrack: remove prealloc support Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 42/53] netfilter: conntrack: mark extension structs as const Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 43/53] netfilter: conntrack: handle initial extension alloc via krealloc Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 44/53] netfilter: masquerade: attach nat extension if not present Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 45/53] netfilter: pptp: attach nat extension when needed Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 46/53] netfilter: don't attach a nat extension by default Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 47/53] ipvs: remove unused function ip_vs_set_state_timeout Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 48/53] ipvs: change comparison on sync_refresh_period Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 49/53] netfilter: batch synchronize_net calls during hook unregister Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 50/53] netfilter: nf_log: don't call synchronize_rcu in nf_log_unset Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 51/53] netfilter: nf_queue: only call synchronize_net twice if nf_queue is active Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 52/53] netfilter: snmp: avoid stack size warning Pablo Neira Ayuso
2017-05-01 10:47 ` [PATCH 53/53] netfilter: nf_ct_ext: invoke destroy even when ext is not attached Pablo Neira Ayuso
2017-05-01 10:53 ` [PATCH 00/53] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2017-05-01 14:48 ` David Miller
2017-05-01 14:47 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1493635640-24325-40-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).