The respective xt_table structures already have all the metadata we
were passing in as separate arguments so far. Add a 'priority' field
to xt_table which was yet missing, but is required for hook setup.
Signed-off-by: Jan Engelhardt <jengelh@xxxxxxxxxx>
---
include/linux/netfilter/x_tables.h | 6 +++---
net/ipv4/netfilter/arptable_filter.c | 6 +++---
net/ipv4/netfilter/iptable_filter.c | 6 +++---
net/ipv4/netfilter/iptable_mangle.c | 6 +++---
net/ipv4/netfilter/iptable_raw.c | 6 +++---
net/ipv4/netfilter/iptable_security.c | 6 +++---
net/ipv6/netfilter/ip6table_filter.c | 6 +++---
net/ipv6/netfilter/ip6table_mangle.c | 6 +++---
net/ipv6/netfilter/ip6table_raw.c | 6 +++---
net/ipv6/netfilter/ip6table_security.c | 6 +++---
net/netfilter/x_tables.c | 18 ++++++++----------
11 files changed, 38 insertions(+), 40 deletions(-)
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index b71d9fa..2a47a01 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -363,6 +363,7 @@ struct xt_table
struct module *me;
u_int8_t af; /* address/protocol family */
+ int priority; /* hook order */
/* A unique name... */
const char name[XT_TABLE_MAXNAMELEN];
@@ -525,9 +526,8 @@ static inline unsigned long ifname_compare_aligned(const char *_a,
return ret;
}
-extern struct nf_hook_ops *xt_hook_link(nf_hookfn *, uint8_t, int,
- unsigned int, struct module *);
-extern void xt_hook_unlink(struct nf_hook_ops *, unsigned int);
+extern struct nf_hook_ops *xt_hook_link(const struct xt_table *, nf_hookfn *);
+extern void xt_hook_unlink(const struct xt_table *, struct nf_hook_ops *);
#ifdef CONFIG_COMPAT
#include <net/compat.h>
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index c45a8a1..11e6ee9 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -50,6 +50,7 @@ static const struct xt_table packet_filter = {
.valid_hooks = FILTER_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_ARP,
+ .priority = NF_IP_PRI_FILTER,
};
/* The work comes in here from netfilter.c */
@@ -93,8 +94,7 @@ static int __init arptable_filter_init(void)
if (ret < 0)
return ret;
- arpfilter_ops = xt_hook_link(arptable_filter_hook, NFPROTO_ARP,
- NF_IP_PRI_FILTER, FILTER_VALID_HOOKS, THIS_MODULE);
+ arpfilter_ops = xt_hook_link(&packet_filter, arptable_filter_hook);
if (IS_ERR(arpfilter_ops))
unregister_pernet_subsys(&arptable_filter_net_ops);
return ret;
@@ -102,7 +102,7 @@ static int __init arptable_filter_init(void)
static void __exit arptable_filter_fini(void)
{
- xt_hook_unlink(arpfilter_ops, FILTER_VALID_HOOKS);
+ xt_hook_unlink(&packet_filter, arpfilter_ops);
unregister_pernet_subsys(&arptable_filter_net_ops);
}
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 05c1d3c..61b6faa 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -58,6 +58,7 @@ static const struct xt_table packet_filter = {
.valid_hooks = FILTER_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV4,
+ .priority = NF_IP_PRI_FILTER,
};
static unsigned int
@@ -122,8 +123,7 @@ static int __init iptable_filter_init(void)
return ret;
/* Register hooks */
- filter_ops = xt_hook_link(iptable_filter_hook, NFPROTO_IPV4,
- NF_IP_PRI_FILTER, FILTER_VALID_HOOKS, THIS_MODULE);
+ filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);
if (IS_ERR(filter_ops)) {
unregister_pernet_subsys(&iptable_filter_net_ops);
return PTR_ERR(filter_ops);
@@ -134,7 +134,7 @@ static int __init iptable_filter_init(void)
static void __exit iptable_filter_fini(void)
{
- xt_hook_unlink(filter_ops, FILTER_VALID_HOOKS);
+ xt_hook_unlink(&packet_filter, filter_ops);
unregister_pernet_subsys(&iptable_filter_net_ops);
}
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index b504f72..c178bf1 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -69,6 +69,7 @@ static const struct xt_table packet_mangler = {
.valid_hooks = MANGLE_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV4,
+ .priority = NF_IP_PRI_MANGLE,
};
/* The work comes in here from netfilter.c. */
@@ -156,8 +157,7 @@ static int __init iptable_mangle_init(void)
return ret;
/* Register hooks */
- mangle_ops = xt_hook_link(iptable_mangle_hook, NFPROTO_IPV4,
- NF_IP_PRI_MANGLE, MANGLE_VALID_HOOKS, THIS_MODULE);
+ mangle_ops = xt_hook_link(&packet_mangler, iptable_mangle_hook);
if (IS_ERR(mangle_ops)) {
unregister_pernet_subsys(&iptable_mangle_net_ops);
return PTR_ERR(mangle_ops);
@@ -168,7 +168,7 @@ static int __init iptable_mangle_init(void)
static void __exit iptable_mangle_fini(void)
{
- xt_hook_unlink(mangle_ops, MANGLE_VALID_HOOKS);
+ xt_hook_unlink(&packet_mangler, mangle_ops);
unregister_pernet_subsys(&iptable_mangle_net_ops);
}
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 2f87098..9dcdad0 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -41,6 +41,7 @@ static const struct xt_table packet_raw = {
.valid_hooks = RAW_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV4,
+ .priority = NF_IP_PRI_FIRST,
};
/* The work comes in here from netfilter.c. */
@@ -94,8 +95,7 @@ static int __init iptable_raw_init(void)
return ret;
/* Register hooks */
- rawtable_ops = xt_hook_link(iptable_raw_hook, NFPROTO_IPV4,
- NF_IP_PRI_FIRST, RAW_VALID_HOOKS, THIS_MODULE);
+ rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook);
if (IS_ERR(rawtable_ops)) {
unregister_pernet_subsys(&iptable_raw_net_ops);
return PTR_ERR(rawtable_ops);
@@ -106,7 +106,7 @@ static int __init iptable_raw_init(void)
static void __exit iptable_raw_fini(void)
{
- xt_hook_unlink(rawtable_ops, RAW_VALID_HOOKS);
+ xt_hook_unlink(&packet_raw, rawtable_ops);
unregister_pernet_subsys(&iptable_raw_net_ops);
}
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 4cee3dc..67d54c2 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -62,6 +62,7 @@ static const struct xt_table security_table = {
.valid_hooks = SECURITY_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV4,
+ .priority = NF_IP_PRI_SECURITY,
};
static unsigned int
@@ -114,8 +115,7 @@ static int __init iptable_security_init(void)
if (ret < 0)
return ret;
- sectbl_ops = xt_hook_link(iptable_security_hook, NFPROTO_IPV4,
- NF_IP_PRI_SECURITY, SECURITY_VALID_HOOKS, THIS_MODULE);
+ sectbl_ops = xt_hook_link(&security_table, iptable_security_hook);
if (IS_ERR(sectbl_ops)) {
unregister_pernet_subsys(&iptable_security_net_ops);
return PTR_ERR(sectbl_ops);
@@ -126,7 +126,7 @@ static int __init iptable_security_init(void)
static void __exit iptable_security_fini(void)
{
- xt_hook_unlink(sectbl_ops, SECURITY_VALID_HOOKS);
+ xt_hook_unlink(&security_table, sectbl_ops);
unregister_pernet_subsys(&iptable_security_net_ops);
}
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index e8d3a03..8c8b218 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -56,6 +56,7 @@ static const struct xt_table packet_filter = {
.valid_hooks = FILTER_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV6,
+ .priority = NF_IP6_PRI_FILTER,
};
/* The work comes in here from netfilter.c. */
@@ -113,8 +114,7 @@ static int __init ip6table_filter_init(void)
return ret;
/* Register hooks */
- filter_ops = xt_hook_link(ip6table_filter_hook, NFPROTO_IPV6,
- NF_IP6_PRI_FILTER, FILTER_VALID_HOOKS, THIS_MODULE);
+ filter_ops = xt_hook_link(&packet_filter, ip6table_filter_hook);
if (IS_ERR(filter_ops)) {
unregister_pernet_subsys(&ip6table_filter_net_ops);
return PTR_ERR(filter_ops);
@@ -125,7 +125,7 @@ static int __init ip6table_filter_init(void)
static void __exit ip6table_filter_fini(void)
{
- xt_hook_unlink(filter_ops, FILTER_VALID_HOOKS);
+ xt_hook_unlink(&packet_filter, filter_ops);
unregister_pernet_subsys(&ip6table_filter_net_ops);
}
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index ec803a2..e13adec 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -62,6 +62,7 @@ static const struct xt_table packet_mangler = {
.valid_hooks = MANGLE_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV6,
+ .priority = NF_IP6_PRI_MANGLE,
};
/* The work comes in here from netfilter.c. */
@@ -151,8 +152,7 @@ static int __init ip6table_mangle_init(void)
return ret;
/* Register hooks */
- mangle_ops = xt_hook_link(ip6table_mangle_hook, NFPROTO_IPV6,
- NF_IP6_PRI_MANGLE, MANGLE_VALID_HOOKS, THIS_MODULE);
+ mangle_ops = xt_hook_link(&packet_mangler, ip6table_mangle_hook);
if (IS_ERR(mangle_ops)) {
unregister_pernet_subsys(&ip6table_mangle_net_ops);
return PTR_ERR(mangle_ops);
@@ -163,7 +163,7 @@ static int __init ip6table_mangle_init(void)
static void __exit ip6table_mangle_fini(void)
{
- xt_hook_unlink(mangle_ops, MANGLE_VALID_HOOKS);
+ xt_hook_unlink(&packet_mangler, mangle_ops);
unregister_pernet_subsys(&ip6table_mangle_net_ops);
}
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 86ea699..b7c535d 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -40,6 +40,7 @@ static const struct xt_table packet_raw = {
.valid_hooks = RAW_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV6,
+ .priority = NF_IP6_PRI_FIRST,
};
/* The work comes in here from netfilter.c. */
@@ -85,8 +86,7 @@ static int __init ip6table_raw_init(void)
return ret;
/* Register hooks */
- rawtable_ops = xt_hook_link(ip6table_raw_hook, NFPROTO_IPV6,
- NF_IP6_PRI_FIRST, RAW_VALID_HOOKS, THIS_MODULE);
+ rawtable_ops = xt_hook_link(&packet_raw, ip6table_raw_hook);
if (IS_ERR(rawtable_ops)) {
unregister_pernet_subsys(&ip6table_raw_net_ops);
return PTR_ERR(rawtable_ops);
@@ -97,7 +97,7 @@ static int __init ip6table_raw_init(void)
static void __exit ip6table_raw_fini(void)
{
- xt_hook_unlink(rawtable_ops, RAW_VALID_HOOKS);
+ xt_hook_unlink(&packet_raw, rawtable_ops);
unregister_pernet_subsys(&ip6table_raw_net_ops);
}
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 7db37ba..ef3ad0b 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -61,6 +61,7 @@ static const struct xt_table security_table = {
.valid_hooks = SECURITY_VALID_HOOKS,
.me = THIS_MODULE,
.af = NFPROTO_IPV6,
+ .priority = NF_IP6_PRI_SECURITY,
};
static unsigned int
@@ -105,8 +106,7 @@ static int __init ip6table_security_init(void)
if (ret < 0)
return ret;
- sectbl_ops = xt_hook_link(ip6table_security_hook, NFPROTO_IPV6,
- NF_IP6_PRI_SECURITY, SECURITY_VALID_HOOKS, THIS_MODULE);
+ sectbl_ops = xt_hook_link(&security_table, ip6table_security_hook);
if (IS_ERR(sectbl_ops)) {
unregister_pernet_subsys(&ip6table_security_net_ops);
return PTR_ERR(sectbl_ops);
@@ -117,7 +117,7 @@ static int __init ip6table_security_init(void)
static void __exit ip6table_security_fini(void)
{
- xt_hook_unlink(sectbl_ops, SECURITY_VALID_HOOKS);
+ xt_hook_unlink(&security_table, sectbl_ops);
unregister_pernet_subsys(&ip6table_security_net_ops);
}
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index f7c4c39..46e0120 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1103,17 +1103,15 @@ static unsigned int xt_hookmask_bitcount(unsigned int mask)
/**
* xt_hook_link - set up hooks for a new table
+ * @table: table with metadata needed to set up hooks
* @fn: Hook function
- * @nfproto: %NFPROTO_*
- * @prio: n'th place within @nfproto's hook list (%NF_IP_PRI_*, etc.)
- * @hook_mask: Requested hooks
*
* This function will take care of creating and registering the necessary
* Netfilter hooks for XT tables.
*/
-struct nf_hook_ops *xt_hook_link(nf_hookfn *fn, uint8_t nfproto, int prio,
- unsigned int hook_mask, struct module *owner)
+struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn)
{
+ unsigned int hook_mask = table->valid_hooks;
uint8_t i, num_hooks = xt_hookmask_bitcount(hook_mask);
uint8_t hooknum;
struct nf_hook_ops *ops;
@@ -1128,10 +1126,10 @@ struct nf_hook_ops *xt_hook_link(nf_hookfn *fn, uint8_t nfproto, int prio,
if (!(hook_mask & 1))
continue;
ops[i].hook = fn;
- ops[i].owner = owner;
- ops[i].pf = nfproto;
+ ops[i].owner = table->me;
+ ops[i].pf = table->af;
ops[i].hooknum = hooknum;
- ops[i].priority = prio;
+ ops[i].priority = table->priority;
++i;
}
@@ -1150,9 +1148,9 @@ EXPORT_SYMBOL_GPL(xt_hook_link);
* @ops: nf_hook_ops array as returned by nf_hook_link
* @hook_mask: the very same mask that was passed to nf_hook_link
*/
-void xt_hook_unlink(struct nf_hook_ops *ops, unsigned int hook_mask)
+void xt_hook_unlink(const struct xt_table *table, struct nf_hook_ops *ops)
{
- nf_unregister_hooks(ops, xt_hookmask_bitcount(hook_mask));
+ nf_unregister_hooks(ops, xt_hookmask_bitcount(table->valid_hooks));
kfree(ops);
}
EXPORT_SYMBOL_GPL(xt_hook_unlink);
--
1.6.3.3
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
