Re: [PATCH nf-next 0/3] netfilter: clusterip: don't register hook in all netns

[Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>]

On Thu, Jul 22, 2021 at 10:48:31AM +0200, Florian Westphal wrote:
> This series stops ipt_CLUSTERIP from registering arp mangling hook
> unconditionally.
> 
> Hook gets installed/removed from checkentry/destroy callbacks.
> 
> Before this, modprobe ipt_CLUSTERIP would add a hook in each netns.
> While at it, also get rid of x_tables.h/xt storage space in struct net,
> there is no need for this.

Series applied, thanks.

I made a small update to 2/3 here:

@@ -517,6 +531,19 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
                return ret;
        }

+       if (cn->hook_users == 0) {
+               ret = nf_register_net_hook(par->net, &cip_arp_ops);
+
+               if (ret < 0) {
+                       clusterip_config_entry_put(config); <--
+                       clusterip_config_put(config); <--

to use config instead cipinfo->config which is set on later.