This flag was introduced to restore rulesets from the new netdev family, but since 5ebe0b0eec9d6f7 ("netfilter: nf_tables: destroy basechain and rules on netdevice removal") the ruleset is released once the netdev is gone. This also removes nft_register_basechain() and nft_unregister_basechain() since they have no clients anymore after this rework.
Unified · Split
| @@ -798,7 +798,6 @@ struct nft_stats { · 797 unmodified lines | ||
| 798 | 798 | }; |
| 799 | 799 | |
| 800 | 800 | #define NFT_HOOK_OPS_MAX 2 |
| 801 | −#define NFT_BASECHAIN_DISABLED (1 << 0) | |
| 802 | 801 | |
| 803 | 802 | /** |
| 804 | 803 | * struct nft_base_chain - nf_tables base chain |
| @@ -131,29 +131,8 @@ static void nft_trans_destroy(struct nft_trans *trans) · 130 unmodified lines | ||
| 131 | 131 | kfree(trans); |
| 132 | 132 | } |
| 133 | 133 | |
| 134 | −static int nft_register_basechain(struct nft_base_chain *basechain, | |
| 135 | − unsigned int hook_nops) | |
| 136 | −{ | |
| 137 | − struct net *net = read_pnet(&basechain->pnet); | |
| 138 | − | |
| 139 | − if (basechain->flags & NFT_BASECHAIN_DISABLED) | |
| 140 | − return 0; | |
| 141 | − | |
| 142 | − return nf_register_net_hooks(net, basechain->ops, hook_nops); | |
| 143 | −} | |
| 144 | − | |
| 145 | −static void nft_unregister_basechain(struct nft_base_chain *basechain, | |
| 146 | − unsigned int hook_nops) | |
| 147 | −{ | |
| 148 | − struct net *net = read_pnet(&basechain->pnet); | |
| 149 | − | |
| 150 | − if (basechain->flags & NFT_BASECHAIN_DISABLED) | |
| 151 | − return; | |
| 152 | − | |
| 153 | − nf_unregister_net_hooks(net, basechain->ops, hook_nops); | |
| 154 | −} | |
| 155 | − | |
| 156 | −static int nf_tables_register_hooks(const struct nft_table *table, | |
| 134 | +static int nf_tables_register_hooks(struct net *net, | |
| 135 | + const struct nft_table *table, | |
| 157 | 136 | struct nft_chain *chain, |
| 158 | 137 | unsigned int hook_nops) |
| 159 | 138 | { |
| @@ -161,10 +140,12 @@ static int nf_tables_register_hooks(const struct nft_table *table, · 1 unmodified line | ||
| 161 | 140 | !(chain->flags & NFT_BASE_CHAIN)) |
| 162 | 141 | return 0; |
| 163 | 142 | |
| 164 | − return nft_register_basechain(nft_base_chain(chain), hook_nops); | |
| 143 | + return nf_register_net_hooks(net, nft_base_chain(chain)->ops, | |
| 144 | + hook_nops); | |
| 165 | 145 | } |
| 166 | 146 | |
| 167 | −static void nf_tables_unregister_hooks(const struct nft_table *table, | |
| 147 | +static void nf_tables_unregister_hooks(struct net *net, | |
| 148 | + const struct nft_table *table, | |
| 168 | 149 | struct nft_chain *chain, |
| 169 | 150 | unsigned int hook_nops) |
| 170 | 151 | { |
| @@ -172,7 +153,7 @@ static void nf_tables_unregister_hooks(const struct nft_table *table, · 1 unmodified line | ||
| 172 | 153 | !(chain->flags & NFT_BASE_CHAIN)) |
| 173 | 154 | return; |
| 174 | 155 | |
| 175 | − nft_unregister_basechain(nft_base_chain(chain), hook_nops); | |
| 156 | + nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops); | |
| 176 | 157 | } |
| 177 | 158 | |
| 178 | 159 | static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) |
| @@ -569,7 +550,8 @@ static int nf_tables_table_enable(struct net *net, · 390 unmodified lines | ||
| 569 | 550 | if (!(chain->flags & NFT_BASE_CHAIN)) |
| 570 | 551 | continue; |
| 571 | 552 | |
| 572 | − err = nft_register_basechain(nft_base_chain(chain), afi->nops); | |
| 553 | + err = nf_register_net_hooks(net, nft_base_chain(chain)->ops, | |
| 554 | + afi->nops); | |
| 573 | 555 | if (err < 0) |
| 574 | 556 | goto err; |
| 575 | 557 | |
| @@ -586,7 +568,8 @@ err: · 10 unmodified lines | ||
| 586 | 568 | if (i-- <= 0) |
| 587 | 569 | break; |
| 588 | 570 | |
| 589 | − nft_unregister_basechain(nft_base_chain(chain), afi->nops); | |
| 571 | + nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, | |
| 572 | + afi->nops); | |
| 590 | 573 | } |
| 591 | 574 | return err; |
| 592 | 575 | } |
| @@ -600,9 +583,11 @@ static void nf_tables_table_disable(struct net *net, · 7 unmodified lines | ||
| 600 | 583 | list_for_each_entry(chain, &table->chains, list) { |
| 601 | 584 | if (!nft_is_active_next(net, chain)) |
| 602 | 585 | continue; |
| 603 | − if (chain->flags & NFT_BASE_CHAIN) | |
| 604 | − nft_unregister_basechain(nft_base_chain(chain), | |
| 605 | − afi->nops); | |
| 586 | + if (!(chain->flags & NFT_BASE_CHAIN)) | |
| 587 | + continue; | |
| 588 | + | |
| 589 | + nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, | |
| 590 | + afi->nops); | |
| 606 | 591 | } |
| 607 | 592 | } |
| 608 | 593 | |
| @@ -1451,7 +1436,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk, · 842 unmodified lines | ||
| 1451 | 1436 | chain->table = table; |
| 1452 | 1437 | nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN); |
| 1453 | 1438 | |
| 1454 | − err = nf_tables_register_hooks(table, chain, afi->nops); | |
| 1439 | + err = nf_tables_register_hooks(net, table, chain, afi->nops); | |
| 1455 | 1440 | if (err < 0) |
| 1456 | 1441 | goto err1; |
| 1457 | 1442 | |
| @@ -1464,7 +1449,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk, · 6 unmodified lines | ||
| 1464 | 1449 | list_add_tail_rcu(&chain->list, &table->chains); |
| 1465 | 1450 | return 0; |
| 1466 | 1451 | err2: |
| 1467 | − nf_tables_unregister_hooks(table, chain, afi->nops); | |
| 1452 | + nf_tables_unregister_hooks(net, table, chain, afi->nops); | |
| 1468 | 1453 | err1: |
| 1469 | 1454 | nf_tables_chain_destroy(chain); |
| 1470 | 1455 | return err; |
| @@ -3995,7 +3980,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) · 2524 unmodified lines | ||
| 3995 | 3980 | case NFT_MSG_DELCHAIN: |
| 3996 | 3981 | list_del_rcu(&trans->ctx.chain->list); |
| 3997 | 3982 | nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN); |
| 3998 | − nf_tables_unregister_hooks(trans->ctx.table, | |
| 3983 | + nf_tables_unregister_hooks(trans->ctx.net, | |
| 3984 | + trans->ctx.table, | |
| 3999 | 3985 | trans->ctx.chain, |
| 4000 | 3986 | trans->ctx.afi->nops); |
| 4001 | 3987 | break; |
| @@ -4120,7 +4106,8 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb) · 118 unmodified lines | ||
| 4120 | 4106 | } else { |
| 4121 | 4107 | trans->ctx.table->use--; |
| 4122 | 4108 | list_del_rcu(&trans->ctx.chain->list); |
| 4123 | − nf_tables_unregister_hooks(trans->ctx.table, | |
| 4109 | + nf_tables_unregister_hooks(trans->ctx.net, | |
| 4110 | + trans->ctx.table, | |
| 4124 | 4111 | trans->ctx.chain, |
| 4125 | 4112 | trans->ctx.afi->nops); |
| 4126 | 4113 | } |
| @@ -4662,7 +4649,7 @@ int __nft_release_basechain(struct nft_ctx *ctx) · 535 unmodified lines | ||
| 4662 | 4649 | |
| 4663 | 4650 | BUG_ON(!(ctx->chain->flags & NFT_BASE_CHAIN)); |
| 4664 | 4651 | |
| 4665 | − nf_tables_unregister_hooks(ctx->chain->table, ctx->chain, | |
| 4652 | + nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain, | |
| 4666 | 4653 | ctx->afi->nops); |
| 4667 | 4654 | list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { |
| 4668 | 4655 | list_del(&rule->list); |
| @@ -4691,7 +4678,8 @@ static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi) · 22 unmodified lines | ||
| 4691 | 4678 | |
| 4692 | 4679 | list_for_each_entry_safe(table, nt, &afi->tables, list) { |
| 4693 | 4680 | list_for_each_entry(chain, &table->chains, list) |
| 4694 | − nf_tables_unregister_hooks(table, chain, afi->nops); | |
| 4681 | + nf_tables_unregister_hooks(net, table, chain, | |
| 4682 | + afi->nops); | |
| 4695 | 4683 | /* No packets are walking on these chains anymore. */ |
| 4696 | 4684 | ctx.table = table; |
| 4697 | 4685 | list_for_each_entry(chain, &table->chains, list) { |