Patchwork [3/7] netfilter: nf_tables: remove hook definitions from struct nft_af_info

login
register
mail settings
Submitter Pablo Neira
Date Jan. 10, 2013, 3:28 p.m.
Message ID <1357831721-10182-3-git-send-email-pablo@netfilter.org>
Download mbox | patch
Permalink /patch/211066/
State Not Applicable
Headers show

Comments

Pablo Neira - Jan. 10, 2013, 3:28 p.m.
From: Pablo Neira Ayuso <pablo@netfilter.org>

They are now included in the filter chain definition.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/net/netfilter/nf_tables.h   |    2 --
 net/ipv4/netfilter/nf_tables_ipv4.c |    5 +----
 net/ipv6/netfilter/nf_tables_ipv6.c |    5 +----
 net/netfilter/nf_tables_api.c       |    2 --
 4 files changed, 2 insertions(+), 12 deletions(-)
Patrick McHardy - Jan. 10, 2013, 4:04 p.m.
On Thu, Jan 10, 2013 at 04:28:37PM +0100, pablo@netfilter.org wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> They are now included in the filter chain definition.
> 

Ok should have looked at the entire series before responding.
I do still need the table hooks for the multi family tables,
so I'd suggest to keep the current state until I've come up
with a scheme that accomodates all our needs.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira - Jan. 10, 2013, 4:19 p.m.
On Thu, Jan 10, 2013 at 05:04:18PM +0100, Patrick McHardy wrote:
> On Thu, Jan 10, 2013 at 04:28:37PM +0100, pablo@netfilter.org wrote:
> > From: Pablo Neira Ayuso <pablo@netfilter.org>
> > 
> > They are now included in the filter chain definition.
> > 
> 
> Ok should have looked at the entire series before responding.
> I do still need the table hooks for the multi family tables,
> so I'd suggest to keep the current state until I've come up
> with a scheme that accomodates all our needs.

OK, I'll rework this patch to fix the output path of filter. I will
keep the table hooks so you can still use it.

Thanks Patrick.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 5d9d43f..0dc7d80 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -430,7 +430,6 @@  struct nft_table {
  *	@nhooks: number of hooks in this family
  *	@owner: module owner
  *	@tables: used internally
- *	@hooks: hookfn overrides for packet validation
  */
 struct nft_af_info {
 	struct list_head		list;
@@ -438,7 +437,6 @@  struct nft_af_info {
 	unsigned int			nhooks;
 	struct module			*owner;
 	struct list_head		tables;
-	nf_hookfn			*hooks[NF_MAX_HOOKS];
 };
 
 extern int nft_register_afinfo(struct net *, struct nft_af_info *);
diff --git a/net/ipv4/netfilter/nf_tables_ipv4.c b/net/ipv4/netfilter/nf_tables_ipv4.c
index a0ee4c2..29e09e9 100644
--- a/net/ipv4/netfilter/nf_tables_ipv4.c
+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
@@ -38,9 +38,6 @@  static struct nft_af_info nft_af_ipv4 __read_mostly = {
 	.family		= NFPROTO_IPV4,
 	.nhooks		= NF_INET_NUMHOOKS,
 	.owner		= THIS_MODULE,
-	.hooks		= {
-		[NF_INET_LOCAL_OUT]	= nft_ipv4_output,
-	},
 };
 
 static int nf_tables_ipv4_init_net(struct net *net)
@@ -82,7 +79,7 @@  static struct nf_chain_type filter_ipv4 = {
 			  (1 << NF_INET_POST_ROUTING),
 	.fn		= {
 		[NF_INET_LOCAL_IN]	= nft_do_chain,
-		[NF_INET_LOCAL_OUT]	= nft_do_chain,
+		[NF_INET_LOCAL_OUT]	= nft_ipv4_output,
 		[NF_INET_FORWARD]	= nft_do_chain,
 		[NF_INET_PRE_ROUTING]	= nft_do_chain,
 		[NF_INET_POST_ROUTING]	= nft_do_chain,
diff --git a/net/ipv6/netfilter/nf_tables_ipv6.c b/net/ipv6/netfilter/nf_tables_ipv6.c
index e1eee09..84ccd35 100644
--- a/net/ipv6/netfilter/nf_tables_ipv6.c
+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
@@ -35,9 +35,6 @@  static struct nft_af_info nft_af_ipv6 __read_mostly = {
 	.family		= NFPROTO_IPV6,
 	.nhooks		= NF_INET_NUMHOOKS,
 	.owner		= THIS_MODULE,
-	.hooks		= {
-		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
-	},
 };
 
 static int nf_tables_ipv6_init_net(struct net *net)
@@ -79,7 +76,7 @@  static struct nf_chain_type filter_ipv6 = {
 			  (1 << NF_INET_POST_ROUTING),
 	.fn		= {
 		[NF_INET_LOCAL_IN]	= nft_do_chain,
-		[NF_INET_LOCAL_OUT]	= nft_do_chain,
+		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
 		[NF_INET_FORWARD]	= nft_do_chain,
 		[NF_INET_PRE_ROUTING]	= nft_do_chain,
 		[NF_INET_POST_ROUTING]	= nft_do_chain,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a8ae0b4..697b853 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -842,8 +842,6 @@  static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 		ops->priority	= ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
 		ops->priv	= chain;
 		ops->hook       = hookfn;
-		if (afi->hooks[ops->hooknum])
-			ops->hook = afi->hooks[ops->hooknum];
 
 		chain->flags |= NFT_BASE_CHAIN;