OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: nf_tables: add single table list for all families 

Place all existing user defined tables in struct net *, instead of
having one list per family. This saves us from one level of indentation
in netlink dump functions.

Place pointer to struct nft_af_info in struct nft_table temporarily, as
we still need this to put back reference module reference counter on
table removal.

This patch comes in preparation for the removal of struct nft_af_info.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2018-01-09 02:38:03 +01:00
parent 1ea26cca52
commit 36596dadf5
12 changed files with 284 additions and 301 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/net/netfilter/nf_tables.h
View File

@ -143,22 +143,22 @@ static inline void nft_data_debug(const struct nft_data *data)
* struct nft_ctx - nf_tables rule/set context * struct nft_ctx - nf_tables rule/set context
* *
* @net: net namespace * @net: net namespace
* @afi: address family info
* @table: the table the chain is contained in * @table: the table the chain is contained in
* @chain: the chain the rule is contained in * @chain: the chain the rule is contained in
* @nla: netlink attributes * @nla: netlink attributes
* @portid: netlink portID of the original message * @portid: netlink portID of the original message
* @seq: netlink sequence number * @seq: netlink sequence number
* @family: protocol family
* @report: notify via unicast netlink message * @report: notify via unicast netlink message
*/ */
struct nft_ctx { struct nft_ctx {
struct net *net; struct net *net;
struct nft_af_info *afi;
struct nft_table *table; struct nft_table *table;
struct nft_chain *chain; struct nft_chain *chain;
const struct nlattr * const *nla; const struct nlattr * const *nla;
u32 portid; u32 portid;
u32 seq; u32 seq;
u8 family;
bool report; bool report;
}; };
@ -949,6 +949,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
* @use: number of chain references to this table * @use: number of chain references to this table
* @flags: table flag (see enum nft_table_flags) * @flags: table flag (see enum nft_table_flags)
* @genmask: generation mask * @genmask: generation mask
* @afinfo: address family info
* @name: name of the table * @name: name of the table
*/ */
struct nft_table { struct nft_table {
@ -961,6 +962,7 @@ struct nft_table {
u32 use; u32 use;
u16 flags:14, u16 flags:14,
genmask:2; genmask:2;
struct nft_af_info *afi;
char *name; char *name;
}; };
@ -970,13 +972,11 @@ struct nft_table {
* @list: used internally * @list: used internally
* @family: address family * @family: address family
* @owner: module owner * @owner: module owner
* @tables: used internally
*/ */
struct nft_af_info { struct nft_af_info {
struct list_head list; struct list_head list;
int family; int family;
struct module *owner; struct module *owner;
struct list_head tables;
}; };
int nft_register_afinfo(struct net *, struct nft_af_info *); int nft_register_afinfo(struct net *, struct nft_af_info *);

1
include/net/netns/nftables.h
View File

@ -8,6 +8,7 @@ struct nft_af_info;
struct netns_nftables { struct netns_nftables {
struct list_head af_info; struct list_head af_info;
struct list_head tables;
struct list_head commit_list; struct list_head commit_list;
struct nft_af_info *ipv4; struct nft_af_info *ipv4;
struct nft_af_info *ipv6; struct nft_af_info *ipv6;

505
net/netfilter/nf_tables_api.c
View File

File diff suppressed because it is too large Load Diff

21
net/netfilter/nf_tables_netdev.c
View File

@ -107,7 +107,6 @@ static int nf_tables_netdev_event(struct notifier_block *this,
unsigned long event, void *ptr) unsigned long event, void *ptr)
{ {
struct net_device *dev = netdev_notifier_info_to_dev(ptr); struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct nft_af_info *afi;
struct nft_table *table; struct nft_table *table;
struct nft_chain *chain, *nr; struct nft_chain *chain, *nr;
struct nft_ctx ctx = { struct nft_ctx ctx = {
@ -119,20 +118,18 @@ static int nf_tables_netdev_event(struct notifier_block *this,
return NOTIFY_DONE; return NOTIFY_DONE;
nfnl_lock(NFNL_SUBSYS_NFTABLES); nfnl_lock(NFNL_SUBSYS_NFTABLES);
list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) { list_for_each_entry(table, &ctx.net->nft.tables, list) {
ctx.afi = afi; if (table->afi->family != NFPROTO_NETDEV)
if (afi->family != NFPROTO_NETDEV)
continue; continue;
list_for_each_entry(table, &afi->tables, list) { ctx.family = table->afi->family;
ctx.table = table; ctx.table = table;
list_for_each_entry_safe(chain, nr, &table->chains, list) { list_for_each_entry_safe(chain, nr, &table->chains, list) {
if (!nft_is_base_chain(chain)) if (!nft_is_base_chain(chain))
continue; continue;
ctx.chain = chain; ctx.chain = chain;
nft_netdev_event(event, dev, &ctx); nft_netdev_event(event, dev, &ctx);
}
} }
} }
nfnl_unlock(NFNL_SUBSYS_NFTABLES); nfnl_unlock(NFNL_SUBSYS_NFTABLES);

16
net/netfilter/nft_compat.c
View File

@ -144,7 +144,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
{ {
par->net = ctx->net; par->net = ctx->net;
par->table = ctx->table->name; par->table = ctx->table->name;
switch (ctx->afi->family) { switch (ctx->family) {
case AF_INET: case AF_INET:
entry->e4.ip.proto = proto; entry->e4.ip.proto = proto;
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
@ -175,7 +175,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
} else { } else {
par->hook_mask = 0; par->hook_mask = 0;
} }
par->family = ctx->afi->family; par->family = ctx->family;
par->nft_compat = true; par->nft_compat = true;
} }
@ -267,7 +267,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
par.net = ctx->net; par.net = ctx->net;
par.target = target; par.target = target;
par.targinfo = info; par.targinfo = info;
par.family = ctx->afi->family; par.family = ctx->family;
if (par.target->destroy != NULL) if (par.target->destroy != NULL)
par.target->destroy(&par); par.target->destroy(&par);
@ -358,7 +358,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
{ {
par->net = ctx->net; par->net = ctx->net;
par->table = ctx->table->name; par->table = ctx->table->name;
switch (ctx->afi->family) { switch (ctx->family) {
case AF_INET: case AF_INET:
entry->e4.ip.proto = proto; entry->e4.ip.proto = proto;
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
@ -389,7 +389,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
} else { } else {
par->hook_mask = 0; par->hook_mask = 0;
} }
par->family = ctx->afi->family; par->family = ctx->family;
par->nft_compat = true; par->nft_compat = true;
} }
@ -446,7 +446,7 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
par.net = ctx->net; par.net = ctx->net;
par.match = match; par.match = match;
par.matchinfo = info; par.matchinfo = info;
par.family = ctx->afi->family; par.family = ctx->family;
if (par.match->destroy != NULL) if (par.match->destroy != NULL)
par.match->destroy(&par); par.match->destroy(&par);
@ -648,7 +648,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
mt_name = nla_data(tb[NFTA_MATCH_NAME]); mt_name = nla_data(tb[NFTA_MATCH_NAME]);
rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
family = ctx->afi->family; family = ctx->family;
/* Re-use the existing match if it's already loaded. */ /* Re-use the existing match if it's already loaded. */
list_for_each_entry(nft_match, &nft_match_list, head) { list_for_each_entry(nft_match, &nft_match_list, head) {
@ -733,7 +733,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
tg_name = nla_data(tb[NFTA_TARGET_NAME]); tg_name = nla_data(tb[NFTA_TARGET_NAME]);
rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
family = ctx->afi->family; family = ctx->family;
/* Re-use the existing target if it's already loaded. */ /* Re-use the existing target if it's already loaded. */
list_for_each_entry(nft_target, &nft_target_list, head) { list_for_each_entry(nft_target, &nft_target_list, head) {

16
net/netfilter/nft_ct.c
View File

@ -405,7 +405,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
if (tb[NFTA_CT_DIRECTION] == NULL) if (tb[NFTA_CT_DIRECTION] == NULL)
return -EINVAL; return -EINVAL;
switch (ctx->afi->family) { switch (ctx->family) {
case NFPROTO_IPV4: case NFPROTO_IPV4:
len = FIELD_SIZEOF(struct nf_conntrack_tuple, len = FIELD_SIZEOF(struct nf_conntrack_tuple,
src.u3.ip); src.u3.ip);
@ -456,7 +456,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
if (err < 0) if (err < 0)
return err; return err;
err = nf_ct_netns_get(ctx->net, ctx->afi->family); err = nf_ct_netns_get(ctx->net, ctx->family);
if (err < 0) if (err < 0)
return err; return err;
@ -550,7 +550,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
if (err < 0) if (err < 0)
goto err1; goto err1;
err = nf_ct_netns_get(ctx->net, ctx->afi->family); err = nf_ct_netns_get(ctx->net, ctx->family);
if (err < 0) if (err < 0)
goto err1; goto err1;
@ -564,7 +564,7 @@ err1:
static void nft_ct_get_destroy(const struct nft_ctx *ctx, static void nft_ct_get_destroy(const struct nft_ctx *ctx,
const struct nft_expr *expr) const struct nft_expr *expr)
{ {
nf_ct_netns_put(ctx->net, ctx->afi->family); nf_ct_netns_put(ctx->net, ctx->family);
} }
static void nft_ct_set_destroy(const struct nft_ctx *ctx, static void nft_ct_set_destroy(const struct nft_ctx *ctx,
@ -573,7 +573,7 @@ static void nft_ct_set_destroy(const struct nft_ctx *ctx,
struct nft_ct *priv = nft_expr_priv(expr); struct nft_ct *priv = nft_expr_priv(expr);
__nft_ct_set_destroy(ctx, priv); __nft_ct_set_destroy(ctx, priv);
nf_ct_netns_put(ctx->net, ctx->afi->family); nf_ct_netns_put(ctx->net, ctx->family);
} }
static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr) static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
@ -734,7 +734,7 @@ static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
struct nft_ct_helper_obj *priv = nft_obj_data(obj); struct nft_ct_helper_obj *priv = nft_obj_data(obj);
struct nf_conntrack_helper *help4, *help6; struct nf_conntrack_helper *help4, *help6;
char name[NF_CT_HELPER_NAME_LEN]; char name[NF_CT_HELPER_NAME_LEN];
int family = ctx->afi->family; int family = ctx->family;
if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO]) if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
return -EINVAL; return -EINVAL;
@ -753,14 +753,14 @@ static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
switch (family) { switch (family) {
case NFPROTO_IPV4: case NFPROTO_IPV4:
if (ctx->afi->family == NFPROTO_IPV6) if (ctx->family == NFPROTO_IPV6)
return -EINVAL; return -EINVAL;
help4 = nf_conntrack_helper_try_module_get(name, family, help4 = nf_conntrack_helper_try_module_get(name, family,
priv->l4proto); priv->l4proto);
break; break;
case NFPROTO_IPV6: case NFPROTO_IPV6:
if (ctx->afi->family == NFPROTO_IPV4) if (ctx->family == NFPROTO_IPV4)
return -EINVAL; return -EINVAL;
help6 = nf_conntrack_helper_try_module_get(name, family, help6 = nf_conntrack_helper_try_module_get(name, family,

4
net/netfilter/nft_flow_offload.c
View File

@ -151,7 +151,7 @@ static int nft_flow_offload_init(const struct nft_ctx *ctx,
priv->flowtable = flowtable; priv->flowtable = flowtable;
flowtable->use++; flowtable->use++;
return nf_ct_netns_get(ctx->net, ctx->afi->family); return nf_ct_netns_get(ctx->net, ctx->family);
} }
static void nft_flow_offload_destroy(const struct nft_ctx *ctx, static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
@ -160,7 +160,7 @@ static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
struct nft_flow_offload *priv = nft_expr_priv(expr); struct nft_flow_offload *priv = nft_expr_priv(expr);
priv->flowtable->use--; priv->flowtable->use--;
nf_ct_netns_put(ctx->net, ctx->afi->family); nf_ct_netns_put(ctx->net, ctx->family);
} }
static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr) static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr)

4
net/netfilter/nft_log.c
View File

@ -112,7 +112,7 @@ static int nft_log_init(const struct nft_ctx *ctx,
break; break;
} }
err = nf_logger_find_get(ctx->afi->family, li->type); err = nf_logger_find_get(ctx->family, li->type);
if (err < 0) if (err < 0)
goto err1; goto err1;
@ -133,7 +133,7 @@ static void nft_log_destroy(const struct nft_ctx *ctx,
if (priv->prefix != nft_log_null_prefix) if (priv->prefix != nft_log_null_prefix)
kfree(priv->prefix); kfree(priv->prefix);
nf_logger_put(ctx->afi->family, li->type); nf_logger_put(ctx->family, li->type);
} }
static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr) static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)

2
net/netfilter/nft_masq.c
View File

@ -73,7 +73,7 @@ int nft_masq_init(const struct nft_ctx *ctx,
} }
} }
return nf_ct_netns_get(ctx->net, ctx->afi->family); return nf_ct_netns_get(ctx->net, ctx->family);
} }
EXPORT_SYMBOL_GPL(nft_masq_init); EXPORT_SYMBOL_GPL(nft_masq_init);

4
net/netfilter/nft_meta.c
View File

@ -339,7 +339,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx,
if (priv->key != NFT_META_SECPATH) if (priv->key != NFT_META_SECPATH)
return 0; return 0;
switch (ctx->afi->family) { switch (ctx->family) {
case NFPROTO_NETDEV: case NFPROTO_NETDEV:
hooks = 1 << NF_NETDEV_INGRESS; hooks = 1 << NF_NETDEV_INGRESS;
break; break;
@ -370,7 +370,7 @@ int nft_meta_set_validate(const struct nft_ctx *ctx,
if (priv->key != NFT_META_PKTTYPE) if (priv->key != NFT_META_PKTTYPE)
return 0; return 0;
switch (ctx->afi->family) { switch (ctx->family) {
case NFPROTO_BRIDGE: case NFPROTO_BRIDGE:
hooks = 1 << NF_BR_PRE_ROUTING; hooks = 1 << NF_BR_PRE_ROUTING;
break; break;

2
net/netfilter/nft_nat.c
View File

@ -142,7 +142,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
return -EINVAL; return -EINVAL;
family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY])); family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
if (family != ctx->afi->family) if (family != ctx->family)
return -EOPNOTSUPP; return -EOPNOTSUPP;
switch (family) { switch (family) {

2
net/netfilter/nft_redir.c
View File

@ -75,7 +75,7 @@ int nft_redir_init(const struct nft_ctx *ctx,
return -EINVAL; return -EINVAL;
} }
return nf_ct_netns_get(ctx->net, ctx->afi->family); return nf_ct_netns_get(ctx->net, ctx->family);
} }
EXPORT_SYMBOL_GPL(nft_redir_init); EXPORT_SYMBOL_GPL(nft_redir_init);