nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

netfilter: nf_tables: add single table list for all families

Browse source 
Place all existing user defined tables in struct net *, instead of
having one list per family. This saves us from one level of indentation
in netlink dump functions.

Place pointer to struct nft_af_info in struct nft_table temporarily, as
we still need this to put back reference module reference counter on
table removal.

This patch comes in preparation for the removal of struct nft_af_info.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2018-01-09 02:38:03 +01:00
parent 1ea26cca52
commit 36596dadf5
12 changed files with 284 additions and 301 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

8
include/net/netfilter/nf_tables.h
View file

@ -143,22 +143,22 @@ static inline void nft_data_debug(const struct nft_data *data)
* struct nft_ctx - nf_tables rule/set context * struct nft_ctx - nf_tables rule/set context
* *
* @net: net namespace * @net: net namespace
* @afi: address family info
* @table: the table the chain is contained in * @table: the table the chain is contained in
* @chain: the chain the rule is contained in * @chain: the chain the rule is contained in
* @nla: netlink attributes * @nla: netlink attributes
* @portid: netlink portID of the original message * @portid: netlink portID of the original message
* @seq: netlink sequence number * @seq: netlink sequence number
* @family: protocol family
* @report: notify via unicast netlink message * @report: notify via unicast netlink message
*/ */
struct nft_ctx { struct nft_ctx {
struct net *net; struct net *net;
struct nft_af_info *afi;
struct nft_table *table; struct nft_table *table;
struct nft_chain *chain; struct nft_chain *chain;
const struct nlattr * const *nla; const struct nlattr * const *nla;
u32 portid; u32 portid;
u32 seq; u32 seq;
u8 family;
bool report; bool report;
}; };
@ -949,6 +949,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
* @use: number of chain references to this table * @use: number of chain references to this table
* @flags: table flag (see enum nft_table_flags) * @flags: table flag (see enum nft_table_flags)
* @genmask: generation mask * @genmask: generation mask
* @afinfo: address family info
* @name: name of the table * @name: name of the table
*/ */
struct nft_table { struct nft_table {
@ -961,6 +962,7 @@ struct nft_table {
u32 use; u32 use;
u16 flags:14, u16 flags:14,
genmask:2; genmask:2;
struct nft_af_info *afi;
char *name; char *name;
}; };
@ -970,13 +972,11 @@ struct nft_table {
* @list: used internally * @list: used internally
* @family: address family * @family: address family
* @owner: module owner * @owner: module owner
* @tables: used internally
*/ */
struct nft_af_info { struct nft_af_info {
struct list_head list; struct list_head list;
int family; int family;
struct module *owner; struct module *owner;
struct list_head tables;
}; };
int nft_register_afinfo(struct net *, struct nft_af_info *); int nft_register_afinfo(struct net *, struct nft_af_info *);

1
include/net/netns/nftables.h
View file

@ -8,6 +8,7 @@ struct nft_af_info;
struct netns_nftables { struct netns_nftables {
struct list_head af_info; struct list_head af_info;
struct list_head tables;
struct list_head commit_list; struct list_head commit_list;
struct nft_af_info *ipv4; struct nft_af_info *ipv4;
struct nft_af_info *ipv6; struct nft_af_info *ipv6;

247
net/netfilter/nf_tables_api.c
View file

@ -37,7 +37,6 @@ static LIST_HEAD(nf_tables_flowtables);
*/ */
int nft_register_afinfo(struct net *net, struct nft_af_info *afi) int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
{ {
INIT_LIST_HEAD(&afi->tables);
nfnl_lock(NFNL_SUBSYS_NFTABLES); nfnl_lock(NFNL_SUBSYS_NFTABLES);
list_add_tail_rcu(&afi->list, &net->nft.af_info); list_add_tail_rcu(&afi->list, &net->nft.af_info);
nfnl_unlock(NFNL_SUBSYS_NFTABLES); nfnl_unlock(NFNL_SUBSYS_NFTABLES);
@ -99,13 +98,13 @@ static void nft_ctx_init(struct nft_ctx *ctx,
struct net *net, struct net *net,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct nlmsghdr *nlh, const struct nlmsghdr *nlh,
struct nft_af_info *afi, u8 family,
struct nft_table *table, struct nft_table *table,
struct nft_chain *chain, struct nft_chain *chain,
const struct nlattr * const *nla) const struct nlattr * const *nla)
{ {
ctx->net = net; ctx->net = net;
ctx->afi = afi; ctx->family = family;
ctx->table = table; ctx->table = table;
ctx->chain = chain; ctx->chain = chain;
ctx->nla = nla; ctx->nla = nla;
@ -385,30 +384,31 @@ static int nft_delflowtable(struct nft_ctx *ctx,
* Tables * Tables
*/ */
static struct nft_table *nft_table_lookup(const struct nft_af_info *afi, static struct nft_table *nft_table_lookup(const struct net *net,
const struct nlattr *nla, const struct nlattr *nla,
u8 genmask) u8 family, u8 genmask)
{ {
struct nft_table *table; struct nft_table *table;
list_for_each_entry(table, &afi->tables, list) { list_for_each_entry(table, &net->nft.tables, list) {
if (!nla_strcmp(nla, table->name) && if (!nla_strcmp(nla, table->name) &&
table->afi->family == family &&
nft_active_genmask(table, genmask)) nft_active_genmask(table, genmask))
return table; return table;
} }
return NULL; return NULL;
} }
static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi, static struct nft_table *nf_tables_table_lookup(const struct net *net,
const struct nlattr *nla, const struct nlattr *nla,
u8 genmask) u8 family, u8 genmask)
{ {
struct nft_table *table; struct nft_table *table;
if (nla == NULL) if (nla == NULL)
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
table = nft_table_lookup(afi, nla, genmask); table = nft_table_lookup(net, nla, family, genmask);
if (table != NULL) if (table != NULL)
return table; return table;
@ -507,7 +507,7 @@ static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
goto err; goto err;
err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
event, 0, ctx->afi->family, ctx->table); event, 0, ctx->family, ctx->table);
if (err < 0) { if (err < 0) {
kfree_skb(skb); kfree_skb(skb);
goto err; goto err;
@ -524,7 +524,6 @@ static int nf_tables_dump_tables(struct sk_buff *skb,
struct netlink_callback *cb) struct netlink_callback *cb)
{ {
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
const struct nft_af_info *afi;
const struct nft_table *table; const struct nft_table *table;
unsigned int idx = 0, s_idx = cb->args[0]; unsigned int idx = 0, s_idx = cb->args[0];
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
@ -533,11 +532,10 @@ static int nf_tables_dump_tables(struct sk_buff *skb,
rcu_read_lock(); rcu_read_lock();
cb->seq = net->nft.base_seq; cb->seq = net->nft.base_seq;
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
if (family != NFPROTO_UNSPEC && family != afi->family) if (family != NFPROTO_UNSPEC && family != table->afi->family)
continue; continue;
list_for_each_entry_rcu(table, &afi->tables, list) {
if (idx < s_idx) if (idx < s_idx)
goto cont; goto cont;
if (idx > s_idx) if (idx > s_idx)
@ -548,16 +546,14 @@ static int nf_tables_dump_tables(struct sk_buff *skb,
if (nf_tables_fill_table_info(skb, net, if (nf_tables_fill_table_info(skb, net,
NETLINK_CB(cb->skb).portid, NETLINK_CB(cb->skb).portid,
cb->nlh->nlmsg_seq, cb->nlh->nlmsg_seq,
NFT_MSG_NEWTABLE, NFT_MSG_NEWTABLE, NLM_F_MULTI,
NLM_F_MULTI, table->afi->family, table) < 0)
afi->family, table) < 0)
goto done; goto done;
nl_dump_check_consistent(cb, nlmsg_hdr(skb)); nl_dump_check_consistent(cb, nlmsg_hdr(skb));
cont: cont:
idx++; idx++;
} }
}
done: done:
rcu_read_unlock(); rcu_read_unlock();
cb->args[0] = idx; cb->args[0] = idx;
@ -588,7 +584,8 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask); table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -719,7 +716,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
return PTR_ERR(afi); return PTR_ERR(afi);
name = nla[NFTA_TABLE_NAME]; name = nla[NFTA_TABLE_NAME];
table = nf_tables_table_lookup(afi, name, genmask); table = nf_tables_table_lookup(net, name, afi->family, genmask);
if (IS_ERR(table)) { if (IS_ERR(table)) {
if (PTR_ERR(table) != -ENOENT) if (PTR_ERR(table) != -ENOENT)
return PTR_ERR(table); return PTR_ERR(table);
@ -729,7 +726,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
if (nlh->nlmsg_flags & NLM_F_REPLACE) if (nlh->nlmsg_flags & NLM_F_REPLACE)
return -EOPNOTSUPP; return -EOPNOTSUPP;
nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
return nf_tables_updtable(&ctx); return nf_tables_updtable(&ctx);
} }
@ -756,14 +753,15 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
INIT_LIST_HEAD(&table->sets); INIT_LIST_HEAD(&table->sets);
INIT_LIST_HEAD(&table->objects); INIT_LIST_HEAD(&table->objects);
INIT_LIST_HEAD(&table->flowtables); INIT_LIST_HEAD(&table->flowtables);
table->afi = afi;
table->flags = flags; table->flags = flags;
nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
if (err < 0) if (err < 0)
goto err4; goto err4;
list_add_tail_rcu(&table->list, &afi->tables); list_add_tail_rcu(&table->list, &net->nft.tables);
return 0; return 0;
err4: err4:
kfree(table->name); kfree(table->name);
@ -837,17 +835,16 @@ static int nft_flush_table(struct nft_ctx *ctx)
static int nft_flush(struct nft_ctx *ctx, int family) static int nft_flush(struct nft_ctx *ctx, int family)
{ {
struct nft_af_info *afi;
struct nft_table *table, *nt; struct nft_table *table, *nt;
const struct nlattr * const *nla = ctx->nla; const struct nlattr * const *nla = ctx->nla;
int err = 0; int err = 0;
list_for_each_entry(afi, &ctx->net->nft.af_info, list) { list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
if (family != AF_UNSPEC && afi->family != family) if (family != AF_UNSPEC && table->afi->family != family)
continue; continue;
ctx->afi = afi; ctx->family = table->afi->family;
list_for_each_entry_safe(table, nt, &afi->tables, list) {
if (!nft_is_active_next(ctx->net, table)) if (!nft_is_active_next(ctx->net, table))
continue; continue;
@ -861,7 +858,6 @@ static int nft_flush(struct nft_ctx *ctx, int family)
if (err < 0) if (err < 0)
goto out; goto out;
} }
}
out: out:
return err; return err;
} }
@ -878,7 +874,7 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
int family = nfmsg->nfgen_family; int family = nfmsg->nfgen_family;
struct nft_ctx ctx; struct nft_ctx ctx;
nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL) if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
return nft_flush(&ctx, family); return nft_flush(&ctx, family);
@ -886,7 +882,8 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask); table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -894,7 +891,7 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
table->use > 0) table->use > 0)
return -EBUSY; return -EBUSY;
ctx.afi = afi; ctx.family = afi->family;
ctx.table = table; ctx.table = table;
return nft_flush_table(&ctx); return nft_flush_table(&ctx);
@ -906,7 +903,7 @@ static void nf_tables_table_destroy(struct nft_ctx *ctx)
kfree(ctx->table->name); kfree(ctx->table->name);
kfree(ctx->table); kfree(ctx->table);
module_put(ctx->afi->owner); module_put(ctx->table->afi->owner);
} }
int nft_register_chain_type(const struct nf_chain_type *ctype) int nft_register_chain_type(const struct nf_chain_type *ctype)
@ -1107,7 +1104,7 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
goto err; goto err;
err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
event, 0, ctx->afi->family, ctx->table, event, 0, ctx->family, ctx->table,
ctx->chain); ctx->chain);
if (err < 0) { if (err < 0) {
kfree_skb(skb); kfree_skb(skb);
@ -1125,7 +1122,6 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
struct netlink_callback *cb) struct netlink_callback *cb)
{ {
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
const struct nft_af_info *afi;
const struct nft_table *table; const struct nft_table *table;
const struct nft_chain *chain; const struct nft_chain *chain;
unsigned int idx = 0, s_idx = cb->args[0]; unsigned int idx = 0, s_idx = cb->args[0];
@ -1135,11 +1131,10 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
rcu_read_lock(); rcu_read_lock();
cb->seq = net->nft.base_seq; cb->seq = net->nft.base_seq;
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
if (family != NFPROTO_UNSPEC && family != afi->family) if (family != NFPROTO_UNSPEC && family != table->afi->family)
continue; continue;
list_for_each_entry_rcu(table, &afi->tables, list) {
list_for_each_entry_rcu(chain, &table->chains, list) { list_for_each_entry_rcu(chain, &table->chains, list) {
if (idx < s_idx) if (idx < s_idx)
goto cont; goto cont;
@ -1153,7 +1148,8 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
cb->nlh->nlmsg_seq, cb->nlh->nlmsg_seq,
NFT_MSG_NEWCHAIN, NFT_MSG_NEWCHAIN,
NLM_F_MULTI, NLM_F_MULTI,
afi->family, table, chain) < 0) table->afi->family, table,
chain) < 0)
goto done; goto done;
nl_dump_check_consistent(cb, nlmsg_hdr(skb)); nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@ -1161,7 +1157,6 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
idx++; idx++;
} }
} }
}
done: done:
rcu_read_unlock(); rcu_read_unlock();
cb->args[0] = idx; cb->args[0] = idx;
@ -1193,7 +1188,8 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -1301,8 +1297,8 @@ struct nft_chain_hook {
static int nft_chain_parse_hook(struct net *net, static int nft_chain_parse_hook(struct net *net,
const struct nlattr * const nla[], const struct nlattr * const nla[],
struct nft_af_info *afi, struct nft_chain_hook *hook, u8 family,
struct nft_chain_hook *hook, bool create) bool create)
{ {
struct nlattr *ha[NFTA_HOOK_MAX + 1]; struct nlattr *ha[NFTA_HOOK_MAX + 1];
const struct nf_chain_type *type; const struct nf_chain_type *type;
@ -1321,10 +1317,10 @@ static int nft_chain_parse_hook(struct net *net,
hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT]; type = chain_type[family][NFT_CHAIN_T_DEFAULT];
if (nla[NFTA_CHAIN_TYPE]) { if (nla[NFTA_CHAIN_TYPE]) {
type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE], type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
afi->family, create); family, create);
if (IS_ERR(type)) if (IS_ERR(type))
return PTR_ERR(type); return PTR_ERR(type);
} }
@ -1341,7 +1337,7 @@ static int nft_chain_parse_hook(struct net *net,
hook->type = type; hook->type = type;
hook->dev = NULL; hook->dev = NULL;
if (afi->family == NFPROTO_NETDEV) { if (family == NFPROTO_NETDEV) {
char ifname[IFNAMSIZ]; char ifname[IFNAMSIZ];
if (!ha[NFTA_HOOK_DEV]) { if (!ha[NFTA_HOOK_DEV]) {
@ -1376,7 +1372,6 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
{ {
const struct nlattr * const *nla = ctx->nla; const struct nlattr * const *nla = ctx->nla;
struct nft_table *table = ctx->table; struct nft_table *table = ctx->table;
struct nft_af_info *afi = ctx->afi;
struct nft_base_chain *basechain; struct nft_base_chain *basechain;
struct nft_stats __percpu *stats; struct nft_stats __percpu *stats;
struct net *net = ctx->net; struct net *net = ctx->net;
@ -1390,7 +1385,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
struct nft_chain_hook hook; struct nft_chain_hook hook;
struct nf_hook_ops *ops; struct nf_hook_ops *ops;
err = nft_chain_parse_hook(net, nla, afi, &hook, create); err = nft_chain_parse_hook(net, nla, &hook, family, create);
if (err < 0) if (err < 0)
return err; return err;
@ -1483,7 +1478,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
if (!nft_is_base_chain(chain)) if (!nft_is_base_chain(chain))
return -EBUSY; return -EBUSY;
err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook, err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
create); create);
if (err < 0) if (err < 0)
return err; return err;
@ -1576,7 +1571,8 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -1616,7 +1612,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
} }
} }
nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
if (chain != NULL) { if (chain != NULL) {
if (nlh->nlmsg_flags & NLM_F_EXCL) if (nlh->nlmsg_flags & NLM_F_EXCL)
@ -1650,7 +1646,8 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -1662,7 +1659,7 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk,
chain->use > 0) chain->use > 0)
return -EBUSY; return -EBUSY;
nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
use = chain->use; use = chain->use;
list_for_each_entry(rule, &chain->rules, list) { list_for_each_entry(rule, &chain->rules, list) {
@ -1827,7 +1824,7 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx,
if (err < 0) if (err < 0)
return err; return err;
type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]); type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
if (IS_ERR(type)) if (IS_ERR(type))
return PTR_ERR(type); return PTR_ERR(type);
@ -2050,7 +2047,7 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx,
goto err; goto err;
err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
event, 0, ctx->afi->family, ctx->table, event, 0, ctx->family, ctx->table,
ctx->chain, rule); ctx->chain, rule);
if (err < 0) { if (err < 0) {
kfree_skb(skb); kfree_skb(skb);
@ -2074,7 +2071,6 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
{ {
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
const struct nft_rule_dump_ctx *ctx = cb->data; const struct nft_rule_dump_ctx *ctx = cb->data;
const struct nft_af_info *afi;
const struct nft_table *table; const struct nft_table *table;
const struct nft_chain *chain; const struct nft_chain *chain;
const struct nft_rule *rule; const struct nft_rule *rule;
@ -2085,13 +2081,11 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
rcu_read_lock(); rcu_read_lock();
cb->seq = net->nft.base_seq; cb->seq = net->nft.base_seq;
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
if (family != NFPROTO_UNSPEC && family != afi->family) if (family != NFPROTO_UNSPEC && family != table->afi->family)
continue; continue;
list_for_each_entry_rcu(table, &afi->tables, list) { if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
if (ctx && ctx->table &&
strcmp(ctx->table, table->name) != 0)
continue; continue;
list_for_each_entry_rcu(chain, &table->chains, list) { list_for_each_entry_rcu(chain, &table->chains, list) {
@ -2111,7 +2105,8 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
cb->nlh->nlmsg_seq, cb->nlh->nlmsg_seq,
NFT_MSG_NEWRULE, NFT_MSG_NEWRULE,
NLM_F_MULTI | NLM_F_APPEND, NLM_F_MULTI | NLM_F_APPEND,
afi->family, table, chain, rule) < 0) table->afi->family,
table, chain, rule) < 0)
goto done; goto done;
nl_dump_check_consistent(cb, nlmsg_hdr(skb)); nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@ -2120,7 +2115,6 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
} }
} }
} }
}
done: done:
rcu_read_unlock(); rcu_read_unlock();
@ -2195,7 +2189,8 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -2272,7 +2267,8 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -2311,7 +2307,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
return PTR_ERR(old_rule); return PTR_ERR(old_rule);
} }
nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
n = 0; n = 0;
size = 0; size = 0;
@ -2446,7 +2442,8 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -2457,7 +2454,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,
return PTR_ERR(chain); return PTR_ERR(chain);
} }
nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
if (chain) { if (chain) {
if (nla[NFTA_RULE_HANDLE]) { if (nla[NFTA_RULE_HANDLE]) {
@ -2650,13 +2647,13 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
if (afi == NULL) if (afi == NULL)
return -EAFNOSUPPORT; return -EAFNOSUPPORT;
table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
genmask); afi->family, genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
} }
nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
return 0; return 0;
} }
@ -2783,7 +2780,7 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
goto nla_put_failure; goto nla_put_failure;
nfmsg = nlmsg_data(nlh); nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = ctx->afi->family; nfmsg->nfgen_family = ctx->family;
nfmsg->version = NFNETLINK_V0; nfmsg->version = NFNETLINK_V0;
nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
@ -2875,10 +2872,8 @@ static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
{ {
const struct nft_set *set; const struct nft_set *set;
unsigned int idx, s_idx = cb->args[0]; unsigned int idx, s_idx = cb->args[0];
struct nft_af_info *afi;
struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
int cur_family = cb->args[3];
struct nft_ctx *ctx = cb->data, ctx_set; struct nft_ctx *ctx = cb->data, ctx_set;
if (cb->args[1]) if (cb->args[1])
@ -2887,17 +2882,11 @@ static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
rcu_read_lock(); rcu_read_lock();
cb->seq = net->nft.base_seq; cb->seq = net->nft.base_seq;
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
if (ctx->afi && ctx->afi != afi) if (ctx->family != NFPROTO_UNSPEC &&
ctx->family != table->afi->family)
continue; continue;
if (cur_family) {
if (afi->family != cur_family)
continue;
cur_family = 0;
}
list_for_each_entry_rcu(table, &afi->tables, list) {
if (ctx->table && ctx->table != table) if (ctx->table && ctx->table != table)
continue; continue;
@ -2916,13 +2905,13 @@ static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
ctx_set = *ctx; ctx_set = *ctx;
ctx_set.table = table; ctx_set.table = table;
ctx_set.afi = afi; ctx_set.family = table->afi->family;
if (nf_tables_fill_set(skb, &ctx_set, set, if (nf_tables_fill_set(skb, &ctx_set, set,
NFT_MSG_NEWSET, NFT_MSG_NEWSET,
NLM_F_MULTI) < 0) { NLM_F_MULTI) < 0) {
cb->args[0] = idx; cb->args[0] = idx;
cb->args[2] = (unsigned long) table; cb->args[2] = (unsigned long) table;
cb->args[3] = afi->family;
goto done; goto done;
} }
nl_dump_check_consistent(cb, nlmsg_hdr(skb)); nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@ -2932,7 +2921,6 @@ static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
if (s_idx) if (s_idx)
s_idx = 0; s_idx = 0;
} }
}
cb->args[1] = 1; cb->args[1] = 1;
done: done:
rcu_read_unlock(); rcu_read_unlock();
@ -3141,11 +3129,12 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask); set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
if (IS_ERR(set)) { if (IS_ERR(set)) {
@ -3410,12 +3399,12 @@ static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE], table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
genmask); afi->family, genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
return 0; return 0;
} }
@ -3520,7 +3509,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
{ {
struct nft_set_dump_ctx *dump_ctx = cb->data; struct nft_set_dump_ctx *dump_ctx = cb->data;
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
struct nft_af_info *afi;
struct nft_table *table; struct nft_table *table;
struct nft_set *set; struct nft_set *set;
struct nft_set_dump_args args; struct nft_set_dump_args args;
@ -3532,11 +3520,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
int event; int event;
rcu_read_lock(); rcu_read_lock();
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
if (afi != dump_ctx->ctx.afi) if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
dump_ctx->ctx.family != table->afi->family)
continue; continue;
list_for_each_entry_rcu(table, &afi->tables, list) {
if (table != dump_ctx->ctx.table) if (table != dump_ctx->ctx.table)
continue; continue;
@ -3548,8 +3536,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
} }
break; break;
} }
break;
}
if (!set_found) { if (!set_found) {
rcu_read_unlock(); rcu_read_unlock();
@ -3566,7 +3552,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
goto nla_put_failure; goto nla_put_failure;
nfmsg = nlmsg_data(nlh); nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = afi->family; nfmsg->nfgen_family = table->afi->family;
nfmsg->version = NFNETLINK_V0; nfmsg->version = NFNETLINK_V0;
nfmsg->res_id = htons(net->nft.base_seq & 0xffff); nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
@ -3629,7 +3615,7 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb,
goto nla_put_failure; goto nla_put_failure;
nfmsg = nlmsg_data(nlh); nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = ctx->afi->family; nfmsg->nfgen_family = ctx->family;
nfmsg->version = NFNETLINK_V0; nfmsg->version = NFNETLINK_V0;
nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
@ -3986,7 +3972,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
list_for_each_entry(binding, &set->bindings, list) { list_for_each_entry(binding, &set->bindings, list) {
struct nft_ctx bind_ctx = { struct nft_ctx bind_ctx = {
.net = ctx->net, .net = ctx->net,
.afi = ctx->afi, .family = ctx->family,
.table = ctx->table, .table = ctx->table,
.chain = (struct nft_chain *)binding->chain, .chain = (struct nft_chain *)binding->chain,
}; };
@ -4533,7 +4519,8 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -4551,7 +4538,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
return 0; return 0;
} }
nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
type = nft_obj_type_get(objtype); type = nft_obj_type_get(objtype);
if (IS_ERR(type)) if (IS_ERR(type))
@ -4628,7 +4615,6 @@ struct nft_obj_filter {
static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
{ {
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
const struct nft_af_info *afi;
const struct nft_table *table; const struct nft_table *table;
unsigned int idx = 0, s_idx = cb->args[0]; unsigned int idx = 0, s_idx = cb->args[0];
struct nft_obj_filter *filter = cb->data; struct nft_obj_filter *filter = cb->data;
@ -4643,11 +4629,10 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
rcu_read_lock(); rcu_read_lock();
cb->seq = net->nft.base_seq; cb->seq = net->nft.base_seq;
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
if (family != NFPROTO_UNSPEC && family != afi->family) if (family != NFPROTO_UNSPEC && family != table->afi->family)
continue; continue;
list_for_each_entry_rcu(table, &afi->tables, list) {
list_for_each_entry_rcu(obj, &table->objects, list) { list_for_each_entry_rcu(obj, &table->objects, list) {
if (!nft_is_active(net, obj)) if (!nft_is_active(net, obj))
goto cont; goto cont;
@ -4668,7 +4653,8 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
cb->nlh->nlmsg_seq, cb->nlh->nlmsg_seq,
NFT_MSG_NEWOBJ, NFT_MSG_NEWOBJ,
NLM_F_MULTI | NLM_F_APPEND, NLM_F_MULTI | NLM_F_APPEND,
afi->family, table, obj, reset) < 0) table->afi->family, table,
obj, reset) < 0)
goto done; goto done;
nl_dump_check_consistent(cb, nlmsg_hdr(skb)); nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@ -4676,7 +4662,6 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
idx++; idx++;
} }
} }
}
done: done:
rcu_read_unlock(); rcu_read_unlock();
@ -4761,7 +4746,8 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -4821,7 +4807,8 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -4832,7 +4819,7 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk,
if (obj->use > 0) if (obj->use > 0)
return -EBUSY; return -EBUSY;
nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
return nft_delobj(&ctx, obj); return nft_delobj(&ctx, obj);
} }
@ -4870,7 +4857,7 @@ static void nf_tables_obj_notify(const struct nft_ctx *ctx,
struct nft_object *obj, int event) struct nft_object *obj, int event)
{ {
nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
ctx->afi->family, ctx->report, GFP_KERNEL); ctx->family, ctx->report, GFP_KERNEL);
} }
/* /*
@ -5060,7 +5047,7 @@ void nft_flow_table_iterate(struct net *net,
rcu_read_lock(); rcu_read_lock();
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
list_for_each_entry_rcu(table, &afi->tables, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
list_for_each_entry_rcu(flowtable, &table->flowtables, list) { list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
iter(&flowtable->data, data); iter(&flowtable->data, data);
} }
@ -5108,7 +5095,8 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
afi->family, genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -5125,7 +5113,7 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
return 0; return 0;
} }
nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL); flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
if (!flowtable) if (!flowtable)
@ -5206,7 +5194,8 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
afi->family, genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -5217,7 +5206,7 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
if (flowtable->use > 0) if (flowtable->use > 0)
return -EBUSY; return -EBUSY;
nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
return nft_delflowtable(&ctx, flowtable); return nft_delflowtable(&ctx, flowtable);
} }
@ -5286,17 +5275,15 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
int family = nfmsg->nfgen_family; int family = nfmsg->nfgen_family;
struct nft_flowtable *flowtable; struct nft_flowtable *flowtable;
const struct nft_af_info *afi;
const struct nft_table *table; const struct nft_table *table;
rcu_read_lock(); rcu_read_lock();
cb->seq = net->nft.base_seq; cb->seq = net->nft.base_seq;
list_for_each_entry_rcu(afi, &net->nft.af_info, list) { list_for_each_entry_rcu(table, &net->nft.tables, list) {
if (family != NFPROTO_UNSPEC && family != afi->family) if (family != NFPROTO_UNSPEC && family != table->afi->family)
continue; continue;
list_for_each_entry_rcu(table, &afi->tables, list) {
list_for_each_entry_rcu(flowtable, &table->flowtables, list) { list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
if (!nft_is_active(net, flowtable)) if (!nft_is_active(net, flowtable))
goto cont; goto cont;
@ -5313,7 +5300,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
cb->nlh->nlmsg_seq, cb->nlh->nlmsg_seq,
NFT_MSG_NEWFLOWTABLE, NFT_MSG_NEWFLOWTABLE,
NLM_F_MULTI | NLM_F_APPEND, NLM_F_MULTI | NLM_F_APPEND,
afi->family, flowtable) < 0) table->afi->family, flowtable) < 0)
goto done; goto done;
nl_dump_check_consistent(cb, nlmsg_hdr(skb)); nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@ -5321,7 +5308,6 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
idx++; idx++;
} }
} }
}
done: done:
rcu_read_unlock(); rcu_read_unlock();
@ -5402,7 +5388,8 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
if (IS_ERR(afi)) if (IS_ERR(afi))
return PTR_ERR(afi); return PTR_ERR(afi);
table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
afi->family, genmask);
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
@ -5445,7 +5432,7 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
ctx->seq, event, 0, ctx->seq, event, 0,
ctx->afi->family, flowtable); ctx->family, flowtable);
if (err < 0) { if (err < 0) {
kfree_skb(skb); kfree_skb(skb);
goto err; goto err;
@ -5523,19 +5510,16 @@ static int nf_tables_flowtable_event(struct notifier_block *this,
struct net_device *dev = netdev_notifier_info_to_dev(ptr); struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct nft_flowtable *flowtable; struct nft_flowtable *flowtable;
struct nft_table *table; struct nft_table *table;
struct nft_af_info *afi;
if (event != NETDEV_UNREGISTER) if (event != NETDEV_UNREGISTER)
return 0; return 0;
nfnl_lock(NFNL_SUBSYS_NFTABLES); nfnl_lock(NFNL_SUBSYS_NFTABLES);
list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) { list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
list_for_each_entry(table, &afi->tables, list) {
list_for_each_entry(flowtable, &table->flowtables, list) { list_for_each_entry(flowtable, &table->flowtables, list) {
nft_flowtable_event(event, dev, flowtable); nft_flowtable_event(event, dev, flowtable);
} }
} }
}
nfnl_unlock(NFNL_SUBSYS_NFTABLES); nfnl_unlock(NFNL_SUBSYS_NFTABLES);
return NOTIFY_DONE; return NOTIFY_DONE;
@ -6552,6 +6536,7 @@ EXPORT_SYMBOL_GPL(nft_data_dump);
static int __net_init nf_tables_init_net(struct net *net) static int __net_init nf_tables_init_net(struct net *net)
{ {
INIT_LIST_HEAD(&net->nft.af_info); INIT_LIST_HEAD(&net->nft.af_info);
INIT_LIST_HEAD(&net->nft.tables);
INIT_LIST_HEAD(&net->nft.commit_list); INIT_LIST_HEAD(&net->nft.commit_list);
net->nft.base_seq = 1; net->nft.base_seq = 1;
return 0; return 0;
@ -6594,10 +6579,10 @@ static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
struct nft_set *set, *ns; struct nft_set *set, *ns;
struct nft_ctx ctx = { struct nft_ctx ctx = {
.net = net, .net = net,
.afi = afi, .family = afi->family,
}; };
list_for_each_entry_safe(table, nt, &afi->tables, list) { list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
list_for_each_entry(chain, &table->chains, list) list_for_each_entry(chain, &table->chains, list)
nf_tables_unregister_hook(net, table, chain); nf_tables_unregister_hook(net, table, chain);
list_for_each_entry(flowtable, &table->flowtables, list) list_for_each_entry(flowtable, &table->flowtables, list)

9
net/netfilter/nf_tables_netdev.c
View file

@ -107,7 +107,6 @@ static int nf_tables_netdev_event(struct notifier_block *this,
unsigned long event, void *ptr) unsigned long event, void *ptr)
{ {
struct net_device *dev = netdev_notifier_info_to_dev(ptr); struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct nft_af_info *afi;
struct nft_table *table; struct nft_table *table;
struct nft_chain *chain, *nr; struct nft_chain *chain, *nr;
struct nft_ctx ctx = { struct nft_ctx ctx = {
@ -119,12 +118,11 @@ static int nf_tables_netdev_event(struct notifier_block *this,
return NOTIFY_DONE; return NOTIFY_DONE;
nfnl_lock(NFNL_SUBSYS_NFTABLES); nfnl_lock(NFNL_SUBSYS_NFTABLES);
list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) { list_for_each_entry(table, &ctx.net->nft.tables, list) {
ctx.afi = afi; if (table->afi->family != NFPROTO_NETDEV)
if (afi->family != NFPROTO_NETDEV)
continue; continue;
list_for_each_entry(table, &afi->tables, list) { ctx.family = table->afi->family;
ctx.table = table; ctx.table = table;
list_for_each_entry_safe(chain, nr, &table->chains, list) { list_for_each_entry_safe(chain, nr, &table->chains, list) {
if (!nft_is_base_chain(chain)) if (!nft_is_base_chain(chain))
@ -134,7 +132,6 @@ static int nf_tables_netdev_event(struct notifier_block *this,
nft_netdev_event(event, dev, &ctx); nft_netdev_event(event, dev, &ctx);
} }
} }
}
nfnl_unlock(NFNL_SUBSYS_NFTABLES); nfnl_unlock(NFNL_SUBSYS_NFTABLES);
return NOTIFY_DONE; return NOTIFY_DONE;

16
net/netfilter/nft_compat.c
View file

@ -144,7 +144,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
{ {
par->net = ctx->net; par->net = ctx->net;
par->table = ctx->table->name; par->table = ctx->table->name;
switch (ctx->afi->family) { switch (ctx->family) {
case AF_INET: case AF_INET:
entry->e4.ip.proto = proto; entry->e4.ip.proto = proto;
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
@ -175,7 +175,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
} else { } else {
par->hook_mask = 0; par->hook_mask = 0;
} }
par->family = ctx->afi->family; par->family = ctx->family;
par->nft_compat = true; par->nft_compat = true;
} }
@ -267,7 +267,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
par.net = ctx->net; par.net = ctx->net;
par.target = target; par.target = target;
par.targinfo = info; par.targinfo = info;
par.family = ctx->afi->family; par.family = ctx->family;
if (par.target->destroy != NULL) if (par.target->destroy != NULL)
par.target->destroy(&par); par.target->destroy(&par);
@ -358,7 +358,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
{ {
par->net = ctx->net; par->net = ctx->net;
par->table = ctx->table->name; par->table = ctx->table->name;
switch (ctx->afi->family) { switch (ctx->family) {
case AF_INET: case AF_INET:
entry->e4.ip.proto = proto; entry->e4.ip.proto = proto;
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
@ -389,7 +389,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
} else { } else {
par->hook_mask = 0; par->hook_mask = 0;
} }
par->family = ctx->afi->family; par->family = ctx->family;
par->nft_compat = true; par->nft_compat = true;
} }
@ -446,7 +446,7 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
par.net = ctx->net; par.net = ctx->net;
par.match = match; par.match = match;
par.matchinfo = info; par.matchinfo = info;
par.family = ctx->afi->family; par.family = ctx->family;
if (par.match->destroy != NULL) if (par.match->destroy != NULL)
par.match->destroy(&par); par.match->destroy(&par);
@ -648,7 +648,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
mt_name = nla_data(tb[NFTA_MATCH_NAME]); mt_name = nla_data(tb[NFTA_MATCH_NAME]);
rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
family = ctx->afi->family; family = ctx->family;
/* Re-use the existing match if it's already loaded. */ /* Re-use the existing match if it's already loaded. */
list_for_each_entry(nft_match, &nft_match_list, head) { list_for_each_entry(nft_match, &nft_match_list, head) {
@ -733,7 +733,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
tg_name = nla_data(tb[NFTA_TARGET_NAME]); tg_name = nla_data(tb[NFTA_TARGET_NAME]);
rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
family = ctx->afi->family; family = ctx->family;
/* Re-use the existing target if it's already loaded. */ /* Re-use the existing target if it's already loaded. */
list_for_each_entry(nft_target, &nft_target_list, head) { list_for_each_entry(nft_target, &nft_target_list, head) {

16
net/netfilter/nft_ct.c
View file

@ -405,7 +405,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
if (tb[NFTA_CT_DIRECTION] == NULL) if (tb[NFTA_CT_DIRECTION] == NULL)
return -EINVAL; return -EINVAL;
switch (ctx->afi->family) { switch (ctx->family) {
case NFPROTO_IPV4: case NFPROTO_IPV4:
len = FIELD_SIZEOF(struct nf_conntrack_tuple, len = FIELD_SIZEOF(struct nf_conntrack_tuple,
src.u3.ip); src.u3.ip);
@ -456,7 +456,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
if (err < 0) if (err < 0)
return err; return err;
err = nf_ct_netns_get(ctx->net, ctx->afi->family); err = nf_ct_netns_get(ctx->net, ctx->family);
if (err < 0) if (err < 0)
return err; return err;
@ -550,7 +550,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
if (err < 0) if (err < 0)
goto err1; goto err1;
err = nf_ct_netns_get(ctx->net, ctx->afi->family); err = nf_ct_netns_get(ctx->net, ctx->family);
if (err < 0) if (err < 0)
goto err1; goto err1;
@ -564,7 +564,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
static void nft_ct_get_destroy(const struct nft_ctx *ctx, static void nft_ct_get_destroy(const struct nft_ctx *ctx,
const struct nft_expr *expr) const struct nft_expr *expr)
{ {
nf_ct_netns_put(ctx->net, ctx->afi->family); nf_ct_netns_put(ctx->net, ctx->family);
} }
static void nft_ct_set_destroy(const struct nft_ctx *ctx, static void nft_ct_set_destroy(const struct nft_ctx *ctx,
@ -573,7 +573,7 @@ static void nft_ct_set_destroy(const struct nft_ctx *ctx,
struct nft_ct *priv = nft_expr_priv(expr); struct nft_ct *priv = nft_expr_priv(expr);
__nft_ct_set_destroy(ctx, priv); __nft_ct_set_destroy(ctx, priv);
nf_ct_netns_put(ctx->net, ctx->afi->family); nf_ct_netns_put(ctx->net, ctx->family);
} }
static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr) static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
@ -734,7 +734,7 @@ static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
struct nft_ct_helper_obj *priv = nft_obj_data(obj); struct nft_ct_helper_obj *priv = nft_obj_data(obj);
struct nf_conntrack_helper *help4, *help6; struct nf_conntrack_helper *help4, *help6;
char name[NF_CT_HELPER_NAME_LEN]; char name[NF_CT_HELPER_NAME_LEN];
int family = ctx->afi->family; int family = ctx->family;
if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO]) if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
return -EINVAL; return -EINVAL;
@ -753,14 +753,14 @@ static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
switch (family) { switch (family) {
case NFPROTO_IPV4: case NFPROTO_IPV4:
if (ctx->afi->family == NFPROTO_IPV6) if (ctx->family == NFPROTO_IPV6)
return -EINVAL; return -EINVAL;
help4 = nf_conntrack_helper_try_module_get(name, family, help4 = nf_conntrack_helper_try_module_get(name, family,
priv->l4proto); priv->l4proto);
break; break;
case NFPROTO_IPV6: case NFPROTO_IPV6:
if (ctx->afi->family == NFPROTO_IPV4) if (ctx->family == NFPROTO_IPV4)
return -EINVAL; return -EINVAL;
help6 = nf_conntrack_helper_try_module_get(name, family, help6 = nf_conntrack_helper_try_module_get(name, family,

4
net/netfilter/nft_flow_offload.c
View file

@ -151,7 +151,7 @@ static int nft_flow_offload_init(const struct nft_ctx *ctx,
priv->flowtable = flowtable; priv->flowtable = flowtable;
flowtable->use++; flowtable->use++;
return nf_ct_netns_get(ctx->net, ctx->afi->family); return nf_ct_netns_get(ctx->net, ctx->family);
} }
static void nft_flow_offload_destroy(const struct nft_ctx *ctx, static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
@ -160,7 +160,7 @@ static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
struct nft_flow_offload *priv = nft_expr_priv(expr); struct nft_flow_offload *priv = nft_expr_priv(expr);
priv->flowtable->use--; priv->flowtable->use--;
nf_ct_netns_put(ctx->net, ctx->afi->family); nf_ct_netns_put(ctx->net, ctx->family);
} }
static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr) static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr)

4
net/netfilter/nft_log.c
View file

@ -112,7 +112,7 @@ static int nft_log_init(const struct nft_ctx *ctx,
break; break;
} }
err = nf_logger_find_get(ctx->afi->family, li->type); err = nf_logger_find_get(ctx->family, li->type);
if (err < 0) if (err < 0)
goto err1; goto err1;
@ -133,7 +133,7 @@ static void nft_log_destroy(const struct nft_ctx *ctx,
if (priv->prefix != nft_log_null_prefix) if (priv->prefix != nft_log_null_prefix)
kfree(priv->prefix); kfree(priv->prefix);
nf_logger_put(ctx->afi->family, li->type); nf_logger_put(ctx->family, li->type);
} }
static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr) static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)

2
net/netfilter/nft_masq.c
View file

@ -73,7 +73,7 @@ int nft_masq_init(const struct nft_ctx *ctx,
} }
} }
return nf_ct_netns_get(ctx->net, ctx->afi->family); return nf_ct_netns_get(ctx->net, ctx->family);
} }
EXPORT_SYMBOL_GPL(nft_masq_init); EXPORT_SYMBOL_GPL(nft_masq_init);

4
net/netfilter/nft_meta.c
View file

@ -339,7 +339,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx,
if (priv->key != NFT_META_SECPATH) if (priv->key != NFT_META_SECPATH)
return 0; return 0;
switch (ctx->afi->family) { switch (ctx->family) {
case NFPROTO_NETDEV: case NFPROTO_NETDEV:
hooks = 1 << NF_NETDEV_INGRESS; hooks = 1 << NF_NETDEV_INGRESS;
break; break;
@ -370,7 +370,7 @@ int nft_meta_set_validate(const struct nft_ctx *ctx,
if (priv->key != NFT_META_PKTTYPE) if (priv->key != NFT_META_PKTTYPE)
return 0; return 0;
switch (ctx->afi->family) { switch (ctx->family) {
case NFPROTO_BRIDGE: case NFPROTO_BRIDGE:
hooks = 1 << NF_BR_PRE_ROUTING; hooks = 1 << NF_BR_PRE_ROUTING;
break; break;

2
net/netfilter/nft_nat.c
View file

@ -142,7 +142,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
return -EINVAL; return -EINVAL;
family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY])); family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
if (family != ctx->afi->family) if (family != ctx->family)
return -EOPNOTSUPP; return -EOPNOTSUPP;
switch (family) { switch (family) {

2
net/netfilter/nft_redir.c
View file

@ -75,7 +75,7 @@ int nft_redir_init(const struct nft_ctx *ctx,
return -EINVAL; return -EINVAL;
} }
return nf_ct_netns_get(ctx->net, ctx->afi->family); return nf_ct_netns_get(ctx->net, ctx->family);
} }
EXPORT_SYMBOL_GPL(nft_redir_init); EXPORT_SYMBOL_GPL(nft_redir_init);