Commit 1cbf9098 authored by David Wilder's avatar David Wilder Committed by Pablo Neira Ayuso
Browse files

netfilter: iptables: Split ipt_unregister_table() into pre_exit and exit helpers. 



The pre_exit will un-register the underlying hook and .exit will do the
table freeing. The netns core does an unconditional synchronize_rcu after
the pre_exit hooks insuring no packets are in flight that have picked up
the pointer before completing the un-register.

Fixes: b9e69e12 ("netfilter: xtables: don't hook tables by default")
Signed-off-by: default avatarDavid Wilder <dwilder@us.ibm.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 4cacc395

include/linux/netfilter_ipv4/ip_tables.h

+6 −0
Original line number Diff line number Diff line
@@ -25,6 +25,12 @@ 
int ipt_register_table(struct net *net, const struct xt_table *table,

		       const struct ipt_replace *repl,

		       const struct nf_hook_ops *ops, struct xt_table **res);



void ipt_unregister_table_pre_exit(struct net *net, struct xt_table *table,

		       const struct nf_hook_ops *ops);



void ipt_unregister_table_exit(struct net *net, struct xt_table *table);



void ipt_unregister_table(struct net *net, struct xt_table *table,

			  const struct nf_hook_ops *ops);

net/ipv4/netfilter/ip_tables.c

+14 −1
Original line number Diff line number Diff line
@@ -1797,11 +1797,22 @@ out_free: 
	return ret;

}



void ipt_unregister_table_pre_exit(struct net *net, struct xt_table *table,

				   const struct nf_hook_ops *ops)

{

	nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));

}



void ipt_unregister_table_exit(struct net *net, struct xt_table *table)

{

	__ipt_unregister_table(net, table);

}



void ipt_unregister_table(struct net *net, struct xt_table *table,

			  const struct nf_hook_ops *ops)

{

	if (ops)

		nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));

		ipt_unregister_table_pre_exit(net, table, ops);

	__ipt_unregister_table(net, table);

}
@@ -1958,6 +1969,8 @@ static void __exit ip_tables_fini(void) 


EXPORT_SYMBOL(ipt_register_table);

EXPORT_SYMBOL(ipt_unregister_table);

EXPORT_SYMBOL(ipt_unregister_table_pre_exit);

EXPORT_SYMBOL(ipt_unregister_table_exit);

EXPORT_SYMBOL(ipt_do_table);

module_init(ip_tables_init);

module_exit(ip_tables_fini);

CRA Git | Maintained and supported by SUSTech CRA and CCSE