Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

[uclinux-h8/linux.git] / net / netfilter / nf_tables_api.c

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 34ded09..cfe6368 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -127,13 +127,46 @@ static void nft_trans_destroy(struct nft_trans *trans)
        kfree(trans);
 }
 
+int nft_register_basechain(struct nft_base_chain *basechain,
+                          unsigned int hook_nops)
+{
+       if (basechain->flags & NFT_BASECHAIN_DISABLED)
+               return 0;
+
+       return nf_register_hooks(basechain->ops, hook_nops);
+}
+EXPORT_SYMBOL_GPL(nft_register_basechain);
+
+void nft_unregister_basechain(struct nft_base_chain *basechain,
+                             unsigned int hook_nops)
+{
+       if (basechain->flags & NFT_BASECHAIN_DISABLED)
+               return;
+
+       nf_unregister_hooks(basechain->ops, hook_nops);
+}
+EXPORT_SYMBOL_GPL(nft_unregister_basechain);
+
+static int nf_tables_register_hooks(const struct nft_table *table,
+                                   struct nft_chain *chain,
+                                   unsigned int hook_nops)
+{
+       if (table->flags & NFT_TABLE_F_DORMANT ||
+           !(chain->flags & NFT_BASE_CHAIN))
+               return 0;
+
+       return nft_register_basechain(nft_base_chain(chain), hook_nops);
+}
+
 static void nf_tables_unregister_hooks(const struct nft_table *table,
-                                      const struct nft_chain *chain,
+                                      struct nft_chain *chain,
                                       unsigned int hook_nops)
 {
-       if (!(table->flags & NFT_TABLE_F_DORMANT) &&
-           chain->flags & NFT_BASE_CHAIN)
-               nf_unregister_hooks(nft_base_chain(chain)->ops, hook_nops);
+       if (table->flags & NFT_TABLE_F_DORMANT ||
+           !(chain->flags & NFT_BASE_CHAIN))
+               return;
+
+       nft_unregister_basechain(nft_base_chain(chain), hook_nops);
 }
 
 /* Internal table flags */
@@ -560,7 +593,7 @@ static int nf_tables_table_enable(const struct nft_af_info *afi,
                if (!(chain->flags & NFT_BASE_CHAIN))
                        continue;
 
-               err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
+               err = nft_register_basechain(nft_base_chain(chain), afi->nops);
                if (err < 0)
                        goto err;
 
@@ -575,20 +608,20 @@ err:
                if (i-- <= 0)
                        break;
 
-               nf_unregister_hooks(nft_base_chain(chain)->ops, afi->nops);
+               nft_unregister_basechain(nft_base_chain(chain), afi->nops);
        }
        return err;
 }
 
 static void nf_tables_table_disable(const struct nft_af_info *afi,
-                                  struct nft_table *table)
+                                   struct nft_table *table)
 {
        struct nft_chain *chain;
 
        list_for_each_entry(chain, &table->chains, list) {
                if (chain->flags & NFT_BASE_CHAIN)
-                       nf_unregister_hooks(nft_base_chain(chain)->ops,
-                                           afi->nops);
+                       nft_unregister_basechain(nft_base_chain(chain),
+                                                afi->nops);
        }
 }
 
@@ -679,13 +712,14 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
                        return -EINVAL;
        }
 
+       err = -EAFNOSUPPORT;
        if (!try_module_get(afi->owner))
-               return -EAFNOSUPPORT;
+               goto err1;
 
        err = -ENOMEM;
        table = kzalloc(sizeof(*table), GFP_KERNEL);
        if (table == NULL)
-               goto err1;
+               goto err2;
 
        nla_strlcpy(table->name, name, NFT_TABLE_MAXNAMELEN);
        INIT_LIST_HEAD(&table->chains);
@@ -695,14 +729,15 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
        nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
        err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
        if (err < 0)
-               goto err2;
+               goto err3;
 
        list_add_tail_rcu(&table->list, &afi->tables);
        return 0;
-err2:
+err3:
        kfree(table);
-err1:
+err2:
        module_put(afi->owner);
+err1:
        return err;
 }
 
@@ -881,6 +916,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
        [NFTA_HOOK_HOOKNUM]     = { .type = NLA_U32 },
        [NFTA_HOOK_PRIORITY]    = { .type = NLA_U32 },
+       [NFTA_HOOK_DEV]         = { .type = NLA_STRING,
+                                   .len = IFNAMSIZ - 1 },
 };
 
 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
@@ -954,6 +991,9 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
                        goto nla_put_failure;
                if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
                        goto nla_put_failure;
+               if (basechain->dev_name[0] &&
+                   nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
+                       goto nla_put_failure;
                nla_nest_end(skb, nest);
 
                if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
@@ -1165,9 +1205,13 @@ static void nf_tables_chain_destroy(struct nft_chain *chain)
        BUG_ON(chain->use > 0);
 
        if (chain->flags & NFT_BASE_CHAIN) {
-               module_put(nft_base_chain(chain)->type->owner);
-               free_percpu(nft_base_chain(chain)->stats);
-               kfree(nft_base_chain(chain));
+               struct nft_base_chain *basechain = nft_base_chain(chain);
+
+               module_put(basechain->type->owner);
+               free_percpu(basechain->stats);
+               if (basechain->ops[0].dev != NULL)
+                       dev_put(basechain->ops[0].dev);
+               kfree(basechain);
        } else {
                kfree(chain);
        }
@@ -1186,6 +1230,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
        struct nlattr *ha[NFTA_HOOK_MAX + 1];
        struct net *net = sock_net(skb->sk);
        int family = nfmsg->nfgen_family;
+       struct net_device *dev = NULL;
        u8 policy = NF_ACCEPT;
        u64 handle = 0;
        unsigned int i;
@@ -1325,17 +1370,43 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                        return -ENOENT;
                hookfn = type->hooks[hooknum];
 
+               if (afi->flags & NFT_AF_NEEDS_DEV) {
+                       char ifname[IFNAMSIZ];
+
+                       if (!ha[NFTA_HOOK_DEV]) {
+                               module_put(type->owner);
+                               return -EOPNOTSUPP;
+                       }
+
+                       nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
+                       dev = dev_get_by_name(net, ifname);
+                       if (!dev) {
+                               module_put(type->owner);
+                               return -ENOENT;
+                       }
+               } else if (ha[NFTA_HOOK_DEV]) {
+                       module_put(type->owner);
+                       return -EOPNOTSUPP;
+               }
+
                basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
                if (basechain == NULL) {
                        module_put(type->owner);
+                       if (dev != NULL)
+                               dev_put(dev);
                        return -ENOMEM;
                }
 
+               if (dev != NULL)
+                       strncpy(basechain->dev_name, dev->name, IFNAMSIZ);
+
                if (nla[NFTA_CHAIN_COUNTERS]) {
                        stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
                        if (IS_ERR(stats)) {
                                module_put(type->owner);
                                kfree(basechain);
+                               if (dev != NULL)
+                                       dev_put(dev);
                                return PTR_ERR(stats);
                        }
                        basechain->stats = stats;
@@ -1344,6 +1415,8 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                        if (stats == NULL) {
                                module_put(type->owner);
                                kfree(basechain);
+                               if (dev != NULL)
+                                       dev_put(dev);
                                return -ENOMEM;
                        }
                        rcu_assign_pointer(basechain->stats, stats);
@@ -1361,6 +1434,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                        ops->priority   = priority;
                        ops->priv       = chain;
                        ops->hook       = afi->hooks[ops->hooknum];
+                       ops->dev        = dev;
                        if (hookfn)
                                ops->hook = hookfn;
                        if (afi->hook_ops_init)
@@ -1380,12 +1454,9 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
        chain->table = table;
        nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
 
-       if (!(table->flags & NFT_TABLE_F_DORMANT) &&
-           chain->flags & NFT_BASE_CHAIN) {
-               err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
-               if (err < 0)
-                       goto err1;
-       }
+       err = nf_tables_register_hooks(table, chain, afi->nops);
+       if (err < 0)
+               goto err1;
 
        nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
        err = nft_trans_chain_add(&ctx, NFT_MSG_NEWCHAIN);