netfilter: remove hook owner refcounting
since commit 8405a8fff3
("netfilter: nf_qeueue: Drop queue entries on
nf_unregister_hook") all pending queued entries are discarded.
So we can simply remove all of the owner handling -- when module is
removed it also needs to unregister all its hooks.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
8cbc870829
commit
2ffbceb2b0
|
@ -90,7 +90,6 @@ struct nf_hook_ops {
|
||||||
/* User fills in from here down. */
|
/* User fills in from here down. */
|
||||||
nf_hookfn *hook;
|
nf_hookfn *hook;
|
||||||
struct net_device *dev;
|
struct net_device *dev;
|
||||||
struct module *owner;
|
|
||||||
void *priv;
|
void *priv;
|
||||||
u_int8_t pf;
|
u_int8_t pf;
|
||||||
unsigned int hooknum;
|
unsigned int hooknum;
|
||||||
|
|
|
@ -901,49 +901,42 @@ EXPORT_SYMBOL_GPL(br_netfilter_enable);
|
||||||
static struct nf_hook_ops br_nf_ops[] __read_mostly = {
|
static struct nf_hook_ops br_nf_ops[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = br_nf_pre_routing,
|
.hook = br_nf_pre_routing,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_PRE_ROUTING,
|
.hooknum = NF_BR_PRE_ROUTING,
|
||||||
.priority = NF_BR_PRI_BRNF,
|
.priority = NF_BR_PRI_BRNF,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = br_nf_local_in,
|
.hook = br_nf_local_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_LOCAL_IN,
|
.hooknum = NF_BR_LOCAL_IN,
|
||||||
.priority = NF_BR_PRI_BRNF,
|
.priority = NF_BR_PRI_BRNF,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = br_nf_forward_ip,
|
.hook = br_nf_forward_ip,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_FORWARD,
|
.hooknum = NF_BR_FORWARD,
|
||||||
.priority = NF_BR_PRI_BRNF - 1,
|
.priority = NF_BR_PRI_BRNF - 1,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = br_nf_forward_arp,
|
.hook = br_nf_forward_arp,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_FORWARD,
|
.hooknum = NF_BR_FORWARD,
|
||||||
.priority = NF_BR_PRI_BRNF,
|
.priority = NF_BR_PRI_BRNF,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = br_nf_post_routing,
|
.hook = br_nf_post_routing,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_POST_ROUTING,
|
.hooknum = NF_BR_POST_ROUTING,
|
||||||
.priority = NF_BR_PRI_LAST,
|
.priority = NF_BR_PRI_LAST,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ip_sabotage_in,
|
.hook = ip_sabotage_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP_PRI_FIRST,
|
.priority = NF_IP_PRI_FIRST,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ip_sabotage_in,
|
.hook = ip_sabotage_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP6_PRI_FIRST,
|
.priority = NF_IP6_PRI_FIRST,
|
||||||
|
|
|
@ -73,21 +73,18 @@ ebt_out_hook(void *priv, struct sk_buff *skb,
|
||||||
static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
|
static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = ebt_in_hook,
|
.hook = ebt_in_hook,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_LOCAL_IN,
|
.hooknum = NF_BR_LOCAL_IN,
|
||||||
.priority = NF_BR_PRI_FILTER_BRIDGED,
|
.priority = NF_BR_PRI_FILTER_BRIDGED,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ebt_in_hook,
|
.hook = ebt_in_hook,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_FORWARD,
|
.hooknum = NF_BR_FORWARD,
|
||||||
.priority = NF_BR_PRI_FILTER_BRIDGED,
|
.priority = NF_BR_PRI_FILTER_BRIDGED,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ebt_out_hook,
|
.hook = ebt_out_hook,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_LOCAL_OUT,
|
.hooknum = NF_BR_LOCAL_OUT,
|
||||||
.priority = NF_BR_PRI_FILTER_OTHER,
|
.priority = NF_BR_PRI_FILTER_OTHER,
|
||||||
|
|
|
@ -73,21 +73,18 @@ ebt_nat_out(void *priv, struct sk_buff *skb,
|
||||||
static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
|
static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = ebt_nat_out,
|
.hook = ebt_nat_out,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_LOCAL_OUT,
|
.hooknum = NF_BR_LOCAL_OUT,
|
||||||
.priority = NF_BR_PRI_NAT_DST_OTHER,
|
.priority = NF_BR_PRI_NAT_DST_OTHER,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ebt_nat_out,
|
.hook = ebt_nat_out,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_POST_ROUTING,
|
.hooknum = NF_BR_POST_ROUTING,
|
||||||
.priority = NF_BR_PRI_NAT_SRC,
|
.priority = NF_BR_PRI_NAT_SRC,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ebt_nat_in,
|
.hook = ebt_nat_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_BRIDGE,
|
.pf = NFPROTO_BRIDGE,
|
||||||
.hooknum = NF_BR_PRE_ROUTING,
|
.hooknum = NF_BR_PRE_ROUTING,
|
||||||
.priority = NF_BR_PRI_NAT_DST_BRIDGED,
|
.priority = NF_BR_PRI_NAT_DST_BRIDGED,
|
||||||
|
|
|
@ -437,14 +437,12 @@ static struct xt_target synproxy_tg4_reg __read_mostly = {
|
||||||
static struct nf_hook_ops ipv4_synproxy_ops[] __read_mostly = {
|
static struct nf_hook_ops ipv4_synproxy_ops[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = ipv4_synproxy_hook,
|
.hook = ipv4_synproxy_hook,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv4_synproxy_hook,
|
.hook = ipv4_synproxy_hook,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
||||||
|
|
|
@ -68,7 +68,6 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
|
||||||
/* Before packet filtering, change destination */
|
/* Before packet filtering, change destination */
|
||||||
{
|
{
|
||||||
.hook = iptable_nat_ipv4_in,
|
.hook = iptable_nat_ipv4_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP_PRI_NAT_DST,
|
.priority = NF_IP_PRI_NAT_DST,
|
||||||
|
@ -76,7 +75,6 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source */
|
/* After packet filtering, change source */
|
||||||
{
|
{
|
||||||
.hook = iptable_nat_ipv4_out,
|
.hook = iptable_nat_ipv4_out,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP_PRI_NAT_SRC,
|
.priority = NF_IP_PRI_NAT_SRC,
|
||||||
|
@ -84,7 +82,6 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
|
||||||
/* Before packet filtering, change destination */
|
/* Before packet filtering, change destination */
|
||||||
{
|
{
|
||||||
.hook = iptable_nat_ipv4_local_fn,
|
.hook = iptable_nat_ipv4_local_fn,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP_PRI_NAT_DST,
|
.priority = NF_IP_PRI_NAT_DST,
|
||||||
|
@ -92,7 +89,6 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source */
|
/* After packet filtering, change source */
|
||||||
{
|
{
|
||||||
.hook = iptable_nat_ipv4_fn,
|
.hook = iptable_nat_ipv4_fn,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP_PRI_NAT_SRC,
|
.priority = NF_IP_PRI_NAT_SRC,
|
||||||
|
|
|
@ -166,42 +166,36 @@ static unsigned int ipv4_conntrack_local(void *priv,
|
||||||
static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
|
static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = ipv4_conntrack_in,
|
.hook = ipv4_conntrack_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP_PRI_CONNTRACK,
|
.priority = NF_IP_PRI_CONNTRACK,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv4_conntrack_local,
|
.hook = ipv4_conntrack_local,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP_PRI_CONNTRACK,
|
.priority = NF_IP_PRI_CONNTRACK,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv4_helper,
|
.hook = ipv4_helper,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_HELPER,
|
.priority = NF_IP_PRI_CONNTRACK_HELPER,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv4_confirm,
|
.hook = ipv4_confirm,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_CONFIRM,
|
.priority = NF_IP_PRI_CONNTRACK_CONFIRM,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv4_helper,
|
.hook = ipv4_helper,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_HELPER,
|
.priority = NF_IP_PRI_CONNTRACK_HELPER,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv4_confirm,
|
.hook = ipv4_confirm,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_CONFIRM,
|
.priority = NF_IP_PRI_CONNTRACK_CONFIRM,
|
||||||
|
|
|
@ -94,14 +94,12 @@ static unsigned int ipv4_conntrack_defrag(void *priv,
|
||||||
static struct nf_hook_ops ipv4_defrag_ops[] = {
|
static struct nf_hook_ops ipv4_defrag_ops[] = {
|
||||||
{
|
{
|
||||||
.hook = ipv4_conntrack_defrag,
|
.hook = ipv4_conntrack_defrag,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_DEFRAG,
|
.priority = NF_IP_PRI_CONNTRACK_DEFRAG,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv4_conntrack_defrag,
|
.hook = ipv4_conntrack_defrag,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_DEFRAG,
|
.priority = NF_IP_PRI_CONNTRACK_DEFRAG,
|
||||||
|
|
|
@ -458,14 +458,12 @@ static struct xt_target synproxy_tg6_reg __read_mostly = {
|
||||||
static struct nf_hook_ops ipv6_synproxy_ops[] __read_mostly = {
|
static struct nf_hook_ops ipv6_synproxy_ops[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = ipv6_synproxy_hook,
|
.hook = ipv6_synproxy_hook,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv6_synproxy_hook,
|
.hook = ipv6_synproxy_hook,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
.priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
|
||||||
|
|
|
@ -70,7 +70,6 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
|
||||||
/* Before packet filtering, change destination */
|
/* Before packet filtering, change destination */
|
||||||
{
|
{
|
||||||
.hook = ip6table_nat_in,
|
.hook = ip6table_nat_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP6_PRI_NAT_DST,
|
.priority = NF_IP6_PRI_NAT_DST,
|
||||||
|
@ -78,7 +77,6 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source */
|
/* After packet filtering, change source */
|
||||||
{
|
{
|
||||||
.hook = ip6table_nat_out,
|
.hook = ip6table_nat_out,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP6_PRI_NAT_SRC,
|
.priority = NF_IP6_PRI_NAT_SRC,
|
||||||
|
@ -86,7 +84,6 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
|
||||||
/* Before packet filtering, change destination */
|
/* Before packet filtering, change destination */
|
||||||
{
|
{
|
||||||
.hook = ip6table_nat_local_fn,
|
.hook = ip6table_nat_local_fn,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP6_PRI_NAT_DST,
|
.priority = NF_IP6_PRI_NAT_DST,
|
||||||
|
@ -94,7 +91,6 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source */
|
/* After packet filtering, change source */
|
||||||
{
|
{
|
||||||
.hook = ip6table_nat_fn,
|
.hook = ip6table_nat_fn,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP6_PRI_NAT_SRC,
|
.priority = NF_IP6_PRI_NAT_SRC,
|
||||||
|
|
|
@ -187,42 +187,36 @@ static unsigned int ipv6_conntrack_local(void *priv,
|
||||||
static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
|
static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = ipv6_conntrack_in,
|
.hook = ipv6_conntrack_in,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP6_PRI_CONNTRACK,
|
.priority = NF_IP6_PRI_CONNTRACK,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv6_conntrack_local,
|
.hook = ipv6_conntrack_local,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP6_PRI_CONNTRACK,
|
.priority = NF_IP6_PRI_CONNTRACK,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv6_helper,
|
.hook = ipv6_helper,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP6_PRI_CONNTRACK_HELPER,
|
.priority = NF_IP6_PRI_CONNTRACK_HELPER,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv6_confirm,
|
.hook = ipv6_confirm,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP6_PRI_LAST,
|
.priority = NF_IP6_PRI_LAST,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv6_helper,
|
.hook = ipv6_helper,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP6_PRI_CONNTRACK_HELPER,
|
.priority = NF_IP6_PRI_CONNTRACK_HELPER,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv6_confirm,
|
.hook = ipv6_confirm,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP6_PRI_LAST-1,
|
.priority = NF_IP6_PRI_LAST-1,
|
||||||
|
|
|
@ -84,14 +84,12 @@ static unsigned int ipv6_defrag(void *priv,
|
||||||
static struct nf_hook_ops ipv6_defrag_ops[] = {
|
static struct nf_hook_ops ipv6_defrag_ops[] = {
|
||||||
{
|
{
|
||||||
.hook = ipv6_defrag,
|
.hook = ipv6_defrag,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_PRE_ROUTING,
|
.hooknum = NF_INET_PRE_ROUTING,
|
||||||
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
|
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ipv6_defrag,
|
.hook = ipv6_defrag,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
|
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
|
||||||
|
|
|
@ -1923,7 +1923,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source only for VS/NAT */
|
/* After packet filtering, change source only for VS/NAT */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_reply4,
|
.hook = ip_vs_reply4,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP_PRI_NAT_SRC - 2,
|
.priority = NF_IP_PRI_NAT_SRC - 2,
|
||||||
|
@ -1933,7 +1932,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
* applied to IPVS. */
|
* applied to IPVS. */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_remote_request4,
|
.hook = ip_vs_remote_request4,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP_PRI_NAT_SRC - 1,
|
.priority = NF_IP_PRI_NAT_SRC - 1,
|
||||||
|
@ -1941,7 +1939,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* Before ip_vs_in, change source only for VS/NAT */
|
/* Before ip_vs_in, change source only for VS/NAT */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_local_reply4,
|
.hook = ip_vs_local_reply4,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP_PRI_NAT_DST + 1,
|
.priority = NF_IP_PRI_NAT_DST + 1,
|
||||||
|
@ -1949,7 +1946,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* After mangle, schedule and forward local requests */
|
/* After mangle, schedule and forward local requests */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_local_request4,
|
.hook = ip_vs_local_request4,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP_PRI_NAT_DST + 2,
|
.priority = NF_IP_PRI_NAT_DST + 2,
|
||||||
|
@ -1958,7 +1954,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
* destined for 0.0.0.0/0, which is for incoming IPVS connections */
|
* destined for 0.0.0.0/0, which is for incoming IPVS connections */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_forward_icmp,
|
.hook = ip_vs_forward_icmp,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_FORWARD,
|
.hooknum = NF_INET_FORWARD,
|
||||||
.priority = 99,
|
.priority = 99,
|
||||||
|
@ -1966,7 +1961,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source only for VS/NAT */
|
/* After packet filtering, change source only for VS/NAT */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_reply4,
|
.hook = ip_vs_reply4,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_FORWARD,
|
.hooknum = NF_INET_FORWARD,
|
||||||
.priority = 100,
|
.priority = 100,
|
||||||
|
@ -1975,7 +1969,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source only for VS/NAT */
|
/* After packet filtering, change source only for VS/NAT */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_reply6,
|
.hook = ip_vs_reply6,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP6_PRI_NAT_SRC - 2,
|
.priority = NF_IP6_PRI_NAT_SRC - 2,
|
||||||
|
@ -1985,7 +1978,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
* applied to IPVS. */
|
* applied to IPVS. */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_remote_request6,
|
.hook = ip_vs_remote_request6,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_IN,
|
.hooknum = NF_INET_LOCAL_IN,
|
||||||
.priority = NF_IP6_PRI_NAT_SRC - 1,
|
.priority = NF_IP6_PRI_NAT_SRC - 1,
|
||||||
|
@ -1993,7 +1985,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* Before ip_vs_in, change source only for VS/NAT */
|
/* Before ip_vs_in, change source only for VS/NAT */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_local_reply6,
|
.hook = ip_vs_local_reply6,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP6_PRI_NAT_DST + 1,
|
.priority = NF_IP6_PRI_NAT_DST + 1,
|
||||||
|
@ -2001,7 +1992,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* After mangle, schedule and forward local requests */
|
/* After mangle, schedule and forward local requests */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_local_request6,
|
.hook = ip_vs_local_request6,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP6_PRI_NAT_DST + 2,
|
.priority = NF_IP6_PRI_NAT_DST + 2,
|
||||||
|
@ -2010,7 +2000,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
* destined for 0.0.0.0/0, which is for incoming IPVS connections */
|
* destined for 0.0.0.0/0, which is for incoming IPVS connections */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_forward_icmp_v6,
|
.hook = ip_vs_forward_icmp_v6,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_FORWARD,
|
.hooknum = NF_INET_FORWARD,
|
||||||
.priority = 99,
|
.priority = 99,
|
||||||
|
@ -2018,7 +2007,6 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
|
||||||
/* After packet filtering, change source only for VS/NAT */
|
/* After packet filtering, change source only for VS/NAT */
|
||||||
{
|
{
|
||||||
.hook = ip_vs_reply6,
|
.hook = ip_vs_reply6,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_FORWARD,
|
.hooknum = NF_INET_FORWARD,
|
||||||
.priority = 100,
|
.priority = 100,
|
||||||
|
|
|
@ -69,8 +69,6 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
|
||||||
dev_put(physdev);
|
dev_put(physdev);
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
/* Drop reference to owner of hook which queued us. */
|
|
||||||
module_put(entry->elem->owner);
|
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
|
EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
|
||||||
|
|
||||||
|
@ -79,9 +77,6 @@ bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
|
||||||
{
|
{
|
||||||
struct nf_hook_state *state = &entry->state;
|
struct nf_hook_state *state = &entry->state;
|
||||||
|
|
||||||
if (!try_module_get(entry->elem->owner))
|
|
||||||
return false;
|
|
||||||
|
|
||||||
if (state->in)
|
if (state->in)
|
||||||
dev_hold(state->in);
|
dev_hold(state->in);
|
||||||
if (state->out)
|
if (state->out)
|
||||||
|
|
|
@ -1433,7 +1433,6 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
|
||||||
for (i = 0; i < afi->nops; i++) {
|
for (i = 0; i < afi->nops; i++) {
|
||||||
ops = &basechain->ops[i];
|
ops = &basechain->ops[i];
|
||||||
ops->pf = family;
|
ops->pf = family;
|
||||||
ops->owner = afi->owner;
|
|
||||||
ops->hooknum = hooknum;
|
ops->hooknum = hooknum;
|
||||||
ops->priority = priority;
|
ops->priority = priority;
|
||||||
ops->priv = chain;
|
ops->priv = chain;
|
||||||
|
|
|
@ -1193,7 +1193,6 @@ struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn)
|
||||||
if (!(hook_mask & 1))
|
if (!(hook_mask & 1))
|
||||||
continue;
|
continue;
|
||||||
ops[i].hook = fn;
|
ops[i].hook = fn;
|
||||||
ops[i].owner = table->me;
|
|
||||||
ops[i].pf = table->af;
|
ops[i].pf = table->af;
|
||||||
ops[i].hooknum = hooknum;
|
ops[i].hooknum = hooknum;
|
||||||
ops[i].priority = table->priority;
|
ops[i].priority = table->priority;
|
||||||
|
|
|
@ -6127,21 +6127,18 @@ security_initcall(selinux_init);
|
||||||
static struct nf_hook_ops selinux_nf_ops[] = {
|
static struct nf_hook_ops selinux_nf_ops[] = {
|
||||||
{
|
{
|
||||||
.hook = selinux_ipv4_postroute,
|
.hook = selinux_ipv4_postroute,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP_PRI_SELINUX_LAST,
|
.priority = NF_IP_PRI_SELINUX_LAST,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = selinux_ipv4_forward,
|
.hook = selinux_ipv4_forward,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_FORWARD,
|
.hooknum = NF_INET_FORWARD,
|
||||||
.priority = NF_IP_PRI_SELINUX_FIRST,
|
.priority = NF_IP_PRI_SELINUX_FIRST,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = selinux_ipv4_output,
|
.hook = selinux_ipv4_output,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP_PRI_SELINUX_FIRST,
|
.priority = NF_IP_PRI_SELINUX_FIRST,
|
||||||
|
@ -6149,14 +6146,12 @@ static struct nf_hook_ops selinux_nf_ops[] = {
|
||||||
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
||||||
{
|
{
|
||||||
.hook = selinux_ipv6_postroute,
|
.hook = selinux_ipv6_postroute,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_POST_ROUTING,
|
.hooknum = NF_INET_POST_ROUTING,
|
||||||
.priority = NF_IP6_PRI_SELINUX_LAST,
|
.priority = NF_IP6_PRI_SELINUX_LAST,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = selinux_ipv6_forward,
|
.hook = selinux_ipv6_forward,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_FORWARD,
|
.hooknum = NF_INET_FORWARD,
|
||||||
.priority = NF_IP6_PRI_SELINUX_FIRST,
|
.priority = NF_IP6_PRI_SELINUX_FIRST,
|
||||||
|
|
|
@ -57,7 +57,6 @@ static unsigned int smack_ipv4_output(void *priv,
|
||||||
static struct nf_hook_ops smack_nf_ops[] = {
|
static struct nf_hook_ops smack_nf_ops[] = {
|
||||||
{
|
{
|
||||||
.hook = smack_ipv4_output,
|
.hook = smack_ipv4_output,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV4,
|
.pf = NFPROTO_IPV4,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP_PRI_SELINUX_FIRST,
|
.priority = NF_IP_PRI_SELINUX_FIRST,
|
||||||
|
@ -65,7 +64,6 @@ static struct nf_hook_ops smack_nf_ops[] = {
|
||||||
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
||||||
{
|
{
|
||||||
.hook = smack_ipv6_output,
|
.hook = smack_ipv6_output,
|
||||||
.owner = THIS_MODULE,
|
|
||||||
.pf = NFPROTO_IPV6,
|
.pf = NFPROTO_IPV6,
|
||||||
.hooknum = NF_INET_LOCAL_OUT,
|
.hooknum = NF_INET_LOCAL_OUT,
|
||||||
.priority = NF_IP6_PRI_SELINUX_FIRST,
|
.priority = NF_IP6_PRI_SELINUX_FIRST,
|
||||||
|
|
Loading…
Reference in a new issue