netfilter: nf_tables: Introduce nft_hook_find_ops{,_rcu}()

Also a pretty dull wrapper around the hook->ops.dev comparison for now.
Will search the embedded nf_hook_ops list in future. The ugly cast to
eliminate the const qualifier will vanish then, too.

Since this future list will be RCU-protected, also introduce an _rcu()
variant here.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 803d5f1601f9ddcef048f64b28e55baef80fb590..df0b151743a2f0cae88e4c249341668b75320557 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1205,6 +1205,11 @@ struct nft_hook {
        u8                      ifnamelen;
 };
 
+struct nf_hook_ops *nft_hook_find_ops(const struct nft_hook *hook,
+                                     const struct net_device *dev);
+struct nf_hook_ops *nft_hook_find_ops_rcu(const struct nft_hook *hook,
+                                         const struct net_device *dev);
+
 /**
  *     struct nft_base_chain - nf_tables base chain
  *

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 9998fcf44a38de1efdb1f7684c3ec4e46e4e5463..c5b7922ca5bfe01a359892dfe1098bd2a41419d3 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9600,13 +9600,32 @@ nla_put_failure:
        return -EMSGSIZE;
 }
 
+struct nf_hook_ops *nft_hook_find_ops(const struct nft_hook *hook,
+                                     const struct net_device *dev)
+{
+       if (hook->ops.dev == dev)
+               return (struct nf_hook_ops *)&hook->ops;
+
+       return NULL;
+}
+EXPORT_SYMBOL_GPL(nft_hook_find_ops);
+
+struct nf_hook_ops *nft_hook_find_ops_rcu(const struct nft_hook *hook,
+                                         const struct net_device *dev)
+{
+       return nft_hook_find_ops(hook, dev);
+}
+EXPORT_SYMBOL_GPL(nft_hook_find_ops_rcu);
+
 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
                                struct nft_flowtable *flowtable)
 {
+       struct nf_hook_ops *ops;
        struct nft_hook *hook;
 
        list_for_each_entry(hook, &flowtable->hook_list, list) {
-               if (hook->ops.dev != dev)
+               ops = nft_hook_find_ops(hook, dev);
+               if (!ops)
                        continue;
 
                /* flow_offload_netdev_event() cleans up entries for us. */

diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 64675f1c7f2953d31a7cf48be721f752f45211a9..75b756f0b9f0be9fd88db8a97fd2a722ae2cff1c 100644 (file)
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -638,7 +638,7 @@ static struct nft_chain *__nft_offload_get_chain(const struct nftables_pernet *n
                        found = NULL;
                        basechain = nft_base_chain(chain);
                        list_for_each_entry(hook, &basechain->hook_list, list) {
-                               if (hook->ops.dev != dev)
+                               if (!nft_hook_find_ops(hook, dev))
                                        continue;
 
                                found = hook;

diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 19a553550c769c8e6a7ab8aeffc85d4343c170dc..783e4b5ef3e0e387597eefe5269711890cb6ad54 100644 (file)
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -321,14 +321,16 @@ static const struct nft_chain_type nft_chain_filter_netdev = {
 static void nft_netdev_event(unsigned long event, struct net_device *dev,
                             struct nft_base_chain *basechain)
 {
+       struct nf_hook_ops *ops;
        struct nft_hook *hook;
 
        list_for_each_entry(hook, &basechain->hook_list, list) {
-               if (hook->ops.dev != dev)
+               ops = nft_hook_find_ops(hook, dev);
+               if (!ops)
                        continue;
 
                if (!(basechain->chain.table->flags & NFT_TABLE_F_DORMANT))
-                       nf_unregister_net_hook(dev_net(dev), &hook->ops);
+                       nf_unregister_net_hook(dev_net(dev), ops);
 
                list_del_rcu(&hook->list);
                kfree_rcu(hook, rcu);

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index 221d50223018106f8292f92a791d5d02da1e66f0..225ff293cd50081a30fc82feeed5bb054f6387f0 100644 (file)
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -175,7 +175,7 @@ static bool nft_flowtable_find_dev(const struct net_device *dev,
        bool found = false;
 
        list_for_each_entry_rcu(hook, &ft->hook_list, list) {
-               if (hook->ops.dev != dev)
+               if (!nft_hook_find_ops_rcu(hook, dev))
                        continue;
 
                found = true;