Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd4cbef7 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: get rid of pernet families 



Now that we have a single table list for each netns, we can get rid of
one pointer per family and the global afinfo list, thus, shrinking
struct netns for nftables that now becomes 64 bytes smaller.

And call __nft_release_afinfo() from __net_exit path accordingly to
release netnamespace objects on removal.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 36596dad

include/net/netfilter/nf_tables.h

+2 −2
Original line number Diff line number Diff line
@@ -979,8 +979,8 @@ struct nft_af_info { 
	struct module			*owner;

};



int nft_register_afinfo(struct net *, struct nft_af_info *);

void nft_unregister_afinfo(struct net *, struct nft_af_info *);

int nft_register_afinfo(struct nft_af_info *);

void nft_unregister_afinfo(struct nft_af_info *);



int nft_register_chain_type(const struct nf_chain_type *);

void nft_unregister_chain_type(const struct nf_chain_type *);

include/net/netns/nftables.h

+0 −7
Original line number Diff line number Diff line
@@ -7,15 +7,8 @@ 
struct nft_af_info;



struct netns_nftables {

	struct list_head	af_info;

	struct list_head	tables;

	struct list_head	commit_list;

	struct nft_af_info	*ipv4;

	struct nft_af_info	*ipv6;

	struct nft_af_info	*inet;

	struct nft_af_info	*arp;

	struct nft_af_info	*bridge;

	struct nft_af_info	*netdev;

	unsigned int		base_seq;

	u8			gencursor;

};

net/bridge/netfilter/nf_tables_bridge.c

+5 −33
Original line number Diff line number Diff line
@@ -47,34 +47,6 @@ static struct nft_af_info nft_af_bridge __read_mostly = { 
	.owner		= THIS_MODULE,

};



static int nf_tables_bridge_init_net(struct net *net)

{

	net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);

	if (net->nft.bridge == NULL)

		return -ENOMEM;



	memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));



	if (nft_register_afinfo(net, net->nft.bridge) < 0)

		goto err;



	return 0;

err:

	kfree(net->nft.bridge);

	return -ENOMEM;

}



static void nf_tables_bridge_exit_net(struct net *net)

{

	nft_unregister_afinfo(net, net->nft.bridge);

	kfree(net->nft.bridge);

}



static struct pernet_operations nf_tables_bridge_net_ops = {

	.init	= nf_tables_bridge_init_net,

	.exit	= nf_tables_bridge_exit_net,

};



static const struct nf_chain_type filter_bridge = {

	.name		= "filter",

	.type		= NFT_CHAIN_T_DEFAULT,
@@ -98,17 +70,17 @@ static int __init nf_tables_bridge_init(void) 
{

	int ret;



	ret = nft_register_chain_type(&filter_bridge);

	ret = nft_register_afinfo(&nft_af_bridge);

	if (ret < 0)

		return ret;



	ret = register_pernet_subsys(&nf_tables_bridge_net_ops);

	ret = nft_register_chain_type(&filter_bridge);

	if (ret < 0)

		goto err_register_subsys;

		goto err_register_chain;



	return ret;



err_register_subsys:

err_register_chain:

	nft_unregister_chain_type(&filter_bridge);



	return ret;
@@ -116,8 +88,8 @@ static int __init nf_tables_bridge_init(void) 


static void __exit nf_tables_bridge_exit(void)

{

	unregister_pernet_subsys(&nf_tables_bridge_net_ops);

	nft_unregister_chain_type(&filter_bridge);

	nft_unregister_afinfo(&nft_af_bridge);

}



module_init(nf_tables_bridge_init);

net/ipv4/netfilter/nf_tables_arp.c

+9 −32
Original line number Diff line number Diff line
@@ -32,34 +32,6 @@ static struct nft_af_info nft_af_arp __read_mostly = { 
	.owner		= THIS_MODULE,

};



static int nf_tables_arp_init_net(struct net *net)

{

	net->nft.arp = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);

	if (net->nft.arp== NULL)

		return -ENOMEM;



	memcpy(net->nft.arp, &nft_af_arp, sizeof(nft_af_arp));



	if (nft_register_afinfo(net, net->nft.arp) < 0)

		goto err;



	return 0;

err:

	kfree(net->nft.arp);

	return -ENOMEM;

}



static void nf_tables_arp_exit_net(struct net *net)

{

	nft_unregister_afinfo(net, net->nft.arp);

	kfree(net->nft.arp);

}



static struct pernet_operations nf_tables_arp_net_ops = {

	.init   = nf_tables_arp_init_net,

	.exit   = nf_tables_arp_exit_net,

};



static const struct nf_chain_type filter_arp = {

	.name		= "filter",

	.type		= NFT_CHAIN_T_DEFAULT,
@@ -77,12 +49,17 @@ static int __init nf_tables_arp_init(void) 
{

	int ret;



	ret = nft_register_chain_type(&filter_arp);

	ret = nft_register_afinfo(&nft_af_arp);

	if (ret < 0)

		return ret;



	ret = register_pernet_subsys(&nf_tables_arp_net_ops);

	ret = nft_register_chain_type(&filter_arp);

	if (ret < 0)

		goto err_register_chain;



	return 0;



err_register_chain:

	nft_unregister_chain_type(&filter_arp);



	return ret;
@@ -90,8 +67,8 @@ static int __init nf_tables_arp_init(void) 


static void __exit nf_tables_arp_exit(void)

{

	unregister_pernet_subsys(&nf_tables_arp_net_ops);

	nft_unregister_chain_type(&filter_arp);

	nft_unregister_afinfo(&nft_af_arp);

}



module_init(nf_tables_arp_init);

net/ipv4/netfilter/nf_tables_ipv4.c

+8 −32
Original line number Diff line number Diff line
@@ -35,34 +35,6 @@ static struct nft_af_info nft_af_ipv4 __read_mostly = { 
	.owner		= THIS_MODULE,

};



static int nf_tables_ipv4_init_net(struct net *net)

{

	net->nft.ipv4 = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);

	if (net->nft.ipv4 == NULL)

		return -ENOMEM;



	memcpy(net->nft.ipv4, &nft_af_ipv4, sizeof(nft_af_ipv4));



	if (nft_register_afinfo(net, net->nft.ipv4) < 0)

		goto err;



	return 0;

err:

	kfree(net->nft.ipv4);

	return -ENOMEM;

}



static void nf_tables_ipv4_exit_net(struct net *net)

{

	nft_unregister_afinfo(net, net->nft.ipv4);

	kfree(net->nft.ipv4);

}



static struct pernet_operations nf_tables_ipv4_net_ops = {

	.init	= nf_tables_ipv4_init_net,

	.exit	= nf_tables_ipv4_exit_net,

};



static const struct nf_chain_type filter_ipv4 = {

	.name		= "filter",

	.type		= NFT_CHAIN_T_DEFAULT,
@@ -86,21 +58,25 @@ static int __init nf_tables_ipv4_init(void) 
{

	int ret;



	ret = nft_register_chain_type(&filter_ipv4);

	ret = nft_register_afinfo(&nft_af_ipv4);

	if (ret < 0)

		return ret;



	ret = register_pernet_subsys(&nf_tables_ipv4_net_ops);

	ret = nft_register_chain_type(&filter_ipv4);

	if (ret < 0)

		nft_unregister_chain_type(&filter_ipv4);

		goto err_register_chain;



	return 0;



err_register_chain:

	nft_unregister_afinfo(&nft_af_ipv4);

	return ret;

}



static void __exit nf_tables_ipv4_exit(void)

{

	unregister_pernet_subsys(&nf_tables_ipv4_net_ops);

	nft_unregister_chain_type(&filter_ipv4);

	nft_unregister_afinfo(&nft_af_ipv4);

}



module_init(nf_tables_ipv4_init);