Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8da4cc1b authored by Arturo Borrero's avatar Arturo Borrero Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_masq: register/unregister notifiers on module init/exit 



We have to register the notifiers in the masquerade expression from
the the module _init and _exit path.

This fixes crashes when removing the masquerade rule with no
ipt_MASQUERADE support in place (which was masking the problem).

Fixes: 9ba1f726 ("netfilter: nf_tables: add new nft_masq expression")
Signed-off-by: default avatarArturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 07dcc686

net/ipv4/netfilter/nft_masq_ipv4.c

+11 −23
Original line number Diff line number Diff line
@@ -32,33 +32,12 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr, 
	data[NFT_REG_VERDICT].verdict = verdict;

}



static int nft_masq_ipv4_init(const struct nft_ctx *ctx,

			      const struct nft_expr *expr,

			      const struct nlattr * const tb[])

{

	int err;



	err = nft_masq_init(ctx, expr, tb);

	if (err < 0)

		return err;



	nf_nat_masquerade_ipv4_register_notifier();

	return 0;

}



static void nft_masq_ipv4_destroy(const struct nft_ctx *ctx,

				  const struct nft_expr *expr)

{

	nf_nat_masquerade_ipv4_unregister_notifier();

}



static struct nft_expr_type nft_masq_ipv4_type;

static const struct nft_expr_ops nft_masq_ipv4_ops = {

	.type		= &nft_masq_ipv4_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_masq)),

	.eval		= nft_masq_ipv4_eval,

	.init		= nft_masq_ipv4_init,

	.destroy	= nft_masq_ipv4_destroy,

	.init		= nft_masq_init,

	.dump		= nft_masq_dump,

};
@@ -73,12 +52,21 @@ static struct nft_expr_type nft_masq_ipv4_type __read_mostly = { 


static int __init nft_masq_ipv4_module_init(void)

{

	return nft_register_expr(&nft_masq_ipv4_type);

	int ret;



	ret = nft_register_expr(&nft_masq_ipv4_type);

	if (ret < 0)

		return ret;



	nf_nat_masquerade_ipv4_register_notifier();



	return ret;

}



static void __exit nft_masq_ipv4_module_exit(void)

{

	nft_unregister_expr(&nft_masq_ipv4_type);

	nf_nat_masquerade_ipv4_unregister_notifier();

}



module_init(nft_masq_ipv4_module_init);

net/ipv6/netfilter/nft_masq_ipv6.c

+11 −23
Original line number Diff line number Diff line
@@ -32,33 +32,12 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr, 
	data[NFT_REG_VERDICT].verdict = verdict;

}



static int nft_masq_ipv6_init(const struct nft_ctx *ctx,

			      const struct nft_expr *expr,

			      const struct nlattr * const tb[])

{

	int err;



	err = nft_masq_init(ctx, expr, tb);

	if (err < 0)

		return err;



	nf_nat_masquerade_ipv6_register_notifier();

	return 0;

}



static void nft_masq_ipv6_destroy(const struct nft_ctx *ctx,

				  const struct nft_expr *expr)

{

	nf_nat_masquerade_ipv6_unregister_notifier();

}



static struct nft_expr_type nft_masq_ipv6_type;

static const struct nft_expr_ops nft_masq_ipv6_ops = {

	.type		= &nft_masq_ipv6_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_masq)),

	.eval		= nft_masq_ipv6_eval,

	.init		= nft_masq_ipv6_init,

	.destroy	= nft_masq_ipv6_destroy,

	.init		= nft_masq_init,

	.dump		= nft_masq_dump,

};
@@ -73,12 +52,21 @@ static struct nft_expr_type nft_masq_ipv6_type __read_mostly = { 


static int __init nft_masq_ipv6_module_init(void)

{

	return nft_register_expr(&nft_masq_ipv6_type);

	int ret;



	ret = nft_register_expr(&nft_masq_ipv6_type);

	if (ret < 0)

		return ret;



	nf_nat_masquerade_ipv6_register_notifier();



	return ret;

}



static void __exit nft_masq_ipv6_module_exit(void)

{

	nft_unregister_expr(&nft_masq_ipv6_type);

	nf_nat_masquerade_ipv6_unregister_notifier();

}



module_init(nft_masq_ipv6_module_init);