projects / openwrt / staging / svanheule.git / blob
? search:


e08b9b26d5b30214ab12c5dcabe1ebb072a1a47c
[openwrt/staging/svanheule.git] /
1 From: Pablo Neira Ayuso <pablo@netfilter.org>
2 Date: Tue, 9 Jan 2018 02:38:03 +0100
3 Subject: [PATCH] netfilter: nf_tables: add single table list for all families
4
5 Place all existing user defined tables in struct net *, instead of
6 having one list per family. This saves us from one level of indentation
7 in netlink dump functions.
8
9 Place pointer to struct nft_af_info in struct nft_table temporarily, as
10 we still need this to put back reference module reference counter on
11 table removal.
12
13 This patch comes in preparation for the removal of struct nft_af_info.
14
15 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
16 ---
17
18 --- a/include/net/netfilter/nf_tables.h
19 +++ b/include/net/netfilter/nf_tables.h
20 @@ -143,22 +143,22 @@ static inline void nft_data_debug(const
21 * struct nft_ctx - nf_tables rule/set context
22 *
23 * @net: net namespace
24 - * @afi: address family info
25 * @table: the table the chain is contained in
26 * @chain: the chain the rule is contained in
27 * @nla: netlink attributes
28 * @portid: netlink portID of the original message
29 * @seq: netlink sequence number
30 + * @family: protocol family
31 * @report: notify via unicast netlink message
32 */
33 struct nft_ctx {
34 struct net *net;
35 - struct nft_af_info *afi;
36 struct nft_table *table;
37 struct nft_chain *chain;
38 const struct nlattr * const *nla;
39 u32 portid;
40 u32 seq;
41 + u8 family;
42 bool report;
43 };
44
45 @@ -944,6 +944,7 @@ unsigned int nft_do_chain(struct nft_pkt
46 * @use: number of chain references to this table
47 * @flags: table flag (see enum nft_table_flags)
48 * @genmask: generation mask
49 + * @afinfo: address family info
50 * @name: name of the table
51 */
52 struct nft_table {
53 @@ -956,6 +957,7 @@ struct nft_table {
54 u32 use;
55 u16 flags:14,
56 genmask:2;
57 + struct nft_af_info *afi;
58 char *name;
59 };
60
61 @@ -965,13 +967,11 @@ struct nft_table {
62 * @list: used internally
63 * @family: address family
64 * @owner: module owner
65 - * @tables: used internally
66 */
67 struct nft_af_info {
68 struct list_head list;
69 int family;
70 struct module *owner;
71 - struct list_head tables;
72 };
73
74 int nft_register_afinfo(struct net *, struct nft_af_info *);
75 --- a/include/net/netns/nftables.h
76 +++ b/include/net/netns/nftables.h
77 @@ -8,6 +8,7 @@ struct nft_af_info;
78
79 struct netns_nftables {
80 struct list_head af_info;
81 + struct list_head tables;
82 struct list_head commit_list;
83 struct nft_af_info *ipv4;
84 struct nft_af_info *ipv6;
85 --- a/net/netfilter/nf_tables_api.c
86 +++ b/net/netfilter/nf_tables_api.c
87 @@ -37,7 +37,6 @@ static LIST_HEAD(nf_tables_flowtables);
88 */
89 int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
90 {
91 - INIT_LIST_HEAD(&afi->tables);
92 nfnl_lock(NFNL_SUBSYS_NFTABLES);
93 list_add_tail_rcu(&afi->list, &net->nft.af_info);
94 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
95 @@ -99,13 +98,13 @@ static void nft_ctx_init(struct nft_ctx
96 struct net *net,
97 const struct sk_buff *skb,
98 const struct nlmsghdr *nlh,
99 - struct nft_af_info *afi,
100 + u8 family,
101 struct nft_table *table,
102 struct nft_chain *chain,
103 const struct nlattr * const *nla)
104 {
105 ctx->net = net;
106 - ctx->afi = afi;
107 + ctx->family = family;
108 ctx->table = table;
109 ctx->chain = chain;
110 ctx->nla = nla;
111 @@ -414,30 +413,31 @@ static int nft_delflowtable(struct nft_c
112 * Tables
113 */
114
115 -static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
116 +static struct nft_table *nft_table_lookup(const struct net *net,
117 const struct nlattr *nla,
118 - u8 genmask)
119 + u8 family, u8 genmask)
120 {
121 struct nft_table *table;
122
123 - list_for_each_entry(table, &afi->tables, list) {
124 + list_for_each_entry(table, &net->nft.tables, list) {
125 if (!nla_strcmp(nla, table->name) &&
126 + table->afi->family == family &&
127 nft_active_genmask(table, genmask))
128 return table;
129 }
130 return NULL;
131 }
132
133 -static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
134 +static struct nft_table *nf_tables_table_lookup(const struct net *net,
135 const struct nlattr *nla,
136 - u8 genmask)
137 + u8 family, u8 genmask)
138 {
139 struct nft_table *table;
140
141 if (nla == NULL)
142 return ERR_PTR(-EINVAL);
143
144 - table = nft_table_lookup(afi, nla, genmask);
145 + table = nft_table_lookup(net, nla, family, genmask);
146 if (table != NULL)
147 return table;
148
149 @@ -536,7 +536,7 @@ static void nf_tables_table_notify(const
150 goto err;
151
152 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
153 - event, 0, ctx->afi->family, ctx->table);
154 + event, 0, ctx->family, ctx->table);
155 if (err < 0) {
156 kfree_skb(skb);
157 goto err;
158 @@ -553,7 +553,6 @@ static int nf_tables_dump_tables(struct
159 struct netlink_callback *cb)
160 {
161 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
162 - const struct nft_af_info *afi;
163 const struct nft_table *table;
164 unsigned int idx = 0, s_idx = cb->args[0];
165 struct net *net = sock_net(skb->sk);
166 @@ -562,30 +561,27 @@ static int nf_tables_dump_tables(struct
167 rcu_read_lock();
168 cb->seq = net->nft.base_seq;
169
170 - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
171 - if (family != NFPROTO_UNSPEC && family != afi->family)
172 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
173 + if (family != NFPROTO_UNSPEC && family != table->afi->family)
174 continue;
175
176 - list_for_each_entry_rcu(table, &afi->tables, list) {
177 - if (idx < s_idx)
178 - goto cont;
179 - if (idx > s_idx)
180 - memset(&cb->args[1], 0,
181 - sizeof(cb->args) - sizeof(cb->args[0]));
182 - if (!nft_is_active(net, table))
183 - continue;
184 - if (nf_tables_fill_table_info(skb, net,
185 - NETLINK_CB(cb->skb).portid,
186 - cb->nlh->nlmsg_seq,
187 - NFT_MSG_NEWTABLE,
188 - NLM_F_MULTI,
189 - afi->family, table) < 0)
190 - goto done;
191 + if (idx < s_idx)
192 + goto cont;
193 + if (idx > s_idx)
194 + memset(&cb->args[1], 0,
195 + sizeof(cb->args) - sizeof(cb->args[0]));
196 + if (!nft_is_active(net, table))
197 + continue;
198 + if (nf_tables_fill_table_info(skb, net,
199 + NETLINK_CB(cb->skb).portid,
200 + cb->nlh->nlmsg_seq,
201 + NFT_MSG_NEWTABLE, NLM_F_MULTI,
202 + table->afi->family, table) < 0)
203 + goto done;
204
205 - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
206 + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
207 cont:
208 - idx++;
209 - }
210 + idx++;
211 }
212 done:
213 rcu_read_unlock();
214 @@ -617,7 +613,8 @@ static int nf_tables_gettable(struct net
215 if (IS_ERR(afi))
216 return PTR_ERR(afi);
217
218 - table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
219 + table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
220 + genmask);
221 if (IS_ERR(table))
222 return PTR_ERR(table);
223
224 @@ -748,7 +745,7 @@ static int nf_tables_newtable(struct net
225 return PTR_ERR(afi);
226
227 name = nla[NFTA_TABLE_NAME];
228 - table = nf_tables_table_lookup(afi, name, genmask);
229 + table = nf_tables_table_lookup(net, name, afi->family, genmask);
230 if (IS_ERR(table)) {
231 if (PTR_ERR(table) != -ENOENT)
232 return PTR_ERR(table);
233 @@ -758,7 +755,7 @@ static int nf_tables_newtable(struct net
234 if (nlh->nlmsg_flags & NLM_F_REPLACE)
235 return -EOPNOTSUPP;
236
237 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
238 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
239 return nf_tables_updtable(&ctx);
240 }
241
242 @@ -785,14 +782,15 @@ static int nf_tables_newtable(struct net
243 INIT_LIST_HEAD(&table->sets);
244 INIT_LIST_HEAD(&table->objects);
245 INIT_LIST_HEAD(&table->flowtables);
246 + table->afi = afi;
247 table->flags = flags;
248
249 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
250 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
251 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
252 if (err < 0)
253 goto err4;
254
255 - list_add_tail_rcu(&table->list, &afi->tables);
256 + list_add_tail_rcu(&table->list, &net->nft.tables);
257 return 0;
258 err4:
259 kfree(table->name);
260 @@ -866,30 +864,28 @@ out:
261
262 static int nft_flush(struct nft_ctx *ctx, int family)
263 {
264 - struct nft_af_info *afi;
265 struct nft_table *table, *nt;
266 const struct nlattr * const *nla = ctx->nla;
267 int err = 0;
268
269 - list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
270 - if (family != AF_UNSPEC && afi->family != family)
271 + list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
272 + if (family != AF_UNSPEC && table->afi->family != family)
273 continue;
274
275 - ctx->afi = afi;
276 - list_for_each_entry_safe(table, nt, &afi->tables, list) {
277 - if (!nft_is_active_next(ctx->net, table))
278 - continue;
279 + ctx->family = table->afi->family;
280
281 - if (nla[NFTA_TABLE_NAME] &&
282 - nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
283 - continue;
284 + if (!nft_is_active_next(ctx->net, table))
285 + continue;
286
287 - ctx->table = table;
288 + if (nla[NFTA_TABLE_NAME] &&
289 + nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
290 + continue;
291
292 - err = nft_flush_table(ctx);
293 - if (err < 0)
294 - goto out;
295 - }
296 + ctx->table = table;
297 +
298 + err = nft_flush_table(ctx);
299 + if (err < 0)
300 + goto out;
301 }
302 out:
303 return err;
304 @@ -907,7 +903,7 @@ static int nf_tables_deltable(struct net
305 int family = nfmsg->nfgen_family;
306 struct nft_ctx ctx;
307
308 - nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
309 + nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
310 if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
311 return nft_flush(&ctx, family);
312
313 @@ -915,7 +911,8 @@ static int nf_tables_deltable(struct net
314 if (IS_ERR(afi))
315 return PTR_ERR(afi);
316
317 - table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
318 + table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
319 + genmask);
320 if (IS_ERR(table))
321 return PTR_ERR(table);
322
323 @@ -923,7 +920,7 @@ static int nf_tables_deltable(struct net
324 table->use > 0)
325 return -EBUSY;
326
327 - ctx.afi = afi;
328 + ctx.family = afi->family;
329 ctx.table = table;
330
331 return nft_flush_table(&ctx);
332 @@ -935,7 +932,7 @@ static void nf_tables_table_destroy(stru
333
334 kfree(ctx->table->name);
335 kfree(ctx->table);
336 - module_put(ctx->afi->owner);
337 + module_put(ctx->table->afi->owner);
338 }
339
340 int nft_register_chain_type(const struct nf_chain_type *ctype)
341 @@ -1136,7 +1133,7 @@ static void nf_tables_chain_notify(const
342 goto err;
343
344 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
345 - event, 0, ctx->afi->family, ctx->table,
346 + event, 0, ctx->family, ctx->table,
347 ctx->chain);
348 if (err < 0) {
349 kfree_skb(skb);
350 @@ -1154,7 +1151,6 @@ static int nf_tables_dump_chains(struct
351 struct netlink_callback *cb)
352 {
353 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
354 - const struct nft_af_info *afi;
355 const struct nft_table *table;
356 const struct nft_chain *chain;
357 unsigned int idx = 0, s_idx = cb->args[0];
358 @@ -1164,31 +1160,30 @@ static int nf_tables_dump_chains(struct
359 rcu_read_lock();
360 cb->seq = net->nft.base_seq;
361
362 - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
363 - if (family != NFPROTO_UNSPEC && family != afi->family)
364 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
365 + if (family != NFPROTO_UNSPEC && family != table->afi->family)
366 continue;
367
368 - list_for_each_entry_rcu(table, &afi->tables, list) {
369 - list_for_each_entry_rcu(chain, &table->chains, list) {
370 - if (idx < s_idx)
371 - goto cont;
372 - if (idx > s_idx)
373 - memset(&cb->args[1], 0,
374 - sizeof(cb->args) - sizeof(cb->args[0]));
375 - if (!nft_is_active(net, chain))
376 - continue;
377 - if (nf_tables_fill_chain_info(skb, net,
378 - NETLINK_CB(cb->skb).portid,
379 - cb->nlh->nlmsg_seq,
380 - NFT_MSG_NEWCHAIN,
381 - NLM_F_MULTI,
382 - afi->family, table, chain) < 0)
383 - goto done;
384 + list_for_each_entry_rcu(chain, &table->chains, list) {
385 + if (idx < s_idx)
386 + goto cont;
387 + if (idx > s_idx)
388 + memset(&cb->args[1], 0,
389 + sizeof(cb->args) - sizeof(cb->args[0]));
390 + if (!nft_is_active(net, chain))
391 + continue;
392 + if (nf_tables_fill_chain_info(skb, net,
393 + NETLINK_CB(cb->skb).portid,
394 + cb->nlh->nlmsg_seq,
395 + NFT_MSG_NEWCHAIN,
396 + NLM_F_MULTI,
397 + table->afi->family, table,
398 + chain) < 0)
399 + goto done;
400
401 - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
402 + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
403 cont:
404 - idx++;
405 - }
406 + idx++;
407 }
408 }
409 done:
410 @@ -1222,7 +1217,8 @@ static int nf_tables_getchain(struct net
411 if (IS_ERR(afi))
412 return PTR_ERR(afi);
413
414 - table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
415 + table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
416 + genmask);
417 if (IS_ERR(table))
418 return PTR_ERR(table);
419
420 @@ -1332,8 +1328,8 @@ struct nft_chain_hook {
421
422 static int nft_chain_parse_hook(struct net *net,
423 const struct nlattr * const nla[],
424 - struct nft_af_info *afi,
425 - struct nft_chain_hook *hook, bool create)
426 + struct nft_chain_hook *hook, u8 family,
427 + bool create)
428 {
429 struct nlattr *ha[NFTA_HOOK_MAX + 1];
430 const struct nf_chain_type *type;
431 @@ -1352,10 +1348,10 @@ static int nft_chain_parse_hook(struct n
432 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
433 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
434
435 - type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
436 + type = chain_type[family][NFT_CHAIN_T_DEFAULT];
437 if (nla[NFTA_CHAIN_TYPE]) {
438 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
439 - afi->family, create);
440 + family, create);
441 if (IS_ERR(type))
442 return PTR_ERR(type);
443 }
444 @@ -1367,7 +1363,7 @@ static int nft_chain_parse_hook(struct n
445 hook->type = type;
446
447 hook->dev = NULL;
448 - if (afi->family == NFPROTO_NETDEV) {
449 + if (family == NFPROTO_NETDEV) {
450 char ifname[IFNAMSIZ];
451
452 if (!ha[NFTA_HOOK_DEV]) {
453 @@ -1402,7 +1398,6 @@ static int nf_tables_addchain(struct nft
454 {
455 const struct nlattr * const *nla = ctx->nla;
456 struct nft_table *table = ctx->table;
457 - struct nft_af_info *afi = ctx->afi;
458 struct nft_base_chain *basechain;
459 struct nft_stats __percpu *stats;
460 struct net *net = ctx->net;
461 @@ -1416,7 +1411,7 @@ static int nf_tables_addchain(struct nft
462 struct nft_chain_hook hook;
463 struct nf_hook_ops *ops;
464
465 - err = nft_chain_parse_hook(net, nla, afi, &hook, create);
466 + err = nft_chain_parse_hook(net, nla, &hook, family, create);
467 if (err < 0)
468 return err;
469
470 @@ -1508,7 +1503,7 @@ static int nf_tables_updchain(struct nft
471 if (!nft_is_base_chain(chain))
472 return -EBUSY;
473
474 - err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook,
475 + err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
476 create);
477 if (err < 0)
478 return err;
479 @@ -1618,7 +1613,8 @@ static int nf_tables_newchain(struct net
480 if (IS_ERR(afi))
481 return PTR_ERR(afi);
482
483 - table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
484 + table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
485 + genmask);
486 if (IS_ERR(table))
487 return PTR_ERR(table);
488
489 @@ -1658,7 +1654,7 @@ static int nf_tables_newchain(struct net
490 }
491 }
492
493 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
494 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
495
496 if (chain != NULL) {
497 if (nlh->nlmsg_flags & NLM_F_EXCL)
498 @@ -1692,7 +1688,8 @@ static int nf_tables_delchain(struct net
499 if (IS_ERR(afi))
500 return PTR_ERR(afi);
501
502 - table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
503 + table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
504 + genmask);
505 if (IS_ERR(table))
506 return PTR_ERR(table);
507
508 @@ -1704,7 +1701,7 @@ static int nf_tables_delchain(struct net
509 chain->use > 0)
510 return -EBUSY;
511
512 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
513 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
514
515 use = chain->use;
516 list_for_each_entry(rule, &chain->rules, list) {
517 @@ -1869,7 +1866,7 @@ static int nf_tables_expr_parse(const st
518 if (err < 0)
519 return err;
520
521 - type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
522 + type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
523 if (IS_ERR(type))
524 return PTR_ERR(type);
525
526 @@ -2093,7 +2090,7 @@ static void nf_tables_rule_notify(const
527 goto err;
528
529 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
530 - event, 0, ctx->afi->family, ctx->table,
531 + event, 0, ctx->family, ctx->table,
532 ctx->chain, rule);
533 if (err < 0) {
534 kfree_skb(skb);
535 @@ -2117,7 +2114,6 @@ static int nf_tables_dump_rules(struct s
536 {
537 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
538 const struct nft_rule_dump_ctx *ctx = cb->data;
539 - const struct nft_af_info *afi;
540 const struct nft_table *table;
541 const struct nft_chain *chain;
542 const struct nft_rule *rule;
543 @@ -2128,39 +2124,37 @@ static int nf_tables_dump_rules(struct s
544 rcu_read_lock();
545 cb->seq = net->nft.base_seq;
546
547 - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
548 - if (family != NFPROTO_UNSPEC && family != afi->family)
549 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
550 + if (family != NFPROTO_UNSPEC && family != table->afi->family)
551 + continue;
552 +
553 + if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
554 continue;
555
556 - list_for_each_entry_rcu(table, &afi->tables, list) {
557 - if (ctx && ctx->table &&
558 - strcmp(ctx->table, table->name) != 0)
559 + list_for_each_entry_rcu(chain, &table->chains, list) {
560 + if (ctx && ctx->chain &&
561 + strcmp(ctx->chain, chain->name) != 0)
562 continue;
563
564 - list_for_each_entry_rcu(chain, &table->chains, list) {
565 - if (ctx && ctx->chain &&
566 - strcmp(ctx->chain, chain->name) != 0)
567 - continue;
568 -
569 - list_for_each_entry_rcu(rule, &chain->rules, list) {
570 - if (!nft_is_active(net, rule))
571 - goto cont;
572 - if (idx < s_idx)
573 - goto cont;
574 - if (idx > s_idx)
575 - memset(&cb->args[1], 0,
576 - sizeof(cb->args) - sizeof(cb->args[0]));
577 - if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
578 - cb->nlh->nlmsg_seq,
579 - NFT_MSG_NEWRULE,
580 - NLM_F_MULTI | NLM_F_APPEND,
581 - afi->family, table, chain, rule) < 0)
582 - goto done;
583 + list_for_each_entry_rcu(rule, &chain->rules, list) {
584 + if (!nft_is_active(net, rule))
585 + goto cont;
586 + if (idx < s_idx)
587 + goto cont;
588 + if (idx > s_idx)
589 + memset(&cb->args[1], 0,
590 + sizeof(cb->args) - sizeof(cb->args[0]));
591 + if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
592 + cb->nlh->nlmsg_seq,
593 + NFT_MSG_NEWRULE,
594 + NLM_F_MULTI | NLM_F_APPEND,
595 + table->afi->family,
596 + table, chain, rule) < 0)
597 + goto done;
598
599 - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
600 + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
601 cont:
602 - idx++;
603 - }
604 + idx++;
605 }
606 }
607 }
608 @@ -2238,7 +2232,8 @@ static int nf_tables_getrule(struct net
609 if (IS_ERR(afi))
610 return PTR_ERR(afi);
611
612 - table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
613 + table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
614 + genmask);
615 if (IS_ERR(table))
616 return PTR_ERR(table);
617
618 @@ -2323,7 +2318,8 @@ static int nf_tables_newrule(struct net
619 if (IS_ERR(afi))
620 return PTR_ERR(afi);
621
622 - table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
623 + table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
624 + genmask);
625 if (IS_ERR(table))
626 return PTR_ERR(table);
627
628 @@ -2362,7 +2358,7 @@ static int nf_tables_newrule(struct net
629 return PTR_ERR(old_rule);
630 }
631
632 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
633 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
634
635 n = 0;
636 size = 0;
637 @@ -2495,7 +2491,8 @@ static int nf_tables_delrule(struct net
638 if (IS_ERR(afi))
639 return PTR_ERR(afi);
640
641 - table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
642 + table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
643 + genmask);
644 if (IS_ERR(table))
645 return PTR_ERR(table);
646
647 @@ -2506,7 +2503,7 @@ static int nf_tables_delrule(struct net
648 return PTR_ERR(chain);
649 }
650
651 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
652 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
653
654 if (chain) {
655 if (nla[NFTA_RULE_HANDLE]) {
656 @@ -2704,13 +2701,13 @@ static int nft_ctx_init_from_setattr(str
657 if (afi == NULL)
658 return -EAFNOSUPPORT;
659
660 - table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE],
661 - genmask);
662 + table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
663 + afi->family, genmask);
664 if (IS_ERR(table))
665 return PTR_ERR(table);
666 }
667
668 - nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
669 + nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
670 return 0;
671 }
672
673 @@ -2838,7 +2835,7 @@ static int nf_tables_fill_set(struct sk_
674 goto nla_put_failure;
675
676 nfmsg = nlmsg_data(nlh);
677 - nfmsg->nfgen_family = ctx->afi->family;
678 + nfmsg->nfgen_family = ctx->family;
679 nfmsg->version = NFNETLINK_V0;
680 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
681
682 @@ -2930,10 +2927,8 @@ static int nf_tables_dump_sets(struct sk
683 {
684 const struct nft_set *set;
685 unsigned int idx, s_idx = cb->args[0];
686 - struct nft_af_info *afi;
687 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
688 struct net *net = sock_net(skb->sk);
689 - int cur_family = cb->args[3];
690 struct nft_ctx *ctx = cb->data, ctx_set;
691
692 if (cb->args[1])
693 @@ -2942,51 +2937,44 @@ static int nf_tables_dump_sets(struct sk
694 rcu_read_lock();
695 cb->seq = net->nft.base_seq;
696
697 - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
698 - if (ctx->afi && ctx->afi != afi)
699 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
700 + if (ctx->family != NFPROTO_UNSPEC &&
701 + ctx->family != table->afi->family)
702 continue;
703
704 - if (cur_family) {
705 - if (afi->family != cur_family)
706 - continue;
707 + if (ctx->table && ctx->table != table)
708 + continue;
709
710 - cur_family = 0;
711 - }
712 - list_for_each_entry_rcu(table, &afi->tables, list) {
713 - if (ctx->table && ctx->table != table)
714 + if (cur_table) {
715 + if (cur_table != table)
716 continue;
717
718 - if (cur_table) {
719 - if (cur_table != table)
720 - continue;
721 + cur_table = NULL;
722 + }
723 + idx = 0;
724 + list_for_each_entry_rcu(set, &table->sets, list) {
725 + if (idx < s_idx)
726 + goto cont;
727 + if (!nft_is_active(net, set))
728 + goto cont;
729
730 - cur_table = NULL;
731 + ctx_set = *ctx;
732 + ctx_set.table = table;
733 + ctx_set.family = table->afi->family;
734 +
735 + if (nf_tables_fill_set(skb, &ctx_set, set,
736 + NFT_MSG_NEWSET,
737 + NLM_F_MULTI) < 0) {
738 + cb->args[0] = idx;
739 + cb->args[2] = (unsigned long) table;
740 + goto done;
741 }
742 - idx = 0;
743 - list_for_each_entry_rcu(set, &table->sets, list) {
744 - if (idx < s_idx)
745 - goto cont;
746 - if (!nft_is_active(net, set))
747 - goto cont;
748 -
749 - ctx_set = *ctx;
750 - ctx_set.table = table;
751 - ctx_set.afi = afi;
752 - if (nf_tables_fill_set(skb, &ctx_set, set,
753 - NFT_MSG_NEWSET,
754 - NLM_F_MULTI) < 0) {
755 - cb->args[0] = idx;
756 - cb->args[2] = (unsigned long) table;
757 - cb->args[3] = afi->family;
758 - goto done;
759 - }
760 - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
761 + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
762 cont:
763 - idx++;
764 - }
765 - if (s_idx)
766 - s_idx = 0;
767 + idx++;
768 }
769 + if (s_idx)
770 + s_idx = 0;
771 }
772 cb->args[1] = 1;
773 done:
774 @@ -3196,11 +3184,12 @@ static int nf_tables_newset(struct net *
775 if (IS_ERR(afi))
776 return PTR_ERR(afi);
777
778 - table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask);
779 + table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], afi->family,
780 + genmask);
781 if (IS_ERR(table))
782 return PTR_ERR(table);
783
784 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
785 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
786
787 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
788 if (IS_ERR(set)) {
789 @@ -3469,12 +3458,12 @@ static int nft_ctx_init_from_elemattr(st
790 if (IS_ERR(afi))
791 return PTR_ERR(afi);
792
793 - table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE],
794 - genmask);
795 + table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
796 + afi->family, genmask);
797 if (IS_ERR(table))
798 return PTR_ERR(table);
799
800 - nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
801 + nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
802 return 0;
803 }
804
805 @@ -3579,7 +3568,6 @@ static int nf_tables_dump_set(struct sk_
806 {
807 struct nft_set_dump_ctx *dump_ctx = cb->data;
808 struct net *net = sock_net(skb->sk);
809 - struct nft_af_info *afi;
810 struct nft_table *table;
811 struct nft_set *set;
812 struct nft_set_dump_args args;
813 @@ -3591,21 +3579,19 @@ static int nf_tables_dump_set(struct sk_
814 int event;
815
816 rcu_read_lock();
817 - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
818 - if (afi != dump_ctx->ctx.afi)
819 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
820 + if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
821 + dump_ctx->ctx.family != table->afi->family)
822 continue;
823
824 - list_for_each_entry_rcu(table, &afi->tables, list) {
825 - if (table != dump_ctx->ctx.table)
826 - continue;
827 + if (table != dump_ctx->ctx.table)
828 + continue;
829
830 - list_for_each_entry_rcu(set, &table->sets, list) {
831 - if (set == dump_ctx->set) {
832 - set_found = true;
833 - break;
834 - }
835 + list_for_each_entry_rcu(set, &table->sets, list) {
836 + if (set == dump_ctx->set) {
837 + set_found = true;
838 + break;
839 }
840 - break;
841 }
842 break;
843 }
844 @@ -3625,7 +3611,7 @@ static int nf_tables_dump_set(struct sk_
845 goto nla_put_failure;
846
847 nfmsg = nlmsg_data(nlh);
848 - nfmsg->nfgen_family = afi->family;
849 + nfmsg->nfgen_family = table->afi->family;
850 nfmsg->version = NFNETLINK_V0;
851 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
852
853 @@ -3727,7 +3713,7 @@ static int nf_tables_fill_setelem_info(s
854 goto nla_put_failure;
855
856 nfmsg = nlmsg_data(nlh);
857 - nfmsg->nfgen_family = ctx->afi->family;
858 + nfmsg->nfgen_family = ctx->family;
859 nfmsg->version = NFNETLINK_V0;
860 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
861
862 @@ -3971,7 +3957,7 @@ static int nft_add_set_elem(struct nft_c
863 list_for_each_entry(binding, &set->bindings, list) {
864 struct nft_ctx bind_ctx = {
865 .net = ctx->net,
866 - .afi = ctx->afi,
867 + .family = ctx->family,
868 .table = ctx->table,
869 .chain = (struct nft_chain *)binding->chain,
870 };
871 @@ -4521,7 +4507,8 @@ static int nf_tables_newobj(struct net *
872 if (IS_ERR(afi))
873 return PTR_ERR(afi);
874
875 - table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
876 + table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
877 + genmask);
878 if (IS_ERR(table))
879 return PTR_ERR(table);
880
881 @@ -4539,7 +4526,7 @@ static int nf_tables_newobj(struct net *
882 return 0;
883 }
884
885 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
886 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
887
888 type = nft_obj_type_get(objtype);
889 if (IS_ERR(type))
890 @@ -4616,7 +4603,6 @@ struct nft_obj_filter {
891 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
892 {
893 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
894 - const struct nft_af_info *afi;
895 const struct nft_table *table;
896 unsigned int idx = 0, s_idx = cb->args[0];
897 struct nft_obj_filter *filter = cb->data;
898 @@ -4631,38 +4617,37 @@ static int nf_tables_dump_obj(struct sk_
899 rcu_read_lock();
900 cb->seq = net->nft.base_seq;
901
902 - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
903 - if (family != NFPROTO_UNSPEC && family != afi->family)
904 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
905 + if (family != NFPROTO_UNSPEC && family != table->afi->family)
906 continue;
907
908 - list_for_each_entry_rcu(table, &afi->tables, list) {
909 - list_for_each_entry_rcu(obj, &table->objects, list) {
910 - if (!nft_is_active(net, obj))
911 - goto cont;
912 - if (idx < s_idx)
913 - goto cont;
914 - if (idx > s_idx)
915 - memset(&cb->args[1], 0,
916 - sizeof(cb->args) - sizeof(cb->args[0]));
917 - if (filter && filter->table &&
918 - strcmp(filter->table, table->name))
919 - goto cont;
920 - if (filter &&
921 - filter->type != NFT_OBJECT_UNSPEC &&
922 - obj->ops->type->type != filter->type)
923 - goto cont;
924 + list_for_each_entry_rcu(obj, &table->objects, list) {
925 + if (!nft_is_active(net, obj))
926 + goto cont;
927 + if (idx < s_idx)
928 + goto cont;
929 + if (idx > s_idx)
930 + memset(&cb->args[1], 0,
931 + sizeof(cb->args) - sizeof(cb->args[0]));
932 + if (filter && filter->table &&
933 + strcmp(filter->table, table->name))
934 + goto cont;
935 + if (filter &&
936 + filter->type != NFT_OBJECT_UNSPEC &&
937 + obj->ops->type->type != filter->type)
938 + goto cont;
939
940 - if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
941 - cb->nlh->nlmsg_seq,
942 - NFT_MSG_NEWOBJ,
943 - NLM_F_MULTI | NLM_F_APPEND,
944 - afi->family, table, obj, reset) < 0)
945 - goto done;
946 + if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
947 + cb->nlh->nlmsg_seq,
948 + NFT_MSG_NEWOBJ,
949 + NLM_F_MULTI | NLM_F_APPEND,
950 + table->afi->family, table,
951 + obj, reset) < 0)
952 + goto done;
953
954 - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
955 + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
956 cont:
957 - idx++;
958 - }
959 + idx++;
960 }
961 }
962 done:
963 @@ -4749,7 +4734,8 @@ static int nf_tables_getobj(struct net *
964 if (IS_ERR(afi))
965 return PTR_ERR(afi);
966
967 - table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
968 + table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
969 + genmask);
970 if (IS_ERR(table))
971 return PTR_ERR(table);
972
973 @@ -4809,7 +4795,8 @@ static int nf_tables_delobj(struct net *
974 if (IS_ERR(afi))
975 return PTR_ERR(afi);
976
977 - table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
978 + table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
979 + genmask);
980 if (IS_ERR(table))
981 return PTR_ERR(table);
982
983 @@ -4820,7 +4807,7 @@ static int nf_tables_delobj(struct net *
984 if (obj->use > 0)
985 return -EBUSY;
986
987 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
988 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
989
990 return nft_delobj(&ctx, obj);
991 }
992 @@ -4858,7 +4845,7 @@ static void nf_tables_obj_notify(const s
993 struct nft_object *obj, int event)
994 {
995 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
996 - ctx->afi->family, ctx->report, GFP_KERNEL);
997 + ctx->family, ctx->report, GFP_KERNEL);
998 }
999
1000 /*
1001 @@ -5048,7 +5035,7 @@ void nft_flow_table_iterate(struct net *
1002
1003 rcu_read_lock();
1004 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
1005 - list_for_each_entry_rcu(table, &afi->tables, list) {
1006 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
1007 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
1008 iter(&flowtable->data, data);
1009 }
1010 @@ -5096,7 +5083,8 @@ static int nf_tables_newflowtable(struct
1011 if (IS_ERR(afi))
1012 return PTR_ERR(afi);
1013
1014 - table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
1015 + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
1016 + afi->family, genmask);
1017 if (IS_ERR(table))
1018 return PTR_ERR(table);
1019
1020 @@ -5113,7 +5101,7 @@ static int nf_tables_newflowtable(struct
1021 return 0;
1022 }
1023
1024 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
1025 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
1026
1027 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
1028 if (!flowtable)
1029 @@ -5194,7 +5182,8 @@ static int nf_tables_delflowtable(struct
1030 if (IS_ERR(afi))
1031 return PTR_ERR(afi);
1032
1033 - table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
1034 + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
1035 + afi->family, genmask);
1036 if (IS_ERR(table))
1037 return PTR_ERR(table);
1038
1039 @@ -5205,7 +5194,7 @@ static int nf_tables_delflowtable(struct
1040 if (flowtable->use > 0)
1041 return -EBUSY;
1042
1043 - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
1044 + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
1045
1046 return nft_delflowtable(&ctx, flowtable);
1047 }
1048 @@ -5274,40 +5263,37 @@ static int nf_tables_dump_flowtable(stru
1049 struct net *net = sock_net(skb->sk);
1050 int family = nfmsg->nfgen_family;
1051 struct nft_flowtable *flowtable;
1052 - const struct nft_af_info *afi;
1053 const struct nft_table *table;
1054
1055 rcu_read_lock();
1056 cb->seq = net->nft.base_seq;
1057
1058 - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
1059 - if (family != NFPROTO_UNSPEC && family != afi->family)
1060 + list_for_each_entry_rcu(table, &net->nft.tables, list) {
1061 + if (family != NFPROTO_UNSPEC && family != table->afi->family)
1062 continue;
1063
1064 - list_for_each_entry_rcu(table, &afi->tables, list) {
1065 - list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
1066 - if (!nft_is_active(net, flowtable))
1067 - goto cont;
1068 - if (idx < s_idx)
1069 - goto cont;
1070 - if (idx > s_idx)
1071 - memset(&cb->args[1], 0,
1072 - sizeof(cb->args) - sizeof(cb->args[0]));
1073 - if (filter && filter->table[0] &&
1074 - strcmp(filter->table, table->name))
1075 - goto cont;
1076 + list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
1077 + if (!nft_is_active(net, flowtable))
1078 + goto cont;
1079 + if (idx < s_idx)
1080 + goto cont;
1081 + if (idx > s_idx)
1082 + memset(&cb->args[1], 0,
1083 + sizeof(cb->args) - sizeof(cb->args[0]));
1084 + if (filter && filter->table &&
1085 + strcmp(filter->table, table->name))
1086 + goto cont;
1087
1088 - if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
1089 - cb->nlh->nlmsg_seq,
1090 - NFT_MSG_NEWFLOWTABLE,
1091 - NLM_F_MULTI | NLM_F_APPEND,
1092 - afi->family, flowtable) < 0)
1093 - goto done;
1094 + if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
1095 + cb->nlh->nlmsg_seq,
1096 + NFT_MSG_NEWFLOWTABLE,
1097 + NLM_F_MULTI | NLM_F_APPEND,
1098 + table->afi->family, flowtable) < 0)
1099 + goto done;
1100
1101 - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1102 + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1103 cont:
1104 - idx++;
1105 - }
1106 + idx++;
1107 }
1108 }
1109 done:
1110 @@ -5392,7 +5378,8 @@ static int nf_tables_getflowtable(struct
1111 if (IS_ERR(afi))
1112 return PTR_ERR(afi);
1113
1114 - table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
1115 + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
1116 + afi->family, genmask);
1117 if (IS_ERR(table))
1118 return PTR_ERR(table);
1119
1120 @@ -5435,7 +5422,7 @@ static void nf_tables_flowtable_notify(s
1121
1122 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
1123 ctx->seq, event, 0,
1124 - ctx->afi->family, flowtable);
1125 + ctx->family, flowtable);
1126 if (err < 0) {
1127 kfree_skb(skb);
1128 goto err;
1129 @@ -5513,17 +5500,14 @@ static int nf_tables_flowtable_event(str
1130 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1131 struct nft_flowtable *flowtable;
1132 struct nft_table *table;
1133 - struct nft_af_info *afi;
1134
1135 if (event != NETDEV_UNREGISTER)
1136 return 0;
1137
1138 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1139 - list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
1140 - list_for_each_entry(table, &afi->tables, list) {
1141 - list_for_each_entry(flowtable, &table->flowtables, list) {
1142 - nft_flowtable_event(event, dev, flowtable);
1143 - }
1144 + list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
1145 + list_for_each_entry(flowtable, &table->flowtables, list) {
1146 + nft_flowtable_event(event, dev, flowtable);
1147 }
1148 }
1149 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1150 @@ -6549,6 +6533,7 @@ EXPORT_SYMBOL_GPL(nft_data_dump);
1151 static int __net_init nf_tables_init_net(struct net *net)
1152 {
1153 INIT_LIST_HEAD(&net->nft.af_info);
1154 + INIT_LIST_HEAD(&net->nft.tables);
1155 INIT_LIST_HEAD(&net->nft.commit_list);
1156 net->nft.base_seq = 1;
1157 return 0;
1158 @@ -6585,10 +6570,10 @@ static void __nft_release_afinfo(struct
1159 struct nft_set *set, *ns;
1160 struct nft_ctx ctx = {
1161 .net = net,
1162 - .afi = afi,
1163 + .family = afi->family,
1164 };
1165
1166 - list_for_each_entry_safe(table, nt, &afi->tables, list) {
1167 + list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
1168 list_for_each_entry(chain, &table->chains, list)
1169 nf_tables_unregister_hook(net, table, chain);
1170 list_for_each_entry(flowtable, &table->flowtables, list)
1171 --- a/net/netfilter/nf_tables_netdev.c
1172 +++ b/net/netfilter/nf_tables_netdev.c
1173 @@ -107,7 +107,6 @@ static int nf_tables_netdev_event(struct
1174 unsigned long event, void *ptr)
1175 {
1176 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1177 - struct nft_af_info *afi;
1178 struct nft_table *table;
1179 struct nft_chain *chain, *nr;
1180 struct nft_ctx ctx = {
1181 @@ -119,20 +118,18 @@ static int nf_tables_netdev_event(struct
1182 return NOTIFY_DONE;
1183
1184 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1185 - list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
1186 - ctx.afi = afi;
1187 - if (afi->family != NFPROTO_NETDEV)
1188 + list_for_each_entry(table, &ctx.net->nft.tables, list) {
1189 + if (table->afi->family != NFPROTO_NETDEV)
1190 continue;
1191
1192 - list_for_each_entry(table, &afi->tables, list) {
1193 - ctx.table = table;
1194 - list_for_each_entry_safe(chain, nr, &table->chains, list) {
1195 - if (!nft_is_base_chain(chain))
1196 - continue;
1197 + ctx.family = table->afi->family;
1198 + ctx.table = table;
1199 + list_for_each_entry_safe(chain, nr, &table->chains, list) {
1200 + if (!nft_is_base_chain(chain))
1201 + continue;
1202
1203 - ctx.chain = chain;
1204 - nft_netdev_event(event, dev, &ctx);
1205 - }
1206 + ctx.chain = chain;
1207 + nft_netdev_event(event, dev, &ctx);
1208 }
1209 }
1210 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1211 --- a/net/netfilter/nft_compat.c
1212 +++ b/net/netfilter/nft_compat.c
1213 @@ -161,7 +161,7 @@ nft_target_set_tgchk_param(struct xt_tgc
1214 {
1215 par->net = ctx->net;
1216 par->table = ctx->table->name;
1217 - switch (ctx->afi->family) {
1218 + switch (ctx->family) {
1219 case AF_INET:
1220 entry->e4.ip.proto = proto;
1221 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
1222 @@ -192,7 +192,7 @@ nft_target_set_tgchk_param(struct xt_tgc
1223 } else {
1224 par->hook_mask = 0;
1225 }
1226 - par->family = ctx->afi->family;
1227 + par->family = ctx->family;
1228 par->nft_compat = true;
1229 }
1230
1231 @@ -282,7 +282,7 @@ nft_target_destroy(const struct nft_ctx
1232 par.net = ctx->net;
1233 par.target = target;
1234 par.targinfo = info;
1235 - par.family = ctx->afi->family;
1236 + par.family = ctx->family;
1237 if (par.target->destroy != NULL)
1238 par.target->destroy(&par);
1239
1240 @@ -389,7 +389,7 @@ nft_match_set_mtchk_param(struct xt_mtch
1241 {
1242 par->net = ctx->net;
1243 par->table = ctx->table->name;
1244 - switch (ctx->afi->family) {
1245 + switch (ctx->family) {
1246 case AF_INET:
1247 entry->e4.ip.proto = proto;
1248 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
1249 @@ -420,7 +420,7 @@ nft_match_set_mtchk_param(struct xt_mtch
1250 } else {
1251 par->hook_mask = 0;
1252 }
1253 - par->family = ctx->afi->family;
1254 + par->family = ctx->family;
1255 par->nft_compat = true;
1256 }
1257
1258 @@ -503,7 +503,7 @@ __nft_match_destroy(const struct nft_ctx
1259 par.net = ctx->net;
1260 par.match = match;
1261 par.matchinfo = info;
1262 - par.family = ctx->afi->family;
1263 + par.family = ctx->family;
1264 if (par.match->destroy != NULL)
1265 par.match->destroy(&par);
1266
1267 @@ -733,7 +733,7 @@ nft_match_select_ops(const struct nft_ct
1268
1269 mt_name = nla_data(tb[NFTA_MATCH_NAME]);
1270 rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
1271 - family = ctx->afi->family;
1272 + family = ctx->family;
1273
1274 /* Re-use the existing match if it's already loaded. */
1275 list_for_each_entry(nft_match, &nft_match_list, head) {
1276 @@ -824,7 +824,7 @@ nft_target_select_ops(const struct nft_c
1277
1278 tg_name = nla_data(tb[NFTA_TARGET_NAME]);
1279 rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
1280 - family = ctx->afi->family;
1281 + family = ctx->family;
1282
1283 if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
1284 strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
1285 --- a/net/netfilter/nft_ct.c
1286 +++ b/net/netfilter/nft_ct.c
1287 @@ -405,7 +405,7 @@ static int nft_ct_get_init(const struct
1288 if (tb[NFTA_CT_DIRECTION] == NULL)
1289 return -EINVAL;
1290
1291 - switch (ctx->afi->family) {
1292 + switch (ctx->family) {
1293 case NFPROTO_IPV4:
1294 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
1295 src.u3.ip);
1296 @@ -456,7 +456,7 @@ static int nft_ct_get_init(const struct
1297 if (err < 0)
1298 return err;
1299
1300 - err = nf_ct_netns_get(ctx->net, ctx->afi->family);
1301 + err = nf_ct_netns_get(ctx->net, ctx->family);
1302 if (err < 0)
1303 return err;
1304
1305 @@ -550,7 +550,7 @@ static int nft_ct_set_init(const struct
1306 if (err < 0)
1307 goto err1;
1308
1309 - err = nf_ct_netns_get(ctx->net, ctx->afi->family);
1310 + err = nf_ct_netns_get(ctx->net, ctx->family);
1311 if (err < 0)
1312 goto err1;
1313
1314 @@ -564,7 +564,7 @@ err1:
1315 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
1316 const struct nft_expr *expr)
1317 {
1318 - nf_ct_netns_put(ctx->net, ctx->afi->family);
1319 + nf_ct_netns_put(ctx->net, ctx->family);
1320 }
1321
1322 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
1323 @@ -573,7 +573,7 @@ static void nft_ct_set_destroy(const str
1324 struct nft_ct *priv = nft_expr_priv(expr);
1325
1326 __nft_ct_set_destroy(ctx, priv);
1327 - nf_ct_netns_put(ctx->net, ctx->afi->family);
1328 + nf_ct_netns_put(ctx->net, ctx->family);
1329 }
1330
1331 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
1332 @@ -734,7 +734,7 @@ static int nft_ct_helper_obj_init(const
1333 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1334 struct nf_conntrack_helper *help4, *help6;
1335 char name[NF_CT_HELPER_NAME_LEN];
1336 - int family = ctx->afi->family;
1337 + int family = ctx->family;
1338
1339 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1340 return -EINVAL;
1341 @@ -753,14 +753,14 @@ static int nft_ct_helper_obj_init(const
1342
1343 switch (family) {
1344 case NFPROTO_IPV4:
1345 - if (ctx->afi->family == NFPROTO_IPV6)
1346 + if (ctx->family == NFPROTO_IPV6)
1347 return -EINVAL;
1348
1349 help4 = nf_conntrack_helper_try_module_get(name, family,
1350 priv->l4proto);
1351 break;
1352 case NFPROTO_IPV6:
1353 - if (ctx->afi->family == NFPROTO_IPV4)
1354 + if (ctx->family == NFPROTO_IPV4)
1355 return -EINVAL;
1356
1357 help6 = nf_conntrack_helper_try_module_get(name, family,
1358 --- a/net/netfilter/nft_flow_offload.c
1359 +++ b/net/netfilter/nft_flow_offload.c
1360 @@ -151,7 +151,7 @@ static int nft_flow_offload_init(const s
1361 priv->flowtable = flowtable;
1362 flowtable->use++;
1363
1364 - return nf_ct_netns_get(ctx->net, ctx->afi->family);
1365 + return nf_ct_netns_get(ctx->net, ctx->family);
1366 }
1367
1368 static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
1369 @@ -160,7 +160,7 @@ static void nft_flow_offload_destroy(con
1370 struct nft_flow_offload *priv = nft_expr_priv(expr);
1371
1372 priv->flowtable->use--;
1373 - nf_ct_netns_put(ctx->net, ctx->afi->family);
1374 + nf_ct_netns_put(ctx->net, ctx->family);
1375 }
1376
1377 static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr)
1378 --- a/net/netfilter/nft_log.c
1379 +++ b/net/netfilter/nft_log.c
1380 @@ -112,7 +112,7 @@ static int nft_log_init(const struct nft
1381 break;
1382 }
1383
1384 - err = nf_logger_find_get(ctx->afi->family, li->type);
1385 + err = nf_logger_find_get(ctx->family, li->type);
1386 if (err < 0)
1387 goto err1;
1388
1389 @@ -133,7 +133,7 @@ static void nft_log_destroy(const struct
1390 if (priv->prefix != nft_log_null_prefix)
1391 kfree(priv->prefix);
1392
1393 - nf_logger_put(ctx->afi->family, li->type);
1394 + nf_logger_put(ctx->family, li->type);
1395 }
1396
1397 static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)
1398 --- a/net/netfilter/nft_masq.c
1399 +++ b/net/netfilter/nft_masq.c
1400 @@ -73,7 +73,7 @@ int nft_masq_init(const struct nft_ctx *
1401 }
1402 }
1403
1404 - return nf_ct_netns_get(ctx->net, ctx->afi->family);
1405 + return nf_ct_netns_get(ctx->net, ctx->family);
1406 }
1407 EXPORT_SYMBOL_GPL(nft_masq_init);
1408
1409 --- a/net/netfilter/nft_meta.c
1410 +++ b/net/netfilter/nft_meta.c
1411 @@ -341,7 +341,7 @@ static int nft_meta_get_validate(const s
1412 if (priv->key != NFT_META_SECPATH)
1413 return 0;
1414
1415 - switch (ctx->afi->family) {
1416 + switch (ctx->family) {
1417 case NFPROTO_NETDEV:
1418 hooks = 1 << NF_NETDEV_INGRESS;
1419 break;
1420 @@ -372,7 +372,7 @@ int nft_meta_set_validate(const struct n
1421 if (priv->key != NFT_META_PKTTYPE)
1422 return 0;
1423
1424 - switch (ctx->afi->family) {
1425 + switch (ctx->family) {
1426 case NFPROTO_BRIDGE:
1427 hooks = 1 << NF_BR_PRE_ROUTING;
1428 break;
1429 --- a/net/netfilter/nft_nat.c
1430 +++ b/net/netfilter/nft_nat.c
1431 @@ -142,7 +142,7 @@ static int nft_nat_init(const struct nft
1432 return -EINVAL;
1433
1434 family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
1435 - if (family != ctx->afi->family)
1436 + if (family != ctx->family)
1437 return -EOPNOTSUPP;
1438
1439 switch (family) {
1440 --- a/net/netfilter/nft_redir.c
1441 +++ b/net/netfilter/nft_redir.c
1442 @@ -75,7 +75,7 @@ int nft_redir_init(const struct nft_ctx
1443 return -EINVAL;
1444 }
1445
1446 - return nf_ct_netns_get(ctx->net, ctx->afi->family);
1447 + return nf_ct_netns_get(ctx->net, ctx->family);
1448 }
1449 EXPORT_SYMBOL_GPL(nft_redir_init);
1450
Staging tree of Sander Vanheule