Commit d163a925 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: arp_tables: add pre_exit hook for table unregister 



Same problem that also existed in iptables/ip(6)tables, when
arptable_filter is removed there is no longer a wait period before the
table/ruleset is free'd.

Unregister the hook in pre_exit, then remove the table in the exit
function.
This used to work correctly because the old nf_hook_unregister API
did unconditional synchronize_net.

The per-net hook unregister function uses call_rcu instead.

Fixes: b9e69e12 ("netfilter: xtables: don't hook tables by default")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7ee3c61d

include/linux/netfilter_arp/arp_tables.h

+3 −2
Original line number Diff line number Diff line
@@ -52,7 +52,8 @@ extern void *arpt_alloc_initial_table(const struct xt_table *); 
int arpt_register_table(struct net *net, const struct xt_table *table,

			const struct arpt_replace *repl,

			const struct nf_hook_ops *ops, struct xt_table **res);

void arpt_unregister_table(struct net *net, struct xt_table *table,

void arpt_unregister_table(struct net *net, struct xt_table *table);

void arpt_unregister_table_pre_exit(struct net *net, struct xt_table *table,

				    const struct nf_hook_ops *ops);

extern unsigned int arpt_do_table(struct sk_buff *skb,

				  const struct nf_hook_state *state,

net/ipv4/netfilter/arp_tables.c

+7 −2
Original line number Diff line number Diff line
@@ -1539,10 +1539,15 @@ int arpt_register_table(struct net *net, 
	return ret;

}



void arpt_unregister_table(struct net *net, struct xt_table *table,

void arpt_unregister_table_pre_exit(struct net *net, struct xt_table *table,

				    const struct nf_hook_ops *ops)

{

	nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));

}

EXPORT_SYMBOL(arpt_unregister_table_pre_exit);



void arpt_unregister_table(struct net *net, struct xt_table *table)

{

	__arpt_unregister_table(net, table);

}

net/ipv4/netfilter/arptable_filter.c

+9 −1
Original line number Diff line number Diff line
@@ -56,16 +56,24 @@ static int __net_init arptable_filter_table_init(struct net *net) 
	return err;

}



static void __net_exit arptable_filter_net_pre_exit(struct net *net)

{

	if (net->ipv4.arptable_filter)

		arpt_unregister_table_pre_exit(net, net->ipv4.arptable_filter,

					       arpfilter_ops);

}



static void __net_exit arptable_filter_net_exit(struct net *net)

{

	if (!net->ipv4.arptable_filter)

		return;

	arpt_unregister_table(net, net->ipv4.arptable_filter, arpfilter_ops);

	arpt_unregister_table(net, net->ipv4.arptable_filter);

	net->ipv4.arptable_filter = NULL;

}



static struct pernet_operations arptable_filter_net_ops = {

	.exit = arptable_filter_net_exit,

	.pre_exit = arptable_filter_net_pre_exit,

};



static int __init arptable_filter_init(void)