netfilter: xtables: add struct xt_mtdtor_param::net

[safe/jmp/linux-2.6] / net / ipv4 / netfilter / iptable_filter.c

diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 69f3d7e..dee90eb 100644 (file)
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -53,23 +53,34 @@ static struct
        .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table packet_filter = {
+static const struct xt_table packet_filter = {
        .name           = "filter",
        .valid_hooks    = FILTER_VALID_HOOKS,
-       .lock           = RW_LOCK_UNLOCKED,
        .me             = THIS_MODULE,
-       .af             = AF_INET,
+       .af             = NFPROTO_IPV4,
 };
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
+ipt_local_in_hook(unsigned int hook,
+                 struct sk_buff *skb,
+                 const struct net_device *in,
+                 const struct net_device *out,
+                 int (*okfn)(struct sk_buff *))
+{
+       return ipt_do_table(skb, hook, in, out,
+                           dev_net(in)->ipv4.iptable_filter);
+}
+
+static unsigned int
 ipt_hook(unsigned int hook,
         struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-       return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_filter);
+       return ipt_do_table(skb, hook, in, out,
+                           dev_net(in)->ipv4.iptable_filter);
 }
 
 static unsigned int
@@ -81,35 +92,31 @@ ipt_local_out_hook(unsigned int hook,
 {
        /* root is playing with raw sockets. */
        if (skb->len < sizeof(struct iphdr) ||
-           ip_hdrlen(skb) < sizeof(struct iphdr)) {
-               if (net_ratelimit())
-                       printk("iptable_filter: ignoring short SOCK_RAW "
-                              "packet.\n");
+           ip_hdrlen(skb) < sizeof(struct iphdr))
                return NF_ACCEPT;
-       }
-
-       return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_filter);
+       return ipt_do_table(skb, hook, in, out,
+                           dev_net(out)->ipv4.iptable_filter);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {
        {
-               .hook           = ipt_hook,
+               .hook           = ipt_local_in_hook,
                .owner          = THIS_MODULE,
-               .pf             = PF_INET,
+               .pf             = NFPROTO_IPV4,
                .hooknum        = NF_INET_LOCAL_IN,
                .priority       = NF_IP_PRI_FILTER,
        },
        {
                .hook           = ipt_hook,
                .owner          = THIS_MODULE,
-               .pf             = PF_INET,
+               .pf             = NFPROTO_IPV4,
                .hooknum        = NF_INET_FORWARD,
                .priority       = NF_IP_PRI_FILTER,
        },
        {
                .hook           = ipt_local_out_hook,
                .owner          = THIS_MODULE,
-               .pf             = PF_INET,
+               .pf             = NFPROTO_IPV4,
                .hooknum        = NF_INET_LOCAL_OUT,
                .priority       = NF_IP_PRI_FILTER,
        },
@@ -131,7 +138,7 @@ static int __net_init iptable_filter_net_init(struct net *net)
 
 static void __net_exit iptable_filter_net_exit(struct net *net)
 {
-       ipt_unregister_table(net->ipv4.iptable_filter);
+       ipt_unregister_table(net, net->ipv4.iptable_filter);
 }
 
 static struct pernet_operations iptable_filter_net_ops = {