netfilter: xtables: generate initial table on-demand

[safe/jmp/linux-2.6] / net / ipv4 / netfilter / iptable_mangle.c

diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 2355a22..58d7097 100644 (file)
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -27,43 +27,6 @@ MODULE_DESCRIPTION("iptables mangle table");
                            (1 << NF_INET_LOCAL_OUT) | \
                            (1 << NF_INET_POST_ROUTING))
 
-/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
-static const struct
-{
-       struct ipt_replace repl;
-       struct ipt_standard entries[5];
-       struct ipt_error term;
-} initial_table __net_initdata = {
-       .repl = {
-               .name = "mangle",
-               .valid_hooks = MANGLE_VALID_HOOKS,
-               .num_entries = 6,
-               .size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
-               .hook_entry = {
-                       [NF_INET_PRE_ROUTING]   = 0,
-                       [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
-                       [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
-                       [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
-                       [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
-               },
-               .underflow = {
-                       [NF_INET_PRE_ROUTING]   = 0,
-                       [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
-                       [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
-                       [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
-                       [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
-               },
-       },
-       .entries = {
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
-       },
-       .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table packet_mangler = {
        .name           = "mangle",
        .valid_hooks    = MANGLE_VALID_HOOKS,
@@ -134,9 +97,14 @@ static struct nf_hook_ops *mangle_ops __read_mostly;
 
 static int __net_init iptable_mangle_net_init(struct net *net)
 {
-       /* Register table */
+       struct ipt_replace *repl;
+
+       repl = ipt_alloc_initial_table(&packet_mangler);
+       if (repl == NULL)
+               return -ENOMEM;
        net->ipv4.iptable_mangle =
-               ipt_register_table(net, &packet_mangler, &initial_table.repl);
+               ipt_register_table(net, &packet_mangler, repl);
+       kfree(repl);
        if (IS_ERR(net->ipv4.iptable_mangle))
                return PTR_ERR(net->ipv4.iptable_mangle);
        return 0;