mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
netfilter: nf_tables_offload: remove rules on unregistered device only
After unbinding the list of flow_block callbacks, iterate over it to remove the existing rules in the netdevice that has just been unregistered. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
c5d275276f
commit
bbaef955af
1 changed files with 13 additions and 13 deletions
|
@ -206,6 +206,16 @@ static int nft_flow_offload_unbind(struct flow_block_offload *bo,
|
||||||
struct nft_base_chain *basechain)
|
struct nft_base_chain *basechain)
|
||||||
{
|
{
|
||||||
struct flow_block_cb *block_cb, *next;
|
struct flow_block_cb *block_cb, *next;
|
||||||
|
struct flow_cls_offload cls_flow;
|
||||||
|
struct nft_chain *chain;
|
||||||
|
struct nft_rule *rule;
|
||||||
|
|
||||||
|
chain = &basechain->chain;
|
||||||
|
list_for_each_entry(rule, &chain->rules, list) {
|
||||||
|
nft_flow_cls_offload_setup(&cls_flow, basechain, rule, NULL,
|
||||||
|
FLOW_CLS_DESTROY);
|
||||||
|
nft_setup_cb_call(TC_SETUP_CLSFLOWER, &cls_flow, &bo->cb_list);
|
||||||
|
}
|
||||||
|
|
||||||
list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
|
list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
|
||||||
list_del(&block_cb->list);
|
list_del(&block_cb->list);
|
||||||
|
@ -445,18 +455,6 @@ static void nft_indr_block_cb(struct net_device *dev,
|
||||||
mutex_unlock(&net->nft.commit_mutex);
|
mutex_unlock(&net->nft.commit_mutex);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void nft_offload_chain_clean(struct nft_chain *chain)
|
|
||||||
{
|
|
||||||
struct nft_rule *rule;
|
|
||||||
|
|
||||||
list_for_each_entry(rule, &chain->rules, list) {
|
|
||||||
nft_flow_offload_rule(chain, rule,
|
|
||||||
NULL, FLOW_CLS_DESTROY);
|
|
||||||
}
|
|
||||||
|
|
||||||
nft_flow_offload_chain(chain, NULL, FLOW_BLOCK_UNBIND);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int nft_offload_netdev_event(struct notifier_block *this,
|
static int nft_offload_netdev_event(struct notifier_block *this,
|
||||||
unsigned long event, void *ptr)
|
unsigned long event, void *ptr)
|
||||||
{
|
{
|
||||||
|
@ -467,7 +465,9 @@ static int nft_offload_netdev_event(struct notifier_block *this,
|
||||||
mutex_lock(&net->nft.commit_mutex);
|
mutex_lock(&net->nft.commit_mutex);
|
||||||
chain = __nft_offload_get_chain(dev);
|
chain = __nft_offload_get_chain(dev);
|
||||||
if (chain)
|
if (chain)
|
||||||
nft_offload_chain_clean(chain);
|
nft_flow_block_chain(nft_base_chain(chain), dev,
|
||||||
|
FLOW_BLOCK_UNBIND);
|
||||||
|
|
||||||
mutex_unlock(&net->nft.commit_mutex);
|
mutex_unlock(&net->nft.commit_mutex);
|
||||||
|
|
||||||
return NOTIFY_DONE;
|
return NOTIFY_DONE;
|
||||||
|
|
Loading…
Reference in a new issue