netfilter: xtables: allow table definitions not backed by hook_ops

The ip(6)tables nat table is currently receiving skbs from the netfilter
core, after a followup patch skbs will be coming from the netfilter nat
core instead, so the table is no longer backed by normal hook_ops.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 444f125f3974c5c5ece3aec4842b5f0bbe5b2ef2..ddcc56c37d4d23affa7c366060854dcd1c70db1d 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1782,6 +1782,8 @@ int ipt_register_table(struct net *net, const struct xt_table *table,
 
        /* set res now, will see skbs right after nf_register_net_hooks */
        WRITE_ONCE(*res, new_table);
+       if (!ops)
+               return 0;
 
        ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
        if (ret != 0) {
@@ -1799,7 +1801,8 @@ out_free:
 void ipt_unregister_table(struct net *net, struct xt_table *table,
                          const struct nf_hook_ops *ops)
 {
-       nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
+       if (ops)
+               nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
        __ipt_unregister_table(net, table);
 }
 

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 7097bbf958430e72a780441875d62fddb4c06dcf..e18b14b2e019175cfcfa28e8e019f09ae5cf9066 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1792,6 +1792,8 @@ int ip6t_register_table(struct net *net, const struct xt_table *table,
 
        /* set res now, will see skbs right after nf_register_net_hooks */
        WRITE_ONCE(*res, new_table);
+       if (!ops)
+               return 0;
 
        ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
        if (ret != 0) {
@@ -1809,7 +1811,8 @@ out_free:
 void ip6t_unregister_table(struct net *net, struct xt_table *table,
                           const struct nf_hook_ops *ops)
 {
-       nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
+       if (ops)
+               nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
        __ip6t_unregister_table(net, table);
 }