netfilter: nf_tables: drop unused 3rd argument from validate callback ops

Since commit a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation")
the validate() callback no longer needs the return pointer argument.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 1cc33d946d41f1b4082a4957dee3d0e36c08134e..7cd60ea7cdee6b021cff072c6cf1a84339823e7e 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -961,8 +961,7 @@ struct nft_expr_ops {
                                                const struct nft_expr *expr,
                                                bool reset);
        int                             (*validate)(const struct nft_ctx *ctx,
-                                                   const struct nft_expr *expr,
-                                                   const struct nft_data **data);
+                                                   const struct nft_expr *expr);
        bool                            (*reduce)(struct nft_regs_track *track,
                                                  const struct nft_expr *expr);
        bool                            (*gc)(struct net *net,

diff --git a/include/net/netfilter/nft_fib.h b/include/net/netfilter/nft_fib.h
index 167640b843ef8ac4e77cf46f5076fcfbaca9ae04..38cae7113de4621824472352f3f0ab9e1054707e 100644 (file)
--- a/include/net/netfilter/nft_fib.h
+++ b/include/net/netfilter/nft_fib.h
@@ -21,9 +21,7 @@ nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in)
 int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr, bool reset);
 int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 const struct nlattr * const tb[]);
-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
-                    const struct nft_data **data);
-
+int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr);
 
 void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs,
                        const struct nft_pktinfo *pkt);

diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h
index ba1238f12a487a4ccc6ae4ee19661d1c4538de05..d602263590fed53d362f280faa6978d22394c49a 100644 (file)
--- a/include/net/netfilter/nft_meta.h
+++ b/include/net/netfilter/nft_meta.h
@@ -41,8 +41,7 @@ void nft_meta_set_destroy(const struct nft_ctx *ctx,
                          const struct nft_expr *expr);
 
 int nft_meta_set_validate(const struct nft_ctx *ctx,
-                         const struct nft_expr *expr,
-                         const struct nft_data **data);
+                         const struct nft_expr *expr);
 
 bool nft_meta_get_reduce(struct nft_regs_track *track,
                         const struct nft_expr *expr);

diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h
index 6d9ba62efd7504cb8d521b3736133e704f1ea01a..19060212988a1e97bc9e3296aaab63cf98840e6b 100644 (file)
--- a/include/net/netfilter/nft_reject.h
+++ b/include/net/netfilter/nft_reject.h
@@ -15,8 +15,7 @@ struct nft_reject {
 extern const struct nla_policy nft_reject_policy[];
 
 int nft_reject_validate(const struct nft_ctx *ctx,
-                       const struct nft_expr *expr,
-                       const struct nft_data **data);
+                       const struct nft_expr *expr);
 
 int nft_reject_init(const struct nft_ctx *ctx,
                    const struct nft_expr *expr,

diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 4d8e15927217ba3db4510e90bef691fde5ef18c4..d12a221366d60c8eb13182913149cd887243f30a 100644 (file)
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -168,8 +168,7 @@ static bool nft_meta_bridge_set_reduce(struct nft_regs_track *track,
 }
 
 static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx,
-                                       const struct nft_expr *expr,
-                                       const struct nft_data **data)
+                                       const struct nft_expr *expr)
 {
        struct nft_meta *priv = nft_expr_priv(expr);
        unsigned int hooks;
@@ -179,7 +178,7 @@ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx,
                hooks = 1 << NF_BR_PRE_ROUTING;
                break;
        default:
-               return nft_meta_set_validate(ctx, expr, data);
+               return nft_meta_set_validate(ctx, expr);
        }
 
        return nft_chain_validate_hooks(ctx->chain, hooks);

diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index 71b54fed7263df62342102fc6effc25e6be17d52..1cb5c16e97b7fa493bdae4e1dbebe7ff695e0884 100644 (file)
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -170,8 +170,7 @@ out:
 }
 
 static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
-                                     const struct nft_expr *expr,
-                                     const struct nft_data **data)
+                                     const struct nft_expr *expr)
 {
        return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) |
                                                    (1 << NF_BR_LOCAL_IN));

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 904f2e25b4a4dd520000e8e21f4fa9f290423084..b6547fe22bd8ddeb9fe2bd7da183206516b68d48 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3886,7 +3886,6 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r
 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
 {
        struct nft_expr *expr, *last;
-       const struct nft_data *data;
        struct nft_rule *rule;
        int err;
 
@@ -3907,7 +3906,7 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
                        /* This may call nft_chain_validate() recursively,
                         * callers that do so must increment ctx->level.
                         */
-                       err = expr->ops->validate(ctx, expr, &data);
+                       err = expr->ops->validate(ctx, expr);
                        if (err < 0)
                                return err;
                }

diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index d3d11dede54507262022725a5e54a12f0def7f89..52cdfee17f73f111e3c2423d1ad9dbc4239b8e3d 100644 (file)
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -350,8 +350,7 @@ nla_put_failure:
 }
 
 static int nft_target_validate(const struct nft_ctx *ctx,
-                              const struct nft_expr *expr,
-                              const struct nft_data **data)
+                              const struct nft_expr *expr)
 {
        struct xt_target *target = expr->ops->data;
        unsigned int hook_mask = 0;
@@ -611,8 +610,7 @@ static int nft_match_large_dump(struct sk_buff *skb,
 }
 
 static int nft_match_validate(const struct nft_ctx *ctx,
-                             const struct nft_expr *expr,
-                             const struct nft_data **data)
+                             const struct nft_expr *expr)
 {
        struct xt_match *match = expr->ops->data;
        unsigned int hook_mask = 0;

diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c
index b58f62195ff3ee04aebcf62a166349ff3a1f1285..96e02a83c045e21c7fb2983707fd09f698a9b53b 100644 (file)
--- a/net/netfilter/nft_fib.c
+++ b/net/netfilter/nft_fib.c
@@ -26,8 +26,7 @@ const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = {
 };
 EXPORT_SYMBOL(nft_fib_policy);
 
-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
-                    const struct nft_data **data)
+int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
        const struct nft_fib *priv = nft_expr_priv(expr);
        unsigned int hooks;

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index ab95760987010b649483bf052fbdba9fde4c9624..9dcd1548df9d5f5df073f73c21dbef0e5e369019 100644 (file)
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -380,8 +380,7 @@ out:
 }
 
 static int nft_flow_offload_validate(const struct nft_ctx *ctx,
-                                    const struct nft_expr *expr,
-                                    const struct nft_data **data)
+                                    const struct nft_expr *expr)
 {
        unsigned int hook_mask = (1 << NF_INET_FORWARD);
 

diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
index c83a794025f92c3a491fcfd3c7133c1094c9488d..152a9fb4d23af5b5b3385d5c552d38b8581a8d22 100644 (file)
--- a/net/netfilter/nft_fwd_netdev.c
+++ b/net/netfilter/nft_fwd_netdev.c
@@ -204,8 +204,7 @@ nla_put_failure:
 }
 
 static int nft_fwd_validate(const struct nft_ctx *ctx,
-                           const struct nft_expr *expr,
-                           const struct nft_data **data)
+                           const struct nft_expr *expr)
 {
        return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) |
                                                    (1 << NF_NETDEV_EGRESS));

diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index ac2422c215e54599659aa493cddad7f2a2d803e9..02ee5fb69871f838bbc9051dd4c718afc8340bd6 100644 (file)
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -244,8 +244,7 @@ nla_put_failure:
 }
 
 static int nft_immediate_validate(const struct nft_ctx *ctx,
-                                 const struct nft_expr *expr,
-                                 const struct nft_data **d)
+                                 const struct nft_expr *expr)
 {
        const struct nft_immediate_expr *priv = nft_expr_priv(expr);
        struct nft_ctx *pctx = (struct nft_ctx *)ctx;

diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 580e4b1deb9ba00c2c85fd451eefadbed54f51b4..63ef832b8aa7108543dc8e5572a4e92e705b0dba 100644 (file)
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -206,8 +206,7 @@ nla_put_failure:
 }
 
 static int nft_lookup_validate(const struct nft_ctx *ctx,
-                              const struct nft_expr *expr,
-                              const struct nft_data **d)
+                              const struct nft_expr *expr)
 {
        const struct nft_lookup *priv = nft_expr_priv(expr);
        struct nft_set_iter iter;

diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c
index cb43c72a8c2ad8b2ec8257e1ab29db2a3ff7be66..868bd4d7355553fb0bb7d0b767aa900fedb29f8a 100644 (file)
--- a/net/netfilter/nft_masq.c
+++ b/net/netfilter/nft_masq.c
@@ -27,8 +27,7 @@ static const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = {
 };
 
 static int nft_masq_validate(const struct nft_ctx *ctx,
-                            const struct nft_expr *expr,
-                            const struct nft_data **data)
+                            const struct nft_expr *expr)
 {
        int err;
 

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 0214ad1ced2fe2ab3bf626ecd65ab6aa02444795..8c8eb14d647b07d8c2160d323d1daa8810bf9eac 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -581,8 +581,7 @@ static int nft_meta_get_validate_xfrm(const struct nft_ctx *ctx)
 }
 
 static int nft_meta_get_validate(const struct nft_ctx *ctx,
-                                const struct nft_expr *expr,
-                                const struct nft_data **data)
+                                const struct nft_expr *expr)
 {
        const struct nft_meta *priv = nft_expr_priv(expr);
 
@@ -600,8 +599,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx,
 }
 
 int nft_meta_set_validate(const struct nft_ctx *ctx,
-                         const struct nft_expr *expr,
-                         const struct nft_data **data)
+                         const struct nft_expr *expr)
 {
        struct nft_meta *priv = nft_expr_priv(expr);
        unsigned int hooks;

diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 983dd937fe02993f65bc91607deae1c695fc31a2..6e21f72c5b5741c89f01a27606d947d718c6ddb6 100644 (file)
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -137,8 +137,7 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = {
 };
 
 static int nft_nat_validate(const struct nft_ctx *ctx,
-                           const struct nft_expr *expr,
-                           const struct nft_data **data)
+                           const struct nft_expr *expr)
 {
        struct nft_nat *priv = nft_expr_priv(expr);
        int err;

diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index 7fec57ff736f65bace26955e646111d57fe9bbb9..1c0b493ef0a994ffc093e27b86e75bbc699d5949 100644 (file)
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -108,8 +108,7 @@ nla_put_failure:
 }
 
 static int nft_osf_validate(const struct nft_ctx *ctx,
-                           const struct nft_expr *expr,
-                           const struct nft_data **data)
+                           const struct nft_expr *expr)
 {
        unsigned int hooks;
 

diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
index 44e6817e6e29bab9039488e85ea3880a89c7f617..344fe311878fe0357a595262b82023a462d4f468 100644 (file)
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -69,8 +69,7 @@ static void nft_queue_sreg_eval(const struct nft_expr *expr,
 }
 
 static int nft_queue_validate(const struct nft_ctx *ctx,
-                             const struct nft_expr *expr,
-                             const struct nft_data **data)
+                             const struct nft_expr *expr)
 {
        static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) |
                                                     (1 << NF_INET_LOCAL_IN) |

diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c
index 6568cc264078d0b35c6e0d7cb185264af6707dfb..95eedad85c835c3eb10c38fe0e0369b82a200d0e 100644 (file)
--- a/net/netfilter/nft_redir.c
+++ b/net/netfilter/nft_redir.c
@@ -27,8 +27,7 @@ static const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = {
 };
 
 static int nft_redir_validate(const struct nft_ctx *ctx,
-                             const struct nft_expr *expr,
-                             const struct nft_data **data)
+                             const struct nft_expr *expr)
 {
        int err;
 

diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index ed2e668474d677b30183f914b41f04351d62be00..196a92c7ea09b7c3af00f0906b1537fc59bb0823 100644 (file)
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -24,8 +24,7 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
 EXPORT_SYMBOL_GPL(nft_reject_policy);
 
 int nft_reject_validate(const struct nft_ctx *ctx,
-                       const struct nft_expr *expr,
-                       const struct nft_data **data)
+                       const struct nft_expr *expr)
 {
        return nft_chain_validate_hooks(ctx->chain,
                                        (1 << NF_INET_LOCAL_IN) |

diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 973fa31a9dd6cd55ef3c67d4b3f9970fe9816db9..49020e67304ad721c6600a137e36b610f1d56236 100644 (file)
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -61,8 +61,7 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
 }
 
 static int nft_reject_inet_validate(const struct nft_ctx *ctx,
-                                   const struct nft_expr *expr,
-                                   const struct nft_data **data)
+                                   const struct nft_expr *expr)
 {
        return nft_chain_validate_hooks(ctx->chain,
                                        (1 << NF_INET_LOCAL_IN) |

diff --git a/net/netfilter/nft_reject_netdev.c b/net/netfilter/nft_reject_netdev.c
index 7865cd8b11bb6a3bbab23e92344e9b4cfc07804c..2558ce1505d9890981bcb24961ade0c71a8ce4b1 100644 (file)
--- a/net/netfilter/nft_reject_netdev.c
+++ b/net/netfilter/nft_reject_netdev.c
@@ -145,8 +145,7 @@ out:
 }
 
 static int nft_reject_netdev_validate(const struct nft_ctx *ctx,
-                                     const struct nft_expr *expr,
-                                     const struct nft_data **data)
+                                     const struct nft_expr *expr)
 {
        return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
 }

diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
index 14d88394bcb7f5f4c35bbfe523d0a0a9d5bf5fbb..dc50b9a5bd6888fad40b354f301cefcf09b8ab0d 100644 (file)
--- a/net/netfilter/nft_rt.c
+++ b/net/netfilter/nft_rt.c
@@ -160,8 +160,7 @@ nla_put_failure:
        return -1;
 }
 
-static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
-                          const struct nft_data **data)
+static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
        const struct nft_rt *priv = nft_expr_priv(expr);
        unsigned int hooks;

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index f30163e2ca620783cceda339c702c9f81b29cfa2..947566dba1ea18fca554d8b74f52fcdc92fa46bb 100644 (file)
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -239,8 +239,7 @@ static bool nft_socket_reduce(struct nft_regs_track *track,
 }
 
 static int nft_socket_validate(const struct nft_ctx *ctx,
-                              const struct nft_expr *expr,
-                              const struct nft_data **data)
+                              const struct nft_expr *expr)
 {
        if (ctx->family != NFPROTO_IPV4 &&
            ctx->family != NFPROTO_IPV6 &&

diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 1d737f89dfc18ccdf816e00407bc9be70c13e8f2..5d3e51825985960fdf1a19c818f86c0027cdb010 100644 (file)
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -248,8 +248,7 @@ static void nft_synproxy_eval(const struct nft_expr *expr,
 }
 
 static int nft_synproxy_validate(const struct nft_ctx *ctx,
-                                const struct nft_expr *expr,
-                                const struct nft_data **data)
+                                const struct nft_expr *expr)
 {
        if (ctx->family != NFPROTO_IPV4 &&
            ctx->family != NFPROTO_IPV6 &&

diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
index 1b691393d8b1d2c1a8cd8771c9e4ea64e949c4b4..50481280abd2658b757829732eb51f5efd9fca95 100644 (file)
--- a/net/netfilter/nft_tproxy.c
+++ b/net/netfilter/nft_tproxy.c
@@ -313,8 +313,7 @@ static int nft_tproxy_dump(struct sk_buff *skb,
 }
 
 static int nft_tproxy_validate(const struct nft_ctx *ctx,
-                              const struct nft_expr *expr,
-                              const struct nft_data **data)
+                              const struct nft_expr *expr)
 {
        if (ctx->family != NFPROTO_IPV4 &&
            ctx->family != NFPROTO_IPV6 &&

diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c
index 1c866757db55247b8e267fb038dd4e1fbd9681ea..8a07b46cc8fb73d51c50b0fb7b18e42915af63b7 100644 (file)
--- a/net/netfilter/nft_xfrm.c
+++ b/net/netfilter/nft_xfrm.c
@@ -229,8 +229,7 @@ static int nft_xfrm_get_dump(struct sk_buff *skb,
        return 0;
 }
 
-static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
-                            const struct nft_data **data)
+static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
        const struct nft_xfrm *priv = nft_expr_priv(expr);
        unsigned int hooks;