|
@@ -90,10 +90,12 @@ static void nf_set_hooks_head(struct net *net, const struct nf_hook_ops *reg,
|
|
|
{
|
|
|
switch (reg->pf) {
|
|
|
case NFPROTO_NETDEV:
|
|
|
+#ifdef CONFIG_NETFILTER_INGRESS
|
|
|
/* We already checked in nf_register_net_hook() that this is
|
|
|
* used from ingress.
|
|
|
*/
|
|
|
rcu_assign_pointer(reg->dev->nf_hooks_ingress, entry);
|
|
|
+#endif
|
|
|
break;
|
|
|
default:
|
|
|
rcu_assign_pointer(net->nf.hooks[reg->pf][reg->hooknum],
|
|
@@ -107,10 +109,15 @@ int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
|
|
|
struct nf_hook_entry *hooks_entry;
|
|
|
struct nf_hook_entry *entry;
|
|
|
|
|
|
- if (reg->pf == NFPROTO_NETDEV &&
|
|
|
- (reg->hooknum != NF_NETDEV_INGRESS ||
|
|
|
- !reg->dev || dev_net(reg->dev) != net))
|
|
|
- return -EINVAL;
|
|
|
+ if (reg->pf == NFPROTO_NETDEV) {
|
|
|
+#ifndef CONFIG_NETFILTER_INGRESS
|
|
|
+ if (reg->hooknum == NF_NETDEV_INGRESS)
|
|
|
+ return -EOPNOTSUPP;
|
|
|
+#endif
|
|
|
+ if (reg->hooknum != NF_NETDEV_INGRESS ||
|
|
|
+ !reg->dev || dev_net(reg->dev) != net)
|
|
|
+ return -EINVAL;
|
|
|
+ }
|
|
|
|
|
|
entry = kmalloc(sizeof(*entry), GFP_KERNEL);
|
|
|
if (!entry)
|
|
@@ -160,7 +167,7 @@ void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
|
|
|
|
|
|
mutex_lock(&nf_hook_mutex);
|
|
|
hooks_entry = nf_hook_entry_head(net, reg);
|
|
|
- if (hooks_entry->orig_ops == reg) {
|
|
|
+ if (hooks_entry && hooks_entry->orig_ops == reg) {
|
|
|
nf_set_hooks_head(net, reg,
|
|
|
nf_entry_dereference(hooks_entry->next));
|
|
|
goto unlock;
|