netfilter: xtables: don't hook tables by default

[deliverable/linux.git] / net / ipv6 / netfilter / ip6table_nat.c

diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 7f9740e8ef4783f983e9192707f1f17aefa9406d..7d2bd940291fd47a68977ec86b7ac0952744c432 100644 (file)
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -20,6 +20,8 @@
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l3proto.h>
 
+static int __net_init ip6table_nat_table_init(struct net *net);
+
 static const struct xt_table nf_nat_ipv6_table = {
        .name           = "nat",
        .valid_hooks    = (1 << NF_INET_PRE_ROUTING) |
@@ -28,6 +30,7 @@ static const struct xt_table nf_nat_ipv6_table = {
                          (1 << NF_INET_LOCAL_IN),
        .me             = THIS_MODULE,
        .af             = NFPROTO_IPV6,
+       .table_init     = ip6table_nat_table_init,
 };
 
 static unsigned int ip6table_nat_do_chain(void *priv,
@@ -97,11 +100,14 @@ static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
        },
 };
 
-static int __net_init ip6table_nat_net_init(struct net *net)
+static int __net_init ip6table_nat_table_init(struct net *net)
 {
        struct ip6t_replace *repl;
        int ret;
 
+       if (net->ipv6.ip6table_nat)
+               return 0;
+
        repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
        if (repl == NULL)
                return -ENOMEM;
@@ -113,36 +119,31 @@ static int __net_init ip6table_nat_net_init(struct net *net)
 
 static void __net_exit ip6table_nat_net_exit(struct net *net)
 {
+       if (!net->ipv6.ip6table_nat)
+               return;
        ip6t_unregister_table(net, net->ipv6.ip6table_nat, nf_nat_ipv6_ops);
+       net->ipv6.ip6table_nat = NULL;
 }
 
 static struct pernet_operations ip6table_nat_net_ops = {
-       .init   = ip6table_nat_net_init,
        .exit   = ip6table_nat_net_exit,
 };
 
 static int __init ip6table_nat_init(void)
 {
-       int err;
-
-       err = register_pernet_subsys(&ip6table_nat_net_ops);
-       if (err < 0)
-               goto err1;
+       int ret = register_pernet_subsys(&ip6table_nat_net_ops);
 
-       err = nf_register_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
-       if (err < 0)
-               goto err2;
-       return 0;
+       if (ret)
+               return ret;
 
-err2:
-       unregister_pernet_subsys(&ip6table_nat_net_ops);
-err1:
-       return err;
+       ret = ip6table_nat_table_init(&init_net);
+       if (ret)
+               unregister_pernet_subsys(&ip6table_nat_net_ops);
+       return ret;
 }
 
 static void __exit ip6table_nat_exit(void)
 {
-       nf_unregister_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
        unregister_pernet_subsys(&ip6table_nat_net_ops);
 }