netfilter: netns: remove nf_*_net() wrappers

Now that dev_net() exists, the usefullness of them is even less. Also they're
a big problem in resolving circular header dependencies necessary for
NOTRACK-in-netns patch. See below.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index bf3afb0844f78d76f10da9461c72b7fb9b88cb1c..48cfe51bfddcd989396d5c3fc2c71b2581f3caa2 100644 (file)
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -5,13 +5,11 @@
 #include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/net.h>
-#include <linux/netdevice.h>
 #include <linux/if.h>
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/wait.h>
 #include <linux/list.h>
-#include <net/net_namespace.h>
 #endif
 #include <linux/types.h>
 #include <linux/compiler.h>
@@ -355,56 +353,5 @@ extern void (*nf_ct_destroy)(struct nf_conntrack *);
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
 #endif
 
-static inline struct net *nf_pre_routing_net(const struct net_device *in,
-                                            const struct net_device *out)
-{
-#ifdef CONFIG_NET_NS
-       return in->nd_net;
-#else
-       return &init_net;
-#endif
-}
-
-static inline struct net *nf_local_in_net(const struct net_device *in,
-                                         const struct net_device *out)
-{
-#ifdef CONFIG_NET_NS
-       return in->nd_net;
-#else
-       return &init_net;
-#endif
-}
-
-static inline struct net *nf_forward_net(const struct net_device *in,
-                                        const struct net_device *out)
-{
-#ifdef CONFIG_NET_NS
-       BUG_ON(in->nd_net != out->nd_net);
-       return in->nd_net;
-#else
-       return &init_net;
-#endif
-}
-
-static inline struct net *nf_local_out_net(const struct net_device *in,
-                                          const struct net_device *out)
-{
-#ifdef CONFIG_NET_NS
-       return out->nd_net;
-#else
-       return &init_net;
-#endif
-}
-
-static inline struct net *nf_post_routing_net(const struct net_device *in,
-                                             const struct net_device *out)
-{
-#ifdef CONFIG_NET_NS
-       return out->nd_net;
-#else
-       return &init_net;
-#endif
-}
-
 #endif /*__KERNEL__*/
 #endif /*__LINUX_NETFILTER_H*/

diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 1ea677dcf84575b62280e83eff76955f3454ba5b..c9224310ebae68c8573292e06dd1ebd02f21d9ec 100644 (file)
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -70,7 +70,7 @@ ipt_local_in_hook(unsigned int hook,
                  int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_local_in_net(in, out)->ipv4.iptable_filter);
+                           dev_net(in)->ipv4.iptable_filter);
 }
 
 static unsigned int
@@ -81,7 +81,7 @@ ipt_hook(unsigned int hook,
         int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_forward_net(in, out)->ipv4.iptable_filter);
+                           dev_net(in)->ipv4.iptable_filter);
 }
 
 static unsigned int
@@ -101,7 +101,7 @@ ipt_local_out_hook(unsigned int hook,
        }
 
        return ipt_do_table(skb, hook, in, out,
-                           nf_local_out_net(in, out)->ipv4.iptable_filter);
+                           dev_net(out)->ipv4.iptable_filter);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {

diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index da59182f222639ffbc0dda3652e9b89d3b36fc0b..69f2c4287146a078b4f33910591bb30ec73797fd 100644 (file)
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -81,7 +81,7 @@ ipt_pre_routing_hook(unsigned int hook,
                     int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_pre_routing_net(in, out)->ipv4.iptable_mangle);
+                           dev_net(in)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -92,7 +92,7 @@ ipt_post_routing_hook(unsigned int hook,
                      int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_post_routing_net(in, out)->ipv4.iptable_mangle);
+                           dev_net(out)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -103,7 +103,7 @@ ipt_local_in_hook(unsigned int hook,
                  int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_local_in_net(in, out)->ipv4.iptable_mangle);
+                           dev_net(in)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -114,7 +114,7 @@ ipt_forward_hook(unsigned int hook,
         int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_forward_net(in, out)->ipv4.iptable_mangle);
+                           dev_net(in)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -147,7 +147,7 @@ ipt_local_hook(unsigned int hook,
        tos = iph->tos;
 
        ret = ipt_do_table(skb, hook, in, out,
-                          nf_local_out_net(in, out)->ipv4.iptable_mangle);
+                          dev_net(out)->ipv4.iptable_mangle);
        /* Reroute for ANY change. */
        if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
                iph = ip_hdr(skb);

diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index fddce7754b7250d5f3087840f31f1aa27748a9a1..8faebfe638f1fab623f6d528d031720aa6ad4dc7 100644 (file)
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -53,7 +53,7 @@ ipt_hook(unsigned int hook,
         int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_pre_routing_net(in, out)->ipv4.iptable_raw);
+                           dev_net(in)->ipv4.iptable_raw);
 }
 
 static unsigned int
@@ -72,7 +72,7 @@ ipt_local_hook(unsigned int hook,
                return NF_ACCEPT;
        }
        return ipt_do_table(skb, hook, in, out,
-                           nf_local_out_net(in, out)->ipv4.iptable_raw);
+                           dev_net(out)->ipv4.iptable_raw);
 }
 
 /* 'raw' is the very first table. */

diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index db6d312128e1f3623d78a579bca55dc9c7d125fb..36f3be3cc4285ece3804fbabecc6e238fdd6756e 100644 (file)
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -73,7 +73,7 @@ ipt_local_in_hook(unsigned int hook,
                  int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_local_in_net(in, out)->ipv4.iptable_security);
+                           dev_net(in)->ipv4.iptable_security);
 }
 
 static unsigned int
@@ -84,7 +84,7 @@ ipt_forward_hook(unsigned int hook,
                 int (*okfn)(struct sk_buff *))
 {
        return ipt_do_table(skb, hook, in, out,
-                           nf_forward_net(in, out)->ipv4.iptable_security);
+                           dev_net(in)->ipv4.iptable_security);
 }
 
 static unsigned int
@@ -103,7 +103,7 @@ ipt_local_out_hook(unsigned int hook,
                return NF_ACCEPT;
        }
        return ipt_do_table(skb, hook, in, out,
-                           nf_local_out_net(in, out)->ipv4.iptable_security);
+                           dev_net(out)->ipv4.iptable_security);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {

diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 55a2c290bad4e8d07cc1b3f43c90f5136c916e18..b110a8a85a1480855fb6bdea238c82dccd29cc7a 100644 (file)
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -68,7 +68,7 @@ ip6t_local_in_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
        return ip6t_do_table(skb, hook, in, out,
-                            nf_local_in_net(in, out)->ipv6.ip6table_filter);
+                            dev_net(in)->ipv6.ip6table_filter);
 }
 
 static unsigned int
@@ -79,7 +79,7 @@ ip6t_forward_hook(unsigned int hook,
                  int (*okfn)(struct sk_buff *))
 {
        return ip6t_do_table(skb, hook, in, out,
-                            nf_forward_net(in, out)->ipv6.ip6table_filter);
+                            dev_net(in)->ipv6.ip6table_filter);
 }
 
 static unsigned int
@@ -100,7 +100,7 @@ ip6t_local_out_hook(unsigned int hook,
 #endif
 
        return ip6t_do_table(skb, hook, in, out,
-                            nf_local_out_net(in, out)->ipv6.ip6table_filter);
+                            dev_net(out)->ipv6.ip6table_filter);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {

diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 6e7131036bc6bf7603daa7401ff418fb836368c0..20bc52f13e436218abdc060721e0fa8a8ca87468 100644 (file)
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -72,7 +72,7 @@ ip6t_local_in_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
        return ip6t_do_table(skb, hook, in, out,
-                            nf_local_in_net(in, out)->ipv6.ip6table_security);
+                            dev_net(in)->ipv6.ip6table_security);
 }
 
 static unsigned int
@@ -83,7 +83,7 @@ ip6t_forward_hook(unsigned int hook,
                  int (*okfn)(struct sk_buff *))
 {
        return ip6t_do_table(skb, hook, in, out,
-                            nf_forward_net(in, out)->ipv6.ip6table_security);
+                            dev_net(in)->ipv6.ip6table_security);
 }
 
 static unsigned int
@@ -95,7 +95,7 @@ ip6t_local_out_hook(unsigned int hook,
 {
        /* TBD: handle short packets via raw socket */
        return ip6t_do_table(skb, hook, in, out,
-                            nf_local_out_net(in, out)->ipv6.ip6table_security);
+                            dev_net(out)->ipv6.ip6table_security);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {