1 files changed, 21 insertions, 74 deletions

diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 97337601827..bfe26f32b93 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp/arp_tables.h>
 
 MODULE_LICENSE("GPL");
@@ -15,93 +16,37 @@ MODULE_DESCRIPTION("arptables filter table");
 #define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \
                            (1 << NF_ARP_FORWARD))
 
-static const struct
-{
-        struct arpt_replace repl;
-        struct arpt_standard entries[3];
-        struct arpt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "filter",
-                .valid_hooks = FILTER_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct arpt_standard) * 3 + sizeof(struct arpt_error),
-                .hook_entry = {
-                        [NF_ARP_IN] = 0,
-                        [NF_ARP_OUT] = sizeof(struct arpt_standard),
-                        [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-                },
-                .underflow = {
-                        [NF_ARP_IN] = 0,
-                        [NF_ARP_OUT] = sizeof(struct arpt_standard),
-                        [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-                },
-        },
-        .entries = {
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_IN */
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_OUT */
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_FORWARD */
-        },
-        .term = ARPT_ERROR_INIT,
-};
-
 static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_ARP,
+        .priority       = NF_IP_PRI_FILTER,
 };
 
 /* The work comes in here from netfilter.c */
-static unsigned int arpt_in_hook(unsigned int hook,
-                                 struct sk_buff *skb,
-                                 const struct net_device *in,
-                                 const struct net_device *out,
-                                 int (*okfn)(struct sk_buff *))
+static unsigned int
+arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
+                     const struct net_device *in, const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv4.arptable_filter);
-}
+        const struct net *net = dev_net((in != NULL) ? in : out);
 
-static unsigned int arpt_out_hook(unsigned int hook,
-                                  struct sk_buff *skb,
-                                  const struct net_device *in,
-                                  const struct net_device *out,
-                                  int (*okfn)(struct sk_buff *))
-{
-        return arpt_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv4.arptable_filter);
+        return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
 }
 
-static struct nf_hook_ops arpt_ops[] __read_mostly = {
-        {
-                .hook           = arpt_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_IN,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = arpt_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_OUT,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = arpt_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_FORWARD,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-};
+static struct nf_hook_ops *arpfilter_ops __read_mostly;
 
 static int __net_init arptable_filter_net_init(struct net *net)
 {
-        /* Register table */
+        struct arpt_replace *repl;
+        
+        repl = arpt_alloc_initial_table(&packet_filter);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv4.arptable_filter =
-                arpt_register_table(net, &packet_filter, &initial_table.repl);
+                arpt_register_table(net, &packet_filter, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.arptable_filter))
                 return PTR_ERR(net->ipv4.arptable_filter);
         return 0;
@@ -125,9 +70,11 @@ static int __init arptable_filter_init(void)
         if (ret < 0)
                 return ret;
 
-        ret = nf_register_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
-        if (ret < 0)
+        arpfilter_ops = xt_hook_link(&packet_filter, arptable_filter_hook);
+        if (IS_ERR(arpfilter_ops)) {
+                ret = PTR_ERR(arpfilter_ops);
                 goto cleanup_table;
+        }
         return ret;
 
 cleanup_table:
@@ -137,7 +84,7 @@ cleanup_table:
 
 static void __exit arptable_filter_fini(void)
 {
-        nf_unregister_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
+        xt_hook_unlink(&packet_filter, arpfilter_ops);
         unregister_pernet_subsys(&arptable_filter_net_ops);
 }