netfilter: xtables: generate initial table on-demand

[net-next-2.6.git] / net / ipv4 / netfilter / nf_nat_rule.c

diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 85da34fdc7559ee4109f1016bde79c893366a86d..ab74cc0535e26843d1c50a9e050f841ce4cd40bc 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -28,36 +28,6 @@
                         (1 << NF_INET_POST_ROUTING) | \
                         (1 << NF_INET_LOCAL_OUT))
 
-static const struct
-{
-       struct ipt_replace repl;
-       struct ipt_standard entries[3];
-       struct ipt_error term;
-} nat_initial_table __net_initdata = {
-       .repl = {
-               .name = "nat",
-               .valid_hooks = NAT_VALID_HOOKS,
-               .num_entries = 4,
-               .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-               .hook_entry = {
-                       [NF_INET_PRE_ROUTING] = 0,
-                       [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
-                       [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
-               },
-               .underflow = {
-                       [NF_INET_PRE_ROUTING] = 0,
-                       [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
-                       [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
-               },
-       },
-       .entries = {
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-       },
-       .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table nat_table = {
        .name           = "nat",
        .valid_hooks    = NAT_VALID_HOOKS,
@@ -186,8 +156,13 @@ static struct xt_target ipt_dnat_reg __read_mostly = {
 
 static int __net_init nf_nat_rule_net_init(struct net *net)
 {
-       net->ipv4.nat_table = ipt_register_table(net, &nat_table,
-                                                &nat_initial_table.repl);
+       struct ipt_replace *repl;
+
+       repl = ipt_alloc_initial_table(&nat_table);
+       if (repl == NULL)
+               return -ENOMEM;
+       net->ipv4.nat_table = ipt_register_table(net, &nat_table, repl);
+       kfree(repl);
        if (IS_ERR(net->ipv4.nat_table))
                return PTR_ERR(net->ipv4.nat_table);
        return 0;