netfilter: xtables: generate initial table on-demand

[net-next-2.6.git] / net / ipv4 / netfilter / iptable_security.c

diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index b1bf3ca2c6c7fd0631396e9a9acf39555aa9cc55..cce2f64e6f21ee61822adf28f0fcc988dffe4239 100644 (file)
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -27,36 +27,6 @@ MODULE_DESCRIPTION("iptables security table, for MAC rules");
                                (1 << NF_INET_FORWARD) | \
                                (1 << NF_INET_LOCAL_OUT)
 
-static const struct
-{
-       struct ipt_replace repl;
-       struct ipt_standard entries[3];
-       struct ipt_error term;
-} initial_table __net_initdata = {
-       .repl = {
-               .name = "security",
-               .valid_hooks = SECURITY_VALID_HOOKS,
-               .num_entries = 4,
-               .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-               .hook_entry = {
-                       [NF_INET_LOCAL_IN]      = 0,
-                       [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
-                       [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
-               },
-               .underflow = {
-                       [NF_INET_LOCAL_IN]      = 0,
-                       [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
-                       [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
-               },
-       },
-       .entries = {
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-       },
-       .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table security_table = {
        .name           = "security",
        .valid_hooks    = SECURITY_VALID_HOOKS,
@@ -87,9 +57,14 @@ static struct nf_hook_ops *sectbl_ops __read_mostly;
 
 static int __net_init iptable_security_net_init(struct net *net)
 {
-       net->ipv4.iptable_security =
-               ipt_register_table(net, &security_table, &initial_table.repl);
+       struct ipt_replace *repl;
 
+       repl = ipt_alloc_initial_table(&security_table);
+       if (repl == NULL)
+               return -ENOMEM;
+       net->ipv4.iptable_security =
+               ipt_register_table(net, &security_table, repl);
+       kfree(repl);
        if (IS_ERR(net->ipv4.iptable_security))
                return PTR_ERR(net->ipv4.iptable_security);