Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88182a0e authored by Eric W. Biederman's avatar Eric W. Biederman Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: Use pkt->net instead of computing net from the passed net_devices 



Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 46448d00

net/bridge/netfilter/nft_reject_bridge.c

+6 −7
Original line number Diff line number Diff line
@@ -261,7 +261,6 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, 
				   const struct nft_pktinfo *pkt)

{

	struct nft_reject *priv = nft_expr_priv(expr);

	struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);

	const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;



	if (is_broadcast_ether_addr(dest) ||
@@ -290,17 +289,17 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, 
	case htons(ETH_P_IPV6):

		switch (priv->type) {

		case NFT_REJECT_ICMP_UNREACH:

			nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,

						      pkt->hook,

			nft_reject_br_send_v6_unreach(pkt->net, pkt->skb,

						      pkt->in, pkt->hook,

						      priv->icmp_code);

			break;

		case NFT_REJECT_TCP_RST:

			nft_reject_br_send_v6_tcp_reset(net, pkt->skb, pkt->in,

							pkt->hook);

			nft_reject_br_send_v6_tcp_reset(pkt->net, pkt->skb,

							pkt->in, pkt->hook);

			break;

		case NFT_REJECT_ICMPX_UNREACH:

			nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,

						      pkt->hook,

			nft_reject_br_send_v6_unreach(pkt->net, pkt->skb,

						      pkt->in, pkt->hook,

						      nft_reject_icmpv6_code(priv->icmp_code));

			break;

		}

net/ipv6/netfilter/nft_reject_ipv6.c

+3 −3
Original line number Diff line number Diff line
@@ -24,14 +24,14 @@ static void nft_reject_ipv6_eval(const struct nft_expr *expr, 
				 const struct nft_pktinfo *pkt)

{

	struct nft_reject *priv = nft_expr_priv(expr);

	struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);



	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

		nf_send_unreach6(net, pkt->skb, priv->icmp_code, pkt->hook);

		nf_send_unreach6(pkt->net, pkt->skb, priv->icmp_code,

				 pkt->hook);

		break;

	case NFT_REJECT_TCP_RST:

		nf_send_reset6(net, pkt->skb, pkt->hook);

		nf_send_reset6(pkt->net, pkt->skb, pkt->hook);

		break;

	default:

		break;

net/netfilter/nf_tables_core.c

+2 −4
Original line number Diff line number Diff line
@@ -48,9 +48,7 @@ static void __nft_trace_packet(const struct nft_pktinfo *pkt, 
			       const struct nft_chain *chain,

			       int rulenum, enum nft_trace type)

{

	struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);



	nf_log_trace(net, pkt->pf, pkt->hook, pkt->skb, pkt->in,

	nf_log_trace(pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in,

		     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",

		     chain->table->name, chain->name, comments[type],

		     rulenum);
@@ -114,7 +112,7 @@ unsigned int 
nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops)

{

	const struct nft_chain *chain = ops->priv, *basechain = chain;

	const struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);

	const struct net *net = pkt->net;

	const struct nft_rule *rule;

	const struct nft_expr *expr, *last;

	struct nft_regs regs;

net/netfilter/nft_log.c

+1 −2
Original line number Diff line number Diff line
@@ -31,9 +31,8 @@ static void nft_log_eval(const struct nft_expr *expr, 
			 const struct nft_pktinfo *pkt)

{

	const struct nft_log *priv = nft_expr_priv(expr);

	struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);



	nf_log_packet(net, pkt->pf, pkt->hook, pkt->skb, pkt->in,

	nf_log_packet(pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in,

		      pkt->out, &priv->loginfo, "%s", priv->prefix);

}

net/netfilter/nft_reject_inet.c

+3 −4
Original line number Diff line number Diff line
@@ -22,7 +22,6 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, 
				 const struct nft_pktinfo *pkt)

{

	struct nft_reject *priv = nft_expr_priv(expr);

	struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);



	switch (pkt->pf) {

	case NFPROTO_IPV4:
@@ -44,14 +43,14 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, 
	case NFPROTO_IPV6:

		switch (priv->type) {

		case NFT_REJECT_ICMP_UNREACH:

			nf_send_unreach6(net, pkt->skb, priv->icmp_code,

			nf_send_unreach6(pkt->net, pkt->skb, priv->icmp_code,

					 pkt->hook);

			break;

		case NFT_REJECT_TCP_RST:

			nf_send_reset6(net, pkt->skb, pkt->hook);

			nf_send_reset6(pkt->net, pkt->skb, pkt->hook);

			break;

		case NFT_REJECT_ICMPX_UNREACH:

			nf_send_unreach6(net, pkt->skb,

			nf_send_unreach6(pkt->net, pkt->skb,

					 nft_reject_icmpv6_code(priv->icmp_code),

					 pkt->hook);

			break;