Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e633508a authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_fib: Fix existence check support 



NFTA_FIB_F_PRESENT flag was not always honored since eval functions did
not call nft_fib_store_result in all cases.

Given that in all callsites there is a struct net_device pointer
available which holds the interface data to be stored in destination
register, simplify nft_fib_store_result() to just accept that pointer
instead of the nft_pktinfo pointer and interface index. This also
allows to drop the index to interface lookup previously needed to get
the name associated with given index.

Fixes: 055c4b34 ("netfilter: nft_fib: Support existence check")
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 946c0d8e

include/net/netfilter/nft_fib.h

+1 −1
Original line number Diff line number Diff line
@@ -34,5 +34,5 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, 
		   const struct nft_pktinfo *pkt);



void nft_fib_store_result(void *reg, const struct nft_fib *priv,

			  const struct nft_pktinfo *pkt, int index);

			  const struct net_device *dev);

#endif

net/ipv4/netfilter/nft_fib_ipv4.c

+3 −20
Original line number Diff line number Diff line
@@ -58,11 +58,6 @@ void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs, 
}

EXPORT_SYMBOL_GPL(nft_fib4_eval_type);



static int get_ifindex(const struct net_device *dev)

{

	return dev ? dev->ifindex : 0;

}



void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,

		   const struct nft_pktinfo *pkt)

{
@@ -94,8 +89,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 


	if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&

	    nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {

		nft_fib_store_result(dest, priv, pkt,

				     nft_in(pkt)->ifindex);

		nft_fib_store_result(dest, priv, nft_in(pkt));

		return;

	}
@@ -108,8 +102,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	if (ipv4_is_zeronet(iph->saddr)) {

		if (ipv4_is_lbcast(iph->daddr) ||

		    ipv4_is_local_multicast(iph->daddr)) {

			nft_fib_store_result(dest, priv, pkt,

					     get_ifindex(pkt->skb->dev));

			nft_fib_store_result(dest, priv, pkt->skb->dev);

			return;

		}

	}
@@ -150,17 +143,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 
		found = oif;

	}



	switch (priv->result) {

	case NFT_FIB_RESULT_OIF:

		*dest = found->ifindex;

		break;

	case NFT_FIB_RESULT_OIFNAME:

		strncpy((char *)dest, found->name, IFNAMSIZ);

		break;

	default:

		WARN_ON_ONCE(1);

		break;

	}

	nft_fib_store_result(dest, priv, found);

}

EXPORT_SYMBOL_GPL(nft_fib4_eval);

net/ipv6/netfilter/nft_fib_ipv6.c

+2 −14
Original line number Diff line number Diff line
@@ -169,8 +169,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, 


	if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&

	    nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {

		nft_fib_store_result(dest, priv, pkt,

				     nft_in(pkt)->ifindex);

		nft_fib_store_result(dest, priv, nft_in(pkt));

		return;

	}
@@ -187,18 +186,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	if (oif && oif != rt->rt6i_idev->dev)

		goto put_rt_err;



	switch (priv->result) {

	case NFT_FIB_RESULT_OIF:

		*dest = rt->rt6i_idev->dev->ifindex;

		break;

	case NFT_FIB_RESULT_OIFNAME:

		strncpy((char *)dest, rt->rt6i_idev->dev->name, IFNAMSIZ);

		break;

	default:

		WARN_ON_ONCE(1);

		break;

	}



	nft_fib_store_result(dest, priv, rt->rt6i_idev->dev);

 put_rt_err:

	ip6_rt_put(rt);

}

net/netfilter/nft_fib.c

+3 −3
Original line number Diff line number Diff line
@@ -135,17 +135,17 @@ int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr) 
EXPORT_SYMBOL_GPL(nft_fib_dump);



void nft_fib_store_result(void *reg, const struct nft_fib *priv,

			  const struct nft_pktinfo *pkt, int index)

			  const struct net_device *dev)

{

	struct net_device *dev;

	u32 *dreg = reg;

	int index;



	switch (priv->result) {

	case NFT_FIB_RESULT_OIF:

		index = dev ? dev->ifindex : 0;

		*dreg = (priv->flags & NFTA_FIB_F_PRESENT) ? !!index : index;

		break;

	case NFT_FIB_RESULT_OIFNAME:

		dev = dev_get_by_index_rcu(nft_net(pkt), index);

		if (priv->flags & NFTA_FIB_F_PRESENT)

			*dreg = !!dev;

		else