Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58f40ab6 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_lookup: use nft_validate_register_store() to validate types 



In preparation of validating the length of a register store, use
nft_validate_register_store() in nft_lookup instead of open coding the
validation.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 1ec10212

net/netfilter/nf_tables_api.c

+4 −3
Original line number Diff line number Diff line
@@ -4169,7 +4169,7 @@ EXPORT_SYMBOL_GPL(nft_validate_output_register); 
 * 	Validate that a data load uses the appropriate data type for

 * 	the destination register and the length is within the bounds.

 * 	A value of NULL for the data means that its runtime gathered

 * 	data, which is always of type NFT_DATA_VALUE.

 * 	data.

 */

int nft_validate_register_store(const struct nft_ctx *ctx,

				enum nft_registers reg,
@@ -4180,10 +4180,11 @@ int nft_validate_register_store(const struct nft_ctx *ctx, 


	switch (reg) {

	case NFT_REG_VERDICT:

		if (data == NULL || type != NFT_DATA_VERDICT)

		if (type != NFT_DATA_VERDICT)

			return -EINVAL;



		if (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP) {

		if (data != NULL &&

		    (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP)) {

			err = nf_tables_check_loops(ctx, data->chain);

			if (err < 0)

				return err;

net/netfilter/nft_lookup.c

+4 −5
Original line number Diff line number Diff line
@@ -84,11 +84,10 @@ static int nft_lookup_init(const struct nft_ctx *ctx, 
		if (err < 0)

			return err;



		if (priv->dreg == NFT_REG_VERDICT) {

			if (set->dtype != NFT_DATA_VERDICT)

				return -EINVAL;

		} else if (set->dtype == NFT_DATA_VERDICT)

			return -EINVAL;

		err = nft_validate_register_store(ctx, priv->dreg, NULL,

						  set->dtype, set->dlen);

		if (err < 0)

			return err;

	} else if (set->flags & NFT_SET_MAP)

		return -EINVAL;