Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe92ca45 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_ct: split nft_ct_init() into two functions for get/set 



For value spanning multiple registers, we need to validate the length
of data loads. In order to add this to nft_ct, we need the length from
key validation. Split the nft_ct_init() function into two functions
for the get and set operations as preparation for that.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d2caa696

net/netfilter/nft_ct.c

+43 −53
Original line number Diff line number Diff line
@@ -215,22 +215,14 @@ static void nft_ct_l3proto_module_put(uint8_t family) 
		nf_ct_l3proto_module_put(family);

}



static int nft_ct_init_validate_get(const struct nft_expr *expr,

static int nft_ct_get_init(const struct nft_ctx *ctx,

			   const struct nft_expr *expr,

			   const struct nlattr * const tb[])

{

	struct nft_ct *priv = nft_expr_priv(expr);

	int err;



	if (tb[NFTA_CT_DIRECTION] != NULL) {

		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);

		switch (priv->dir) {

		case IP_CT_DIR_ORIGINAL:

		case IP_CT_DIR_REPLY:

			break;

		default:

			return -EINVAL;

		}

	}



	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));

	switch (priv->key) {

	case NFT_CT_STATE:

	case NFT_CT_DIRECTION:
@@ -262,56 +254,54 @@ static int nft_ct_init_validate_get(const struct nft_expr *expr, 
		return -EOPNOTSUPP;

	}



	return 0;

}



static int nft_ct_init_validate_set(uint32_t key)

{

	switch (key) {

#ifdef CONFIG_NF_CONNTRACK_MARK

	case NFT_CT_MARK:

	if (tb[NFTA_CT_DIRECTION] != NULL) {

		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);

		switch (priv->dir) {

		case IP_CT_DIR_ORIGINAL:

		case IP_CT_DIR_REPLY:

			break;

#endif

		default:

		return -EOPNOTSUPP;

			return -EINVAL;

		}



	return 0;

	}



static int nft_ct_init(const struct nft_ctx *ctx,

		       const struct nft_expr *expr,

		       const struct nlattr * const tb[])

{

	struct nft_ct *priv = nft_expr_priv(expr);

	int err;



	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));



	if (tb[NFTA_CT_DREG]) {

		err = nft_ct_init_validate_get(expr, tb);

		if (err < 0)

			return err;



	priv->dreg = ntohl(nla_get_be32(tb[NFTA_CT_DREG]));

	err = nft_validate_output_register(priv->dreg);

	if (err < 0)

		return err;



		err = nft_validate_data_load(ctx, priv->dreg, NULL,

					     NFT_DATA_VALUE);

	err = nft_validate_data_load(ctx, priv->dreg, NULL, NFT_DATA_VALUE);

	if (err < 0)

		return err;

	} else {

		err = nft_ct_init_validate_set(priv->key);



	err = nft_ct_l3proto_try_module_get(ctx->afi->family);

	if (err < 0)

		return err;



	return 0;

}



static int nft_ct_set_init(const struct nft_ctx *ctx,

			   const struct nft_expr *expr,

			   const struct nlattr * const tb[])

{

	struct nft_ct *priv = nft_expr_priv(expr);

	int err;



	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));

	switch (priv->key) {

#ifdef CONFIG_NF_CONNTRACK_MARK

	case NFT_CT_MARK:

		break;

#endif

	default:

		return -EOPNOTSUPP;

	}



	priv->sreg = ntohl(nla_get_be32(tb[NFTA_CT_SREG]));

	err = nft_validate_input_register(priv->sreg);

	if (err < 0)

		return err;

	}



	err = nft_ct_l3proto_try_module_get(ctx->afi->family);

	if (err < 0)
@@ -372,7 +362,7 @@ static const struct nft_expr_ops nft_ct_get_ops = { 
	.type		= &nft_ct_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),

	.eval		= nft_ct_get_eval,

	.init		= nft_ct_init,

	.init		= nft_ct_get_init,

	.destroy	= nft_ct_destroy,

	.dump		= nft_ct_get_dump,

};
@@ -381,7 +371,7 @@ static const struct nft_expr_ops nft_ct_set_ops = { 
	.type		= &nft_ct_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),

	.eval		= nft_ct_set_eval,

	.init		= nft_ct_init,

	.init		= nft_ct_set_init,

	.destroy	= nft_ct_destroy,

	.dump		= nft_ct_set_dump,

};