From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 13/18] netfilter: nf_tables: fix log/queue expressions for NFPROTO_INET
Date: Fri, 7 Feb 2014 18:41:39 +0100 [thread overview]
Message-ID: <1391794904-4017-14-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1391794904-4017-1-git-send-email-pablo@netfilter.org>
From: Patrick McHardy <kaber@trash.net>
The log and queue expressions both store the family during ->init() and
use it to deliver packets. This is wrong when used in NFPROTO_INET since
they should both deliver to the actual AF of the packet, not the dummy
NFPROTO_INET.
Use the family from the hook ops to fix this.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_log.c | 5 +----
net/netfilter/nft_queue.c | 4 +---
2 files changed, 2 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 5af7901..26c5154 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -23,7 +23,6 @@ static const char *nft_log_null_prefix = "";
struct nft_log {
struct nf_loginfo loginfo;
char *prefix;
- int family;
};
static void nft_log_eval(const struct nft_expr *expr,
@@ -33,7 +32,7 @@ static void nft_log_eval(const struct nft_expr *expr,
const struct nft_log *priv = nft_expr_priv(expr);
struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
- nf_log_packet(net, priv->family, pkt->ops->hooknum, pkt->skb, pkt->in,
+ nf_log_packet(net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in,
pkt->out, &priv->loginfo, "%s", priv->prefix);
}
@@ -52,8 +51,6 @@ static int nft_log_init(const struct nft_ctx *ctx,
struct nf_loginfo *li = &priv->loginfo;
const struct nlattr *nla;
- priv->family = ctx->afi->family;
-
nla = tb[NFTA_LOG_PREFIX];
if (nla != NULL) {
priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
index cbea473..e8ae2f6 100644
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -25,7 +25,6 @@ struct nft_queue {
u16 queuenum;
u16 queues_total;
u16 flags;
- u8 family;
};
static void nft_queue_eval(const struct nft_expr *expr,
@@ -43,7 +42,7 @@ static void nft_queue_eval(const struct nft_expr *expr,
queue = priv->queuenum + cpu % priv->queues_total;
} else {
queue = nfqueue_hash(pkt->skb, queue,
- priv->queues_total, priv->family,
+ priv->queues_total, pkt->ops->pf,
jhash_initval);
}
}
@@ -71,7 +70,6 @@ static int nft_queue_init(const struct nft_ctx *ctx,
return -EINVAL;
init_hashrandom(&jhash_initval);
- priv->family = ctx->afi->family;
priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
if (tb[NFTA_QUEUE_TOTAL] != NULL)
--
1.7.10.4
next prev parent reply other threads:[~2014-02-07 17:42 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-07 17:41 [PATCH 00/18] Netfilter/nftables/IPVS fixes for net Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 01/18] ipvs: fix AF assignment in ip_vs_conn_new() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 02/18] netfilter: nft_ct: fix unconditional dump of 'dir' attr Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 03/18] netfilter: nf_tables: fix oops when deleting a chain with references Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 04/18] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 05/18] netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 06/18] netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 07/18] netfilter: nf_tables: fix overrun in nf_tables_set_alloc_name() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 08/18] netfilter: nf_tables: fix potential oops when dumping sets Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 09/18] netfilter: nft_ct: fix missing NFT_CT_L3PROTOCOL key in validity checks Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 10/18] netfilter: nf_tables: add AF specific expression support Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 11/18] netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 12/18] netfilter: nf_tables: add reject module for NFPROTO_INET Pablo Neira Ayuso
2014-02-07 17:41 ` Pablo Neira Ayuso [this message]
2014-02-07 17:41 ` [PATCH 14/18] netfilter: nf_tables: fix racy rule deletion Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 15/18] netfilter: nf_tables: do not allow NFT_SET_ELEM_INTERVAL_END flag and data Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 16/18] netfilter: nft_rbtree: fix data handling of end interval elements Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 17/18] netfilter: nf_tables: fix loop checking with " Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 18/18] netfilter: nf_tables: unininline nft_trace_packet() Pablo Neira Ayuso
2014-02-09 22:20 ` [PATCH 00/18] Netfilter/nftables/IPVS fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1391794904-4017-14-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).