netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 13/18] netfilter: nf_tables: fix log/queue expressions for NFPROTO_INET
Date: Fri,  7 Feb 2014 18:41:39 +0100	[thread overview]
Message-ID: <1391794904-4017-14-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1391794904-4017-1-git-send-email-pablo@netfilter.org>

From: Patrick McHardy <kaber@trash.net>

The log and queue expressions both store the family during ->init() and
use it to deliver packets. This is wrong when used in NFPROTO_INET since
they should both deliver to the actual AF of the packet, not the dummy
NFPROTO_INET.

Use the family from the hook ops to fix this.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_log.c   |    5 +----
 net/netfilter/nft_queue.c |    4 +---
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 5af7901..26c5154 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -23,7 +23,6 @@ static const char *nft_log_null_prefix = "";
 struct nft_log {
 	struct nf_loginfo	loginfo;
 	char			*prefix;
-	int			family;
 };
 
 static void nft_log_eval(const struct nft_expr *expr,
@@ -33,7 +32,7 @@ static void nft_log_eval(const struct nft_expr *expr,
 	const struct nft_log *priv = nft_expr_priv(expr);
 	struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-	nf_log_packet(net, priv->family, pkt->ops->hooknum, pkt->skb, pkt->in,
+	nf_log_packet(net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in,
 		      pkt->out, &priv->loginfo, "%s", priv->prefix);
 }
 
@@ -52,8 +51,6 @@ static int nft_log_init(const struct nft_ctx *ctx,
 	struct nf_loginfo *li = &priv->loginfo;
 	const struct nlattr *nla;
 
-	priv->family = ctx->afi->family;
-
 	nla = tb[NFTA_LOG_PREFIX];
 	if (nla != NULL) {
 		priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
index cbea473..e8ae2f6 100644
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -25,7 +25,6 @@ struct nft_queue {
 	u16	queuenum;
 	u16	queues_total;
 	u16	flags;
-	u8	family;
 };
 
 static void nft_queue_eval(const struct nft_expr *expr,
@@ -43,7 +42,7 @@ static void nft_queue_eval(const struct nft_expr *expr,
 			queue = priv->queuenum + cpu % priv->queues_total;
 		} else {
 			queue = nfqueue_hash(pkt->skb, queue,
-					     priv->queues_total, priv->family,
+					     priv->queues_total, pkt->ops->pf,
 					     jhash_initval);
 		}
 	}
@@ -71,7 +70,6 @@ static int nft_queue_init(const struct nft_ctx *ctx,
 		return -EINVAL;
 
 	init_hashrandom(&jhash_initval);
-	priv->family = ctx->afi->family;
 	priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
 
 	if (tb[NFTA_QUEUE_TOTAL] != NULL)
-- 
1.7.10.4

  parent reply	other threads:[~2014-02-07 17:42 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-02-07 17:41 [PATCH 00/18] Netfilter/nftables/IPVS fixes for net Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 01/18] ipvs: fix AF assignment in ip_vs_conn_new() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 02/18] netfilter: nft_ct: fix unconditional dump of 'dir' attr Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 03/18] netfilter: nf_tables: fix oops when deleting a chain with references Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 04/18] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 05/18] netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 06/18] netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 07/18] netfilter: nf_tables: fix overrun in nf_tables_set_alloc_name() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 08/18] netfilter: nf_tables: fix potential oops when dumping sets Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 09/18] netfilter: nft_ct: fix missing NFT_CT_L3PROTOCOL key in validity checks Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 10/18] netfilter: nf_tables: add AF specific expression support Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 11/18] netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 12/18] netfilter: nf_tables: add reject module for NFPROTO_INET Pablo Neira Ayuso
2014-02-07 17:41 ` Pablo Neira Ayuso [this message]
2014-02-07 17:41 ` [PATCH 14/18] netfilter: nf_tables: fix racy rule deletion Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 15/18] netfilter: nf_tables: do not allow NFT_SET_ELEM_INTERVAL_END flag and data Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 16/18] netfilter: nft_rbtree: fix data handling of end interval elements Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 17/18] netfilter: nf_tables: fix loop checking with " Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 18/18] netfilter: nf_tables: unininline nft_trace_packet() Pablo Neira Ayuso
2014-02-09 22:20 ` [PATCH 00/18] Netfilter/nftables/IPVS fixes for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1391794904-4017-14-git-send-email-pablo@netfilter.org \
    --to=pablo@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).