From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 09/14] netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it
Date: Thu, 10 Nov 2016 01:23:42 +0100 [thread overview]
Message-ID: <1478737427-1574-10-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1478737427-1574-1-git-send-email-pablo@netfilter.org>
From: Liping Zhang <zlpnobody@gmail.com>
The NFTA_DUP_SREG_DEV attribute is not a must option, so we should use it
in routing lookup only when the user specify it.
Fixes: d877f07112f1 ("netfilter: nf_tables: add nft_dup expression")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/nft_dup_ipv4.c | 6 ++++--
net/ipv6/netfilter/nft_dup_ipv6.c | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/netfilter/nft_dup_ipv4.c b/net/ipv4/netfilter/nft_dup_ipv4.c
index bf855e64fc45..0c01a270bf9f 100644
--- a/net/ipv4/netfilter/nft_dup_ipv4.c
+++ b/net/ipv4/netfilter/nft_dup_ipv4.c
@@ -28,7 +28,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr,
struct in_addr gw = {
.s_addr = (__force __be32)regs->data[priv->sreg_addr],
};
- int oif = regs->data[priv->sreg_dev];
+ int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
nf_dup_ipv4(pkt->net, pkt->skb, pkt->hook, &gw, oif);
}
@@ -59,7 +59,9 @@ static int nft_dup_ipv4_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
struct nft_dup_ipv4 *priv = nft_expr_priv(expr);
- if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+ if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+ goto nla_put_failure;
+ if (priv->sreg_dev &&
nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
goto nla_put_failure;
diff --git a/net/ipv6/netfilter/nft_dup_ipv6.c b/net/ipv6/netfilter/nft_dup_ipv6.c
index 8bfd470cbe72..831f86e1ec08 100644
--- a/net/ipv6/netfilter/nft_dup_ipv6.c
+++ b/net/ipv6/netfilter/nft_dup_ipv6.c
@@ -26,7 +26,7 @@ static void nft_dup_ipv6_eval(const struct nft_expr *expr,
{
struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
struct in6_addr *gw = (struct in6_addr *)®s->data[priv->sreg_addr];
- int oif = regs->data[priv->sreg_dev];
+ int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
nf_dup_ipv6(pkt->net, pkt->skb, pkt->hook, gw, oif);
}
@@ -57,7 +57,9 @@ static int nft_dup_ipv6_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
- if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+ if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+ goto nla_put_failure;
+ if (priv->sreg_dev &&
nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
goto nla_put_failure;
--
2.1.4
next prev parent reply other threads:[~2016-11-10 0:24 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-10 0:23 [PATCH 00/14] Netfilter fixes for net Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 01/14] netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 02/14] netfilter: nf_tables: fix *leak* when expr clone fail Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 03/14] netfilter: nf_tables: fix race when create new element in dynset Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 04/14] netfilter: nf_conntrack_sip: extend request line validation Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 05/14] netfilter: nf_tables: fix type mismatch with error return from nft_parse_u32_check Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 06/14] netfilter: conntrack: avoid excess memory allocation Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 07/14] netfilter: ip_vs_sync: fix bogus maybe-uninitialized warning Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 08/14] netfilter: nf_tables: destroy the set if fail to add transaction Pablo Neira Ayuso
2016-11-10 0:23 ` Pablo Neira Ayuso [this message]
2016-11-10 0:23 ` [PATCH 10/14] ipvs: use IPVS_CMD_ATTR_MAX for family.maxattr Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 11/14] netfilter: connmark: ignore skbs with magic untracked conntrack objects Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 12/14] netfilter: conntrack: fix CT target for UNSPEC helpers Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 13/14] netfilter: conntrack: refine gc worker heuristics Pablo Neira Ayuso
2016-11-10 0:23 ` [PATCH 14/14] netfilter: nf_tables: fix oops when inserting an element into a verdict map Pablo Neira Ayuso
2016-11-10 1:38 ` [PATCH 00/14] Netfilter fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1478737427-1574-10-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).