Commit 312ca575 authored by Jose M. Guisado Gomez's avatar Jose M. Guisado Gomez Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_reject: unify reject init and dump into nft_reject 



Bridge family is using the same static init and dump function as inet.

This patch removes duplicate code unifying these functions body into
nft_reject.c so they can be reused in the rest of families supporting
reject verdict.

Signed-off-by: default avatarJose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent fa538f7c

net/bridge/netfilter/nft_reject_bridge.c

+2 −58
Original line number Diff line number Diff line
@@ -177,69 +177,13 @@ static int nft_reject_bridge_validate(const struct nft_ctx *ctx, 
						    (1 << NF_BR_LOCAL_IN));

}



static int nft_reject_bridge_init(const struct nft_ctx *ctx,

				  const struct nft_expr *expr,

				  const struct nlattr * const tb[])

{

	struct nft_reject *priv = nft_expr_priv(expr);

	int icmp_code;



	if (tb[NFTA_REJECT_TYPE] == NULL)

		return -EINVAL;



	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));

	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (tb[NFTA_REJECT_ICMP_CODE] == NULL)

			return -EINVAL;



		icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);

		if (priv->type == NFT_REJECT_ICMPX_UNREACH &&

		    icmp_code > NFT_REJECT_ICMPX_MAX)

			return -EINVAL;



		priv->icmp_code = icmp_code;

		break;

	case NFT_REJECT_TCP_RST:

		break;

	default:

		return -EINVAL;

	}

	return 0;

}



static int nft_reject_bridge_dump(struct sk_buff *skb,

				  const struct nft_expr *expr)

{

	const struct nft_reject *priv = nft_expr_priv(expr);



	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))

		goto nla_put_failure;



	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))

			goto nla_put_failure;

		break;

	default:

		break;

	}



	return 0;



nla_put_failure:

	return -1;

}



static struct nft_expr_type nft_reject_bridge_type;

static const struct nft_expr_ops nft_reject_bridge_ops = {

	.type		= &nft_reject_bridge_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),

	.eval		= nft_reject_bridge_eval,

	.init		= nft_reject_bridge_init,

	.dump		= nft_reject_bridge_dump,

	.init		= nft_reject_init,

	.dump		= nft_reject_dump,

	.validate	= nft_reject_bridge_validate,

};

net/netfilter/nft_reject.c

+11 −1
Original line number Diff line number Diff line
@@ -40,6 +40,7 @@ int nft_reject_init(const struct nft_ctx *ctx, 
		    const struct nlattr * const tb[])

{

	struct nft_reject *priv = nft_expr_priv(expr);

	int icmp_code;



	if (tb[NFTA_REJECT_TYPE] == NULL)

		return -EINVAL;
@@ -47,9 +48,17 @@ int nft_reject_init(const struct nft_ctx *ctx, 
	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));

	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (tb[NFTA_REJECT_ICMP_CODE] == NULL)

			return -EINVAL;

		priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);



		icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);

		if (priv->type == NFT_REJECT_ICMPX_UNREACH &&

		    icmp_code > NFT_REJECT_ICMPX_MAX)

			return -EINVAL;



		priv->icmp_code = icmp_code;

		break;

	case NFT_REJECT_TCP_RST:

		break;

	default:
@@ -69,6 +78,7 @@ int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr) 


	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))

			goto nla_put_failure;

		break;

net/netfilter/nft_reject_inet.c

+2 −58
Original line number Diff line number Diff line
@@ -58,69 +58,13 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, 
	regs->verdict.code = NF_DROP;

}



static int nft_reject_inet_init(const struct nft_ctx *ctx,

				const struct nft_expr *expr,

				const struct nlattr * const tb[])

{

	struct nft_reject *priv = nft_expr_priv(expr);

	int icmp_code;



	if (tb[NFTA_REJECT_TYPE] == NULL)

		return -EINVAL;



	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));

	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (tb[NFTA_REJECT_ICMP_CODE] == NULL)

			return -EINVAL;



		icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);

		if (priv->type == NFT_REJECT_ICMPX_UNREACH &&

		    icmp_code > NFT_REJECT_ICMPX_MAX)

			return -EINVAL;



		priv->icmp_code = icmp_code;

		break;

	case NFT_REJECT_TCP_RST:

		break;

	default:

		return -EINVAL;

	}

	return 0;

}



static int nft_reject_inet_dump(struct sk_buff *skb,

				const struct nft_expr *expr)

{

	const struct nft_reject *priv = nft_expr_priv(expr);



	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))

		goto nla_put_failure;



	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))

			goto nla_put_failure;

		break;

	default:

		break;

	}



	return 0;



nla_put_failure:

	return -1;

}



static struct nft_expr_type nft_reject_inet_type;

static const struct nft_expr_ops nft_reject_inet_ops = {

	.type		= &nft_reject_inet_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),

	.eval		= nft_reject_inet_eval,

	.init		= nft_reject_inet_init,

	.dump		= nft_reject_inet_dump,

	.init		= nft_reject_init,

	.dump		= nft_reject_dump,

	.validate	= nft_reject_validate,

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE