Commit 4a3046d6 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains two small Netfilter updates for your
net-next tree, they are:

1) Add ebtables support to nft_compat, from Arturo Borrero.

2) Fix missing validation of the SET_ID attribute in the lookup
   expressions, from Patrick McHardy.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 73b4f63a 4c1017aa

net/netfilter/nft_compat.c

+57 −6
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
#include <linux/netfilter/x_tables.h>

#include <linux/netfilter_ipv4/ip_tables.h>

#include <linux/netfilter_ipv6/ip6_tables.h>

#include <linux/netfilter_bridge/ebtables.h>

#include <net/netfilter/nf_tables.h>



static int nft_compat_chain_validate_dependency(const char *tablename,
@@ -40,6 +41,7 @@ static int nft_compat_chain_validate_dependency(const char *tablename, 
union nft_entry {

	struct ipt_entry e4;

	struct ip6t_entry e6;

	struct ebt_entry ebt;

};



static inline void
@@ -50,7 +52,7 @@ nft_compat_set_par(struct xt_action_param *par, void *xt, const void *xt_info) 
	par->hotdrop	= false;

}



static void nft_target_eval(const struct nft_expr *expr,

static void nft_target_eval_xt(const struct nft_expr *expr,

			       struct nft_data data[NFT_REG_MAX + 1],

			       const struct nft_pktinfo *pkt)

{
@@ -74,7 +76,41 @@ static void nft_target_eval(const struct nft_expr *expr, 
		data[NFT_REG_VERDICT].verdict = ret;

		break;

	}

	return;

}



static void nft_target_eval_bridge(const struct nft_expr *expr,

				   struct nft_data data[NFT_REG_MAX + 1],

				   const struct nft_pktinfo *pkt)

{

	void *info = nft_expr_priv(expr);

	struct xt_target *target = expr->ops->data;

	struct sk_buff *skb = pkt->skb;

	int ret;



	nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info);



	ret = target->target(skb, &pkt->xt);



	if (pkt->xt.hotdrop)

		ret = NF_DROP;



	switch (ret) {

	case EBT_ACCEPT:

		data[NFT_REG_VERDICT].verdict = NF_ACCEPT;

		break;

	case EBT_DROP:

		data[NFT_REG_VERDICT].verdict = NF_DROP;

		break;

	case EBT_CONTINUE:

		data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;

		break;

	case EBT_RETURN:

		data[NFT_REG_VERDICT].verdict = NFT_RETURN;

		break;

	default:

		data[NFT_REG_VERDICT].verdict = ret;

		break;

	}

}



static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = {
@@ -100,6 +136,10 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par, 
		entry->e6.ipv6.proto = proto;

		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;

		break;

	case NFPROTO_BRIDGE:

		entry->ebt.ethproto = proto;

		entry->ebt.invflags = inv ? EBT_IPROTO : 0;

		break;

	}

	par->entryinfo	= entry;

	par->target	= target;
@@ -307,6 +347,10 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, 
		entry->e6.ipv6.proto = proto;

		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;

		break;

	case NFPROTO_BRIDGE:

		entry->ebt.ethproto = proto;

		entry->ebt.invflags = inv ? EBT_IPROTO : 0;

		break;

	}

	par->entryinfo	= entry;

	par->match	= match;
@@ -490,6 +534,9 @@ nfnl_compat_get(struct sock *nfnl, struct sk_buff *skb, 
	case AF_INET6:

		fmt = "ip6t_%s";

		break;

	case NFPROTO_BRIDGE:

		fmt = "ebt_%s";

		break;

	default:

		pr_err("nft_compat: unsupported protocol %d\n",

			nfmsg->nfgen_family);
@@ -663,13 +710,17 @@ nft_target_select_ops(const struct nft_ctx *ctx, 


	nft_target->ops.type = &nft_target_type;

	nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));

	nft_target->ops.eval = nft_target_eval;

	nft_target->ops.init = nft_target_init;

	nft_target->ops.destroy = nft_target_destroy;

	nft_target->ops.dump = nft_target_dump;

	nft_target->ops.validate = nft_target_validate;

	nft_target->ops.data = target;



	if (family == NFPROTO_BRIDGE)

		nft_target->ops.eval = nft_target_eval_bridge;

	else

		nft_target->ops.eval = nft_target_eval_xt;



	list_add(&nft_target->head, &nft_target_list);



	return &nft_target->ops;

net/netfilter/nft_lookup.c

+1 −0
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ static void nft_lookup_eval(const struct nft_expr *expr, 


static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {

	[NFTA_LOOKUP_SET]	= { .type = NLA_STRING },

	[NFTA_LOOKUP_SET_ID]	= { .type = NLA_U32 },

	[NFTA_LOOKUP_SREG]	= { .type = NLA_U32 },

	[NFTA_LOOKUP_DREG]	= { .type = NLA_U32 },

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE