Commit ba3d24d4 authored by Nikolay Aleksandrov's avatar Nikolay Aleksandrov Committed by David S. Miller
Browse files

net: sched: em_ipt: keep the user-specified nfproto and dump it 



If we dump NFPROTO_UNSPEC as nfproto user-space libxtables can't handle
it and would exit with an error like:
"libxtables: unhandled NFPROTO in xtables_set_nfproto"
In order to avoid the error return the user-specified nfproto. If we
don't record it then the match family is used which can be
NFPROTO_UNSPEC. Even if we add support to mask NFPROTO_UNSPEC in
iproute2 we have to be compatible with older versions which would be
also be allowed to add NFPROTO_UNSPEC matches (e.g. addrtype after the
last patch).

v3: don't use the user nfproto for matching, only for dumping the rule,
    also don't allow the nfproto to be unspecified (explained above)
v2: adjust changes to missing patch, was patch 04 in v1

Signed-off-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f4c1c40c

net/sched/em_ipt.c

+13 −1
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
struct em_ipt_match {

	const struct xt_match *match;

	u32 hook;

	u8 nfproto;

	u8 match_data[0] __aligned(8);

};
@@ -115,6 +116,7 @@ static int em_ipt_change(struct net *net, void *data, int data_len, 
	struct em_ipt_match *im = NULL;

	struct xt_match *match;

	int mdata_len, ret;

	u8 nfproto;



	ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len,

				   em_ipt_policy, NULL);
@@ -125,6 +127,15 @@ static int em_ipt_change(struct net *net, void *data, int data_len, 
	    !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])

		return -EINVAL;



	nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);

	switch (nfproto) {

	case NFPROTO_IPV4:

	case NFPROTO_IPV6:

		break;

	default:

		return -EINVAL;

	}



	match = get_xt_match(tb);

	if (IS_ERR(match)) {

		pr_err("unable to load match\n");
@@ -140,6 +151,7 @@ static int em_ipt_change(struct net *net, void *data, int data_len, 


	im->match = match;

	im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);

	im->nfproto = nfproto;

	nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);



	ret = check_match(net, im, mdata_len);
@@ -231,7 +243,7 @@ static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em) 
		return -EMSGSIZE;

	if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)

		return -EMSGSIZE;

	if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->match->family) < 0)

	if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->nfproto) < 0)

		return -EMSGSIZE;

	if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,

		    im->match->usersize ?: im->match->matchsize,

CRA Git | Maintained and supported by SUSTech CRA and CCSE