netfilter: nft_ct: unnecessary to require dir when use ct l3proto/protocol (d767ff2c) · Commits · 戴 / test

Currently, if the user want to match ct l3proto, we must specify the direction, for example: # nft add rule filter input ct original l3proto ipv4 ^^^^^^^^ Otherwise, error message will be reported: # nft add rule filter input ct l3proto ipv4 nft add rule filter input ct l3proto ipv4 <cmdline>:1:1-38: Error: Could not process rule: Invalid argument add rule filter input ct l3proto ipv4 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Actually, there's no need to require NFTA_CT_DIRECTION attr, because ct l3proto and protocol are unrelated to direction. And for compatibility, even if the user specify the NFTA_CT_DIRECTION attr, do not report error, just skip it. Signed-off-by:

Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/nft_ct.c

+9 −10

Original line number	Diff line number	Diff line
		@@ -128,15 +128,18 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
		memcpy(dest, &count, sizeof(count));
		return;
		}
		case NFT_CT_L3PROTOCOL:
		*dest = nf_ct_l3num(ct);
		return;
		case NFT_CT_PROTOCOL:
		*dest = nf_ct_protonum(ct);
		return;
		default:
		break;
		}

		tuple = &ct->tuplehash[priv->dir].tuple;
		switch (priv->key) {
		case NFT_CT_L3PROTOCOL:
		*dest = nf_ct_l3num(ct);
		return;
		case NFT_CT_SRC:
		memcpy(dest, tuple->src.u3.all,
		nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		@@ -145,9 +148,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
		memcpy(dest, tuple->dst.u3.all,
		nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
		case NFT_CT_PROTOCOL:
		*dest = nf_ct_protonum(ct);
		return;
		case NFT_CT_PROTO_SRC:
		*dest = (__force __u16)tuple->src.u.all;
		return;
		@@ -283,8 +283,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,

		case NFT_CT_L3PROTOCOL:
		case NFT_CT_PROTOCOL:
		if (tb[NFTA_CT_DIRECTION] == NULL)
		return -EINVAL;
		/* For compatibility, do not report error if NFTA_CT_DIRECTION
		* attribute is specified.
		*/
		len = sizeof(u8);
		break;
		case NFT_CT_SRC:
		@@ -432,8 +433,6 @@ static int nft_ct_get_dump(struct sk_buff skb, const struct nft_expr expr)
		goto nla_put_failure;

		switch (priv->key) {
		case NFT_CT_L3PROTOCOL:
		case NFT_CT_PROTOCOL:
		case NFT_CT_SRC:
		case NFT_CT_DST:
		case NFT_CT_PROTO_SRC:

Admin message