Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-13 16:50:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Browse Source 
Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains two small Netfilter updates for your
net-next tree, they are:

1) Add ebtables support to nft_compat, from Arturo Borrero.

2) Fix missing validation of the SET_ID attribute in the lookup
   expressions, from Patrick McHardy.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2015-02-11 14:27:24 -08:00
commit 4a3046d68a
2 changed files with 58 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
net/netfilter/nft_compat.c
View File

@ -19,6 +19,7 @@
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h> #include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter_bridge/ebtables.h>
#include <net/netfilter/nf_tables.h> #include <net/netfilter/nf_tables.h>
static int nft_compat_chain_validate_dependency(const char *tablename, static int nft_compat_chain_validate_dependency(const char *tablename,
@ -40,6 +41,7 @@ static int nft_compat_chain_validate_dependency(const char *tablename,
union nft_entry { union nft_entry {
struct ipt_entry e4; struct ipt_entry e4;
struct ip6t_entry e6; struct ip6t_entry e6;
struct ebt_entry ebt;
}; };
static inline void static inline void
@ -50,9 +52,9 @@ nft_compat_set_par(struct xt_action_param *par, void *xt, const void *xt_info)
par->hotdrop = false; par->hotdrop = false;
} }
static void nft_target_eval(const struct nft_expr *expr, static void nft_target_eval_xt(const struct nft_expr *expr,
struct nft_data data[NFT_REG_MAX + 1], struct nft_data data[NFT_REG_MAX + 1],
const struct nft_pktinfo *pkt) const struct nft_pktinfo *pkt)
{ {
void *info = nft_expr_priv(expr); void *info = nft_expr_priv(expr);
struct xt_target *target = expr->ops->data; struct xt_target *target = expr->ops->data;
@ -66,7 +68,7 @@ static void nft_target_eval(const struct nft_expr *expr,
if (pkt->xt.hotdrop) if (pkt->xt.hotdrop)
ret = NF_DROP; ret = NF_DROP;
switch(ret) { switch (ret) {
case XT_CONTINUE: case XT_CONTINUE:
data[NFT_REG_VERDICT].verdict = NFT_CONTINUE; data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
break; break;
@ -74,7 +76,41 @@ static void nft_target_eval(const struct nft_expr *expr,
data[NFT_REG_VERDICT].verdict = ret; data[NFT_REG_VERDICT].verdict = ret;
break; break;
} }
return; }
static void nft_target_eval_bridge(const struct nft_expr *expr,
struct nft_data data[NFT_REG_MAX + 1],
const struct nft_pktinfo *pkt)
{
void *info = nft_expr_priv(expr);
struct xt_target *target = expr->ops->data;
struct sk_buff *skb = pkt->skb;
int ret;
nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info);
ret = target->target(skb, &pkt->xt);
if (pkt->xt.hotdrop)
ret = NF_DROP;
switch (ret) {
case EBT_ACCEPT:
data[NFT_REG_VERDICT].verdict = NF_ACCEPT;
break;
case EBT_DROP:
data[NFT_REG_VERDICT].verdict = NF_DROP;
break;
case EBT_CONTINUE:
data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
break;
case EBT_RETURN:
data[NFT_REG_VERDICT].verdict = NFT_RETURN;
break;
default:
data[NFT_REG_VERDICT].verdict = ret;
break;
}
} }
static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = {
@ -100,6 +136,10 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
entry->e6.ipv6.proto = proto; entry->e6.ipv6.proto = proto;
entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
break; break;
case NFPROTO_BRIDGE:
entry->ebt.ethproto = proto;
entry->ebt.invflags = inv ? EBT_IPROTO : 0;
break;
} }
par->entryinfo = entry; par->entryinfo = entry;
par->target = target; par->target = target;
@ -307,6 +347,10 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
entry->e6.ipv6.proto = proto; entry->e6.ipv6.proto = proto;
entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
break; break;
case NFPROTO_BRIDGE:
entry->ebt.ethproto = proto;
entry->ebt.invflags = inv ? EBT_IPROTO : 0;
break;
} }
par->entryinfo = entry; par->entryinfo = entry;
par->match = match; par->match = match;
@ -490,6 +534,9 @@ nfnl_compat_get(struct sock *nfnl, struct sk_buff *skb,
case AF_INET6: case AF_INET6:
fmt = "ip6t_%s"; fmt = "ip6t_%s";
break; break;
case NFPROTO_BRIDGE:
fmt = "ebt_%s";
break;
default: default:
pr_err("nft_compat: unsupported protocol %d\n", pr_err("nft_compat: unsupported protocol %d\n",
nfmsg->nfgen_family); nfmsg->nfgen_family);
@ -663,13 +710,17 @@ nft_target_select_ops(const struct nft_ctx *ctx,
nft_target->ops.type = &nft_target_type; nft_target->ops.type = &nft_target_type;
nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
nft_target->ops.eval = nft_target_eval;
nft_target->ops.init = nft_target_init; nft_target->ops.init = nft_target_init;
nft_target->ops.destroy = nft_target_destroy; nft_target->ops.destroy = nft_target_destroy;
nft_target->ops.dump = nft_target_dump; nft_target->ops.dump = nft_target_dump;
nft_target->ops.validate = nft_target_validate; nft_target->ops.validate = nft_target_validate;
nft_target->ops.data = target; nft_target->ops.data = target;
if (family == NFPROTO_BRIDGE)
nft_target->ops.eval = nft_target_eval_bridge;
else
nft_target->ops.eval = nft_target_eval_xt;
list_add(&nft_target->head, &nft_target_list); list_add(&nft_target->head, &nft_target_list);
return &nft_target->ops; return &nft_target->ops;

1
net/netfilter/nft_lookup.c
View File

@ -39,6 +39,7 @@ static void nft_lookup_eval(const struct nft_expr *expr,
static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = { static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
[NFTA_LOOKUP_SET] = { .type = NLA_STRING }, [NFTA_LOOKUP_SET] = { .type = NLA_STRING },
[NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 },
[NFTA_LOOKUP_SREG] = { .type = NLA_U32 }, [NFTA_LOOKUP_SREG] = { .type = NLA_U32 },
[NFTA_LOOKUP_DREG] = { .type = NLA_U32 }, [NFTA_LOOKUP_DREG] = { .type = NLA_U32 },
}; };