Commit a422757e authored by David S. Miller's avatar David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains the first batch of Netfilter fixes for
your net tree:

1) Fix splat with IPv6 defragmenting locally generated fragments,
   from Florian Westphal.

2) Fix Incorrect check for missing attribute in nft_osf.

3) Missing INT_MIN & INT_MAX definition for netfilter bridge uapi
   header, from Jiri Slaby.

4) Revert map lookup in nft_numgen, this is already possible with
   the existing infrastructure without this extension.

5) Fix wrong listing of set reference counter, make counter
   synchronous again, from Stefano Brivio.

6) Fix CIDR 0 in hash:net,port,net, from Eric Westbrook.

7) Fix allocation failure with large set, use kvcalloc().
   From Andrey Ryabinin.

8) No need to disable BH when fetch ip set comment, patch from
   Jozsef Kadlecsik.

9) Sanity check for valid sysfs entry in xt_IDLETIMER, from
   Taehee Yoo.

10) Fix suspicious rcu usage via ip_set() macro at netlink dump,
    from Jozsef Kadlecsik.

11) Fix setting default timeout via nfnetlink_cttimeout, this
    comes with preparation patch to add nf_{tcp,udp,...}_pernet()
    helper.

12) Allow ebtables table nat to be of filter type via nft_compat.
    From Florian Westphal.

13) Incorrect calculation of next bucket in early_drop, do no bump
    hash value, update bucket counter instead. From Vasily Khoruzhick.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 71311931 f393808d
...@@ -314,7 +314,7 @@ enum { ...@@ -314,7 +314,7 @@ enum {
extern ip_set_id_t ip_set_get_byname(struct net *net, extern ip_set_id_t ip_set_get_byname(struct net *net,
const char *name, struct ip_set **set); const char *name, struct ip_set **set);
extern void ip_set_put_byindex(struct net *net, ip_set_id_t index); extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index); extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index); extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index); extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index);
......
...@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment, ...@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
rcu_assign_pointer(comment->c, c); rcu_assign_pointer(comment->c, c);
} }
/* Used only when dumping a set, protected by rcu_read_lock_bh() */ /* Used only when dumping a set, protected by rcu_read_lock() */
static inline int static inline int
ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment) ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)
{ {
struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c); struct ip_set_comment_rcu *c = rcu_dereference(comment->c);
if (!c) if (!c)
return 0; return 0;
......
...@@ -153,4 +153,43 @@ void nf_ct_l4proto_log_invalid(const struct sk_buff *skb, ...@@ -153,4 +153,43 @@ void nf_ct_l4proto_log_invalid(const struct sk_buff *skb,
const char *fmt, ...) { } const char *fmt, ...) { }
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
static inline struct nf_generic_net *nf_generic_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.generic;
}
static inline struct nf_tcp_net *nf_tcp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.tcp;
}
static inline struct nf_udp_net *nf_udp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.udp;
}
static inline struct nf_icmp_net *nf_icmp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.icmp;
}
static inline struct nf_icmp_net *nf_icmpv6_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.icmpv6;
}
#ifdef CONFIG_NF_CT_PROTO_DCCP
static inline struct nf_dccp_net *nf_dccp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.dccp;
}
#endif
#ifdef CONFIG_NF_CT_PROTO_SCTP
static inline struct nf_sctp_net *nf_sctp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.sctp;
}
#endif
#endif /*_NF_CONNTRACK_PROTOCOL_H*/ #endif /*_NF_CONNTRACK_PROTOCOL_H*/
...@@ -1635,8 +1635,8 @@ enum nft_ng_attributes { ...@@ -1635,8 +1635,8 @@ enum nft_ng_attributes {
NFTA_NG_MODULUS, NFTA_NG_MODULUS,
NFTA_NG_TYPE, NFTA_NG_TYPE,
NFTA_NG_OFFSET, NFTA_NG_OFFSET,
NFTA_NG_SET_NAME, NFTA_NG_SET_NAME, /* deprecated */
NFTA_NG_SET_ID, NFTA_NG_SET_ID, /* deprecated */
__NFTA_NG_MAX __NFTA_NG_MAX
}; };
#define NFTA_NG_MAX (__NFTA_NG_MAX - 1) #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
......
...@@ -11,6 +11,10 @@ ...@@ -11,6 +11,10 @@
#include <linux/if_vlan.h> #include <linux/if_vlan.h>
#include <linux/if_pppox.h> #include <linux/if_pppox.h>
#ifndef __KERNEL__
#include <limits.h> /* for INT_MIN, INT_MAX */
#endif
/* Bridge Hooks */ /* Bridge Hooks */
/* After promisc drops, checksum checks. */ /* After promisc drops, checksum checks. */
#define NF_BR_PRE_ROUTING 0 #define NF_BR_PRE_ROUTING 0
......
...@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) ...@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
*/ */
ret = -EINPROGRESS; ret = -EINPROGRESS;
if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
fq->q.meat == fq->q.len && fq->q.meat == fq->q.len) {
nf_ct_frag6_reasm(fq, skb, dev)) unsigned long orefdst = skb->_skb_refdst;
ret = 0;
else skb->_skb_refdst = 0UL;
if (nf_ct_frag6_reasm(fq, skb, dev))
ret = 0;
skb->_skb_refdst = orefdst;
} else {
skb_dst_drop(skb); skb_dst_drop(skb);
}
out_unlock: out_unlock:
spin_unlock_bh(&fq->q.lock); spin_unlock_bh(&fq->q.lock);
......
...@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>"); ...@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
MODULE_DESCRIPTION("core IP set support"); MODULE_DESCRIPTION("core IP set support");
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET); MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
/* When the nfnl mutex is held: */ /* When the nfnl mutex or ip_set_ref_lock is held: */
#define ip_set_dereference(p) \ #define ip_set_dereference(p) \
rcu_dereference_protected(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET)) rcu_dereference_protected(p, \
lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
lockdep_is_held(&ip_set_ref_lock))
#define ip_set(inst, id) \ #define ip_set(inst, id) \
ip_set_dereference((inst)->ip_set_list)[id] ip_set_dereference((inst)->ip_set_list)[id]
#define ip_set_ref_netlink(inst,id) \
rcu_dereference_raw((inst)->ip_set_list)[id]
/* The set types are implemented in modules and registered set types /* The set types are implemented in modules and registered set types
* can be found in ip_set_type_list. Adding/deleting types is * can be found in ip_set_type_list. Adding/deleting types is
...@@ -693,21 +697,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index) ...@@ -693,21 +697,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index)
EXPORT_SYMBOL_GPL(ip_set_put_byindex); EXPORT_SYMBOL_GPL(ip_set_put_byindex);
/* Get the name of a set behind a set index. /* Get the name of a set behind a set index.
* We assume the set is referenced, so it does exist and * Set itself is protected by RCU, but its name isn't: to protect against
* can't be destroyed. The set cannot be renamed due to * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the
* the referencing either. * name.
*
*/ */
const char * void
ip_set_name_byindex(struct net *net, ip_set_id_t index) ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name)
{ {
const struct ip_set *set = ip_set_rcu_get(net, index); struct ip_set *set = ip_set_rcu_get(net, index);
BUG_ON(!set); BUG_ON(!set);
BUG_ON(set->ref == 0);
/* Referenced, so it's safe */ read_lock_bh(&ip_set_ref_lock);
return set->name; strncpy(name, set->name, IPSET_MAXNAMELEN);
read_unlock_bh(&ip_set_ref_lock);
} }
EXPORT_SYMBOL_GPL(ip_set_name_byindex); EXPORT_SYMBOL_GPL(ip_set_name_byindex);
...@@ -961,7 +964,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl, ...@@ -961,7 +964,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
/* Wraparound */ /* Wraparound */
goto cleanup; goto cleanup;
list = kcalloc(i, sizeof(struct ip_set *), GFP_KERNEL); list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
if (!list) if (!list)
goto cleanup; goto cleanup;
/* nfnl mutex is held, both lists are valid */ /* nfnl mutex is held, both lists are valid */
...@@ -973,7 +976,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl, ...@@ -973,7 +976,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
/* Use new list */ /* Use new list */
index = inst->ip_set_max; index = inst->ip_set_max;
inst->ip_set_max = i; inst->ip_set_max = i;
kfree(tmp); kvfree(tmp);
ret = 0; ret = 0;
} else if (ret) { } else if (ret) {
goto cleanup; goto cleanup;
...@@ -1153,7 +1156,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl, ...@@ -1153,7 +1156,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
if (!set) if (!set)
return -ENOENT; return -ENOENT;
read_lock_bh(&ip_set_ref_lock); write_lock_bh(&ip_set_ref_lock);
if (set->ref != 0) { if (set->ref != 0) {
ret = -IPSET_ERR_REFERENCED; ret = -IPSET_ERR_REFERENCED;
goto out; goto out;
...@@ -1170,7 +1173,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl, ...@@ -1170,7 +1173,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
strncpy(set->name, name2, IPSET_MAXNAMELEN); strncpy(set->name, name2, IPSET_MAXNAMELEN);
out: out:
read_unlock_bh(&ip_set_ref_lock); write_unlock_bh(&ip_set_ref_lock);
return ret; return ret;
} }
...@@ -1252,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb) ...@@ -1252,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb)
struct ip_set_net *inst = struct ip_set_net *inst =
(struct ip_set_net *)cb->args[IPSET_CB_NET]; (struct ip_set_net *)cb->args[IPSET_CB_NET];
ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX]; ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
struct ip_set *set = ip_set(inst, index); struct ip_set *set = ip_set_ref_netlink(inst, index);
if (set->variant->uref) if (set->variant->uref)
set->variant->uref(set, cb, false); set->variant->uref(set, cb, false);
...@@ -1441,7 +1444,7 @@ ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb) ...@@ -1441,7 +1444,7 @@ ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb)
release_refcount: release_refcount:
/* If there was an error or set is done, release set */ /* If there was an error or set is done, release set */
if (ret || !cb->args[IPSET_CB_ARG0]) { if (ret || !cb->args[IPSET_CB_ARG0]) {
set = ip_set(inst, index); set = ip_set_ref_netlink(inst, index);
if (set->variant->uref) if (set->variant->uref)
set->variant->uref(set, cb, false); set->variant->uref(set, cb, false);
pr_debug("release set %s\n", set->name); pr_debug("release set %s\n", set->name);
...@@ -2059,7 +2062,7 @@ ip_set_net_init(struct net *net) ...@@ -2059,7 +2062,7 @@ ip_set_net_init(struct net *net)
if (inst->ip_set_max >= IPSET_INVALID_ID) if (inst->ip_set_max >= IPSET_INVALID_ID)
inst->ip_set_max = IPSET_INVALID_ID - 1; inst->ip_set_max = IPSET_INVALID_ID - 1;
list = kcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL); list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
if (!list) if (!list)
return -ENOMEM; return -ENOMEM;
inst->is_deleted = false; inst->is_deleted = false;
...@@ -2087,7 +2090,7 @@ ip_set_net_exit(struct net *net) ...@@ -2087,7 +2090,7 @@ ip_set_net_exit(struct net *net)
} }
} }
nfnl_unlock(NFNL_SUBSYS_IPSET); nfnl_unlock(NFNL_SUBSYS_IPSET);
kfree(rcu_dereference_protected(inst->ip_set_list, 1)); kvfree(rcu_dereference_protected(inst->ip_set_list, 1));
} }
static struct pernet_operations ip_set_net_ops = { static struct pernet_operations ip_set_net_ops = {
......
...@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], ...@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
if (tb[IPSET_ATTR_CIDR]) { if (tb[IPSET_ATTR_CIDR]) {
e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
if (!e.cidr[0] || e.cidr[0] > HOST_MASK) if (e.cidr[0] > HOST_MASK)
return -IPSET_ERR_INVALID_CIDR; return -IPSET_ERR_INVALID_CIDR;
} }
if (tb[IPSET_ATTR_CIDR2]) { if (tb[IPSET_ATTR_CIDR2]) {
e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
if (!e.cidr[1] || e.cidr[1] > HOST_MASK) if (e.cidr[1] > HOST_MASK)
return -IPSET_ERR_INVALID_CIDR; return -IPSET_ERR_INVALID_CIDR;
} }
...@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], ...@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
if (tb[IPSET_ATTR_CIDR]) { if (tb[IPSET_ATTR_CIDR]) {
e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
if (!e.cidr[0] || e.cidr[0] > HOST_MASK) if (e.cidr[0] > HOST_MASK)
return -IPSET_ERR_INVALID_CIDR; return -IPSET_ERR_INVALID_CIDR;
} }
if (tb[IPSET_ATTR_CIDR2]) { if (tb[IPSET_ATTR_CIDR2]) {
e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
if (!e.cidr[1] || e.cidr[1] > HOST_MASK) if (e.cidr[1] > HOST_MASK)
return -IPSET_ERR_INVALID_CIDR; return -IPSET_ERR_INVALID_CIDR;
} }
......
...@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu) ...@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu)
{ {
struct set_elem *e = container_of(rcu, struct set_elem, rcu); struct set_elem *e = container_of(rcu, struct set_elem, rcu);
struct ip_set *set = e->set; struct ip_set *set = e->set;
struct list_set *map = set->data;
ip_set_put_byindex(map->net, e->id);
ip_set_ext_destroy(set, e); ip_set_ext_destroy(set, e);
kfree(e); kfree(e);
} }
...@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu) ...@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu)
static inline void static inline void
list_set_del(struct ip_set *set, struct set_elem *e) list_set_del(struct ip_set *set, struct set_elem *e)
{ {
struct list_set *map = set->data;
set->elements--; set->elements--;
list_del_rcu(&e->list); list_del_rcu(&e->list);
ip_set_put_byindex(map->net, e->id);
call_rcu(&e->rcu, __list_set_del_rcu); call_rcu(&e->rcu, __list_set_del_rcu);
} }
static inline void static inline void
list_set_replace(struct set_elem *e, struct set_elem *old) list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old)
{ {
struct list_set *map = set->data;
list_replace_rcu(&old->list, &e->list); list_replace_rcu(&old->list, &e->list);
ip_set_put_byindex(map->net, old->id);
call_rcu(&old->rcu, __list_set_del_rcu); call_rcu(&old->rcu, __list_set_del_rcu);
} }
...@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext, ...@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
INIT_LIST_HEAD(&e->list); INIT_LIST_HEAD(&e->list);
list_set_init_extensions(set, ext, e); list_set_init_extensions(set, ext, e);
if (n) if (n)
list_set_replace(e, n); list_set_replace(set, e, n);
else if (next) else if (next)
list_add_tail_rcu(&e->list, &next->list); list_add_tail_rcu(&e->list, &next->list);
else if (prev) else if (prev)
...@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set, ...@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set,
const struct list_set *map = set->data; const struct list_set *map = set->data;
struct nlattr *atd, *nested; struct nlattr *atd, *nested;
u32 i = 0, first = cb->args[IPSET_CB_ARG0]; u32 i = 0, first = cb->args[IPSET_CB_ARG0];
char name[IPSET_MAXNAMELEN];
struct set_elem *e; struct set_elem *e;
int ret = 0; int ret = 0;
...@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set, ...@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set,
nested = ipset_nest_start(skb, IPSET_ATTR_DATA); nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
if (!nested) if (!nested)
goto nla_put_failure; goto nla_put_failure;
if (nla_put_string(skb, IPSET_ATTR_NAME, ip_set_name_byindex(map->net, e->id, name);
ip_set_name_byindex(map->net, e->id))) if (nla_put_string(skb, IPSET_ATTR_NAME, name))
goto nla_put_failure; goto nla_put_failure;
if (ip_set_put_extensions(skb, set, e, true)) if (ip_set_put_extensions(skb, set, e, true))
goto nla_put_failure; goto nla_put_failure;
......
...@@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net, ...@@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net,
return drops; return drops;
} }
static noinline int early_drop(struct net *net, unsigned int _hash) static noinline int early_drop(struct net *net, unsigned int hash)
{ {
unsigned int i; unsigned int i, bucket;
for (i = 0; i < NF_CT_EVICTION_RANGE; i++) { for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
struct hlist_nulls_head *ct_hash; struct hlist_nulls_head *ct_hash;
unsigned int hash, hsize, drops; unsigned int hsize, drops;
rcu_read_lock(); rcu_read_lock();
nf_conntrack_get_ht(&ct_hash, &hsize); nf_conntrack_get_ht(&ct_hash, &hsize);
hash = reciprocal_scale(_hash++, hsize); if (!i)
bucket = reciprocal_scale(hash, hsize);
else
bucket = (bucket + 1) % hsize;
drops = early_drop_list(net, &ct_hash[hash]); drops = early_drop_list(net, &ct_hash[bucket]);
rcu_read_unlock(); rcu_read_unlock();
if (drops) { if (drops) {
......
...@@ -384,11 +384,6 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] = ...@@ -384,11 +384,6 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
}, },
}; };
static inline struct nf_dccp_net *dccp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.dccp;
}
static noinline bool static noinline bool
dccp_new(struct nf_conn *ct, const struct sk_buff *skb, dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
const struct dccp_hdr *dh) const struct dccp_hdr *dh)
...@@ -401,7 +396,7 @@ dccp_new(struct nf_conn *ct, const struct sk_buff *skb, ...@@ -401,7 +396,7 @@ dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE]; state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE];
switch (state) { switch (state) {
default: default:
dn = dccp_pernet(net); dn = nf_dccp_pernet(net);
if (dn->dccp_loose == 0) { if (dn->dccp_loose == 0) {
msg = "not picking up existing connection "; msg = "not picking up existing connection ";
goto out_invalid; goto out_invalid;
...@@ -568,7 +563,7 @@ static int dccp_packet(struct nf_conn *ct, struct sk_buff *skb, ...@@ -568,7 +563,7 @@ static int dccp_packet(struct nf_conn *ct, struct sk_buff *skb,
timeouts = nf_ct_timeout_lookup(ct); timeouts = nf_ct_timeout_lookup(ct);
if (!timeouts) if (!timeouts)
timeouts = dccp_pernet(nf_ct_net(ct))->dccp_timeout; timeouts = nf_dccp_pernet(nf_ct_net(ct))->dccp_timeout;
nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]); nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
return NF_ACCEPT; return NF_ACCEPT;
...@@ -681,7 +676,7 @@ static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct) ...@@ -681,7 +676,7 @@ static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[], static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
struct nf_dccp_net *dn = dccp_pernet(net); struct nf_dccp_net *dn = nf_dccp_pernet(net);
unsigned int *timeouts = data; unsigned int *timeouts = data;
int i; int i;
...@@ -814,7 +809,7 @@ static int dccp_kmemdup_sysctl_table(struct net *net, struct nf_proto_net *pn, ...@@ -814,7 +809,7 @@ static int dccp_kmemdup_sysctl_table(struct net *net, struct nf_proto_net *pn,
static int dccp_init_net(struct net *net) static int dccp_init_net(struct net *net)
{ {
struct nf_dccp_net *dn = dccp_pernet(net); struct nf_dccp_net *dn = nf_dccp_pernet(net);
struct nf_proto_net *pn = &dn->pn; struct nf_proto_net *pn = &dn->pn;
if (!pn->users) { if (!pn->users) {
......
...@@ -27,11 +27,6 @@ static bool nf_generic_should_process(u8 proto) ...@@ -27,11 +27,6 @@ static bool nf_generic_should_process(u8 proto)
} }
} }
static inline struct nf_generic_net *generic_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.generic;
}
static bool generic_pkt_to_tuple(const struct sk_buff *skb, static bool generic_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff, unsigned int dataoff,
struct net *net, struct nf_conntrack_tuple *tuple) struct net *net, struct nf_conntrack_tuple *tuple)
...@@ -58,7 +53,7 @@ static int generic_packet(struct nf_conn *ct, ...@@ -58,7 +53,7 @@ static int generic_packet(struct nf_conn *ct,
} }
if (!timeout) if (!timeout)
timeout = &generic_pernet(nf_ct_net(ct))->timeout; timeout = &nf_generic_pernet(nf_ct_net(ct))->timeout;
nf_ct_refresh_acct(ct, ctinfo, skb, *timeout); nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
return NF_ACCEPT; return NF_ACCEPT;
...@@ -72,7 +67,7 @@ static int generic_packet(struct nf_conn *ct, ...@@ -72,7 +67,7 @@ static int generic_packet(struct nf_conn *ct,
static int generic_timeout_nlattr_to_obj(struct nlattr *tb[], static int generic_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
struct nf_generic_net *gn = generic_pernet(net); struct nf_generic_net *gn = nf_generic_pernet(net);
unsigned int *timeout = data; unsigned int *timeout = data;
if (!timeout) if (!timeout)
...@@ -138,7 +133,7 @@ static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -138,7 +133,7 @@ static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn,
static int generic_init_net(struct net *net) static int generic_init_net(struct net *net)
{ {
struct nf_generic_net *gn = generic_pernet(net); struct nf_generic_net *gn = nf_generic_pernet(net);
struct nf_proto_net *pn = &gn->pn; struct nf_proto_net *pn = &gn->pn;
gn->timeout = nf_ct_generic_timeout; gn->timeout = nf_ct_generic_timeout;
......
...@@ -25,11 +25,6 @@ ...@@ -25,11 +25,6 @@
static const unsigned int nf_ct_icmp_timeout = 30*HZ; static const unsigned int nf_ct_icmp_timeout = 30*HZ;
static inline struct nf_icmp_net *icmp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.icmp;
}
static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff, static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
struct net *net, struct nf_conntrack_tuple *tuple) struct net *net, struct nf_conntrack_tuple *tuple)
{ {
...@@ -103,7 +98,7 @@ static int icmp_packet(struct nf_conn *ct, ...@@ -103,7 +98,7 @@ static int icmp_packet(struct nf_conn *ct,
} }
if (!timeout) if (!timeout)
timeout = &icmp_pernet(nf_ct_net(ct))->timeout; timeout = &nf_icmp_pernet(nf_ct_net(ct))->timeout;
nf_ct_refresh_acct(ct, ctinfo, skb, *timeout); nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
return NF_ACCEPT; return NF_ACCEPT;
...@@ -275,7 +270,7 @@ static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[], ...@@ -275,7 +270,7 @@ static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
unsigned int *timeout = data; unsigned int *timeout = data;
struct nf_icmp_net *in = icmp_pernet(net); struct nf_icmp_net *in = nf_icmp_pernet(net);
if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) { if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) {
if (!timeout) if (!timeout)
...@@ -337,7 +332,7 @@ static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -337,7 +332,7 @@ static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn,
static int icmp_init_net(struct net *net) static int icmp_init_net(struct net *net)
{ {
struct nf_icmp_net *in = icmp_pernet(net); struct nf_icmp_net *in = nf_icmp_pernet(net);
struct nf_proto_net *pn = &in->pn; struct nf_proto_net *pn = &in->pn;
in->timeout = nf_ct_icmp_timeout; in->timeout = nf_ct_icmp_timeout;
......
...@@ -30,11 +30,6 @@ ...@@ -30,11 +30,6 @@
static const unsigned int nf_ct_icmpv6_timeout = 30*HZ; static const unsigned int nf_ct_icmpv6_timeout = 30*HZ;
static inline struct nf_icmp_net *icmpv6_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.icmpv6;
}
static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb, static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff, unsigned int dataoff,
struct net *net, struct net *net,
...@@ -87,7 +82,7 @@ static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple, ...@@ -87,7 +82,7 @@ static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
static unsigned int *icmpv6_get_timeouts(struct net *net) static unsigned int *icmpv6_get_timeouts(struct net *net)
{ {
return &icmpv6_pernet(net)->timeout; return &nf_icmpv6_pernet(net)->timeout;
} }
/* Returns verdict for packet, or -1 for invalid. */ /* Returns verdict for packet, or -1 for invalid. */
...@@ -286,7 +281,7 @@ static int icmpv6_timeout_nlattr_to_obj(struct nlattr *tb[], ...@@ -286,7 +281,7 @@ static int icmpv6_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
unsigned int *timeout = data; unsigned int *timeout = data;
struct nf_icmp_net *in = icmpv6_pernet(net); struct nf_icmp_net *in = nf_icmpv6_pernet(net);
if (!timeout) if (!timeout)
timeout = icmpv6_get_timeouts(net); timeout = icmpv6_get_timeouts(net);
...@@ -348,7 +343,7 @@ static int icmpv6_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -348,7 +343,7 @@ static int icmpv6_kmemdup_sysctl_table(struct nf_proto_net *pn,
static int icmpv6_init_net(struct net *net) static int icmpv6_init_net(struct net *net)
{ {
struct nf_icmp_net *in = icmpv6_pernet(net); struct nf_icmp_net *in = nf_icmpv6_pernet(net);
struct nf_proto_net *pn = &in->pn; struct nf_proto_net *pn = &in->pn;
in->timeout = nf_ct_icmpv6_timeout; in->timeout = nf_ct_icmpv6_timeout;
......
...@@ -146,11 +146,6 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = { ...@@ -146,11 +146,6 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
} }
}; };
static inline struct nf_sctp_net *sctp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.sctp;
}
#ifdef CONFIG_NF_CONNTRACK_PROCFS #ifdef CONFIG_NF_CONNTRACK_PROCFS
/* Print out the private part of the conntrack. */ /* Print out the private part of the conntrack. */
static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct) static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
...@@ -480,7 +475,7 @@ static int sctp_packet(struct nf_conn *ct, ...@@ -480,7 +475,7 @@ static int sctp_packet(struct nf_conn *ct,
timeouts = nf_ct_timeout_lookup(ct); timeouts = nf_ct_timeout_lookup(ct);
if (!timeouts) if (!timeouts)
timeouts = sctp_pernet(nf_ct_net(ct))->timeouts; timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;
nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]); nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
...@@ -599,7 +594,7 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[], ...@@ -599,7 +594,7 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct nf_sctp_net *sn = sctp_pernet(net); struct nf_sctp_net *sn = nf_sctp_pernet(net);
int i; int i;
/* set default SCTP timeouts. */ /* set default SCTP timeouts. */
...@@ -736,7 +731,7 @@ static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -736,7 +731,7 @@ static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn,
static int sctp_init_net(struct net *net) static int sctp_init_net(struct net *net)
{ {
struct nf_sctp_net *sn = sctp_pernet(net); struct nf_sctp_net *sn = nf_sctp_pernet(net);
struct nf_proto_net *pn = &sn->pn; struct nf_proto_net *pn = &sn->pn;
if (!pn->users) { if (!pn->users) {
......
...@@ -272,11 +272,6 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = { ...@@ -272,11 +272,6 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
} }
}; };
static inline struct nf_tcp_net *tcp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.tcp;
}
#ifdef CONFIG_NF_CONNTRACK_PROCFS #ifdef CONFIG_NF_CONNTRACK_PROCFS
/* Print out the private part of the conntrack. */ /* Print out the private part of the conntrack. */
static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct) static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
...@@ -475,7 +470,7 @@ static bool tcp_in_window(const struct nf_conn *ct, ...@@ -475,7 +470,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
const struct tcphdr *tcph) const struct tcphdr *tcph)
{ {
struct net *net = nf_ct_net(ct); struct net *net = nf_ct_net(ct);
struct nf_tcp_net *tn = tcp_pernet(net); struct nf_tcp_net *tn = nf_tcp_pernet(net);
struct ip_ct_tcp_state *sender = &state->seen[dir]; struct ip_ct_tcp_state *sender = &state->seen[dir];
struct ip_ct_tcp_state *receiver = &state->seen[!dir]; struct ip_ct_tcp_state *receiver = &state->seen[!dir];
const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple; const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
...@@ -767,7 +762,7 @@ static noinline bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb, ...@@ -767,7 +762,7 @@ static noinline bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
{ {
enum tcp_conntrack new_state; enum tcp_conntrack new_state;
struct net *net = nf_ct_net(ct); struct net *net = nf_ct_net(ct);
const struct nf_tcp_net *tn = tcp_pernet(net); const struct nf_tcp_net *tn = nf_tcp_pernet(net);
const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0]; const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1]; const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
...@@ -841,7 +836,7 @@ static int tcp_packet(struct nf_conn *ct, ...@@ -841,7 +836,7 @@ static int tcp_packet(struct nf_conn *ct,
const struct nf_hook_state *state) const struct nf_hook_state *state)
{ {
struct net *net = nf_ct_net(ct); struct net *net = nf_ct_net(ct);
struct nf_tcp_net *tn = tcp_pernet(net); struct nf_tcp_net *tn = nf_tcp_pernet(net);
struct nf_conntrack_tuple *tuple; struct nf_conntrack_tuple *tuple;
enum tcp_conntrack new_state, old_state; enum tcp_conntrack new_state, old_state;
unsigned int index, *timeouts; unsigned int index, *timeouts;
...@@ -1283,7 +1278,7 @@ static unsigned int tcp_nlattr_tuple_size(void) ...@@ -1283,7 +1278,7 @@ static unsigned int tcp_nlattr_tuple_size(void)
static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[], static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
struct nf_tcp_net *tn = tcp_pernet(net); struct nf_tcp_net *tn = nf_tcp_pernet(net);
unsigned int *timeouts = data; unsigned int *timeouts = data;
int i; int i;
...@@ -1508,7 +1503,7 @@ static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -1508,7 +1503,7 @@ static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
static int tcp_init_net(struct net *net) static int tcp_init_net(struct net *net)
{ {
struct nf_tcp_net *tn = tcp_pernet(net); struct nf_tcp_net *tn = nf_tcp_pernet(net);
struct nf_proto_net *pn = &tn->pn; struct nf_proto_net *pn = &tn->pn;
if (!pn->users) { if (!pn->users) {
......
...@@ -32,14 +32,9 @@ static const unsigned int udp_timeouts[UDP_CT_MAX] = { ...@@ -32,14 +32,9 @@ static const unsigned int udp_timeouts[UDP_CT_MAX] = {
[UDP_CT_REPLIED] = 180*HZ, [UDP_CT_REPLIED] = 180*HZ,
}; };
static inline struct nf_udp_net *udp_pernet(struct net *net)
{
return &net->ct.nf_ct_proto.udp;
}
static unsigned int *udp_get_timeouts(struct net *net) static unsigned int *udp_get_timeouts(struct net *net)
{ {
return udp_pernet(net)->timeouts; return nf_udp_pernet(net)->timeouts;
} }
static void udp_error_log(const struct sk_buff *skb, static void udp_error_log(const struct sk_buff *skb,
...@@ -212,7 +207,7 @@ static int udp_timeout_nlattr_to_obj(struct nlattr *tb[], ...@@ -212,7 +207,7 @@ static int udp_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct nf_udp_net *un = udp_pernet(net); struct nf_udp_net *un = nf_udp_pernet(net);
if (!timeouts) if (!timeouts)
timeouts = un->timeouts; timeouts = un->timeouts;
...@@ -292,7 +287,7 @@ static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -292,7 +287,7 @@ static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn,
static int udp_init_net(struct net *net) static int udp_init_net(struct net *net)
{ {
struct nf_udp_net *un = udp_pernet(net); struct nf_udp_net *un = nf_udp_pernet(net);
struct nf_proto_net *pn = &un->pn; struct nf_proto_net *pn = &un->pn;
if (!pn->users) { if (!pn->users) {
......
...@@ -382,7 +382,8 @@ static int cttimeout_default_set(struct net *net, struct sock *ctnl, ...@@ -382,7 +382,8 @@ static int cttimeout_default_set(struct net *net, struct sock *ctnl,
static int static int
cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid, cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
u32 seq, u32 type, int event, u16 l3num, u32 seq, u32 type, int event, u16 l3num,
const struct nf_conntrack_l4proto *l4proto) const struct nf_conntrack_l4proto *l4proto,
const unsigned int *timeouts)
{ {
struct nlmsghdr *nlh; struct nlmsghdr *nlh;
struct nfgenmsg *nfmsg; struct nfgenmsg *nfmsg;
...@@ -408,7 +409,7 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid, ...@@ -408,7 +409,7 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
if (!nest_parms) if (!nest_parms)
goto nla_put_failure; goto nla_put_failure;
ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, NULL); ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
if (ret < 0) if (ret < 0)
goto nla_put_failure; goto nla_put_failure;
...@@ -430,6 +431,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, ...@@ -430,6 +431,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
struct netlink_ext_ack *extack) struct netlink_ext_ack *extack)
{ {
const struct nf_conntrack_l4proto *l4proto; const struct nf_conntrack_l4proto *l4proto;
unsigned int *timeouts = NULL;
struct sk_buff *skb2; struct sk_buff *skb2;
int ret, err; int ret, err;
__u16 l3num; __u16 l3num;
...@@ -442,12 +444,44 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, ...@@ -442,12 +444,44 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]); l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
l4proto = nf_ct_l4proto_find_get(l4num); l4proto = nf_ct_l4proto_find_get(l4num);
/* This protocol is not supported, skip. */ err = -EOPNOTSUPP;
if (l4proto->l4proto != l4num) { if (l4proto->l4proto != l4num)
err = -EOPNOTSUPP;
goto err; goto err;
switch (l4proto->l4proto) {
case IPPROTO_ICMP:
timeouts = &nf_icmp_pernet(net)->timeout;
break;
case IPPROTO_TCP:
timeouts = nf_tcp_pernet(net)->timeouts;
break;
case IPPROTO_UDP:
timeouts = nf_udp_pernet(net)->timeouts;
break;
case IPPROTO_DCCP:
#ifdef CONFIG_NF_CT_PROTO_DCCP
timeouts = nf_dccp_pernet(net)->dccp_timeout;
#endif
break;
case IPPROTO_ICMPV6:
timeouts = &nf_icmpv6_pernet(net)->timeout;
break;
case IPPROTO_SCTP:
#ifdef CONFIG_NF_CT_PROTO_SCTP
timeouts = nf_sctp_pernet(net)->timeouts;
#endif
break;
case 255:
timeouts = &nf_generic_pernet(net)->timeout;
break;
default:
WARN_ON_ONCE(1);
break;
} }
if (!timeouts)
goto err;
skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
if (skb2 == NULL) { if (skb2 == NULL) {
err = -ENOMEM; err = -ENOMEM;
...@@ -458,8 +492,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, ...@@ -458,8 +492,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
nlh->nlmsg_seq, nlh->nlmsg_seq,
NFNL_MSG_TYPE(nlh->nlmsg_type), NFNL_MSG_TYPE(nlh->nlmsg_type),
IPCTNL_MSG_TIMEOUT_DEFAULT_SET, IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
l3num, l3num, l4proto, timeouts);
l4proto);
if (ret <= 0) { if (ret <= 0) {
kfree_skb(skb2); kfree_skb(skb2);
err = -ENOMEM; err = -ENOMEM;
......
...@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt) ...@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt)
return false; return false;
} }
static int nft_compat_chain_validate_dependency(const char *tablename, static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
const struct nft_chain *chain) const char *tablename)
{ {
enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
const struct nft_chain *chain = ctx->chain;
const struct nft_base_chain *basechain; const struct nft_base_chain *basechain;
if (!tablename || if (!tablename ||
...@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename, ...@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename,
return 0; return 0;
basechain = nft_base_chain(chain); basechain = nft_base_chain(chain);
if (strcmp(tablename, "nat") == 0 && if (strcmp(tablename, "nat") == 0) {
basechain->type->type != NFT_CHAIN_T_NAT) if (ctx->family != NFPROTO_BRIDGE)
return -EINVAL; type = NFT_CHAIN_T_NAT;
if (basechain->type->type != type)
return -EINVAL;
}
return 0; return 0;
} }
...@@ -342,8 +347,7 @@ static int nft_target_validate(const struct nft_ctx *ctx, ...@@ -342,8 +347,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
if (target->hooks && !(hook_mask & target->hooks)) if (target->hooks && !(hook_mask & target->hooks))
return -EINVAL; return -EINVAL;
ret = nft_compat_chain_validate_dependency(target->table, ret = nft_compat_chain_validate_dependency(ctx, target->table);
ctx->chain);
if (ret < 0) if (ret < 0)
return ret; return ret;
} }
...@@ -590,8 +594,7 @@ static int nft_match_validate(const struct nft_ctx *ctx, ...@@ -590,8 +594,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
if (match->hooks && !(hook_mask & match->hooks)) if (match->hooks && !(hook_mask & match->hooks))
return -EINVAL; return -EINVAL;
ret = nft_compat_chain_validate_dependency(match->table, ret = nft_compat_chain_validate_dependency(ctx, match->table);
ctx->chain);
if (ret < 0) if (ret < 0)
return ret; return ret;
} }
......
...@@ -24,7 +24,6 @@ struct nft_ng_inc { ...@@ -24,7 +24,6 @@ struct nft_ng_inc {
u32 modulus; u32 modulus;
atomic_t counter; atomic_t counter;
u32 offset; u32 offset;
struct nft_set *map;
}; };
static u32 nft_ng_inc_gen(struct nft_ng_inc *priv) static u32 nft_ng_inc_gen(struct nft_ng_inc *priv)
...@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr, ...@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,
regs->data[priv->dreg] = nft_ng_inc_gen(priv); regs->data[priv->dreg] = nft_ng_inc_gen(priv);
} }
static void nft_ng_inc_map_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
struct nft_ng_inc *priv = nft_expr_priv(expr);
const struct nft_set *map = priv->map;
const struct nft_set_ext *ext;
u32 result;
bool found;
result = nft_ng_inc_gen(priv);
found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
if (!found)
return;
nft_data_copy(&regs->data[priv->dreg],
nft_set_ext_data(ext), map->dlen);
}
static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = { static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
[NFTA_NG_DREG] = { .type = NLA_U32 }, [NFTA_NG_DREG] = { .type = NLA_U32 },
[NFTA_NG_MODULUS] = { .type = NLA_U32 }, [NFTA_NG_MODULUS] = { .type = NLA_U32 },
[NFTA_NG_TYPE] = { .type = NLA_U32 }, [NFTA_NG_TYPE] = { .type = NLA_U32 },
[NFTA_NG_OFFSET] = { .type = NLA_U32 }, [NFTA_NG_OFFSET] = { .type = NLA_U32 },
[NFTA_NG_SET_NAME] = { .type = NLA_STRING,
.len = NFT_SET_MAXNAMELEN - 1 },
[NFTA_NG_SET_ID] = { .type = NLA_U32 },
}; };
static int nft_ng_inc_init(const struct nft_ctx *ctx, static int nft_ng_inc_init(const struct nft_ctx *ctx,
...@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx, ...@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
NFT_DATA_VALUE, sizeof(u32)); NFT_DATA_VALUE, sizeof(u32));
} }
static int nft_ng_inc_map_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
{
struct nft_ng_inc *priv = nft_expr_priv(expr);
u8 genmask = nft_genmask_next(ctx->net);
nft_ng_inc_init(ctx, expr, tb);
priv->map = nft_set_lookup_global(ctx->net, ctx->table,
tb[NFTA_NG_SET_NAME],
tb[NFTA_NG_SET_ID], genmask);
return PTR_ERR_OR_ZERO(priv->map);
}
static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg, static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
u32 modulus, enum nft_ng_types type, u32 offset) u32 modulus, enum nft_ng_types type, u32 offset)
{ {
...@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr) ...@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr)
priv->offset); priv->offset);
} }
static int nft_ng_inc_map_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
const struct nft_ng_inc *priv = nft_expr_priv(expr);
if (nft_ng_dump(skb, priv->dreg, priv->modulus,
NFT_NG_INCREMENTAL, priv->offset) ||
nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
goto nla_put_failure;
return 0;
nla_put_failure:
return -1;
}
struct nft_ng_random { struct nft_ng_random {
enum nft_registers dreg:8; enum nft_registers dreg:8;
u32 modulus; u32 modulus;
u32 offset; u32 offset;
struct nft_set *map;
}; };
static u32 nft_ng_random_gen(struct nft_ng_random *priv) static u32 nft_ng_random_gen(struct nft_ng_random *priv)
...@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr, ...@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr,
regs->data[priv->dreg] = nft_ng_random_gen(priv); regs->data[priv->dreg] = nft_ng_random_gen(priv);
} }
static void nft_ng_random_map_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
struct nft_ng_random *priv = nft_expr_priv(expr);
const struct nft_set *map = priv->map;
const struct nft_set_ext *ext;
u32 result;
bool found;
result = nft_ng_random_gen(priv);
found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
if (!found)
return;
nft_data_copy(&regs->data[priv->dreg],
nft_set_ext_data(ext), map->dlen);
}
static int nft_ng_random_init(const struct nft_ctx *ctx, static int nft_ng_random_init(const struct nft_ctx *ctx,
const struct nft_expr *expr, const struct nft_expr *expr,
const struct nlattr * const tb[]) const struct nlattr * const tb[])
...@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx, ...@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,
NFT_DATA_VALUE, sizeof(u32)); NFT_DATA_VALUE, sizeof(u32));
} }
static int nft_ng_random_map_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
{
struct nft_ng_random *priv = nft_expr_priv(expr);
u8 genmask = nft_genmask_next(ctx->net);
nft_ng_random_init(ctx, expr, tb);
priv->map = nft_set_lookup_global(ctx->net, ctx->table,
tb[NFTA_NG_SET_NAME],
tb[NFTA_NG_SET_ID], genmask);
return PTR_ERR_OR_ZERO(priv->map);
}
static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
{ {
const struct nft_ng_random *priv = nft_expr_priv(expr); const struct nft_ng_random *priv = nft_expr_priv(expr);
...@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) ...@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
priv->offset); priv->offset);
} }
static int nft_ng_random_map_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
const struct nft_ng_random *priv = nft_expr_priv(expr);
if (nft_ng_dump(skb, priv->dreg, priv->modulus,
NFT_NG_RANDOM, priv->offset) ||
nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
goto nla_put_failure;
return 0;
nla_put_failure:
return -1;
}
static struct nft_expr_type nft_ng_type; static struct nft_expr_type nft_ng_type;
static const struct nft_expr_ops nft_ng_inc_ops = { static const struct nft_expr_ops nft_ng_inc_ops = {
.type = &nft_ng_type, .type = &nft_ng_type,
...@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = { ...@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = {
.dump = nft_ng_inc_dump, .dump = nft_ng_inc_dump,
}; };
static const struct nft_expr_ops nft_ng_inc_map_ops = {
.type = &nft_ng_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)),
.eval = nft_ng_inc_map_eval,
.init = nft_ng_inc_map_init,
.dump = nft_ng_inc_map_dump,
};
static const struct nft_expr_ops nft_ng_random_ops = { static const struct nft_expr_ops nft_ng_random_ops = {
.type = &nft_ng_type, .type = &nft_ng_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
...@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = { ...@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = {
.dump = nft_ng_random_dump, .dump = nft_ng_random_dump,
}; };
static const struct nft_expr_ops nft_ng_random_map_ops = {
.type = &nft_ng_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
.eval = nft_ng_random_map_eval,
.init = nft_ng_random_map_init,
.dump = nft_ng_random_map_dump,
};
static const struct nft_expr_ops * static const struct nft_expr_ops *
nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
{ {
...@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) ...@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
switch (type) { switch (type) {
case NFT_NG_INCREMENTAL: case NFT_NG_INCREMENTAL:
if (tb[NFTA_NG_SET_NAME])
return &nft_ng_inc_map_ops;
return &nft_ng_inc_ops; return &nft_ng_inc_ops;
case NFT_NG_RANDOM: case NFT_NG_RANDOM:
if (tb[NFTA_NG_SET_NAME])
return &nft_ng_random_map_ops;
return &nft_ng_random_ops; return &nft_ng_random_ops;
} }
......
...@@ -50,7 +50,7 @@ static int nft_osf_init(const struct nft_ctx *ctx, ...@@ -50,7 +50,7 @@ static int nft_osf_init(const struct nft_ctx *ctx,
int err; int err;
u8 ttl; u8 ttl;
if (nla_get_u8(tb[NFTA_OSF_TTL])) { if (tb[NFTA_OSF_TTL]) {
ttl = nla_get_u8(tb[NFTA_OSF_TTL]); ttl = nla_get_u8(tb[NFTA_OSF_TTL]);
if (ttl > 2) if (ttl > 2)
return -EINVAL; return -EINVAL;
......
...@@ -114,6 +114,22 @@ static void idletimer_tg_expired(struct timer_list *t) ...@@ -114,6 +114,22 @@ static void idletimer_tg_expired(struct timer_list *t)
schedule_work(&timer->work); schedule_work(&timer->work);
} }
static int idletimer_check_sysfs_name(const char *name, unsigned int size)
{
int ret;
ret = xt_check_proc_name(name, size);
if (ret < 0)
return ret;
if (!strcmp(name, "power") ||
!strcmp(name, "subsystem") ||
!strcmp(name, "uevent"))
return -EINVAL;
return 0;
}
static int idletimer_tg_create(struct idletimer_tg_info *info) static int idletimer_tg_create(struct idletimer_tg_info *info)
{ {
int ret; int ret;
...@@ -124,6 +140,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) ...@@ -124,6 +140,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
goto out; goto out;
} }
ret = idletimer_check_sysfs_name(info->label, sizeof(info->label));
if (ret < 0)
goto out_free_timer;
sysfs_attr_init(&info->timer->attr.attr); sysfs_attr_init(&info->timer->attr.attr);
info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
if (!info->timer->attr.attr.name) { if (!info->timer->attr.attr.name) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment