leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: simplify and make pkt_type_ok() available for other users

Browse Source 
Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jamal Hadi Salim 2016-07-02 06:43:14 -04:00 committed by David S. Miller
parent 8186f6e382
commit 8b10cab64c
2 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/linux/skbuff.h
View File

@ -37,6 +37,7 @@
#include <net/flow_dissector.h> #include <net/flow_dissector.h>
#include <linux/splice.h> #include <linux/splice.h>
#include <linux/in6.h> #include <linux/in6.h>
#include <linux/if_packet.h>
#include <net/flow.h> #include <net/flow.h>
/* The interface for checksum offload between the stack and networking drivers /* The interface for checksum offload between the stack and networking drivers
@ -881,6 +882,15 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb)
return (struct rtable *)skb_dst(skb); return (struct rtable *)skb_dst(skb);
} }
/* For mangling skb->pkt_type from user space side from applications
* such as nft, tc, etc, we only allow a conservative subset of
* possible pkt_types to be set.
*/
static inline bool skb_pkt_type_ok(u32 ptype)
{
return ptype <= PACKET_OTHERHOST;
}
void kfree_skb(struct sk_buff *skb); void kfree_skb(struct sk_buff *skb);
void kfree_skb_list(struct sk_buff *segs); void kfree_skb_list(struct sk_buff *segs);
void skb_tx_error(struct sk_buff *skb); void skb_tx_error(struct sk_buff *skb);

9
net/netfilter/nft_meta.c
View File

@ -199,13 +199,6 @@ err:
} }
EXPORT_SYMBOL_GPL(nft_meta_get_eval); EXPORT_SYMBOL_GPL(nft_meta_get_eval);
/* don't change or set _LOOPBACK, _USER, etc. */
static bool pkt_type_ok(u32 p)
{
return p == PACKET_HOST || p == PACKET_BROADCAST ||
p == PACKET_MULTICAST || p == PACKET_OTHERHOST;
}
void nft_meta_set_eval(const struct nft_expr *expr, void nft_meta_set_eval(const struct nft_expr *expr,
struct nft_regs *regs, struct nft_regs *regs,
const struct nft_pktinfo *pkt) const struct nft_pktinfo *pkt)
@ -223,7 +216,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
break; break;
case NFT_META_PKTTYPE: case NFT_META_PKTTYPE:
if (skb->pkt_type != value && if (skb->pkt_type != value &&
pkt_type_ok(value) && pkt_type_ok(skb->pkt_type)) skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
skb->pkt_type = value; skb->pkt_type = value;
break; break;
case NFT_META_NFTRACE: case NFT_META_NFTRACE: