leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nf_tables: remove nhooks field from struct nft_af_info

Browse Source 
We already validate the hook through bitmask, so this check is
superfluous. When removing this, this patch is also fixing a bug in the
new flowtable codebase, since ctx->afi points to the table family
instead of the netdev family which is where the flowtable is really
hooked in.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2017-12-19 13:53:45 +01:00
parent 61ad64080e
commit fe19c04ca1
8 changed files with 1 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/netfilter/nf_tables.h
View File

@ -973,7 +973,6 @@ enum nft_af_flags {
* *
* @list: used internally * @list: used internally
* @family: address family * @family: address family
* @nhooks: number of hooks in this family
* @owner: module owner * @owner: module owner
* @tables: used internally * @tables: used internally
* @flags: family flags * @flags: family flags
@ -981,7 +980,6 @@ enum nft_af_flags {
struct nft_af_info { struct nft_af_info {
struct list_head list; struct list_head list;
int family; int family;
unsigned int nhooks;
struct module *owner; struct module *owner;
struct list_head tables; struct list_head tables;
u32 flags; u32 flags;

1
net/bridge/netfilter/nf_tables_bridge.c
View File

@ -44,7 +44,6 @@ nft_do_chain_bridge(void *priv,
static struct nft_af_info nft_af_bridge __read_mostly = { static struct nft_af_info nft_af_bridge __read_mostly = {
.family = NFPROTO_BRIDGE, .family = NFPROTO_BRIDGE,
.nhooks = NF_BR_NUMHOOKS,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}; };

1
net/ipv4/netfilter/nf_tables_arp.c
View File

@ -29,7 +29,6 @@ nft_do_chain_arp(void *priv,
static struct nft_af_info nft_af_arp __read_mostly = { static struct nft_af_info nft_af_arp __read_mostly = {
.family = NFPROTO_ARP, .family = NFPROTO_ARP,
.nhooks = NF_ARP_NUMHOOKS,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}; };

1
net/ipv4/netfilter/nf_tables_ipv4.c
View File

@ -32,7 +32,6 @@ static unsigned int nft_do_chain_ipv4(void *priv,
static struct nft_af_info nft_af_ipv4 __read_mostly = { static struct nft_af_info nft_af_ipv4 __read_mostly = {
.family = NFPROTO_IPV4, .family = NFPROTO_IPV4,
.nhooks = NF_INET_NUMHOOKS,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}; };

1
net/ipv6/netfilter/nf_tables_ipv6.c
View File

@ -30,7 +30,6 @@ static unsigned int nft_do_chain_ipv6(void *priv,
static struct nft_af_info nft_af_ipv6 __read_mostly = { static struct nft_af_info nft_af_ipv6 __read_mostly = {
.family = NFPROTO_IPV6, .family = NFPROTO_IPV6,
.nhooks = NF_INET_NUMHOOKS,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}; };

5
net/netfilter/nf_tables_api.c
View File

@ -1328,9 +1328,6 @@ static int nft_chain_parse_hook(struct net *net,
return -EINVAL; return -EINVAL;
hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
if (hook->num >= afi->nhooks)
return -EINVAL;
hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT]; type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
@ -4993,7 +4990,7 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
return -EINVAL; return -EINVAL;
hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
if (hooknum >= ctx->afi->nhooks) if (hooknum != NF_NETDEV_INGRESS)
return -EINVAL; return -EINVAL;
priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));

1
net/netfilter/nf_tables_inet.c
View File

@ -40,7 +40,6 @@ static unsigned int nft_do_chain_inet(void *priv, struct sk_buff *skb,
static struct nft_af_info nft_af_inet __read_mostly = { static struct nft_af_info nft_af_inet __read_mostly = {
.family = NFPROTO_INET, .family = NFPROTO_INET,
.nhooks = NF_INET_NUMHOOKS,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}; };

1
net/netfilter/nf_tables_netdev.c
View File

@ -40,7 +40,6 @@ nft_do_chain_netdev(void *priv, struct sk_buff *skb,
static struct nft_af_info nft_af_netdev __read_mostly = { static struct nft_af_info nft_af_netdev __read_mostly = {
.family = NFPROTO_NETDEV, .family = NFPROTO_NETDEV,
.nhooks = NF_NETDEV_NUMHOOKS,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.flags = NFT_AF_NEEDS_DEV, .flags = NFT_AF_NEEDS_DEV,
}; };