summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2015-04-11 04:27:28 +0300
committerPablo Neira Ayuso <pablo@netfilter.org>2015-04-13 17:25:49 +0300
commit58f40ab6e2427532881a79e139a4aaae7fbe1826 (patch)
treef6f7998998dd1faafd5ebc90948ec8d4d4b74e6a /net
parent1ec10212f9bc62645932b0ca39bab0eb57d5331a (diff)
downloadlinux-58f40ab6e2427532881a79e139a4aaae7fbe1826.tar.xz
netfilter: nft_lookup: use nft_validate_register_store() to validate types
In preparation of validating the length of a register store, use nft_validate_register_store() in nft_lookup instead of open coding the validation. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/nf_tables_api.c7
-rw-r--r--net/netfilter/nft_lookup.c9
2 files changed, 8 insertions, 8 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a1e4a928f00c..c96070e237e7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4169,7 +4169,7 @@ EXPORT_SYMBOL_GPL(nft_validate_output_register);
* Validate that a data load uses the appropriate data type for
* the destination register and the length is within the bounds.
* A value of NULL for the data means that its runtime gathered
- * data, which is always of type NFT_DATA_VALUE.
+ * data.
*/
int nft_validate_register_store(const struct nft_ctx *ctx,
enum nft_registers reg,
@@ -4180,10 +4180,11 @@ int nft_validate_register_store(const struct nft_ctx *ctx,
switch (reg) {
case NFT_REG_VERDICT:
- if (data == NULL || type != NFT_DATA_VERDICT)
+ if (type != NFT_DATA_VERDICT)
return -EINVAL;
- if (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP) {
+ if (data != NULL &&
+ (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP)) {
err = nf_tables_check_loops(ctx, data->chain);
if (err < 0)
return err;
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index d8cf86fb30fc..3e4d8efa76bc 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -84,11 +84,10 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
if (err < 0)
return err;
- if (priv->dreg == NFT_REG_VERDICT) {
- if (set->dtype != NFT_DATA_VERDICT)
- return -EINVAL;
- } else if (set->dtype == NFT_DATA_VERDICT)
- return -EINVAL;
+ err = nft_validate_register_store(ctx, priv->dreg, NULL,
+ set->dtype, set->dlen);
+ if (err < 0)
+ return err;
} else if (set->flags & NFT_SET_MAP)
return -EINVAL;