|
|
|
@ -108,7 +108,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
ctx->table = table;
|
|
|
|
|
ctx->chain = chain;
|
|
|
|
|
ctx->nla = nla;
|
|
|
|
|
@@ -414,30 +413,31 @@ static int nft_delflowtable(struct nft_c
|
|
|
|
|
@@ -417,30 +416,31 @@ static int nft_delflowtable(struct nft_c
|
|
|
|
|
* Tables
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
@ -146,7 +146,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (table != NULL)
|
|
|
|
|
return table;
|
|
|
|
|
|
|
|
|
|
@@ -536,7 +536,7 @@ static void nf_tables_table_notify(const
|
|
|
|
|
@@ -539,7 +539,7 @@ static void nf_tables_table_notify(const
|
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
|
|
err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
|
|
|
|
@ -155,7 +155,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (err < 0) {
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
goto err;
|
|
|
|
|
@@ -553,7 +553,6 @@ static int nf_tables_dump_tables(struct
|
|
|
|
|
@@ -556,7 +556,6 @@ static int nf_tables_dump_tables(struct
|
|
|
|
|
struct netlink_callback *cb)
|
|
|
|
|
{
|
|
|
|
|
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
|
|
|
|
@ -163,7 +163,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
const struct nft_table *table;
|
|
|
|
|
unsigned int idx = 0, s_idx = cb->args[0];
|
|
|
|
|
struct net *net = sock_net(skb->sk);
|
|
|
|
|
@@ -562,30 +561,27 @@ static int nf_tables_dump_tables(struct
|
|
|
|
|
@@ -565,30 +564,27 @@ static int nf_tables_dump_tables(struct
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
cb->seq = net->nft.base_seq;
|
|
|
|
|
|
|
|
|
@ -211,7 +211,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
done:
|
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
@@ -617,7 +613,8 @@ static int nf_tables_gettable(struct net
|
|
|
|
|
@@ -620,7 +616,8 @@ static int nf_tables_gettable(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -221,7 +221,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -748,7 +745,7 @@ static int nf_tables_newtable(struct net
|
|
|
|
|
@@ -751,7 +748,7 @@ static int nf_tables_newtable(struct net
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
|
name = nla[NFTA_TABLE_NAME];
|
|
|
|
@ -230,7 +230,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table)) {
|
|
|
|
|
if (PTR_ERR(table) != -ENOENT)
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
@@ -758,7 +755,7 @@ static int nf_tables_newtable(struct net
|
|
|
|
|
@@ -761,7 +758,7 @@ static int nf_tables_newtable(struct net
|
|
|
|
|
if (nlh->nlmsg_flags & NLM_F_REPLACE)
|
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
|
|
|
|
@ -239,7 +239,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
return nf_tables_updtable(&ctx);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -785,14 +782,15 @@ static int nf_tables_newtable(struct net
|
|
|
|
|
@@ -788,14 +785,15 @@ static int nf_tables_newtable(struct net
|
|
|
|
|
INIT_LIST_HEAD(&table->sets);
|
|
|
|
|
INIT_LIST_HEAD(&table->objects);
|
|
|
|
|
INIT_LIST_HEAD(&table->flowtables);
|
|
|
|
@ -257,7 +257,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
return 0;
|
|
|
|
|
err4:
|
|
|
|
|
kfree(table->name);
|
|
|
|
|
@@ -866,30 +864,28 @@ out:
|
|
|
|
|
@@ -869,30 +867,28 @@ out:
|
|
|
|
|
|
|
|
|
|
static int nft_flush(struct nft_ctx *ctx, int family)
|
|
|
|
|
{
|
|
|
|
@ -301,7 +301,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
out:
|
|
|
|
|
return err;
|
|
|
|
|
@@ -907,7 +903,7 @@ static int nf_tables_deltable(struct net
|
|
|
|
|
@@ -910,7 +906,7 @@ static int nf_tables_deltable(struct net
|
|
|
|
|
int family = nfmsg->nfgen_family;
|
|
|
|
|
struct nft_ctx ctx;
|
|
|
|
|
|
|
|
|
@ -310,7 +310,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
|
|
|
|
|
return nft_flush(&ctx, family);
|
|
|
|
|
|
|
|
|
|
@@ -915,7 +911,8 @@ static int nf_tables_deltable(struct net
|
|
|
|
|
@@ -918,7 +914,8 @@ static int nf_tables_deltable(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -320,7 +320,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -923,7 +920,7 @@ static int nf_tables_deltable(struct net
|
|
|
|
|
@@ -926,7 +923,7 @@ static int nf_tables_deltable(struct net
|
|
|
|
|
table->use > 0)
|
|
|
|
|
return -EBUSY;
|
|
|
|
|
|
|
|
|
@ -329,7 +329,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
ctx.table = table;
|
|
|
|
|
|
|
|
|
|
return nft_flush_table(&ctx);
|
|
|
|
|
@@ -935,7 +932,7 @@ static void nf_tables_table_destroy(stru
|
|
|
|
|
@@ -938,7 +935,7 @@ static void nf_tables_table_destroy(stru
|
|
|
|
|
|
|
|
|
|
kfree(ctx->table->name);
|
|
|
|
|
kfree(ctx->table);
|
|
|
|
@ -338,7 +338,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int nft_register_chain_type(const struct nf_chain_type *ctype)
|
|
|
|
|
@@ -1136,7 +1133,7 @@ static void nf_tables_chain_notify(const
|
|
|
|
|
@@ -1139,7 +1136,7 @@ static void nf_tables_chain_notify(const
|
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
|
|
err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
|
|
|
|
@ -347,7 +347,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
ctx->chain);
|
|
|
|
|
if (err < 0) {
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
@@ -1154,7 +1151,6 @@ static int nf_tables_dump_chains(struct
|
|
|
|
|
@@ -1157,7 +1154,6 @@ static int nf_tables_dump_chains(struct
|
|
|
|
|
struct netlink_callback *cb)
|
|
|
|
|
{
|
|
|
|
|
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
|
|
|
|
@ -355,7 +355,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
const struct nft_table *table;
|
|
|
|
|
const struct nft_chain *chain;
|
|
|
|
|
unsigned int idx = 0, s_idx = cb->args[0];
|
|
|
|
|
@@ -1164,31 +1160,30 @@ static int nf_tables_dump_chains(struct
|
|
|
|
|
@@ -1167,31 +1163,30 @@ static int nf_tables_dump_chains(struct
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
cb->seq = net->nft.base_seq;
|
|
|
|
|
|
|
|
|
@ -407,7 +407,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
done:
|
|
|
|
|
@@ -1222,7 +1217,8 @@ static int nf_tables_getchain(struct net
|
|
|
|
|
@@ -1225,7 +1220,8 @@ static int nf_tables_getchain(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -417,7 +417,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -1332,8 +1328,8 @@ struct nft_chain_hook {
|
|
|
|
|
@@ -1335,8 +1331,8 @@ struct nft_chain_hook {
|
|
|
|
|
|
|
|
|
|
static int nft_chain_parse_hook(struct net *net,
|
|
|
|
|
const struct nlattr * const nla[],
|
|
|
|
@ -428,7 +428,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
{
|
|
|
|
|
struct nlattr *ha[NFTA_HOOK_MAX + 1];
|
|
|
|
|
const struct nf_chain_type *type;
|
|
|
|
|
@@ -1352,10 +1348,10 @@ static int nft_chain_parse_hook(struct n
|
|
|
|
|
@@ -1355,10 +1351,10 @@ static int nft_chain_parse_hook(struct n
|
|
|
|
|
hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
|
|
|
|
|
hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
|
|
|
|
|
|
|
|
|
@ -441,7 +441,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(type))
|
|
|
|
|
return PTR_ERR(type);
|
|
|
|
|
}
|
|
|
|
|
@@ -1367,7 +1363,7 @@ static int nft_chain_parse_hook(struct n
|
|
|
|
|
@@ -1370,7 +1366,7 @@ static int nft_chain_parse_hook(struct n
|
|
|
|
|
hook->type = type;
|
|
|
|
|
|
|
|
|
|
hook->dev = NULL;
|
|
|
|
@ -450,7 +450,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
char ifname[IFNAMSIZ];
|
|
|
|
|
|
|
|
|
|
if (!ha[NFTA_HOOK_DEV]) {
|
|
|
|
|
@@ -1402,7 +1398,6 @@ static int nf_tables_addchain(struct nft
|
|
|
|
|
@@ -1405,7 +1401,6 @@ static int nf_tables_addchain(struct nft
|
|
|
|
|
{
|
|
|
|
|
const struct nlattr * const *nla = ctx->nla;
|
|
|
|
|
struct nft_table *table = ctx->table;
|
|
|
|
@ -458,7 +458,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
struct nft_base_chain *basechain;
|
|
|
|
|
struct nft_stats __percpu *stats;
|
|
|
|
|
struct net *net = ctx->net;
|
|
|
|
|
@@ -1416,7 +1411,7 @@ static int nf_tables_addchain(struct nft
|
|
|
|
|
@@ -1419,7 +1414,7 @@ static int nf_tables_addchain(struct nft
|
|
|
|
|
struct nft_chain_hook hook;
|
|
|
|
|
struct nf_hook_ops *ops;
|
|
|
|
|
|
|
|
|
@ -467,7 +467,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (err < 0)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
@@ -1508,7 +1503,7 @@ static int nf_tables_updchain(struct nft
|
|
|
|
|
@@ -1511,7 +1506,7 @@ static int nf_tables_updchain(struct nft
|
|
|
|
|
if (!nft_is_base_chain(chain))
|
|
|
|
|
return -EBUSY;
|
|
|
|
|
|
|
|
|
@ -476,7 +476,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
create);
|
|
|
|
|
if (err < 0)
|
|
|
|
|
return err;
|
|
|
|
|
@@ -1618,7 +1613,8 @@ static int nf_tables_newchain(struct net
|
|
|
|
|
@@ -1621,7 +1616,8 @@ static int nf_tables_newchain(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -486,7 +486,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -1658,7 +1654,7 @@ static int nf_tables_newchain(struct net
|
|
|
|
|
@@ -1661,7 +1657,7 @@ static int nf_tables_newchain(struct net
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -495,7 +495,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
if (chain != NULL) {
|
|
|
|
|
if (nlh->nlmsg_flags & NLM_F_EXCL)
|
|
|
|
|
@@ -1692,7 +1688,8 @@ static int nf_tables_delchain(struct net
|
|
|
|
|
@@ -1695,7 +1691,8 @@ static int nf_tables_delchain(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -505,7 +505,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -1704,7 +1701,7 @@ static int nf_tables_delchain(struct net
|
|
|
|
|
@@ -1707,7 +1704,7 @@ static int nf_tables_delchain(struct net
|
|
|
|
|
chain->use > 0)
|
|
|
|
|
return -EBUSY;
|
|
|
|
|
|
|
|
|
@ -514,7 +514,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
use = chain->use;
|
|
|
|
|
list_for_each_entry(rule, &chain->rules, list) {
|
|
|
|
|
@@ -1869,7 +1866,7 @@ static int nf_tables_expr_parse(const st
|
|
|
|
|
@@ -1872,7 +1869,7 @@ static int nf_tables_expr_parse(const st
|
|
|
|
|
if (err < 0)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
@ -523,7 +523,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(type))
|
|
|
|
|
return PTR_ERR(type);
|
|
|
|
|
|
|
|
|
|
@@ -2093,7 +2090,7 @@ static void nf_tables_rule_notify(const
|
|
|
|
|
@@ -2096,7 +2093,7 @@ static void nf_tables_rule_notify(const
|
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
|
|
err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
|
|
|
|
@ -532,7 +532,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
ctx->chain, rule);
|
|
|
|
|
if (err < 0) {
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
@@ -2117,7 +2114,6 @@ static int nf_tables_dump_rules(struct s
|
|
|
|
|
@@ -2120,7 +2117,6 @@ static int nf_tables_dump_rules(struct s
|
|
|
|
|
{
|
|
|
|
|
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
|
|
|
|
|
const struct nft_rule_dump_ctx *ctx = cb->data;
|
|
|
|
@ -540,7 +540,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
const struct nft_table *table;
|
|
|
|
|
const struct nft_chain *chain;
|
|
|
|
|
const struct nft_rule *rule;
|
|
|
|
|
@@ -2128,39 +2124,37 @@ static int nf_tables_dump_rules(struct s
|
|
|
|
|
@@ -2131,39 +2127,37 @@ static int nf_tables_dump_rules(struct s
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
cb->seq = net->nft.base_seq;
|
|
|
|
|
|
|
|
|
@ -605,7 +605,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
@@ -2238,7 +2232,8 @@ static int nf_tables_getrule(struct net
|
|
|
|
|
@@ -2241,7 +2235,8 @@ static int nf_tables_getrule(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -615,7 +615,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -2323,7 +2318,8 @@ static int nf_tables_newrule(struct net
|
|
|
|
|
@@ -2326,7 +2321,8 @@ static int nf_tables_newrule(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -625,7 +625,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -2362,7 +2358,7 @@ static int nf_tables_newrule(struct net
|
|
|
|
|
@@ -2365,7 +2361,7 @@ static int nf_tables_newrule(struct net
|
|
|
|
|
return PTR_ERR(old_rule);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -634,7 +634,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
n = 0;
|
|
|
|
|
size = 0;
|
|
|
|
|
@@ -2495,7 +2491,8 @@ static int nf_tables_delrule(struct net
|
|
|
|
|
@@ -2498,7 +2494,8 @@ static int nf_tables_delrule(struct net
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -644,7 +644,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -2506,7 +2503,7 @@ static int nf_tables_delrule(struct net
|
|
|
|
|
@@ -2509,7 +2506,7 @@ static int nf_tables_delrule(struct net
|
|
|
|
|
return PTR_ERR(chain);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -653,7 +653,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
if (chain) {
|
|
|
|
|
if (nla[NFTA_RULE_HANDLE]) {
|
|
|
|
|
@@ -2704,13 +2701,13 @@ static int nft_ctx_init_from_setattr(str
|
|
|
|
|
@@ -2707,13 +2704,13 @@ static int nft_ctx_init_from_setattr(str
|
|
|
|
|
if (afi == NULL)
|
|
|
|
|
return -EAFNOSUPPORT;
|
|
|
|
|
|
|
|
|
@ -670,7 +670,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -2838,7 +2835,7 @@ static int nf_tables_fill_set(struct sk_
|
|
|
|
|
@@ -2841,7 +2838,7 @@ static int nf_tables_fill_set(struct sk_
|
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
|
|
nfmsg = nlmsg_data(nlh);
|
|
|
|
@ -679,7 +679,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
nfmsg->version = NFNETLINK_V0;
|
|
|
|
|
nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
|
|
|
|
|
|
|
|
|
|
@@ -2930,10 +2927,8 @@ static int nf_tables_dump_sets(struct sk
|
|
|
|
|
@@ -2933,10 +2930,8 @@ static int nf_tables_dump_sets(struct sk
|
|
|
|
|
{
|
|
|
|
|
const struct nft_set *set;
|
|
|
|
|
unsigned int idx, s_idx = cb->args[0];
|
|
|
|
@ -690,7 +690,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
struct nft_ctx *ctx = cb->data, ctx_set;
|
|
|
|
|
|
|
|
|
|
if (cb->args[1])
|
|
|
|
|
@@ -2942,51 +2937,44 @@ static int nf_tables_dump_sets(struct sk
|
|
|
|
|
@@ -2945,51 +2940,44 @@ static int nf_tables_dump_sets(struct sk
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
cb->seq = net->nft.base_seq;
|
|
|
|
|
|
|
|
|
@ -771,7 +771,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
cb->args[1] = 1;
|
|
|
|
|
done:
|
|
|
|
|
@@ -3196,11 +3184,12 @@ static int nf_tables_newset(struct net *
|
|
|
|
|
@@ -3199,11 +3187,12 @@ static int nf_tables_newset(struct net *
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -786,7 +786,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
|
|
|
|
|
if (IS_ERR(set)) {
|
|
|
|
|
@@ -3469,12 +3458,12 @@ static int nft_ctx_init_from_elemattr(st
|
|
|
|
|
@@ -3472,12 +3461,12 @@ static int nft_ctx_init_from_elemattr(st
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -802,7 +802,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -3579,7 +3568,6 @@ static int nf_tables_dump_set(struct sk_
|
|
|
|
|
@@ -3582,7 +3571,6 @@ static int nf_tables_dump_set(struct sk_
|
|
|
|
|
{
|
|
|
|
|
struct nft_set_dump_ctx *dump_ctx = cb->data;
|
|
|
|
|
struct net *net = sock_net(skb->sk);
|
|
|
|
@ -810,7 +810,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
struct nft_table *table;
|
|
|
|
|
struct nft_set *set;
|
|
|
|
|
struct nft_set_dump_args args;
|
|
|
|
|
@@ -3591,21 +3579,19 @@ static int nf_tables_dump_set(struct sk_
|
|
|
|
|
@@ -3594,21 +3582,19 @@ static int nf_tables_dump_set(struct sk_
|
|
|
|
|
int event;
|
|
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
@ -841,7 +841,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
@@ -3625,7 +3611,7 @@ static int nf_tables_dump_set(struct sk_
|
|
|
|
|
@@ -3628,7 +3614,7 @@ static int nf_tables_dump_set(struct sk_
|
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
|
|
nfmsg = nlmsg_data(nlh);
|
|
|
|
@ -850,7 +850,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
nfmsg->version = NFNETLINK_V0;
|
|
|
|
|
nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
|
|
|
|
|
|
|
|
|
|
@@ -3727,7 +3713,7 @@ static int nf_tables_fill_setelem_info(s
|
|
|
|
|
@@ -3730,7 +3716,7 @@ static int nf_tables_fill_setelem_info(s
|
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
|
|
nfmsg = nlmsg_data(nlh);
|
|
|
|
@ -859,7 +859,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
nfmsg->version = NFNETLINK_V0;
|
|
|
|
|
nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
|
|
|
|
|
|
|
|
|
|
@@ -3971,7 +3957,7 @@ static int nft_add_set_elem(struct nft_c
|
|
|
|
|
@@ -3974,7 +3960,7 @@ static int nft_add_set_elem(struct nft_c
|
|
|
|
|
list_for_each_entry(binding, &set->bindings, list) {
|
|
|
|
|
struct nft_ctx bind_ctx = {
|
|
|
|
|
.net = ctx->net,
|
|
|
|
@ -868,7 +868,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
.table = ctx->table,
|
|
|
|
|
.chain = (struct nft_chain *)binding->chain,
|
|
|
|
|
};
|
|
|
|
|
@@ -4521,7 +4507,8 @@ static int nf_tables_newobj(struct net *
|
|
|
|
|
@@ -4526,7 +4512,8 @@ static int nf_tables_newobj(struct net *
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -878,7 +878,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -4539,7 +4526,7 @@ static int nf_tables_newobj(struct net *
|
|
|
|
|
@@ -4544,7 +4531,7 @@ static int nf_tables_newobj(struct net *
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -887,7 +887,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
type = nft_obj_type_get(objtype);
|
|
|
|
|
if (IS_ERR(type))
|
|
|
|
|
@@ -4616,7 +4603,6 @@ struct nft_obj_filter {
|
|
|
|
|
@@ -4621,7 +4608,6 @@ struct nft_obj_filter {
|
|
|
|
|
static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
|
|
|
|
|
{
|
|
|
|
|
const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
|
|
|
|
@ -895,7 +895,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
const struct nft_table *table;
|
|
|
|
|
unsigned int idx = 0, s_idx = cb->args[0];
|
|
|
|
|
struct nft_obj_filter *filter = cb->data;
|
|
|
|
|
@@ -4631,38 +4617,37 @@ static int nf_tables_dump_obj(struct sk_
|
|
|
|
|
@@ -4636,38 +4622,37 @@ static int nf_tables_dump_obj(struct sk_
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
cb->seq = net->nft.base_seq;
|
|
|
|
|
|
|
|
|
@ -960,7 +960,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
done:
|
|
|
|
|
@@ -4749,7 +4734,8 @@ static int nf_tables_getobj(struct net *
|
|
|
|
|
@@ -4754,7 +4739,8 @@ static int nf_tables_getobj(struct net *
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -970,7 +970,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -4809,7 +4795,8 @@ static int nf_tables_delobj(struct net *
|
|
|
|
|
@@ -4814,7 +4800,8 @@ static int nf_tables_delobj(struct net *
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -980,7 +980,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -4820,7 +4807,7 @@ static int nf_tables_delobj(struct net *
|
|
|
|
|
@@ -4825,7 +4812,7 @@ static int nf_tables_delobj(struct net *
|
|
|
|
|
if (obj->use > 0)
|
|
|
|
|
return -EBUSY;
|
|
|
|
|
|
|
|
|
@ -989,7 +989,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
return nft_delobj(&ctx, obj);
|
|
|
|
|
}
|
|
|
|
|
@@ -4858,7 +4845,7 @@ static void nf_tables_obj_notify(const s
|
|
|
|
|
@@ -4863,7 +4850,7 @@ static void nf_tables_obj_notify(const s
|
|
|
|
|
struct nft_object *obj, int event)
|
|
|
|
|
{
|
|
|
|
|
nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
|
|
|
|
@ -998,7 +998,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
@@ -5048,7 +5035,7 @@ void nft_flow_table_iterate(struct net *
|
|
|
|
|
@@ -5053,7 +5040,7 @@ void nft_flow_table_iterate(struct net *
|
|
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
|
|
|
|
@ -1007,7 +1007,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
|
|
|
|
|
iter(&flowtable->data, data);
|
|
|
|
|
}
|
|
|
|
|
@@ -5096,7 +5083,8 @@ static int nf_tables_newflowtable(struct
|
|
|
|
|
@@ -5101,7 +5088,8 @@ static int nf_tables_newflowtable(struct
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -1017,7 +1017,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -5113,7 +5101,7 @@ static int nf_tables_newflowtable(struct
|
|
|
|
|
@@ -5118,7 +5106,7 @@ static int nf_tables_newflowtable(struct
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -1026,7 +1026,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
|
|
|
|
|
if (!flowtable)
|
|
|
|
|
@@ -5194,7 +5182,8 @@ static int nf_tables_delflowtable(struct
|
|
|
|
|
@@ -5199,7 +5187,8 @@ static int nf_tables_delflowtable(struct
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -1036,7 +1036,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -5205,7 +5194,7 @@ static int nf_tables_delflowtable(struct
|
|
|
|
|
@@ -5210,7 +5199,7 @@ static int nf_tables_delflowtable(struct
|
|
|
|
|
if (flowtable->use > 0)
|
|
|
|
|
return -EBUSY;
|
|
|
|
|
|
|
|
|
@ -1045,7 +1045,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
return nft_delflowtable(&ctx, flowtable);
|
|
|
|
|
}
|
|
|
|
|
@@ -5274,40 +5263,37 @@ static int nf_tables_dump_flowtable(stru
|
|
|
|
|
@@ -5279,40 +5268,37 @@ static int nf_tables_dump_flowtable(stru
|
|
|
|
|
struct net *net = sock_net(skb->sk);
|
|
|
|
|
int family = nfmsg->nfgen_family;
|
|
|
|
|
struct nft_flowtable *flowtable;
|
|
|
|
@ -1107,7 +1107,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
done:
|
|
|
|
|
@@ -5392,7 +5378,8 @@ static int nf_tables_getflowtable(struct
|
|
|
|
|
@@ -5397,7 +5383,8 @@ static int nf_tables_getflowtable(struct
|
|
|
|
|
if (IS_ERR(afi))
|
|
|
|
|
return PTR_ERR(afi);
|
|
|
|
|
|
|
|
|
@ -1117,7 +1117,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (IS_ERR(table))
|
|
|
|
|
return PTR_ERR(table);
|
|
|
|
|
|
|
|
|
|
@@ -5435,7 +5422,7 @@ static void nf_tables_flowtable_notify(s
|
|
|
|
|
@@ -5440,7 +5427,7 @@ static void nf_tables_flowtable_notify(s
|
|
|
|
|
|
|
|
|
|
err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
|
|
|
|
|
ctx->seq, event, 0,
|
|
|
|
@ -1126,7 +1126,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (err < 0) {
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
goto err;
|
|
|
|
|
@@ -5513,17 +5500,14 @@ static int nf_tables_flowtable_event(str
|
|
|
|
|
@@ -5518,17 +5505,14 @@ static int nf_tables_flowtable_event(str
|
|
|
|
|
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
|
|
|
|
|
struct nft_flowtable *flowtable;
|
|
|
|
|
struct nft_table *table;
|
|
|
|
@ -1147,7 +1147,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
nfnl_unlock(NFNL_SUBSYS_NFTABLES);
|
|
|
|
|
@@ -6549,6 +6533,7 @@ EXPORT_SYMBOL_GPL(nft_data_dump);
|
|
|
|
|
@@ -6554,6 +6538,7 @@ EXPORT_SYMBOL_GPL(nft_data_dump);
|
|
|
|
|
static int __net_init nf_tables_init_net(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
INIT_LIST_HEAD(&net->nft.af_info);
|
|
|
|
@ -1155,7 +1155,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
INIT_LIST_HEAD(&net->nft.commit_list);
|
|
|
|
|
net->nft.base_seq = 1;
|
|
|
|
|
return 0;
|
|
|
|
|
@@ -6585,10 +6570,10 @@ static void __nft_release_afinfo(struct
|
|
|
|
|
@@ -6590,10 +6575,10 @@ static void __nft_release_afinfo(struct
|
|
|
|
|
struct nft_set *set, *ns;
|
|
|
|
|
struct nft_ctx ctx = {
|
|
|
|
|
.net = net,
|
|
|
|
@ -1228,7 +1228,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
par->nft_compat = true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -282,7 +282,7 @@ nft_target_destroy(const struct nft_ctx
|
|
|
|
|
@@ -283,7 +283,7 @@ nft_target_destroy(const struct nft_ctx
|
|
|
|
|
par.net = ctx->net;
|
|
|
|
|
par.target = target;
|
|
|
|
|
par.targinfo = info;
|
|
|
|
@ -1237,7 +1237,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (par.target->destroy != NULL)
|
|
|
|
|
par.target->destroy(&par);
|
|
|
|
|
|
|
|
|
|
@@ -389,7 +389,7 @@ nft_match_set_mtchk_param(struct xt_mtch
|
|
|
|
|
@@ -390,7 +390,7 @@ nft_match_set_mtchk_param(struct xt_mtch
|
|
|
|
|
{
|
|
|
|
|
par->net = ctx->net;
|
|
|
|
|
par->table = ctx->table->name;
|
|
|
|
@ -1246,7 +1246,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
case AF_INET:
|
|
|
|
|
entry->e4.ip.proto = proto;
|
|
|
|
|
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
|
|
|
|
|
@@ -420,7 +420,7 @@ nft_match_set_mtchk_param(struct xt_mtch
|
|
|
|
|
@@ -421,7 +421,7 @@ nft_match_set_mtchk_param(struct xt_mtch
|
|
|
|
|
} else {
|
|
|
|
|
par->hook_mask = 0;
|
|
|
|
|
}
|
|
|
|
@ -1255,7 +1255,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
par->nft_compat = true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -503,7 +503,7 @@ __nft_match_destroy(const struct nft_ctx
|
|
|
|
|
@@ -504,7 +504,7 @@ __nft_match_destroy(const struct nft_ctx
|
|
|
|
|
par.net = ctx->net;
|
|
|
|
|
par.match = match;
|
|
|
|
|
par.matchinfo = info;
|
|
|
|
@ -1264,7 +1264,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
if (par.match->destroy != NULL)
|
|
|
|
|
par.match->destroy(&par);
|
|
|
|
|
|
|
|
|
|
@@ -733,7 +733,7 @@ nft_match_select_ops(const struct nft_ct
|
|
|
|
|
@@ -734,7 +734,7 @@ nft_match_select_ops(const struct nft_ct
|
|
|
|
|
|
|
|
|
|
mt_name = nla_data(tb[NFTA_MATCH_NAME]);
|
|
|
|
|
rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
|
|
|
|
@ -1273,7 +1273,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
/* Re-use the existing match if it's already loaded. */
|
|
|
|
|
list_for_each_entry(nft_match, &nft_match_list, head) {
|
|
|
|
|
@@ -824,7 +824,7 @@ nft_target_select_ops(const struct nft_c
|
|
|
|
|
@@ -825,7 +825,7 @@ nft_target_select_ops(const struct nft_c
|
|
|
|
|
|
|
|
|
|
tg_name = nla_data(tb[NFTA_TARGET_NAME]);
|
|
|
|
|
rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
|
|
|
|
|