mirror of https://gitee.com/openkylin/linux.git
Merge branch 'master' of git://blackhole.kfki.hu/nf
Jozsef Kadlecsik says: ==================== ipset patches for nf - Fix the error code in ip_set_sockfn_get() when copy_to_user() is used, from Dan Carpenter. - The IPv6 part was missed when fixing copying the right MAC address in the patch "netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets", it is completed now by Stefano Brivio. - ipset nla_policies are fixed to fully support NL_VALIDATE_STRICT and the code is converted from deprecated parsings to verified ones. ==================== Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
commit
774e4d34db
|
|
@ -296,7 +296,8 @@ ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr)
|
|||
|
||||
if (unlikely(!flag_nested(nla)))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
|
||||
if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
|
||||
ipaddr_policy, NULL))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
|
|
@ -314,7 +315,8 @@ ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
|
|||
if (unlikely(!flag_nested(nla)))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
|
||||
if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
|
||||
if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
|
||||
ipaddr_policy, NULL))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
|
|
@ -934,7 +936,8 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
|
|||
|
||||
/* Without holding any locks, create private part. */
|
||||
if (attr[IPSET_ATTR_DATA] &&
|
||||
nla_parse_nested_deprecated(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA], set->type->create_policy, NULL)) {
|
||||
nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
|
||||
set->type->create_policy, NULL)) {
|
||||
ret = -IPSET_ERR_PROTOCOL;
|
||||
goto put_out;
|
||||
}
|
||||
|
|
@ -1281,6 +1284,14 @@ dump_attrs(struct nlmsghdr *nlh)
|
|||
}
|
||||
}
|
||||
|
||||
static const struct nla_policy
|
||||
ip_set_dump_policy[IPSET_ATTR_CMD_MAX + 1] = {
|
||||
[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
|
||||
[IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING,
|
||||
.len = IPSET_MAXNAMELEN - 1 },
|
||||
[IPSET_ATTR_FLAGS] = { .type = NLA_U32 },
|
||||
};
|
||||
|
||||
static int
|
||||
dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
|
||||
{
|
||||
|
|
@ -1292,9 +1303,9 @@ dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
|
|||
ip_set_id_t index;
|
||||
int ret;
|
||||
|
||||
ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr,
|
||||
nlh->nlmsg_len - min_len,
|
||||
ip_set_setname_policy, NULL);
|
||||
ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, attr,
|
||||
nlh->nlmsg_len - min_len,
|
||||
ip_set_dump_policy, NULL);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
|
|
@ -1543,9 +1554,9 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
|
|||
memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
|
||||
cmdattr = (void *)&errmsg->msg + min_len;
|
||||
|
||||
ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr,
|
||||
nlh->nlmsg_len - min_len,
|
||||
ip_set_adt_policy, NULL);
|
||||
ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
|
||||
nlh->nlmsg_len - min_len, ip_set_adt_policy,
|
||||
NULL);
|
||||
|
||||
if (ret) {
|
||||
nlmsg_free(skb2);
|
||||
|
|
@ -1596,7 +1607,9 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
|
|||
|
||||
use_lineno = !!attr[IPSET_ATTR_LINENO];
|
||||
if (attr[IPSET_ATTR_DATA]) {
|
||||
if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
|
||||
if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
|
||||
attr[IPSET_ATTR_DATA],
|
||||
set->type->adt_policy, NULL))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
ret = call_ad(ctnl, skb, set, tb, adt, flags,
|
||||
use_lineno);
|
||||
|
|
@ -1606,7 +1619,8 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
|
|||
nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
|
||||
if (nla_type(nla) != IPSET_ATTR_DATA ||
|
||||
!flag_nested(nla) ||
|
||||
nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, nla, set->type->adt_policy, NULL))
|
||||
nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
|
||||
set->type->adt_policy, NULL))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
ret = call_ad(ctnl, skb, set, tb, adt,
|
||||
flags, use_lineno);
|
||||
|
|
@ -1655,7 +1669,8 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
|
|||
if (!set)
|
||||
return -ENOENT;
|
||||
|
||||
if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
|
||||
if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],
|
||||
set->type->adt_policy, NULL))
|
||||
return -IPSET_ERR_PROTOCOL;
|
||||
|
||||
rcu_read_lock_bh();
|
||||
|
|
@ -1961,7 +1976,7 @@ static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
|
|||
[IPSET_CMD_LIST] = {
|
||||
.call = ip_set_dump,
|
||||
.attr_count = IPSET_ATTR_CMD_MAX,
|
||||
.policy = ip_set_setname_policy,
|
||||
.policy = ip_set_dump_policy,
|
||||
},
|
||||
[IPSET_CMD_SAVE] = {
|
||||
.call = ip_set_dump,
|
||||
|
|
@ -2069,8 +2084,9 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
|
|||
}
|
||||
|
||||
req_version->version = IPSET_PROTOCOL;
|
||||
ret = copy_to_user(user, req_version,
|
||||
sizeof(struct ip_set_req_version));
|
||||
if (copy_to_user(user, req_version,
|
||||
sizeof(struct ip_set_req_version)))
|
||||
ret = -EFAULT;
|
||||
goto done;
|
||||
}
|
||||
case IP_SET_OP_GET_BYNAME: {
|
||||
|
|
@ -2129,7 +2145,8 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
|
|||
} /* end of switch(op) */
|
||||
|
||||
copy:
|
||||
ret = copy_to_user(user, data, copylen);
|
||||
if (copy_to_user(user, data, copylen))
|
||||
ret = -EFAULT;
|
||||
|
||||
done:
|
||||
vfree(data);
|
||||
|
|
|
|||
|
|
@ -209,7 +209,7 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
|
|||
(skb_mac_header(skb) + ETH_HLEN) > skb->data)
|
||||
return -EINVAL;
|
||||
|
||||
if (opt->flags & IPSET_DIM_ONE_SRC)
|
||||
if (opt->flags & IPSET_DIM_TWO_SRC)
|
||||
ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
|
||||
else
|
||||
ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
|
||||
|
|
|
|||
|
|
@ -368,6 +368,7 @@ static struct ip_set_type hash_net_type __read_mostly = {
|
|||
[IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
|
||||
[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
|
||||
[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
|
||||
[IPSET_ATTR_LINENO] = { .type = NLA_U32 },
|
||||
[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
|
||||
[IPSET_ATTR_BYTES] = { .type = NLA_U64 },
|
||||
[IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
|
||||
|
|
|
|||
|
|
@ -476,6 +476,7 @@ static struct ip_set_type hash_netnet_type __read_mostly = {
|
|||
[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
|
||||
[IPSET_ATTR_CIDR2] = { .type = NLA_U8 },
|
||||
[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
|
||||
[IPSET_ATTR_LINENO] = { .type = NLA_U32 },
|
||||
[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
|
||||
[IPSET_ATTR_BYTES] = { .type = NLA_U64 },
|
||||
[IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
|
||||
|
|
|
|||
Loading…
Reference in New Issue