Commit b8c5e52c authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: ctnetlink: allow to set expectation class

This patch allows you to set the expectation class.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 660fdb2a
...@@ -173,6 +173,7 @@ enum ctattr_expect { ...@@ -173,6 +173,7 @@ enum ctattr_expect {
CTA_EXPECT_HELP_NAME, CTA_EXPECT_HELP_NAME,
CTA_EXPECT_ZONE, CTA_EXPECT_ZONE,
CTA_EXPECT_FLAGS, CTA_EXPECT_FLAGS,
CTA_EXPECT_CLASS,
__CTA_EXPECT_MAX __CTA_EXPECT_MAX
}; };
#define CTA_EXPECT_MAX (__CTA_EXPECT_MAX - 1) #define CTA_EXPECT_MAX (__CTA_EXPECT_MAX - 1)
......
...@@ -1691,6 +1691,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, ...@@ -1691,6 +1691,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)); NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)); NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
NLA_PUT_BE32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)); NLA_PUT_BE32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags));
NLA_PUT_BE32(skb, CTA_EXPECT_CLASS, htonl(exp->class));
help = nfct_help(master); help = nfct_help(master);
if (help) { if (help) {
struct nf_conntrack_helper *helper; struct nf_conntrack_helper *helper;
...@@ -1856,6 +1857,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { ...@@ -1856,6 +1857,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
[CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING }, [CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING },
[CTA_EXPECT_ZONE] = { .type = NLA_U16 }, [CTA_EXPECT_ZONE] = { .type = NLA_U16 },
[CTA_EXPECT_FLAGS] = { .type = NLA_U32 }, [CTA_EXPECT_FLAGS] = { .type = NLA_U32 },
[CTA_EXPECT_CLASS] = { .type = NLA_U32 },
}; };
static int static int
...@@ -2043,6 +2045,7 @@ ctnetlink_create_expect(struct net *net, u16 zone, ...@@ -2043,6 +2045,7 @@ ctnetlink_create_expect(struct net *net, u16 zone,
struct nf_conn *ct; struct nf_conn *ct;
struct nf_conn_help *help; struct nf_conn_help *help;
struct nf_conntrack_helper *helper = NULL; struct nf_conntrack_helper *helper = NULL;
u_int32_t class = 0;
int err = 0; int err = 0;
/* caller guarantees that those three CTA_EXPECT_* exist */ /* caller guarantees that those three CTA_EXPECT_* exist */
...@@ -2088,6 +2091,13 @@ ctnetlink_create_expect(struct net *net, u16 zone, ...@@ -2088,6 +2091,13 @@ ctnetlink_create_expect(struct net *net, u16 zone,
} }
} }
if (cda[CTA_EXPECT_CLASS] && helper) {
class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
if (class > helper->expect_class_max) {
err = -EINVAL;
goto out;
}
}
exp = nf_ct_expect_alloc(ct); exp = nf_ct_expect_alloc(ct);
if (!exp) { if (!exp) {
err = -ENOMEM; err = -ENOMEM;
...@@ -2115,7 +2125,7 @@ ctnetlink_create_expect(struct net *net, u16 zone, ...@@ -2115,7 +2125,7 @@ ctnetlink_create_expect(struct net *net, u16 zone,
exp->flags = 0; exp->flags = 0;
} }
exp->class = 0; exp->class = class;
exp->expectfn = NULL; exp->expectfn = NULL;
exp->master = ct; exp->master = ct;
exp->helper = helper; exp->helper = helper;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment