Commit d767ff2c authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso

netfilter: nft_ct: unnecessary to require dir when use ct l3proto/protocol

Currently, if the user want to match ct l3proto, we must specify the
direction, for example:
  # nft add rule filter input ct original l3proto ipv4
                                 ^^^^^^^^
Otherwise, error message will be reported:
  # nft add rule filter input ct l3proto ipv4
  nft add rule filter input ct l3proto ipv4
  <cmdline>:1:1-38: Error: Could not process rule: Invalid argument
  add rule filter input ct l3proto ipv4
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Actually, there's no need to require NFTA_CT_DIRECTION attr, because
ct l3proto and protocol are unrelated to direction.

And for compatibility, even if the user specify the NFTA_CT_DIRECTION
attr, do not report error, just skip it.
Signed-off-by: default avatarLiping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8d11350f
...@@ -128,15 +128,18 @@ static void nft_ct_get_eval(const struct nft_expr *expr, ...@@ -128,15 +128,18 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
memcpy(dest, &count, sizeof(count)); memcpy(dest, &count, sizeof(count));
return; return;
} }
case NFT_CT_L3PROTOCOL:
*dest = nf_ct_l3num(ct);
return;
case NFT_CT_PROTOCOL:
*dest = nf_ct_protonum(ct);
return;
default: default:
break; break;
} }
tuple = &ct->tuplehash[priv->dir].tuple; tuple = &ct->tuplehash[priv->dir].tuple;
switch (priv->key) { switch (priv->key) {
case NFT_CT_L3PROTOCOL:
*dest = nf_ct_l3num(ct);
return;
case NFT_CT_SRC: case NFT_CT_SRC:
memcpy(dest, tuple->src.u3.all, memcpy(dest, tuple->src.u3.all,
nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16); nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
...@@ -145,9 +148,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr, ...@@ -145,9 +148,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
memcpy(dest, tuple->dst.u3.all, memcpy(dest, tuple->dst.u3.all,
nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16); nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
return; return;
case NFT_CT_PROTOCOL:
*dest = nf_ct_protonum(ct);
return;
case NFT_CT_PROTO_SRC: case NFT_CT_PROTO_SRC:
*dest = (__force __u16)tuple->src.u.all; *dest = (__force __u16)tuple->src.u.all;
return; return;
...@@ -283,8 +283,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx, ...@@ -283,8 +283,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
case NFT_CT_L3PROTOCOL: case NFT_CT_L3PROTOCOL:
case NFT_CT_PROTOCOL: case NFT_CT_PROTOCOL:
if (tb[NFTA_CT_DIRECTION] == NULL) /* For compatibility, do not report error if NFTA_CT_DIRECTION
return -EINVAL; * attribute is specified.
*/
len = sizeof(u8); len = sizeof(u8);
break; break;
case NFT_CT_SRC: case NFT_CT_SRC:
...@@ -432,8 +433,6 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr) ...@@ -432,8 +433,6 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
goto nla_put_failure; goto nla_put_failure;
switch (priv->key) { switch (priv->key) {
case NFT_CT_L3PROTOCOL:
case NFT_CT_PROTOCOL:
case NFT_CT_SRC: case NFT_CT_SRC:
case NFT_CT_DST: case NFT_CT_DST:
case NFT_CT_PROTO_SRC: case NFT_CT_PROTO_SRC:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment