Commit e3730578 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[NETFILTER]: nfnetlink: support attribute policies

Add support for automatic checking of per-callback attribute policies.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dd82185f
...@@ -58,7 +58,8 @@ struct nfnl_callback ...@@ -58,7 +58,8 @@ struct nfnl_callback
{ {
int (*call)(struct sock *nl, struct sk_buff *skb, int (*call)(struct sock *nl, struct sk_buff *skb,
struct nlmsghdr *nlh, struct nlattr *cda[]); struct nlmsghdr *nlh, struct nlattr *cda[]);
u_int16_t attr_count; /* number of nlattr's */ const struct nla_policy *policy; /* netlink attribute policy */
const u_int16_t attr_count; /* number of nlattr's */
}; };
struct nfnetlink_subsystem struct nfnetlink_subsystem
......
...@@ -111,35 +111,6 @@ nfnetlink_find_client(u_int16_t type, const struct nfnetlink_subsystem *ss) ...@@ -111,35 +111,6 @@ nfnetlink_find_client(u_int16_t type, const struct nfnetlink_subsystem *ss)
return &ss->cb[cb_id]; return &ss->cb[cb_id];
} }
/**
* nfnetlink_check_attributes - check and parse nfnetlink attributes
*
* subsys: nfnl subsystem for which this message is to be parsed
* nlmsghdr: netlink message to be checked/parsed
* cda: array of pointers, needs to be at least subsys->attr_count+1 big
*
*/
static int
nfnetlink_check_attributes(const struct nfnetlink_subsystem *subsys,
struct nlmsghdr *nlh, struct nlattr *cda[])
{
int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
u_int16_t attr_count = subsys->cb[cb_id].attr_count;
/* check attribute lengths. */
if (likely(nlh->nlmsg_len > min_len)) {
struct nlattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
nla_parse(cda, attr_count, attr, attrlen, NULL);
}
/* implicit: if nlmsg_len == min_len, we return 0, and an empty
* (zeroed) cda[] array. The message is valid, but empty. */
return 0;
}
int nfnetlink_has_listeners(unsigned int group) int nfnetlink_has_listeners(unsigned int group)
{ {
return netlink_has_listeners(nfnl, group); return netlink_has_listeners(nfnl, group);
...@@ -192,15 +163,22 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) ...@@ -192,15 +163,22 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
return -EINVAL; return -EINVAL;
{ {
u_int16_t attr_count = int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
ss->cb[NFNL_MSG_TYPE(nlh->nlmsg_type)].attr_count; u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
u_int16_t attr_count = ss->cb[cb_id].attr_count;
struct nlattr *cda[attr_count+1]; struct nlattr *cda[attr_count+1];
memset(cda, 0, sizeof(struct nlattr *) * attr_count); if (likely(nlh->nlmsg_len >= min_len)) {
struct nlattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
err = nfnetlink_check_attributes(ss, nlh, cda); err = nla_parse(cda, attr_count, attr, attrlen,
ss->cb[cb_id].policy);
if (err < 0) if (err < 0)
return err; return err;
} else
return -EINVAL;
return nc->call(nfnl, skb, nlh, cda); return nc->call(nfnl, skb, nlh, cda);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment