Merge tag 'master-2014-11-20' of git://git.kernel.org/pub/scm/linux/kernel/git/linvil...

[firefly-linux-kernel-4.4.55.git] / net / netfilter / nft_nat.c

diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 799550b476fbdeeadc2745aaff97fe5f2b197761..afe2b0b45ec41f82df6f2430958a4392aa5eb608 100644 (file)
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -95,7 +95,13 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        u32 family;
        int err;
 
-       if (tb[NFTA_NAT_TYPE] == NULL)
+       err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+       if (err < 0)
+               return err;
+
+       if (tb[NFTA_NAT_TYPE] == NULL ||
+           (tb[NFTA_NAT_REG_ADDR_MIN] == NULL &&
+            tb[NFTA_NAT_REG_PROTO_MIN] == NULL))
                return -EINVAL;
 
        switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) {
@@ -120,38 +126,44 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        priv->family = family;
 
        if (tb[NFTA_NAT_REG_ADDR_MIN]) {
-               priv->sreg_addr_min = ntohl(nla_get_be32(
-                                               tb[NFTA_NAT_REG_ADDR_MIN]));
+               priv->sreg_addr_min =
+                       ntohl(nla_get_be32(tb[NFTA_NAT_REG_ADDR_MIN]));
+
                err = nft_validate_input_register(priv->sreg_addr_min);
                if (err < 0)
                        return err;
-       }
 
-       if (tb[NFTA_NAT_REG_ADDR_MAX]) {
-               priv->sreg_addr_max = ntohl(nla_get_be32(
-                                               tb[NFTA_NAT_REG_ADDR_MAX]));
-               err = nft_validate_input_register(priv->sreg_addr_max);
-               if (err < 0)
-                       return err;
-       } else
-               priv->sreg_addr_max = priv->sreg_addr_min;
+               if (tb[NFTA_NAT_REG_ADDR_MAX]) {
+                       priv->sreg_addr_max =
+                               ntohl(nla_get_be32(tb[NFTA_NAT_REG_ADDR_MAX]));
+
+                       err = nft_validate_input_register(priv->sreg_addr_max);
+                       if (err < 0)
+                               return err;
+               } else {
+                       priv->sreg_addr_max = priv->sreg_addr_min;
+               }
+       }
 
        if (tb[NFTA_NAT_REG_PROTO_MIN]) {
-               priv->sreg_proto_min = ntohl(nla_get_be32(
-                                               tb[NFTA_NAT_REG_PROTO_MIN]));
+               priv->sreg_proto_min =
+                       ntohl(nla_get_be32(tb[NFTA_NAT_REG_PROTO_MIN]));
+
                err = nft_validate_input_register(priv->sreg_proto_min);
                if (err < 0)
                        return err;
-       }
 
-       if (tb[NFTA_NAT_REG_PROTO_MAX]) {
-               priv->sreg_proto_max = ntohl(nla_get_be32(
-                                               tb[NFTA_NAT_REG_PROTO_MAX]));
-               err = nft_validate_input_register(priv->sreg_proto_max);
-               if (err < 0)
-                       return err;
-       } else
-               priv->sreg_proto_max = priv->sreg_proto_min;
+               if (tb[NFTA_NAT_REG_PROTO_MAX]) {
+                       priv->sreg_proto_max =
+                               ntohl(nla_get_be32(tb[NFTA_NAT_REG_PROTO_MAX]));
+
+                       err = nft_validate_input_register(priv->sreg_proto_max);
+                       if (err < 0)
+                               return err;
+               } else {
+                       priv->sreg_proto_max = priv->sreg_proto_min;
+               }
+       }
 
        if (tb[NFTA_NAT_FLAGS]) {
                priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
@@ -179,17 +191,19 @@ static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
 
        if (nla_put_be32(skb, NFTA_NAT_FAMILY, htonl(priv->family)))
                goto nla_put_failure;
-       if (nla_put_be32(skb,
-                        NFTA_NAT_REG_ADDR_MIN, htonl(priv->sreg_addr_min)))
-               goto nla_put_failure;
-       if (nla_put_be32(skb,
-                        NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max)))
-               goto nla_put_failure;
+
+       if (priv->sreg_addr_min) {
+               if (nla_put_be32(skb, NFTA_NAT_REG_ADDR_MIN,
+                                htonl(priv->sreg_addr_min)) ||
+                   nla_put_be32(skb, NFTA_NAT_REG_ADDR_MAX,
+                                htonl(priv->sreg_addr_max)))
+                       goto nla_put_failure;
+       }
+
        if (priv->sreg_proto_min) {
                if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MIN,
-                                htonl(priv->sreg_proto_min)))
-                       goto nla_put_failure;
-               if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX,
+                                htonl(priv->sreg_proto_min)) ||
+                   nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX,
                                 htonl(priv->sreg_proto_max)))
                        goto nla_put_failure;
        }
@@ -205,6 +219,13 @@ nla_put_failure:
        return -1;
 }
 
+static int nft_nat_validate(const struct nft_ctx *ctx,
+                           const struct nft_expr *expr,
+                           const struct nft_data **data)
+{
+       return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+}
+
 static struct nft_expr_type nft_nat_type;
 static const struct nft_expr_ops nft_nat_ops = {
        .type           = &nft_nat_type,
@@ -212,6 +233,7 @@ static const struct nft_expr_ops nft_nat_ops = {
        .eval           = nft_nat_eval,
        .init           = nft_nat_init,
        .dump           = nft_nat_dump,
+       .validate       = nft_nat_validate,
 };
 
 static struct nft_expr_type nft_nat_type __read_mostly = {