netfilter: nft_lookup: use nft_validate_register_store() to validate types

[deliverable/linux.git] / net / netfilter / nft_meta.c

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index e99911eda91594a6b0f9ea9bcce0aa01b9fc334a..b733755811e76f37d09dacb0e69da71df59e570a 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -83,7 +83,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                *(u16 *)dest->data = out->type;
                break;
        case NFT_META_SKUID:
-               if (skb->sk == NULL || skb->sk->sk_state == TCP_TIME_WAIT)
+               if (skb->sk == NULL || !sk_fullsock(skb->sk))
                        goto err;
 
                read_lock_bh(&skb->sk->sk_callback_lock);
@@ -99,7 +99,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                read_unlock_bh(&skb->sk->sk_callback_lock);
                break;
        case NFT_META_SKGID:
-               if (skb->sk == NULL || skb->sk->sk_state == TCP_TIME_WAIT)
+               if (skb->sk == NULL || !sk_fullsock(skb->sk))
                        goto err;
 
                read_lock_bh(&skb->sk->sk_callback_lock);
@@ -153,7 +153,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                }
                break;
        case NFT_META_CPU:
-               dest->data[0] = smp_processor_id();
+               dest->data[0] = raw_smp_processor_id();
                break;
        case NFT_META_IIFGROUP:
                if (in == NULL)
@@ -166,9 +166,8 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                dest->data[0] = out->group;
                break;
        case NFT_META_CGROUP:
-               if (skb->sk == NULL)
-                       break;
-
+               if (skb->sk == NULL || !sk_fullsock(skb->sk))
+                       goto err;
                dest->data[0] = skb->sk->sk_classid;
                break;
        default:
@@ -218,22 +217,23 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
                      const struct nlattr * const tb[])
 {
        struct nft_meta *priv = nft_expr_priv(expr);
+       unsigned int len;
        int err;
 
        priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
        switch (priv->key) {
-       case NFT_META_LEN:
        case NFT_META_PROTOCOL:
+       case NFT_META_IIFTYPE:
+       case NFT_META_OIFTYPE:
+               len = sizeof(u16);
+               break;
        case NFT_META_NFPROTO:
        case NFT_META_L4PROTO:
+       case NFT_META_LEN:
        case NFT_META_PRIORITY:
        case NFT_META_MARK:
        case NFT_META_IIF:
        case NFT_META_OIF:
-       case NFT_META_IIFNAME:
-       case NFT_META_OIFNAME:
-       case NFT_META_IIFTYPE:
-       case NFT_META_OIFTYPE:
        case NFT_META_SKUID:
        case NFT_META_SKGID:
 #ifdef CONFIG_IP_ROUTE_CLASSID
@@ -247,6 +247,11 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
        case NFT_META_IIFGROUP:
        case NFT_META_OIFGROUP:
        case NFT_META_CGROUP:
+               len = sizeof(u32);
+               break;
+       case NFT_META_IIFNAME:
+       case NFT_META_OIFNAME:
+               len = IFNAMSIZ;
                break;
        default:
                return -EOPNOTSUPP;
@@ -257,7 +262,8 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
        if (err < 0)
                return err;
 
-       err = nft_validate_data_load(ctx, priv->dreg, NULL, NFT_DATA_VALUE);
+       err = nft_validate_register_store(ctx, priv->dreg, NULL,
+                                         NFT_DATA_VALUE, len);
        if (err < 0)
                return err;