iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: validate the expr explicitly after init successfully

Browse Source 
When we want to validate the expr's dependency or hooks, we must do two
things to accomplish it. First, write a X_validate callback function
and point ->validate to it. Second, call X_validate in init routine.
This is very common, such as fib, nat, reject expr and so on ...

It is a little ugly, since we will call X_validate in the expr's init
routine, it's better to do it in nf_tables_newexpr. So we can avoid to
do this again and again. After doing this, the second step listed above
is not useful anymore, remove them now.

Patch was tested by nftables/tests/py/nft-test.py and
nftables/tests/shell/run-tests.sh.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Liping Zhang
2017-03-05 21:02:23 +08:00
committed by Pablo Neira Ayuso
parent 74664cf286
commit c56e3956c1
10 changed files with 14 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
net/bridge/netfilter/nft_reject_bridge.c
View File

@ -375,11 +375,7 @@ static int nft_reject_bridge_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
{
struct nft_reject *priv = nft_expr_priv(expr);
int icmp_code, err;
err = nft_reject_bridge_validate(ctx, expr, NULL);
if (err < 0)
return err;
int icmp_code;
if (tb[NFTA_REJECT_TYPE] == NULL)
return -EINVAL;