[PATCH 4.14 61/86] netfilter: nftables: add nft_parse_register_store() and use it

28 May 2023

From: Pablo Neira Ayuso pablo@netfilter.org
[ 345023b0db315648ccc3c1a36aee88304a8b4d91 ]
This new function combines the netlink register attribute parser
and the store validation function.
This update requires to replace:
enum nft_registers      dreg:8;
in many of the expression private areas otherwise compiler complains
with:
error: cannot take address of bit-field ‘dreg’
when passing the register field as reference.
Signed-off-by: Pablo Neira Ayuso pablo@netfilter.org
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
---
 include/net/netfilter/nf_tables.h      |    8 +++----
 include/net/netfilter/nf_tables_core.h |    4 +--
 include/net/netfilter/nft_fib.h        |    2 -
 include/net/netfilter/nft_meta.h       |    2 -
 net/bridge/netfilter/nft_meta_bridge.c |    5 +---
 net/netfilter/nf_tables_api.c          |   34 ++++++++++++++++++++++++++++-----
 net/netfilter/nft_bitwise.c            |    8 +++----
 net/netfilter/nft_byteorder.c          |    8 +++----
 net/netfilter/nft_ct.c                 |    7 ++----
 net/netfilter/nft_exthdr.c             |    8 +++----
 net/netfilter/nft_fib.c                |    5 +---
 net/netfilter/nft_hash.c               |   17 ++++++----------
 net/netfilter/nft_immediate.c          |    8 +++----
 net/netfilter/nft_lookup.c             |    8 +++----
 net/netfilter/nft_meta.c               |    5 +---
 net/netfilter/nft_numgen.c             |   15 +++++---------
 net/netfilter/nft_payload.c            |    6 ++---
 net/netfilter/nft_rt.c                 |    7 ++----
 18 files changed, 85 insertions(+), 72 deletions(-)

--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -199,10 +199,10 @@ unsigned int nft_parse_register(const st
 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len);
-int nft_validate_register_store(const struct nft_ctx *ctx,
-				enum nft_registers reg,
-				const struct nft_data *data,
-				enum nft_data_types type, unsigned int len);
+int nft_parse_register_store(const struct nft_ctx *ctx,
+			     const struct nlattr *attr, u8 *dreg,
+			     const struct nft_data *data,
+			     enum nft_data_types type, unsigned int len);
/**
  *	struct nft_userdata - user defined data associated with an object
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@ -18,7 +18,7 @@ struct nft_bitwise_fast_expr {
    u32			mask;
    u32			xor;
    u8			sreg;
-	enum nft_registers	dreg:8;
+	u8			dreg;
 };
struct nft_cmp_fast_expr {
@@ -44,7 +44,7 @@ struct nft_payload {
    enum nft_payload_bases	base:8;
    u8			offset;
    u8			len;
-	enum nft_registers	dreg:8;
+	u8			dreg;
 };
struct nft_payload_set {
--- a/include/net/netfilter/nft_fib.h
+++ b/include/net/netfilter/nft_fib.h
@@ -3,7 +3,7 @@
 #define _NFT_FIB_H_
struct nft_fib {
-	enum nft_registers	dreg:8;
+	u8			dreg;
    u8			result;
    u32			flags;
 };
--- a/include/net/netfilter/nft_meta.h
+++ b/include/net/netfilter/nft_meta.h
@@ -5,7 +5,7 @@
 struct nft_meta {
    enum nft_meta_keys	key:8;
    union {
-		enum nft_registers	dreg:8;
+		u8		dreg;
    	u8		sreg;
    };
 };
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -65,9 +65,8 @@ static int nft_meta_bridge_get_init(cons
    	return nft_meta_get_init(ctx, expr, tb);
    }
-	priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, len);
+	return nft_parse_register_store(ctx, tb[NFTA_META_DREG], &priv->dreg,
+					NULL, NFT_DATA_VALUE, len);
 }
static struct nft_expr_type nft_meta_bridge_type;
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3349,6 +3349,12 @@ static int nf_tables_delset(struct net *
    return nft_delset(&ctx, set);
 }
+static int nft_validate_register_store(const struct nft_ctx *ctx,
+				       enum nft_registers reg,
+				       const struct nft_data *data,
+				       enum nft_data_types type,
+				       unsigned int len);
+
 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
    				struct nft_set *set,
    				const struct nft_set_iter *iter,
@@ -5704,10 +5710,11 @@ EXPORT_SYMBOL_GPL(nft_parse_register_loa
  * 	A value of NULL for the data means that its runtime gathered
  * 	data.
  */
-int nft_validate_register_store(const struct nft_ctx *ctx,
-				enum nft_registers reg,
-				const struct nft_data *data,
-				enum nft_data_types type, unsigned int len)
+static int nft_validate_register_store(const struct nft_ctx *ctx,
+				       enum nft_registers reg,
+				       const struct nft_data *data,
+				       enum nft_data_types type,
+				       unsigned int len)
 {
    int err;
@@ -5746,7 +5753,24 @@ int nft_validate_register_store(const st
    	return 0;
    }
 }
-EXPORT_SYMBOL_GPL(nft_validate_register_store);
+
+int nft_parse_register_store(const struct nft_ctx *ctx,
+			     const struct nlattr *attr, u8 *dreg,
+			     const struct nft_data *data,
+			     enum nft_data_types type, unsigned int len)
+{
+	int err;
+	u32 reg;
+
+	reg = nft_parse_register(attr);
+	err = nft_validate_register_store(ctx, reg, data, type, len);
+	if (err < 0)
+		return err;
+
+	*dreg = reg;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(nft_parse_register_store);
static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
    [NFTA_VERDICT_CODE]	= { .type = NLA_U32 },
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -19,7 +19,7 @@
struct nft_bitwise {
    u8			sreg;
-	enum nft_registers	dreg:8;
+	u8			dreg;
    u8			len;
    struct nft_data		mask;
    struct nft_data		xor;
@@ -73,9 +73,9 @@ static int nft_bitwise_init(const struct
    if (err < 0)
    	return err;
-	priv->dreg = nft_parse_register(tb[NFTA_BITWISE_DREG]);
-	err = nft_validate_register_store(ctx, priv->dreg, NULL,
-					  NFT_DATA_VALUE, priv->len);
+	err = nft_parse_register_store(ctx, tb[NFTA_BITWISE_DREG],
+				       &priv->dreg, NULL, NFT_DATA_VALUE,
+				       priv->len);
    if (err < 0)
    	return err;
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c
@@ -20,7 +20,7 @@
struct nft_byteorder {
    u8			sreg;
-	enum nft_registers	dreg:8;
+	u8			dreg;
    enum nft_byteorder_ops	op:8;
    u8			len;
    u8			size;
@@ -144,9 +144,9 @@ static int nft_byteorder_init(const stru
    if (err < 0)
    	return err;
-	priv->dreg = nft_parse_register(tb[NFTA_BYTEORDER_DREG]);
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, priv->len);
+	return nft_parse_register_store(ctx, tb[NFTA_BYTEORDER_DREG],
+					&priv->dreg, NULL, NFT_DATA_VALUE,
+					priv->len);
 }
static int nft_byteorder_dump(struct sk_buff *skb, const struct nft_expr *expr)
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -27,7 +27,7 @@ struct nft_ct {
    enum nft_ct_keys	key:8;
    enum ip_conntrack_dir	dir:8;
    union {
-		enum nft_registers	dreg:8;
+		u8		dreg;
    	u8		sreg;
    };
 };
@@ -483,9 +483,8 @@ static int nft_ct_get_init(const struct
    	}
    }
-	priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
-	err = nft_validate_register_store(ctx, priv->dreg, NULL,
-					  NFT_DATA_VALUE, len);
+	err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
+				       NFT_DATA_VALUE, len);
    if (err < 0)
    	return err;
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -23,7 +23,7 @@ struct nft_exthdr {
    u8			offset;
    u8			len;
    u8			op;
-	enum nft_registers	dreg:8;
+	u8			dreg;
    u8			sreg;
    u8			flags;
 };
@@ -257,12 +257,12 @@ static int nft_exthdr_init(const struct
    priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
    priv->offset = offset;
    priv->len    = len;
-	priv->dreg   = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
    priv->flags  = flags;
    priv->op     = op;
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, priv->len);
+	return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG],
+					&priv->dreg, NULL, NFT_DATA_VALUE,
+					priv->len);
 }
static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
--- a/net/netfilter/nft_fib.c
+++ b/net/netfilter/nft_fib.c
@@ -88,7 +88,6 @@ int nft_fib_init(const struct nft_ctx *c
    	return -EINVAL;
priv->result = ntohl(nla_get_be32(tb[NFTA_FIB_RESULT]));
-	priv->dreg = nft_parse_register(tb[NFTA_FIB_DREG]);
switch (priv->result) {
    case NFT_FIB_RESULT_OIF:
@@ -108,8 +107,8 @@ int nft_fib_init(const struct nft_ctx *c
    	return -EINVAL;
    }
-	err = nft_validate_register_store(ctx, priv->dreg, NULL,
-					  NFT_DATA_VALUE, len);
+	err = nft_parse_register_store(ctx, tb[NFTA_FIB_DREG], &priv->dreg,
+				       NULL, NFT_DATA_VALUE, len);
    if (err < 0)
    	return err;
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -19,7 +19,7 @@
struct nft_jhash {
    u8			sreg;
-	enum nft_registers      dreg:8;
+	u8			dreg;
    u8			len;
    bool			autogen_seed:1;
    u32			modulus;
@@ -40,7 +40,7 @@ static void nft_jhash_eval(const struct
 }
struct nft_symhash {
-	enum nft_registers      dreg:8;
+	u8			dreg;
    u32			modulus;
    u32			offset;
 };
@@ -85,8 +85,6 @@ static int nft_jhash_init(const struct n
    if (tb[NFTA_HASH_OFFSET])
    	priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
-	priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
-
    err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
    if (err < 0)
    	return err;
@@ -113,8 +111,8 @@ static int nft_jhash_init(const struct n
    	get_random_bytes(&priv->seed, sizeof(priv->seed));
    }
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, sizeof(u32));
+	return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG], &priv->dreg,
+					NULL, NFT_DATA_VALUE, sizeof(u32));
 }
static int nft_symhash_init(const struct nft_ctx *ctx,
@@ -130,8 +128,6 @@ static int nft_symhash_init(const struct
    if (tb[NFTA_HASH_OFFSET])
    	priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
-	priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
-
    priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
    if (priv->modulus < 1)
    	return -ERANGE;
@@ -139,8 +135,9 @@ static int nft_symhash_init(const struct
    if (priv->offset + priv->modulus - 1 < priv->offset)
    	return -EOVERFLOW;
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, sizeof(u32));
+	return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG],
+					&priv->dreg, NULL, NFT_DATA_VALUE,
+					sizeof(u32));
 }
static int nft_jhash_dump(struct sk_buff *skb,
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -19,7 +19,7 @@
struct nft_immediate_expr {
    struct nft_data		data;
-	enum nft_registers	dreg:8;
+	u8			dreg;
    u8			dlen;
 };
@@ -56,9 +56,9 @@ static int nft_immediate_init(const stru
priv->dlen = desc.len;
-	priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);
-	err = nft_validate_register_store(ctx, priv->dreg, &priv->data,
-					  desc.type, desc.len);
+	err = nft_parse_register_store(ctx, tb[NFTA_IMMEDIATE_DREG],
+				       &priv->dreg, &priv->data, desc.type,
+				       desc.len);
    if (err < 0)
    	goto err1;
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -21,7 +21,7 @@
 struct nft_lookup {
    struct nft_set			*set;
    u8				sreg;
-	enum nft_registers		dreg:8;
+	u8				dreg;
    bool				invert;
    struct nft_set_binding		binding;
 };
@@ -100,9 +100,9 @@ static int nft_lookup_init(const struct
    	if (!(set->flags & NFT_SET_MAP))
    		return -EINVAL;
-		priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]);
-		err = nft_validate_register_store(ctx, priv->dreg, NULL,
-						  set->dtype, set->dlen);
+		err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG],
+					       &priv->dreg, NULL, set->dtype,
+					       set->dlen);
    	if (err < 0)
    		return err;
    } else if (set->flags & NFT_SET_MAP)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -314,9 +314,8 @@ int nft_meta_get_init(const struct nft_c
    	return -EOPNOTSUPP;
    }
-	priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, len);
+	return nft_parse_register_store(ctx, tb[NFTA_META_DREG], &priv->dreg,
+					NULL, NFT_DATA_VALUE, len);
 }
 EXPORT_SYMBOL_GPL(nft_meta_get_init);
--- a/net/netfilter/nft_numgen.c
+++ b/net/netfilter/nft_numgen.c
@@ -20,7 +20,7 @@
 static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state);
struct nft_ng_inc {
-	enum nft_registers      dreg:8;
+	u8			dreg;
    u32			modulus;
    atomic_t		counter;
    u32			offset;
@@ -64,11 +64,10 @@ static int nft_ng_inc_init(const struct
    if (priv->offset + priv->modulus - 1 < priv->offset)
    	return -EOVERFLOW;
-	priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
    atomic_set(&priv->counter, priv->modulus - 1);
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, sizeof(u32));
+	return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg,
+					NULL, NFT_DATA_VALUE, sizeof(u32));
 }
static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
@@ -98,7 +97,7 @@ static int nft_ng_inc_dump(struct sk_buf
 }
struct nft_ng_random {
-	enum nft_registers      dreg:8;
+	u8			dreg;
    u32			modulus;
    u32			offset;
 };
@@ -133,10 +132,8 @@ static int nft_ng_random_init(const stru
prandom_init_once(&nft_numgen_prandom_state);
-	priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
-
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, sizeof(u32));
+	return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg,
+					NULL, NFT_DATA_VALUE, sizeof(u32));
 }
static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -135,10 +135,10 @@ static int nft_payload_init(const struct
    priv->base   = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
    priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
    priv->len    = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
-	priv->dreg   = nft_parse_register(tb[NFTA_PAYLOAD_DREG]);
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, priv->len);
+	return nft_parse_register_store(ctx, tb[NFTA_PAYLOAD_DREG],
+					&priv->dreg, NULL, NFT_DATA_VALUE,
+					priv->len);
 }
static int nft_payload_dump(struct sk_buff *skb, const struct nft_expr *expr)
--- a/net/netfilter/nft_rt.c
+++ b/net/netfilter/nft_rt.c
@@ -20,7 +20,7 @@
struct nft_rt {
    enum nft_rt_keys	key:8;
-	enum nft_registers	dreg:8;
+	u8			dreg;
 };
static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst)
@@ -141,9 +141,8 @@ static int nft_rt_get_init(const struct
    	return -EOPNOTSUPP;
    }
-	priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
-	return nft_validate_register_store(ctx, priv->dreg, NULL,
-					   NFT_DATA_VALUE, len);
+	return nft_parse_register_store(ctx, tb[NFTA_RT_DREG], &priv->dreg,
+					NULL, NFT_DATA_VALUE, len);
 }
static int nft_rt_get_dump(struct sk_buff *skb,

    

2024

2023

2022

2021

2020

2019

2018

2017

[PATCH 4.14 61/86] netfilter: nftables: add nft_parse_register_store() and use it