]> git.ipfire.org Git - thirdparty/linux.git/commit
netfilter: conntrack: validate cta_ip via parsing
authorLin Ma <linma@zju.edu.cn>
Wed, 12 Jul 2023 13:32:36 +0000 (21:32 +0800)
committerFlorian Westphal <fw@strlen.de>
Thu, 27 Jul 2023 11:45:51 +0000 (13:45 +0200)
commit0c805e80e35d042a41c8702fa13f453a504d2ede
tree8f1e1d701b72f5fb21ad6f722771ac33cbe6b51c
parent100a11b69842ab568cff2a59959daf317be525c9
netfilter: conntrack: validate cta_ip via parsing

In current ctnetlink_parse_tuple_ip() function, nested parsing and
validation is splitting as two parts,  which could be cleanup to a
simplified form. As the nla_parse_nested_deprecated function
supports validation in the fly. These two finially reach same place
__nla_validate_parse with same validate flag.

nla_parse_nested_deprecated
  __nla_parse(.., NL_VALIDATE_LIBERAL, ..)
    __nla_validate_parse

nla_validate_nested_deprecated
  __nla_validate_nested(.., NL_VALIDATE_LIBERAL, ..)
    __nla_validate
      __nla_validate_parse

This commit removes the call to nla_validate_nested_deprecated and pass
cta_ip_nla_policy when do parsing.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
net/netfilter/nf_conntrack_netlink.c