netfilter: nft_reject: unify reject init and dump into nft_reject

[ Upstream commit 312ca575a50543a886a5dfa2af1e72aa6a5b601e ]

Bridge family is using the same static init and dump function as inet.

This patch removes duplicate code unifying these functions body into
nft_reject.c so they can be reused in the rest of families supporting
reject verdict.

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 91a79b792204 ("netfilter: nf_reject: don't leak dst refcount for loopback packets")
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index deae2c9a0f696613b8d3df5b2d95bef966b8413b..9ffadcd524f83a63db31e9ae77ddbef8754bce49 100644 (file)
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -364,69 +364,13 @@ static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
                                                    (1 << NF_BR_LOCAL_IN));
 }
 
-static int nft_reject_bridge_init(const struct nft_ctx *ctx,
-                                 const struct nft_expr *expr,
-                                 const struct nlattr * const tb[])
-{
-       struct nft_reject *priv = nft_expr_priv(expr);
-       int icmp_code;
-
-       if (tb[NFTA_REJECT_TYPE] == NULL)
-               return -EINVAL;
-
-       priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
-       switch (priv->type) {
-       case NFT_REJECT_ICMP_UNREACH:
-       case NFT_REJECT_ICMPX_UNREACH:
-               if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
-                       return -EINVAL;
-
-               icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
-               if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
-                   icmp_code > NFT_REJECT_ICMPX_MAX)
-                       return -EINVAL;
-
-               priv->icmp_code = icmp_code;
-               break;
-       case NFT_REJECT_TCP_RST:
-               break;
-       default:
-               return -EINVAL;
-       }
-       return 0;
-}
-
-static int nft_reject_bridge_dump(struct sk_buff *skb,
-                                 const struct nft_expr *expr)
-{
-       const struct nft_reject *priv = nft_expr_priv(expr);
-
-       if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
-               goto nla_put_failure;
-
-       switch (priv->type) {
-       case NFT_REJECT_ICMP_UNREACH:
-       case NFT_REJECT_ICMPX_UNREACH:
-               if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
-                       goto nla_put_failure;
-               break;
-       default:
-               break;
-       }
-
-       return 0;
-
-nla_put_failure:
-       return -1;
-}
-
 static struct nft_expr_type nft_reject_bridge_type;
 static const struct nft_expr_ops nft_reject_bridge_ops = {
        .type           = &nft_reject_bridge_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
        .eval           = nft_reject_bridge_eval,
-       .init           = nft_reject_bridge_init,
-       .dump           = nft_reject_bridge_dump,
+       .init           = nft_reject_init,
+       .dump           = nft_reject_dump,
        .validate       = nft_reject_bridge_validate,
 };
 

diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index 61fb7e8afbf0a8a43d94c4e90e096bdaf6b18724..927ff8459bd90e922370e87a162a0eaa119d3bf3 100644 (file)
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -40,6 +40,7 @@ int nft_reject_init(const struct nft_ctx *ctx,
                    const struct nlattr * const tb[])
 {
        struct nft_reject *priv = nft_expr_priv(expr);
+       int icmp_code;
 
        if (tb[NFTA_REJECT_TYPE] == NULL)
                return -EINVAL;
@@ -47,9 +48,17 @@ int nft_reject_init(const struct nft_ctx *ctx,
        priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
        switch (priv->type) {
        case NFT_REJECT_ICMP_UNREACH:
+       case NFT_REJECT_ICMPX_UNREACH:
                if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
                        return -EINVAL;
-               priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
+
+               icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
+               if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
+                   icmp_code > NFT_REJECT_ICMPX_MAX)
+                       return -EINVAL;
+
+               priv->icmp_code = icmp_code;
+               break;
        case NFT_REJECT_TCP_RST:
                break;
        default:
@@ -69,6 +78,7 @@ int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 
        switch (priv->type) {
        case NFT_REJECT_ICMP_UNREACH:
+       case NFT_REJECT_ICMPX_UNREACH:
                if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
                        goto nla_put_failure;
                break;

diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index c00b94a1668245e13e6ceb72a16f86bf2c11b17c..115aa446f6d528f8b38f8f71a20c16db32fbbc22 100644 (file)
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -60,69 +60,13 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
        regs->verdict.code = NF_DROP;
 }
 
-static int nft_reject_inet_init(const struct nft_ctx *ctx,
-                               const struct nft_expr *expr,
-                               const struct nlattr * const tb[])
-{
-       struct nft_reject *priv = nft_expr_priv(expr);
-       int icmp_code;
-
-       if (tb[NFTA_REJECT_TYPE] == NULL)
-               return -EINVAL;
-
-       priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
-       switch (priv->type) {
-       case NFT_REJECT_ICMP_UNREACH:
-       case NFT_REJECT_ICMPX_UNREACH:
-               if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
-                       return -EINVAL;
-
-               icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
-               if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
-                   icmp_code > NFT_REJECT_ICMPX_MAX)
-                       return -EINVAL;
-
-               priv->icmp_code = icmp_code;
-               break;
-       case NFT_REJECT_TCP_RST:
-               break;
-       default:
-               return -EINVAL;
-       }
-       return 0;
-}
-
-static int nft_reject_inet_dump(struct sk_buff *skb,
-                               const struct nft_expr *expr)
-{
-       const struct nft_reject *priv = nft_expr_priv(expr);
-
-       if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
-               goto nla_put_failure;
-
-       switch (priv->type) {
-       case NFT_REJECT_ICMP_UNREACH:
-       case NFT_REJECT_ICMPX_UNREACH:
-               if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
-                       goto nla_put_failure;
-               break;
-       default:
-               break;
-       }
-
-       return 0;
-
-nla_put_failure:
-       return -1;
-}
-
 static struct nft_expr_type nft_reject_inet_type;
 static const struct nft_expr_ops nft_reject_inet_ops = {
        .type           = &nft_reject_inet_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
        .eval           = nft_reject_inet_eval,
-       .init           = nft_reject_inet_init,
-       .dump           = nft_reject_inet_dump,
+       .init           = nft_reject_init,
+       .dump           = nft_reject_dump,
        .validate       = nft_reject_validate,
 };