Commit 6387aa6e authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nftables: add loop check helper function 



This patch adds nft_check_loops() to reuse it in the new catch-all
element codebase.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f8bb7889

net/netfilter/nf_tables_api.c

+21 −9
Original line number Diff line number Diff line
@@ -8626,26 +8626,38 @@ EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 
static int nf_tables_check_loops(const struct nft_ctx *ctx,

				 const struct nft_chain *chain);



static int nft_check_loops(const struct nft_ctx *ctx,

			   const struct nft_set_ext *ext)

{

	const struct nft_data *data;

	int ret;



	data = nft_set_ext_data(ext);

	switch (data->verdict.code) {

	case NFT_JUMP:

	case NFT_GOTO:

		ret = nf_tables_check_loops(ctx, data->verdict.chain);

		break;

	default:

		ret = 0;

		break;

	}



	return ret;

}



static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,

					struct nft_set *set,

					const struct nft_set_iter *iter,

					struct nft_set_elem *elem)

{

	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);

	const struct nft_data *data;



	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&

	    *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)

		return 0;



	data = nft_set_ext_data(ext);

	switch (data->verdict.code) {

	case NFT_JUMP:

	case NFT_GOTO:

		return nf_tables_check_loops(ctx, data->verdict.chain);

	default:

		return 0;

	}

	return nft_check_loops(ctx, ext);

}



static int nf_tables_check_loops(const struct nft_ctx *ctx,