Commit 97c976d6 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nftables: add helper function to validate set element data 



When binding sets to rule, validate set element data according to
set definition. This patch adds a helper function to be reused by
the catch-all set element support.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent e6ba7cb6

net/netfilter/nf_tables_api.c

+11 −4
Original line number Diff line number Diff line
@@ -4499,9 +4499,8 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, 
				       enum nft_data_types type,

				       unsigned int len);



static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,

static int nft_setelem_data_validate(const struct nft_ctx *ctx,

				     struct nft_set *set,

					const struct nft_set_iter *iter,

				     struct nft_set_elem *elem)

{

	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
@@ -4514,6 +4513,14 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 
					   set->dlen);

}



static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,

					struct nft_set *set,

					const struct nft_set_iter *iter,

					struct nft_set_elem *elem)

{

	return nft_setelem_data_validate(ctx, set, elem);

}



int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,

		       struct nft_set_binding *binding)

{