Skip to contentSkip to conversation

netfilter: x_tables: don't bail out on mismatching revision

PATCH New Pablo Neira Ayuso 1 participant 1 message Apr 3, 2015

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Pablo Neira Ayuso

author maintainer
#0 lore raw

PATCH 1/1 netfilter: x_tables: don't bail out on mismatching revision

We have to give a chance to find the match/target that is registered using the NFPROTO_UNSPEC family. This is causing us problems to add MARK target support to arptables since we need to register an explicit struct xt_target for the NFPROTO_ARP family.

Remove the -EPROTOTYPE error that was introduced long time ago in 2e4e6a1 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables"). I cannot find any userspace code relying on this error code. So let's just instead bail out with -ENOENT.

Signed-off-by Pablo Neira Ayuso <[email protected]>

---
@Zhang: please, give a test to this and let me know if this resolves the problem for you, so we avoid to register the redundant xt_target structure for MARK. Thanks.

 net/netfilter/x_tables.c |   12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)
net/netfilter/x_tables.c +4 -8
index 51a459c..a7baf90 100644
@@ -182,7 +182,6 @@ EXPORT_SYMBOL(xt_unregister_matches);
 struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
 {
 	struct xt_match *m;
-	int err = -ENOENT;
 
 	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(m, &xt[af].match, list) {

@@ -192,8 +191,7 @@ struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
 					mutex_unlock(&xt[af].mutex);
 					return m;
 				}
-			} else
-				err = -EPROTOTYPE; /* Found something. */
+			}
 		}
 	}
 	mutex_unlock(&xt[af].mutex);

@@ -202,7 +200,7 @@ struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
 		/* Try searching again in the family-independent list */
 		return xt_find_match(NFPROTO_UNSPEC, name, revision);
 
-	return ERR_PTR(err);
+	return ERR_PTR(-ENOENT);
 }
 EXPORT_SYMBOL(xt_find_match);
 

@@ -225,7 +223,6 @@ EXPORT_SYMBOL_GPL(xt_request_find_match);
 struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
 {
 	struct xt_target *t;
-	int err = -ENOENT;
 
 	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(t, &xt[af].target, list) {

@@ -235,8 +232,7 @@ struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
 					mutex_unlock(&xt[af].mutex);
 					return t;
 				}
-			} else
-				err = -EPROTOTYPE; /* Found something. */
+			}
 		}
 	}
 	mutex_unlock(&xt[af].mutex);

@@ -245,7 +241,7 @@ struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
 		/* Try searching again in the family-independent list */
 		return xt_find_target(NFPROTO_UNSPEC, name, revision);
 
-	return ERR_PTR(err);
+	return ERR_PTR(-ENOENT);
 }
 EXPORT_SYMBOL(xt_find_target);
Signature · 1 line
1.7.10.4