netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it

The NFTA_DUP_SREG_DEV attribute is not a must option, so we should use it
in routing lookup only when the user specify it.

Fixes: d877f07112f1 ("netfilter: nf_tables: add nft_dup expression")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv4/netfilter/nft_dup_ipv4.c b/net/ipv4/netfilter/nft_dup_ipv4.c
index bf855e64fc45c86fbf286bc34b2bd96fbac17cff..0c01a270bf9fb0a0a8d57a80633a78133e668c01 100644 (file)
--- a/net/ipv4/netfilter/nft_dup_ipv4.c
+++ b/net/ipv4/netfilter/nft_dup_ipv4.c
@@ -28,7 +28,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr,
        struct in_addr gw = {
                .s_addr = (__force __be32)regs->data[priv->sreg_addr],
        };
-       int oif = regs->data[priv->sreg_dev];
+       int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
        nf_dup_ipv4(pkt->net, pkt->skb, pkt->hook, &gw, oif);
 }
@@ -59,7 +59,9 @@ static int nft_dup_ipv4_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
        struct nft_dup_ipv4 *priv = nft_expr_priv(expr);
 
-       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+               goto nla_put_failure;
+       if (priv->sreg_dev &&
            nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                goto nla_put_failure;
 

diff --git a/net/ipv6/netfilter/nft_dup_ipv6.c b/net/ipv6/netfilter/nft_dup_ipv6.c
index 8bfd470cbe726678c5da89dff4f24b9fa089b356..831f86e1ec08270b4aeed8924ebe09b978953e44 100644 (file)
--- a/net/ipv6/netfilter/nft_dup_ipv6.c
+++ b/net/ipv6/netfilter/nft_dup_ipv6.c
@@ -26,7 +26,7 @@ static void nft_dup_ipv6_eval(const struct nft_expr *expr,
 {
        struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
        struct in6_addr *gw = (struct in6_addr *)&regs->data[priv->sreg_addr];
-       int oif = regs->data[priv->sreg_dev];
+       int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
        nf_dup_ipv6(pkt->net, pkt->skb, pkt->hook, gw, oif);
 }
@@ -57,7 +57,9 @@ static int nft_dup_ipv6_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
        struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
 
-       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+               goto nla_put_failure;
+       if (priv->sreg_dev &&
            nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                goto nla_put_failure;