Merge tag 'pci-v4.20-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaa...

[linux.git] / net / netfilter / nft_socket.c

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index 74e1b3bd695417daf3afb725d3183658a3a81342..d7f3776dfd719d402ae178890107db8ebd1627f2 100644 (file)
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -23,12 +23,15 @@ static void nft_socket_eval(const struct nft_expr *expr,
        struct sock *sk = skb->sk;
        u32 *dest = &regs->data[priv->dreg];
 
+       if (sk && !net_eq(nft_net(pkt), sock_net(sk)))
+               sk = NULL;
+
        if (!sk)
                switch(nft_pf(pkt)) {
                case NFPROTO_IPV4:
                        sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, nft_in(pkt));
                        break;
-#if IS_ENABLED(CONFIG_NF_SOCKET_IPV6)
+#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
                case NFPROTO_IPV6:
                        sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, nft_in(pkt));
                        break;
@@ -39,8 +42,8 @@ static void nft_socket_eval(const struct nft_expr *expr,
                        return;
                }
 
-       if(!sk) {
-               nft_reg_store8(dest, 0);
+       if (!sk) {
+               regs->verdict.code = NFT_BREAK;
                return;
        }
 
@@ -51,6 +54,14 @@ static void nft_socket_eval(const struct nft_expr *expr,
        case NFT_SOCKET_TRANSPARENT:
                nft_reg_store8(dest, inet_sk_transparent(sk));
                break;
+       case NFT_SOCKET_MARK:
+               if (sk_fullsock(sk)) {
+                       *dest = sk->sk_mark;
+               } else {
+                       regs->verdict.code = NFT_BREAK;
+                       return;
+               }
+               break;
        default:
                WARN_ON(1);
                regs->verdict.code = NFT_BREAK;
@@ -74,7 +85,7 @@ static int nft_socket_init(const struct nft_ctx *ctx,
 
        switch(ctx->family) {
        case NFPROTO_IPV4:
-#if IS_ENABLED(CONFIG_NF_SOCKET_IPV6)
+#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
        case NFPROTO_IPV6:
 #endif
        case NFPROTO_INET:
@@ -88,6 +99,9 @@ static int nft_socket_init(const struct nft_ctx *ctx,
        case NFT_SOCKET_TRANSPARENT:
                len = sizeof(u8);
                break;
+       case NFT_SOCKET_MARK:
+               len = sizeof(u32);
+               break;
        default:
                return -EOPNOTSUPP;
        }