[PATCH 09/14] netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it

[Pablo Neira Ayuso]

From: Liping Zhang <zlpnob...@gmail.com>

The NFTA_DUP_SREG_DEV attribute is not a must option, so we should use it
in routing lookup only when the user specify it.

Fixes: d877f07112f1 ("netfilter: nf_tables: add nft_dup expression")
Signed-off-by: Liping Zhang <zlpnob...@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
 net/ipv4/netfilter/nft_dup_ipv4.c | 6 ++++--
 net/ipv6/netfilter/nft_dup_ipv6.c | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/netfilter/nft_dup_ipv4.c 
b/net/ipv4/netfilter/nft_dup_ipv4.c
index bf855e64fc45..0c01a270bf9f 100644
--- a/net/ipv4/netfilter/nft_dup_ipv4.c
+++ b/net/ipv4/netfilter/nft_dup_ipv4.c
@@ -28,7 +28,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr,
        struct in_addr gw = {
                .s_addr = (__force __be32)regs->data[priv->sreg_addr],
        };
-       int oif = regs->data[priv->sreg_dev];
+       int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
        nf_dup_ipv4(pkt->net, pkt->skb, pkt->hook, &gw, oif);
 }
@@ -59,7 +59,9 @@ static int nft_dup_ipv4_dump(struct sk_buff *skb, const 
struct nft_expr *expr)
 {
        struct nft_dup_ipv4 *priv = nft_expr_priv(expr);
 
-       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+               goto nla_put_failure;
+       if (priv->sreg_dev &&
            nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                goto nla_put_failure;
 
diff --git a/net/ipv6/netfilter/nft_dup_ipv6.c 
b/net/ipv6/netfilter/nft_dup_ipv6.c
index 8bfd470cbe72..831f86e1ec08 100644
--- a/net/ipv6/netfilter/nft_dup_ipv6.c
+++ b/net/ipv6/netfilter/nft_dup_ipv6.c
@@ -26,7 +26,7 @@ static void nft_dup_ipv6_eval(const struct nft_expr *expr,
 {
        struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
        struct in6_addr *gw = (struct in6_addr *)&regs->data[priv->sreg_addr];
-       int oif = regs->data[priv->sreg_dev];
+       int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
        nf_dup_ipv6(pkt->net, pkt->skb, pkt->hook, gw, oif);
 }
@@ -57,7 +57,9 @@ static int nft_dup_ipv6_dump(struct sk_buff *skb, const 
struct nft_expr *expr)
 {
        struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
 
-       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+       if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+               goto nla_put_failure;
+       if (priv->sreg_dev &&
            nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                goto nla_put_failure;
 
-- 
2.1.4