Skip to content

Commit

Permalink
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Browse files Browse the repository at this point in the history
Pablo Neira Ayuso says:

====================
Netfilter fixes for net (v2)

The following patchset contains Netfilter fixes for net:

1) Move back the defrag users fields to the global netns_nf area.
   Kernel fails to boot if conntrack is builtin and kernel is booted
   with: nf_conntrack.enable_hooks=1. From Florian Westphal.

2) Rule event notification is missing relevant context such as
   the position handle and the NLM_F_APPEND flag.

3) Rule replacement is expanded to add + delete using the existing
   rule handle, reverse order of this operation so it makes sense
   from rule notification standpoint.

4) Propagate to userspace the NLM_F_CREATE and NLM_F_EXCL flags
   from the rule notification path.

Patches #2, #3 and #4 are used by 'nft monitor' and 'iptables-monitor'
userspace utilities which are not correctly representing the following
operations through netlink notifications:

- rule insertions
- rule addition/insertion from position handle
- create table/chain/set/map/flowtable/...
====================

Signed-off-by: David S. Miller <[email protected]>
  • Loading branch information
davem330 committed Oct 2, 2021
2 parents 5cfe510 + 6fb721c commit dade7f9
Show file tree
Hide file tree
Showing 8 changed files with 91 additions and 68 deletions.
1 change: 0 additions & 1 deletion include/net/netfilter/ipv6/nf_defrag_ipv6.h
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ struct inet_frags_ctl;
struct nft_ct_frag6_pernet {
struct ctl_table_header *nf_frag_frags_hdr;
struct fqdir *fqdir;
unsigned int users;
};

#endif /* _NF_DEFRAG_IPV6_H */
2 changes: 1 addition & 1 deletion include/net/netfilter/nf_tables.h
Original file line number Diff line number Diff line change
Expand Up @@ -1202,7 +1202,7 @@ struct nft_object *nft_obj_lookup(const struct net *net,

void nft_obj_notify(struct net *net, const struct nft_table *table,
struct nft_object *obj, u32 portid, u32 seq,
int event, int family, int report, gfp_t gfp);
int event, u16 flags, int family, int report, gfp_t gfp);

/**
* struct nft_object_type - stateful object type
Expand Down
6 changes: 6 additions & 0 deletions include/net/netns/netfilter.h
Original file line number Diff line number Diff line change
Expand Up @@ -27,5 +27,11 @@ struct netns_nf {
#if IS_ENABLED(CONFIG_DECNET)
struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS];
#endif
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
unsigned int defrag_ipv4_users;
#endif
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
unsigned int defrag_ipv6_users;
#endif
};
#endif
30 changes: 9 additions & 21 deletions net/ipv4/netfilter/nf_defrag_ipv4.c
Original file line number Diff line number Diff line change
Expand Up @@ -20,13 +20,8 @@
#endif
#include <net/netfilter/nf_conntrack_zones.h>

static unsigned int defrag4_pernet_id __read_mostly;
static DEFINE_MUTEX(defrag4_mutex);

struct defrag4_pernet {
unsigned int users;
};

static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb,
u_int32_t user)
{
Expand Down Expand Up @@ -111,19 +106,15 @@ static const struct nf_hook_ops ipv4_defrag_ops[] = {

static void __net_exit defrag4_net_exit(struct net *net)
{
struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id);

if (nf_defrag->users) {
if (net->nf.defrag_ipv4_users) {
nf_unregister_net_hooks(net, ipv4_defrag_ops,
ARRAY_SIZE(ipv4_defrag_ops));
nf_defrag->users = 0;
net->nf.defrag_ipv4_users = 0;
}
}

static struct pernet_operations defrag4_net_ops = {
.exit = defrag4_net_exit,
.id = &defrag4_pernet_id,
.size = sizeof(struct defrag4_pernet),
};

static int __init nf_defrag_init(void)
Expand All @@ -138,24 +129,23 @@ static void __exit nf_defrag_fini(void)

int nf_defrag_ipv4_enable(struct net *net)
{
struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id);
int err = 0;

mutex_lock(&defrag4_mutex);
if (nf_defrag->users == UINT_MAX) {
if (net->nf.defrag_ipv4_users == UINT_MAX) {
err = -EOVERFLOW;
goto out_unlock;
}

if (nf_defrag->users) {
nf_defrag->users++;
if (net->nf.defrag_ipv4_users) {
net->nf.defrag_ipv4_users++;
goto out_unlock;
}

err = nf_register_net_hooks(net, ipv4_defrag_ops,
ARRAY_SIZE(ipv4_defrag_ops));
if (err == 0)
nf_defrag->users = 1;
net->nf.defrag_ipv4_users = 1;

out_unlock:
mutex_unlock(&defrag4_mutex);
Expand All @@ -165,12 +155,10 @@ EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);

void nf_defrag_ipv4_disable(struct net *net)
{
struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id);

mutex_lock(&defrag4_mutex);
if (nf_defrag->users) {
nf_defrag->users--;
if (nf_defrag->users == 0)
if (net->nf.defrag_ipv4_users) {
net->nf.defrag_ipv4_users--;
if (net->nf.defrag_ipv4_users == 0)
nf_unregister_net_hooks(net, ipv4_defrag_ops,
ARRAY_SIZE(ipv4_defrag_ops));
}
Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/netfilter/nf_conntrack_reasm.c
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@

static const char nf_frags_cache_name[] = "nf-frags";

unsigned int nf_frag_pernet_id __read_mostly;
static unsigned int nf_frag_pernet_id __read_mostly;
static struct inet_frags nf_frags;

static struct nft_ct_frag6_pernet *nf_frag_pernet(struct net *net)
Expand Down
25 changes: 9 additions & 16 deletions net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,6 @@
#include <net/netfilter/nf_conntrack_zones.h>
#include <net/netfilter/ipv6/nf_defrag_ipv6.h>

extern unsigned int nf_frag_pernet_id;

static DEFINE_MUTEX(defrag6_mutex);

static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
Expand Down Expand Up @@ -91,12 +89,10 @@ static const struct nf_hook_ops ipv6_defrag_ops[] = {

static void __net_exit defrag6_net_exit(struct net *net)
{
struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id);

if (nf_frag->users) {
if (net->nf.defrag_ipv6_users) {
nf_unregister_net_hooks(net, ipv6_defrag_ops,
ARRAY_SIZE(ipv6_defrag_ops));
nf_frag->users = 0;
net->nf.defrag_ipv6_users = 0;
}
}

Expand Down Expand Up @@ -134,24 +130,23 @@ static void __exit nf_defrag_fini(void)

int nf_defrag_ipv6_enable(struct net *net)
{
struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id);
int err = 0;

mutex_lock(&defrag6_mutex);
if (nf_frag->users == UINT_MAX) {
if (net->nf.defrag_ipv6_users == UINT_MAX) {
err = -EOVERFLOW;
goto out_unlock;
}

if (nf_frag->users) {
nf_frag->users++;
if (net->nf.defrag_ipv6_users) {
net->nf.defrag_ipv6_users++;
goto out_unlock;
}

err = nf_register_net_hooks(net, ipv6_defrag_ops,
ARRAY_SIZE(ipv6_defrag_ops));
if (err == 0)
nf_frag->users = 1;
net->nf.defrag_ipv6_users = 1;

out_unlock:
mutex_unlock(&defrag6_mutex);
Expand All @@ -161,12 +156,10 @@ EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable);

void nf_defrag_ipv6_disable(struct net *net)
{
struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id);

mutex_lock(&defrag6_mutex);
if (nf_frag->users) {
nf_frag->users--;
if (nf_frag->users == 0)
if (net->nf.defrag_ipv6_users) {
net->nf.defrag_ipv6_users--;
if (net->nf.defrag_ipv6_users == 0)
nf_unregister_net_hooks(net, ipv6_defrag_ops,
ARRAY_SIZE(ipv6_defrag_ops));
}
Expand Down
Loading

0 comments on commit dade7f9

Please sign in to comment.