niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

netfilter: nf_tables: make validation state per table

Browse source 
We only need to validate tables that saw changes in the current
transaction.

The existing code revalidates all tables, but this isn't needed as
cross-table jumps are not allowed (chains have table scope).

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2023-04-13 17:13:20 +02:00 • committed by Pablo Neira Ayuso
parent 9a32e98506
commit 00c320f9b7
2 changed files with 20 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
include/net/netfilter/nf_tables.h
View file

@ -1209,6 +1209,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
* @genmask: generation mask * @genmask: generation mask
* @afinfo: address family info * @afinfo: address family info
* @name: name of the table * @name: name of the table
* @validate_state: internal, set when transaction adds jumps
*/ */
struct nft_table { struct nft_table {
struct list_head list; struct list_head list;
@ -1227,6 +1228,7 @@ struct nft_table {
char *name; char *name;
u16 udlen; u16 udlen;
u8 *udata; u8 *udata;
u8 validate_state;
}; };
static inline bool nft_table_has_owner(const struct nft_table *table) static inline bool nft_table_has_owner(const struct nft_table *table)
@ -1698,7 +1700,6 @@ struct nftables_pernet {
struct mutex commit_mutex; struct mutex commit_mutex;
u64 table_handle; u64 table_handle;
unsigned int base_seq; unsigned int base_seq;
u8 validate_state;
}; };
extern unsigned int nf_tables_net_id; extern unsigned int nf_tables_net_id;

38
net/netfilter/nf_tables_api.c
View file

@ -102,11 +102,9 @@ static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types
[NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
}; };
static void nft_validate_state_update(struct net *net, u8 new_validate_state) static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state)
{ {
struct nftables_pernet *nft_net = nft_pernet(net); switch (table->validate_state) {
switch (nft_net->validate_state) {
case NFT_VALIDATE_SKIP: case NFT_VALIDATE_SKIP:
WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
break; break;
@ -117,7 +115,7 @@ static void nft_validate_state_update(struct net *net, u8 new_validate_state)
return; return;
} }
nft_net->validate_state = new_validate_state; table->validate_state = new_validate_state;
} }
static void nf_tables_trans_destroy_work(struct work_struct *w); static void nf_tables_trans_destroy_work(struct work_struct *w);
static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work); static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
@ -1224,6 +1222,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
if (table == NULL) if (table == NULL)
goto err_kzalloc; goto err_kzalloc;
table->validate_state = NFT_VALIDATE_SKIP;
table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT);
if (table->name == NULL) if (table->name == NULL)
goto err_strdup; goto err_strdup;
@ -3660,7 +3659,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
} }
if (expr_info[i].ops->validate) if (expr_info[i].ops->validate)
nft_validate_state_update(net, NFT_VALIDATE_NEED); nft_validate_state_update(table, NFT_VALIDATE_NEED);
expr_info[i].ops = NULL; expr_info[i].ops = NULL;
expr = nft_expr_next(expr); expr = nft_expr_next(expr);
@ -3710,7 +3709,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
if (flow) if (flow)
nft_trans_flow_rule(trans) = flow; nft_trans_flow_rule(trans) = flow;
if (nft_net->validate_state == NFT_VALIDATE_DO) if (table->validate_state == NFT_VALIDATE_DO)
return nft_table_validate(net, table); return nft_table_validate(net, table);
return 0; return 0;
@ -6312,7 +6311,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
if (desc.type == NFT_DATA_VERDICT && if (desc.type == NFT_DATA_VERDICT &&
(elem.data.val.verdict.code == NFT_GOTO || (elem.data.val.verdict.code == NFT_GOTO ||
elem.data.val.verdict.code == NFT_JUMP)) elem.data.val.verdict.code == NFT_JUMP))
nft_validate_state_update(ctx->net, nft_validate_state_update(ctx->table,
NFT_VALIDATE_NEED); NFT_VALIDATE_NEED);
} }
@ -6437,7 +6436,6 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
const struct nfnl_info *info, const struct nfnl_info *info,
const struct nlattr * const nla[]) const struct nlattr * const nla[])
{ {
struct nftables_pernet *nft_net = nft_pernet(info->net);
struct netlink_ext_ack *extack = info->extack; struct netlink_ext_ack *extack = info->extack;
u8 genmask = nft_genmask_next(info->net); u8 genmask = nft_genmask_next(info->net);
u8 family = info->nfmsg->nfgen_family; u8 family = info->nfmsg->nfgen_family;
@ -6476,7 +6474,7 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
} }
} }
if (nft_net->validate_state == NFT_VALIDATE_DO) if (table->validate_state == NFT_VALIDATE_DO)
return nft_table_validate(net, table); return nft_table_validate(net, table);
return 0; return 0;
@ -8628,19 +8626,20 @@ static int nf_tables_validate(struct net *net)
struct nftables_pernet *nft_net = nft_pernet(net); struct nftables_pernet *nft_net = nft_pernet(net);
struct nft_table *table; struct nft_table *table;
switch (nft_net->validate_state) { list_for_each_entry(table, &nft_net->tables, list) {
case NFT_VALIDATE_SKIP: switch (table->validate_state) {
break; case NFT_VALIDATE_SKIP:
case NFT_VALIDATE_NEED: continue;
nft_validate_state_update(net, NFT_VALIDATE_DO); case NFT_VALIDATE_NEED:
fallthrough; nft_validate_state_update(table, NFT_VALIDATE_DO);
case NFT_VALIDATE_DO: fallthrough;
list_for_each_entry(table, &nft_net->tables, list) { case NFT_VALIDATE_DO:
if (nft_table_validate(net, table) < 0) if (nft_table_validate(net, table) < 0)
return -EAGAIN; return -EAGAIN;
nft_validate_state_update(table, NFT_VALIDATE_SKIP);
} }
nft_validate_state_update(net, NFT_VALIDATE_SKIP);
break; break;
} }
@ -10355,7 +10354,6 @@ static int __net_init nf_tables_init_net(struct net *net)
INIT_LIST_HEAD(&nft_net->notify_list); INIT_LIST_HEAD(&nft_net->notify_list);
mutex_init(&nft_net->commit_mutex); mutex_init(&nft_net->commit_mutex);
nft_net->base_seq = 1; nft_net->base_seq = 1;
nft_net->validate_state = NFT_VALIDATE_SKIP;
return 0; return 0;
} }