linux.git/include/linux/netfilter/nfnetlink.h, branch v7.0

netfilter: nf_tables: don't write table validation state without mutex

2023-04-21T23:39:40+00:00

The ->cleanup callback needs to be removed, this doesn't work anymore as
the transaction mutex is already released in the ->abort function.

Just do it after a successful validation pass, this either happens
from commit or abort phases where transaction mutex is held.

Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: add struct nfgenmsg to struct nfnl_info and use it

2021-06-07T10:23:36+00:00

Update the nfnl_info structure to add a pointer to the nfnetlink header.
This simplifies the existing codebase since this header is usually
accessed. Update existing clients to use this new field.

Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: consolidate callback types

2021-04-26T16:16:56+00:00

Add enum nfnl_callback_type to identify the callback type to provide one
single callback.

Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: pass struct nfnl_info to batch callbacks

2021-04-26T16:16:56+00:00

Update batch callbacks to use the nfnl_info structure. Rename one
clashing info variable to expr_info.

Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: pass struct nfnl_info to rcu callbacks

2021-04-26T16:16:52+00:00

Update rcu callbacks to use the nfnl_info structure.

Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: add struct nfnl_info and pass it to callbacks

2021-04-26T01:58:17+00:00

Add a new structure to reduce callback footprint and to facilite
extensions of the nfnetlink callback interface in the future.

Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: add and use nfnetlink_broadcast

2021-04-05T22:34:51+00:00

This removes the only reference of net->nfnl outside of the nfnetlink
module.  This allows to move net->nfnl to net_generic infra.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: add helper function to set up the nfnetlink header and use it

2021-03-31T20:34:11+00:00

This patch adds a helper function to set up the netlink and nfnetlink headers.
Update existing codebase to use it.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: missing validation from the abort path

2020-10-30T11:57:39+00:00

If userspace does not include the trailing end of batch message, then
nfnetlink aborts the transaction. This allows to check that ruleset
updates trigger no errors.

After this patch, invoking this command from the prerouting chain:

 # nft -c add rule x y fib saddr . oif type local

fails since oif is not supported there.

This patch fixes the lack of rule validation from the abort/check path
to catch configuration errors such as the one above.

Fixes: a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation")
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS

2020-08-28T18:11:58+00:00

Frontend callback reports EAGAIN to nfnetlink to retry a command, this
is used to signal that module autoloading is required. Unfortunately,
nlmsg_unicast() reports EAGAIN in case the receiver socket buffer gets
full, so it enters a busy-loop.

This patch updates nfnetlink_unicast() to turn EAGAIN into ENOBUFS and
to use nlmsg_unicast(). Remove the flags field in nfnetlink_unicast()
since this is always MSG_DONTWAIT in the existing code which is exactly
what nlmsg_unicast() passes to netlink_unicast() as parameter.

Fixes: 96518518cc41 ("netfilter: add nftables")
Reported-by: Phil Sutter 
Signed-off-by: Pablo Neira Ayuso