linux.git/net/netfilter/nft_bitwise.c, branch v5.0

netfilter: nf_tables: revisit chain/object refcounting from elements

2017-05-15T10:51:41+00:00

Andreas reports that the following incremental update using our commit
protocol doesn't work.

 # nft -f incremental-update.nft
 delete element ip filter client_to_any { 10.180.86.22 : goto CIn_1 }
 delete chain ip filter CIn_1
 ... Error: Could not process rule: Device or resource busy

The existing code is not well-integrated into the commit phase protocol,
since element deletions do not result in refcount decrement from the
preparation phase. This results in bogus EBUSY errors like the one
above.

Two new functions come with this patch:

* nft_set_elem_activate() function is used from the abort path, to
  restore the set element refcounting on objects that occurred from
  the preparation phase.

* nft_set_elem_deactivate() that is called from nft_del_setelem() to
  decrement set element refcounting on objects from the preparation
  phase in the commit protocol.

The nft_data_uninit() has been renamed to nft_data_release() since this
function does not uninitialize any data store in the data register,
instead just releases the references to objects. Moreover, a new
function nft_data_hold() has been introduced to be used from
nft_set_elem_activate().

Reported-by: Andreas Schultz 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: missing sanitization in data from userspace

2017-05-15T10:51:40+00:00

Do not assume userspace always sends us NFT_DATA_VALUE for bitwise and
cmp expressions. Although NFT_DATA_VERDICT does not make any sense, it
is still possible to handcraft a netlink message using this incorrect
data type.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: simplify the basic expressions' init routine

2016-11-09T22:42:23+00:00

Some basic expressions are built into nf_tables.ko, such as nft_cmp,
nft_lookup, nft_range and so on. But these basic expressions' init
routine is a little ugly, too many goto errX labels, and we forget
to call nft_range_module_exit in the exit routine, although it is
harmless.

Acctually, the init and exit routines of these basic expressions
are same, i.e. do nft_register_expr in the init routine and do
nft_unregister_expr in the exit routine.

So it's better to arrange them into an array and deal with them
together.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: validate maximum value of u32 netlink attributes

2016-09-23T07:29:02+00:00

Fetch value and validate u32 netlink attribute. This validation is
usually required when the u32 netlink attributes are being stored in a
field whose size is smaller.

This patch revisits 4da449ae1df9 ("netfilter: nft_exthdr: Add size check
on u8 nft_exthdr attributes").

Fixes: 96518518cc41 ("netfilter: add nftables")
Suggested-by: Pablo Neira Ayuso 
Signed-off-by: Laura Garcia Liebana 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: support variable sized data in nft_data_init()

2015-04-13T15:17:30+00:00

Add a size argument to nft_data_init() and pass in the available space.
This will be used by the following patches to support variable sized
set element data.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13T15:17:29+00:00

Switch the nf_tables registers from 128 bit addressing to 32 bit
addressing to support so called concatenations, where multiple values
can be concatenated over multiple registers for O(1) exact matches of
multiple dimensions using sets.

The old register values are mapped to areas of 128 bits for compatibility.
When dumping register numbers, values are expressed using the old values
if they refer to the beginning of a 128 bit area for compatibility.

To support concatenations, register loads of less than a full 32 bit
value need to be padded. This mainly affects the payload and exthdr
expressions, which both unconditionally zero the last word before
copying the data.

Userspace fully passes the testsuite using both old and new register
addressing.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add register parsing/dumping helpers

2015-04-13T15:17:28+00:00

Add helper functions to parse and dump register values in netlink attributes.
These helpers will later be changed to take care of translation between the
old 128 bit and the new 32 bit register numbers.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: convert expressions to u32 register pointers

2015-04-13T15:17:25+00:00

Simple conversion to use u32 pointers to the beginning of the registers
to keep follow up patches smaller.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: get rid of NFT_REG_VERDICT usage

2015-04-13T15:17:07+00:00

Replace the array of registers passed to expressions by a struct nft_regs,
containing the verdict as a seperate member, which aliases to the
NFT_REG_VERDICT register.

This is needed to seperate the verdict from the data registers completely,
so their size can be changed.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: introduce nft_validate_register_load()

2015-04-13T14:25:50+00:00

Change nft_validate_input_register() to not only validate the input
register number, but also the length of the load, and rename it to
nft_validate_register_load() to reflect that change.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso