Skip to content

Commit 1127c73

Browse files
author
Paolo Abeni
committed
Merge tag 'nf-24-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix incorrect documentation in uapi/linux/netfilter/nf_tables.h regarding flowtable hooks, from Phil Sutter. 2) Fix nft_audit.sh selftests with newer nft binaries, due to different (valid) audit output, also from Phil. 3) Disable BH when duplicating packets via nf_dup infrastructure, otherwise race on nf_skb_duplicated for locally generated traffic. From Eric. 4) Missing return in callback of selftest C program, from zhang jiao. netfilter pull request 24-10-02 * tag 'nf-24-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: Add missing return value netfilter: nf_tables: prevent nf_skb_duplicated corruption selftests: netfilter: Fix nft_audit.sh for newer nft binaries netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED ==================== Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
2 parents a0ffa68 + 10dbd23 commit 1127c73

File tree

5 files changed

+41
-33
lines changed

5 files changed

+41
-33
lines changed

‎include/uapi/linux/netfilter/nf_tables.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1694,7 +1694,7 @@ enum nft_flowtable_flags {
16941694
*
16951695
* @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
16961696
* @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
1697-
* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
1697+
* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED)
16981698
* @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
16991699
* @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
17001700
* @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)

‎net/ipv4/netfilter/nf_dup_ipv4.c‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,17 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,
5353
{
5454
struct iphdr *iph;
5555

56+
local_bh_disable();
5657
if (this_cpu_read(nf_skb_duplicated))
57-
return;
58+
goto out;
5859
/*
5960
* Copy the skb, and route the copy. Will later return %XT_CONTINUE for
6061
* the original skb, which should continue on its way as if nothing has
6162
* happened. The copy should be independently delivered to the gateway.
6263
*/
6364
skb = pskb_copy(skb, GFP_ATOMIC);
6465
if (skb == NULL)
65-
return;
66+
goto out;
6667

6768
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
6869
/* Avoid counting cloned packets towards the original connection. */
@@ -91,6 +92,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,
9192
} else {
9293
kfree_skb(skb);
9394
}
95+
out:
96+
local_bh_enable();
9497
}
9598
EXPORT_SYMBOL_GPL(nf_dup_ipv4);
9699

‎net/ipv6/netfilter/nf_dup_ipv6.c‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,
4747
void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum,
4848
const struct in6_addr *gw, int oif)
4949
{
50+
local_bh_disable();
5051
if (this_cpu_read(nf_skb_duplicated))
51-
return;
52+
goto out;
5253
skb = pskb_copy(skb, GFP_ATOMIC);
5354
if (skb == NULL)
54-
return;
55+
goto out;
5556

5657
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
5758
nf_reset_ct(skb);
@@ -69,6 +70,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum,
6970
} else {
7071
kfree_skb(skb);
7172
}
73+
out:
74+
local_bh_enable();
7275
}
7376
EXPORT_SYMBOL_GPL(nf_dup_ipv6);
7477

‎tools/testing/selftests/net/netfilter/conntrack_dump_flush.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,7 @@ static int conntrack_data_generate_v6(struct mnl_socket *sock,
207207
static int count_entries(const struct nlmsghdr *nlh, void *data)
208208
{
209209
reply_counter++;
210+
return MNL_CB_OK;
210211
}
211212

212213
static int conntracK_count_zone(struct mnl_socket *sock, uint16_t zone)

‎tools/testing/selftests/net/netfilter/nft_audit.sh‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,31 @@ logread_pid=$!
4848
trap 'kill $logread_pid; rm -f $logfile $rulefile' EXIT
4949
exec 3<"$logfile"
5050

51+
lsplit='s/^\(.*\) entries=\([^ ]*\) \(.*\)$/pfx="\1"\nval="\2"\nsfx="\3"/'
52+
summarize_logs() {
53+
sum=0
54+
while read line; do
55+
eval $(sed "$lsplit" <<< "$line")
56+
[[ $sum -gt 0 ]] && {
57+
[[ "$pfx $sfx" == "$tpfx $tsfx" ]] && {
58+
let "sum += val"
59+
continue
60+
}
61+
echo "$tpfx entries=$sum $tsfx"
62+
}
63+
tpfx="$pfx"
64+
tsfx="$sfx"
65+
sum=$val
66+
done
67+
echo "$tpfx entries=$sum $tsfx"
68+
}
69+
5170
do_test() { # (cmd, log)
5271
echo -n "testing for cmd: $1 ... "
5372
cat <&3 >/dev/null
5473
$1 >/dev/null || exit 1
5574
sleep 0.1
56-
res=$(diff -a -u <(echo "$2") - <&3)
75+
res=$(diff -a -u <(echo "$2") <(summarize_logs <&3))
5776
[ $? -eq 0 ] && { echo "OK"; return; }
5877
echo "FAIL"
5978
grep -v '^\(---\|+++\|@@\)' <<< "$res"
@@ -152,31 +171,17 @@ do_test 'nft reset rules t1 c2' \
152171
'table=t1 family=2 entries=3 op=nft_reset_rule'
153172

154173
do_test 'nft reset rules table t1' \
155-
'table=t1 family=2 entries=3 op=nft_reset_rule
156-
table=t1 family=2 entries=3 op=nft_reset_rule
157-
table=t1 family=2 entries=3 op=nft_reset_rule'
174+
'table=t1 family=2 entries=9 op=nft_reset_rule'
158175

159176
do_test 'nft reset rules t2 c3' \
160-
'table=t2 family=2 entries=189 op=nft_reset_rule
161-
table=t2 family=2 entries=188 op=nft_reset_rule
162-
table=t2 family=2 entries=126 op=nft_reset_rule'
177+
'table=t2 family=2 entries=503 op=nft_reset_rule'
163178

164179
do_test 'nft reset rules t2' \
165-
'table=t2 family=2 entries=3 op=nft_reset_rule
166-
table=t2 family=2 entries=3 op=nft_reset_rule
167-
table=t2 family=2 entries=186 op=nft_reset_rule
168-
table=t2 family=2 entries=188 op=nft_reset_rule
169-
table=t2 family=2 entries=129 op=nft_reset_rule'
180+
'table=t2 family=2 entries=509 op=nft_reset_rule'
170181

171182
do_test 'nft reset rules' \
172-
'table=t1 family=2 entries=3 op=nft_reset_rule
173-
table=t1 family=2 entries=3 op=nft_reset_rule
174-
table=t1 family=2 entries=3 op=nft_reset_rule
175-
table=t2 family=2 entries=3 op=nft_reset_rule
176-
table=t2 family=2 entries=3 op=nft_reset_rule
177-
table=t2 family=2 entries=180 op=nft_reset_rule
178-
table=t2 family=2 entries=188 op=nft_reset_rule
179-
table=t2 family=2 entries=135 op=nft_reset_rule'
183+
'table=t1 family=2 entries=9 op=nft_reset_rule
184+
table=t2 family=2 entries=509 op=nft_reset_rule'
180185

181186
# resetting sets and elements
182187

@@ -200,13 +205,11 @@ do_test 'nft reset counters t1' \
200205
'table=t1 family=2 entries=1 op=nft_reset_obj'
201206

202207
do_test 'nft reset counters t2' \
203-
'table=t2 family=2 entries=342 op=nft_reset_obj
204-
table=t2 family=2 entries=158 op=nft_reset_obj'
208+
'table=t2 family=2 entries=500 op=nft_reset_obj'
205209

206210
do_test 'nft reset counters' \
207211
'table=t1 family=2 entries=1 op=nft_reset_obj
208-
table=t2 family=2 entries=341 op=nft_reset_obj
209-
table=t2 family=2 entries=159 op=nft_reset_obj'
212+
table=t2 family=2 entries=500 op=nft_reset_obj'
210213

211214
# resetting quotas
212215

@@ -217,13 +220,11 @@ do_test 'nft reset quotas t1' \
217220
'table=t1 family=2 entries=1 op=nft_reset_obj'
218221

219222
do_test 'nft reset quotas t2' \
220-
'table=t2 family=2 entries=315 op=nft_reset_obj
221-
table=t2 family=2 entries=185 op=nft_reset_obj'
223+
'table=t2 family=2 entries=500 op=nft_reset_obj'
222224

223225
do_test 'nft reset quotas' \
224226
'table=t1 family=2 entries=1 op=nft_reset_obj
225-
table=t2 family=2 entries=314 op=nft_reset_obj
226-
table=t2 family=2 entries=186 op=nft_reset_obj'
227+
table=t2 family=2 entries=500 op=nft_reset_obj'
227228

228229
# deleting rules
229230

0 commit comments

Comments
 (0)