Commit 0854db2a authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: use net_generic infra for transaction data 



This moves all nf_tables pernet data from struct net to a net_generic
extension, with the exception of the gencursor.

The latter is used in the data path and also outside of the nf_tables
core. All others are only used from the configuration plane.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5b53951c

include/net/netfilter/nf_tables.h

+11 −0
Original line number Diff line number Diff line
@@ -1567,4 +1567,15 @@ __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, ...); 
#else

static inline int nft_request_module(struct net *net, const char *fmt, ...) { return -ENOENT; }

#endif



struct nftables_pernet {

	struct list_head	tables;

	struct list_head	commit_list;

	struct list_head	module_list;

	struct list_head	notify_list;

	struct mutex		commit_mutex;

	unsigned int		base_seq;

	u8			validate_state;

};



#endif /* _NET_NF_TABLES_H */

net/netfilter/nf_tables_api.c

+200 −113

File changed.

Preview size limit exceeded, changes collapsed.

net/netfilter/nf_tables_offload.c

+19 −11
Original line number Diff line number Diff line
@@ -7,6 +7,8 @@ 
#include <net/netfilter/nf_tables_offload.h>

#include <net/pkt_cls.h>



extern unsigned int nf_tables_net_id;



static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions)

{

	struct nft_flow_rule *flow;
@@ -307,16 +309,18 @@ static void nft_indr_block_cleanup(struct flow_block_cb *block_cb) 
	struct nft_base_chain *basechain = block_cb->indr.data;

	struct net_device *dev = block_cb->indr.dev;

	struct netlink_ext_ack extack = {};

	struct nftables_pernet *nft_net;

	struct net *net = dev_net(dev);

	struct flow_block_offload bo;



	nft_flow_block_offload_init(&bo, dev_net(dev), FLOW_BLOCK_UNBIND,

				    basechain, &extack);

	mutex_lock(&net->nft.commit_mutex);

	nft_net = net_generic(net, nf_tables_net_id);

	mutex_lock(&nft_net->commit_mutex);

	list_del(&block_cb->driver_list);

	list_move(&block_cb->list, &bo.cb_list);

	nft_flow_offload_unbind(&bo, basechain);

	mutex_unlock(&net->nft.commit_mutex);

	mutex_unlock(&nft_net->commit_mutex);

}



static int nft_indr_block_offload_cmd(struct nft_base_chain *basechain,
@@ -412,9 +416,10 @@ static int nft_flow_offload_chain(struct nft_chain *chain, u8 *ppolicy, 
static void nft_flow_rule_offload_abort(struct net *net,

					struct nft_trans *trans)

{

	struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);

	int err = 0;



	list_for_each_entry_continue_reverse(trans, &net->nft.commit_list, list) {

	list_for_each_entry_continue_reverse(trans, &nft_net->commit_list, list) {

		if (trans->ctx.family != NFPROTO_NETDEV)

			continue;
@@ -460,11 +465,12 @@ static void nft_flow_rule_offload_abort(struct net *net, 


int nft_flow_rule_offload_commit(struct net *net)

{

	struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);

	struct nft_trans *trans;

	int err = 0;

	u8 policy;



	list_for_each_entry(trans, &net->nft.commit_list, list) {

	list_for_each_entry(trans, &nft_net->commit_list, list) {

		if (trans->ctx.family != NFPROTO_NETDEV)

			continue;
@@ -516,7 +522,7 @@ int nft_flow_rule_offload_commit(struct net *net) 
		}

	}



	list_for_each_entry(trans, &net->nft.commit_list, list) {

	list_for_each_entry(trans, &nft_net->commit_list, list) {

		if (trans->ctx.family != NFPROTO_NETDEV)

			continue;
@@ -536,15 +542,15 @@ int nft_flow_rule_offload_commit(struct net *net) 
	return err;

}



static struct nft_chain *__nft_offload_get_chain(struct net_device *dev)

static struct nft_chain *__nft_offload_get_chain(const struct nftables_pernet *nft_net,

						 struct net_device *dev)

{

	struct nft_base_chain *basechain;

	struct net *net = dev_net(dev);

	struct nft_hook *hook, *found;

	const struct nft_table *table;

	struct nft_chain *chain;



	list_for_each_entry(table, &net->nft.tables, list) {

	list_for_each_entry(table, &nft_net->tables, list) {

		if (table->family != NFPROTO_NETDEV)

			continue;
@@ -576,19 +582,21 @@ static int nft_offload_netdev_event(struct notifier_block *this, 
				    unsigned long event, void *ptr)

{

	struct net_device *dev = netdev_notifier_info_to_dev(ptr);

	struct nftables_pernet *nft_net;

	struct net *net = dev_net(dev);

	struct nft_chain *chain;



	if (event != NETDEV_UNREGISTER)

		return NOTIFY_DONE;



	mutex_lock(&net->nft.commit_mutex);

	chain = __nft_offload_get_chain(dev);

	nft_net = net_generic(net, nf_tables_net_id);

	mutex_lock(&nft_net->commit_mutex);

	chain = __nft_offload_get_chain(nft_net, dev);

	if (chain)

		nft_flow_block_chain(nft_base_chain(chain), dev,

				     FLOW_BLOCK_UNBIND);



	mutex_unlock(&net->nft.commit_mutex);

	mutex_unlock(&nft_net->commit_mutex);



	return NOTIFY_DONE;

}

net/netfilter/nft_chain_filter.c

+8 −3
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
#include <linux/kernel.h>

#include <linux/netdevice.h>

#include <net/net_namespace.h>

#include <net/netns/generic.h>

#include <net/netfilter/nf_tables.h>

#include <linux/netfilter_ipv4.h>

#include <linux/netfilter_ipv6.h>
@@ -10,6 +11,8 @@ 
#include <net/netfilter/nf_tables_ipv4.h>

#include <net/netfilter/nf_tables_ipv6.h>



extern unsigned int nf_tables_net_id;



#ifdef CONFIG_NF_TABLES_IPV4

static unsigned int nft_do_chain_ipv4(void *priv,

				      struct sk_buff *skb,
@@ -355,6 +358,7 @@ static int nf_tables_netdev_event(struct notifier_block *this, 
				  unsigned long event, void *ptr)

{

	struct net_device *dev = netdev_notifier_info_to_dev(ptr);

	struct nftables_pernet *nft_net;

	struct nft_table *table;

	struct nft_chain *chain, *nr;

	struct nft_ctx ctx = {
@@ -365,8 +369,9 @@ static int nf_tables_netdev_event(struct notifier_block *this, 
	    event != NETDEV_CHANGENAME)

		return NOTIFY_DONE;



	mutex_lock(&ctx.net->nft.commit_mutex);

	list_for_each_entry(table, &ctx.net->nft.tables, list) {

	nft_net = net_generic(ctx.net, nf_tables_net_id);

	mutex_lock(&nft_net->commit_mutex);

	list_for_each_entry(table, &nft_net->tables, list) {

		if (table->family != NFPROTO_NETDEV)

			continue;
@@ -380,7 +385,7 @@ static int nf_tables_netdev_event(struct notifier_block *this, 
			nft_netdev_event(event, dev, &ctx);

		}

	}

	mutex_unlock(&ctx.net->nft.commit_mutex);

	mutex_unlock(&nft_net->commit_mutex);



	return NOTIFY_DONE;

}

net/netfilter/nft_dynset.c

+5 −1
Original line number Diff line number Diff line
@@ -11,6 +11,9 @@ 
#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables_core.h>

#include <net/netns/generic.h>



extern unsigned int nf_tables_net_id;



struct nft_dynset {

	struct nft_set			*set;
@@ -161,13 +164,14 @@ static int nft_dynset_init(const struct nft_ctx *ctx, 
			   const struct nft_expr *expr,

			   const struct nlattr * const tb[])

{

	struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);

	struct nft_dynset *priv = nft_expr_priv(expr);

	u8 genmask = nft_genmask_next(ctx->net);

	struct nft_set *set;

	u64 timeout;

	int err, i;



	lockdep_assert_held(&ctx->net->nft.commit_mutex);

	lockdep_assert_held(&nft_net->commit_mutex);



	if (tb[NFTA_DYNSET_SET_NAME] == NULL ||

	    tb[NFTA_DYNSET_OP] == NULL ||