Commit 207296f1 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: allow to create netdev chain without device 



Relax netdev chain creation to allow for loading the ruleset, then
adding/deleting devices at a later stage. Hardware offload does not
support for this feature yet.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7d937b10

net/netfilter/nf_tables_api.c

+11 −12
Original line number Diff line number Diff line
@@ -2023,10 +2023,9 @@ struct nft_chain_hook { 
	struct list_head		list;

};



static int nft_chain_parse_netdev(struct net *net,

				  struct nlattr *tb[],

static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[],

				  struct list_head *hook_list,

				  struct netlink_ext_ack *extack)

				  struct netlink_ext_ack *extack, u32 flags)

{

	struct nft_hook *hook;

	int err;
@@ -2045,12 +2044,12 @@ static int nft_chain_parse_netdev(struct net *net, 
		if (err < 0)

			return err;



		if (list_empty(hook_list))

			return -EINVAL;

	} else {

		return -EINVAL;

	}



	if (flags & NFT_CHAIN_HW_OFFLOAD &&

	    list_empty(hook_list))

		return -EINVAL;



	return 0;

}
@@ -2058,7 +2057,7 @@ static int nft_chain_parse_hook(struct net *net, 
				struct nft_base_chain *basechain,

				const struct nlattr * const nla[],

				struct nft_chain_hook *hook, u8 family,

				struct netlink_ext_ack *extack)

				u32 flags, struct netlink_ext_ack *extack)

{

	struct nftables_pernet *nft_net = nft_pernet(net);

	struct nlattr *ha[NFTA_HOOK_MAX + 1];
@@ -2125,7 +2124,7 @@ static int nft_chain_parse_hook(struct net *net, 


	INIT_LIST_HEAD(&hook->list);

	if (nft_base_chain_netdev(family, hook->num)) {

		err = nft_chain_parse_netdev(net, ha, &hook->list, extack);

		err = nft_chain_parse_netdev(net, ha, &hook->list, extack, flags);

		if (err < 0) {

			module_put(type->owner);

			return err;
@@ -2263,7 +2262,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
		if (flags & NFT_CHAIN_BINDING)

			return -EOPNOTSUPP;



		err = nft_chain_parse_hook(net, NULL, nla, &hook, family,

		err = nft_chain_parse_hook(net, NULL, nla, &hook, family, flags,

					   extack);

		if (err < 0)

			return err;
@@ -2407,7 +2406,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 


		basechain = nft_base_chain(chain);

		err = nft_chain_parse_hook(ctx->net, basechain, nla, &hook,

					   ctx->family, extack);

					   ctx->family, flags, extack);

		if (err < 0)

			return err;
@@ -2683,7 +2682,7 @@ static int nft_delchain_hook(struct nft_ctx *ctx, struct nft_chain *chain, 


	basechain = nft_base_chain(chain);

	err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook,

				   ctx->family, extack);

				   ctx->family, chain->flags, extack);

	if (err < 0)

		return err;