Commit dade7f9d authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net (v2)

The following patchset contains Netfilter fixes for net:

1) Move back the defrag users fields to the global netns_nf area.
   Kernel fails to boot if conntrack is builtin and kernel is booted
   with: nf_conntrack.enable_hooks=1. From Florian Westphal.

2) Rule event notification is missing relevant context such as
   the position handle and the NLM_F_APPEND flag.

3) Rule replacement is expanded to add + delete using the existing
   rule handle, reverse order of this operation so it makes sense
   from rule notification standpoint.

4) Propagate to userspace the NLM_F_CREATE and NLM_F_EXCL flags
   from the rule notification path.

Patches #2, #3 and #4 are used by 'nft monitor' and 'iptables-monitor'
userspace utilities which are not correctly representing the following
operations through netlink notifications:

- rule insertions
- rule addition/insertion from position handle
- create table/chain/set/map/flowtable/...
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 5cfe5109 6fb721cf

include/net/netfilter/ipv6/nf_defrag_ipv6.h

+0 −1
Original line number Diff line number Diff line
@@ -17,7 +17,6 @@ struct inet_frags_ctl; 
struct nft_ct_frag6_pernet {

	struct ctl_table_header *nf_frag_frags_hdr;

	struct fqdir	*fqdir;

	unsigned int users;

};



#endif /* _NF_DEFRAG_IPV6_H */

include/net/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -1202,7 +1202,7 @@ struct nft_object *nft_obj_lookup(const struct net *net, 


void nft_obj_notify(struct net *net, const struct nft_table *table,

		    struct nft_object *obj, u32 portid, u32 seq,

		    int event, int family, int report, gfp_t gfp);

		    int event, u16 flags, int family, int report, gfp_t gfp);



/**

 *	struct nft_object_type - stateful object type

include/net/netns/netfilter.h

+6 −0
Original line number Diff line number Diff line
@@ -27,5 +27,11 @@ struct netns_nf { 
#if IS_ENABLED(CONFIG_DECNET)

	struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS];

#endif

#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)

	unsigned int defrag_ipv4_users;

#endif

#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)

	unsigned int defrag_ipv6_users;

#endif

};

#endif

net/ipv4/netfilter/nf_defrag_ipv4.c

+9 −21
Original line number Diff line number Diff line
@@ -20,13 +20,8 @@ 
#endif

#include <net/netfilter/nf_conntrack_zones.h>



static unsigned int defrag4_pernet_id __read_mostly;

static DEFINE_MUTEX(defrag4_mutex);



struct defrag4_pernet {

	unsigned int users;

};



static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb,

				   u_int32_t user)

{
@@ -111,19 +106,15 @@ static const struct nf_hook_ops ipv4_defrag_ops[] = { 


static void __net_exit defrag4_net_exit(struct net *net)

{

	struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id);



	if (nf_defrag->users) {

	if (net->nf.defrag_ipv4_users) {

		nf_unregister_net_hooks(net, ipv4_defrag_ops,

					ARRAY_SIZE(ipv4_defrag_ops));

		nf_defrag->users = 0;

		net->nf.defrag_ipv4_users = 0;

	}

}



static struct pernet_operations defrag4_net_ops = {

	.exit = defrag4_net_exit,

	.id   = &defrag4_pernet_id,

	.size = sizeof(struct defrag4_pernet),

};



static int __init nf_defrag_init(void)
@@ -138,24 +129,23 @@ static void __exit nf_defrag_fini(void) 


int nf_defrag_ipv4_enable(struct net *net)

{

	struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id);

	int err = 0;



	mutex_lock(&defrag4_mutex);

	if (nf_defrag->users == UINT_MAX) {

	if (net->nf.defrag_ipv4_users == UINT_MAX) {

		err = -EOVERFLOW;

		goto out_unlock;

	}



	if (nf_defrag->users) {

		nf_defrag->users++;

	if (net->nf.defrag_ipv4_users) {

		net->nf.defrag_ipv4_users++;

		goto out_unlock;

	}



	err = nf_register_net_hooks(net, ipv4_defrag_ops,

				    ARRAY_SIZE(ipv4_defrag_ops));

	if (err == 0)

		nf_defrag->users = 1;

		net->nf.defrag_ipv4_users = 1;



 out_unlock:

	mutex_unlock(&defrag4_mutex);
@@ -165,12 +155,10 @@ EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable); 


void nf_defrag_ipv4_disable(struct net *net)

{

	struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id);



	mutex_lock(&defrag4_mutex);

	if (nf_defrag->users) {

		nf_defrag->users--;

		if (nf_defrag->users == 0)

	if (net->nf.defrag_ipv4_users) {

		net->nf.defrag_ipv4_users--;

		if (net->nf.defrag_ipv4_users == 0)

			nf_unregister_net_hooks(net, ipv4_defrag_ops,

						ARRAY_SIZE(ipv4_defrag_ops));

	}

net/ipv6/netfilter/nf_conntrack_reasm.c

+1 −1
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ 


static const char nf_frags_cache_name[] = "nf-frags";



unsigned int nf_frag_pernet_id __read_mostly;

static unsigned int nf_frag_pernet_id __read_mostly;

static struct inet_frags nf_frags;



static struct nft_ct_frag6_pernet *nf_frag_pernet(struct net *net)