Commit 00c320f9 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: nf_tables: make validation state per table

We only need to validate tables that saw changes in the current
transaction.

The existing code revalidates all tables, but this isn't needed as
cross-table jumps are not allowed (chains have table scope).
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 9a32e985
...@@ -1209,6 +1209,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv); ...@@ -1209,6 +1209,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
* @genmask: generation mask * @genmask: generation mask
* @afinfo: address family info * @afinfo: address family info
* @name: name of the table * @name: name of the table
* @validate_state: internal, set when transaction adds jumps
*/ */
struct nft_table { struct nft_table {
struct list_head list; struct list_head list;
...@@ -1227,6 +1228,7 @@ struct nft_table { ...@@ -1227,6 +1228,7 @@ struct nft_table {
char *name; char *name;
u16 udlen; u16 udlen;
u8 *udata; u8 *udata;
u8 validate_state;
}; };
static inline bool nft_table_has_owner(const struct nft_table *table) static inline bool nft_table_has_owner(const struct nft_table *table)
...@@ -1698,7 +1700,6 @@ struct nftables_pernet { ...@@ -1698,7 +1700,6 @@ struct nftables_pernet {
struct mutex commit_mutex; struct mutex commit_mutex;
u64 table_handle; u64 table_handle;
unsigned int base_seq; unsigned int base_seq;
u8 validate_state;
}; };
extern unsigned int nf_tables_net_id; extern unsigned int nf_tables_net_id;
......
...@@ -102,11 +102,9 @@ static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types ...@@ -102,11 +102,9 @@ static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types
[NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
}; };
static void nft_validate_state_update(struct net *net, u8 new_validate_state) static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state)
{ {
struct nftables_pernet *nft_net = nft_pernet(net); switch (table->validate_state) {
switch (nft_net->validate_state) {
case NFT_VALIDATE_SKIP: case NFT_VALIDATE_SKIP:
WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
break; break;
...@@ -117,7 +115,7 @@ static void nft_validate_state_update(struct net *net, u8 new_validate_state) ...@@ -117,7 +115,7 @@ static void nft_validate_state_update(struct net *net, u8 new_validate_state)
return; return;
} }
nft_net->validate_state = new_validate_state; table->validate_state = new_validate_state;
} }
static void nf_tables_trans_destroy_work(struct work_struct *w); static void nf_tables_trans_destroy_work(struct work_struct *w);
static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work); static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
...@@ -1224,6 +1222,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, ...@@ -1224,6 +1222,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
if (table == NULL) if (table == NULL)
goto err_kzalloc; goto err_kzalloc;
table->validate_state = NFT_VALIDATE_SKIP;
table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT);
if (table->name == NULL) if (table->name == NULL)
goto err_strdup; goto err_strdup;
...@@ -3660,7 +3659,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, ...@@ -3660,7 +3659,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
} }
if (expr_info[i].ops->validate) if (expr_info[i].ops->validate)
nft_validate_state_update(net, NFT_VALIDATE_NEED); nft_validate_state_update(table, NFT_VALIDATE_NEED);
expr_info[i].ops = NULL; expr_info[i].ops = NULL;
expr = nft_expr_next(expr); expr = nft_expr_next(expr);
...@@ -3710,7 +3709,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, ...@@ -3710,7 +3709,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
if (flow) if (flow)
nft_trans_flow_rule(trans) = flow; nft_trans_flow_rule(trans) = flow;
if (nft_net->validate_state == NFT_VALIDATE_DO) if (table->validate_state == NFT_VALIDATE_DO)
return nft_table_validate(net, table); return nft_table_validate(net, table);
return 0; return 0;
...@@ -6312,7 +6311,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, ...@@ -6312,7 +6311,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
if (desc.type == NFT_DATA_VERDICT && if (desc.type == NFT_DATA_VERDICT &&
(elem.data.val.verdict.code == NFT_GOTO || (elem.data.val.verdict.code == NFT_GOTO ||
elem.data.val.verdict.code == NFT_JUMP)) elem.data.val.verdict.code == NFT_JUMP))
nft_validate_state_update(ctx->net, nft_validate_state_update(ctx->table,
NFT_VALIDATE_NEED); NFT_VALIDATE_NEED);
} }
...@@ -6437,7 +6436,6 @@ static int nf_tables_newsetelem(struct sk_buff *skb, ...@@ -6437,7 +6436,6 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
const struct nfnl_info *info, const struct nfnl_info *info,
const struct nlattr * const nla[]) const struct nlattr * const nla[])
{ {
struct nftables_pernet *nft_net = nft_pernet(info->net);
struct netlink_ext_ack *extack = info->extack; struct netlink_ext_ack *extack = info->extack;
u8 genmask = nft_genmask_next(info->net); u8 genmask = nft_genmask_next(info->net);
u8 family = info->nfmsg->nfgen_family; u8 family = info->nfmsg->nfgen_family;
...@@ -6476,7 +6474,7 @@ static int nf_tables_newsetelem(struct sk_buff *skb, ...@@ -6476,7 +6474,7 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
} }
} }
if (nft_net->validate_state == NFT_VALIDATE_DO) if (table->validate_state == NFT_VALIDATE_DO)
return nft_table_validate(net, table); return nft_table_validate(net, table);
return 0; return 0;
...@@ -8628,19 +8626,20 @@ static int nf_tables_validate(struct net *net) ...@@ -8628,19 +8626,20 @@ static int nf_tables_validate(struct net *net)
struct nftables_pernet *nft_net = nft_pernet(net); struct nftables_pernet *nft_net = nft_pernet(net);
struct nft_table *table; struct nft_table *table;
switch (nft_net->validate_state) { list_for_each_entry(table, &nft_net->tables, list) {
switch (table->validate_state) {
case NFT_VALIDATE_SKIP: case NFT_VALIDATE_SKIP:
break; continue;
case NFT_VALIDATE_NEED: case NFT_VALIDATE_NEED:
nft_validate_state_update(net, NFT_VALIDATE_DO); nft_validate_state_update(table, NFT_VALIDATE_DO);
fallthrough; fallthrough;
case NFT_VALIDATE_DO: case NFT_VALIDATE_DO:
list_for_each_entry(table, &nft_net->tables, list) {
if (nft_table_validate(net, table) < 0) if (nft_table_validate(net, table) < 0)
return -EAGAIN; return -EAGAIN;
nft_validate_state_update(table, NFT_VALIDATE_SKIP);
} }
nft_validate_state_update(net, NFT_VALIDATE_SKIP);
break; break;
} }
...@@ -10355,7 +10354,6 @@ static int __net_init nf_tables_init_net(struct net *net) ...@@ -10355,7 +10354,6 @@ static int __net_init nf_tables_init_net(struct net *net)
INIT_LIST_HEAD(&nft_net->notify_list); INIT_LIST_HEAD(&nft_net->notify_list);
mutex_init(&nft_net->commit_mutex); mutex_init(&nft_net->commit_mutex);
nft_net->base_seq = 1; nft_net->base_seq = 1;
nft_net->validate_state = NFT_VALIDATE_SKIP;
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment