* [PATCH 0/3] netfilter: nf_tables: minor fixes
@ 2012-12-27 6:43 kaber
2012-12-27 6:43 ` =?a?q?=5BPATCH=201/3=5D=20netfilter=3A=20nf=5Ftables=3A=20fix=20NLM=5FF=5FMULTI=20usage=20in=20netlink=20notifications?= kaber
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: kaber @ 2012-12-27 6:43 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
Hi Pablo,
the following patches fix two minor netlink issues and add a missing check
for duplicate names on chain renames.
Please apply, thanks!
^ permalink raw reply [flat|nested] 5+ messages in thread* =?a?q?=5BPATCH=201/3=5D=20netfilter=3A=20nf=5Ftables=3A=20fix=20NLM=5FF=5FMULTI=20usage=20in=20netlink=20notifications?= 2012-12-27 6:43 [PATCH 0/3] netfilter: nf_tables: minor fixes kaber @ 2012-12-27 6:43 ` kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=202/3=5D=20netfilter=3A=20nf=5Ftables=3A=20include=20NLM=5FF=5FAPPEND=20in=20rule=20dumps?= kaber ` (2 subsequent siblings) 3 siblings, 0 replies; 5+ messages in thread From: kaber @ 2012-12-27 6:43 UTC (permalink / raw) To: pablo; +Cc: netfilter-devel, Patrick McHardy [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain; charset=a, Size: 5099 bytes --] From: Patrick McHardy <kaber@trash.net> All requests contain a portid, but only dumps use multipart messages. Have the caller pass the requested flags to nf_tables_fill_*_info() instead of trying to deduce them based on the portid presence. Signed-off-by: Patrick McHardy <kaber@trash.net> --- net/netfilter/nf_tables_api.c | 28 +++++++++++++--------------- 1 Datei geändert, 13 Zeilen hinzugefügt(+), 15 Zeilen entfernt(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c4e4baa..27f7155 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -162,17 +162,16 @@ static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { }; static int nf_tables_fill_table_info(struct sk_buff *skb, u32 portid, u32 seq, - int event, int family, + int event, u32 flags, int family, const struct nft_table *table) { struct nlmsghdr *nlh; struct nfgenmsg *nfmsg; event |= NFNL_SUBSYS_NFTABLES << 8; - nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0); + nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); if (nlh == NULL) goto nla_put_failure; - nlh->nlmsg_flags = portid ? NLM_F_MULTI : 0; nfmsg = nlmsg_data(nlh); nfmsg->nfgen_family = family; @@ -211,7 +210,8 @@ static int nf_tables_table_notify(const struct sk_buff *oskb, if (skb == NULL) goto err; - err = nf_tables_fill_table_info(skb, portid, seq, event, family, table); + err = nf_tables_fill_table_info(skb, portid, seq, event, 0, family, + table); if (err < 0) { kfree_skb(skb); goto err; @@ -247,7 +247,7 @@ static int nf_tables_dump_tables(struct sk_buff *skb, if (nf_tables_fill_table_info(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, - NFT_MSG_NEWTABLE, + NFT_MSG_NEWTABLE, NLM_F_MULTI, afi->family, table) < 0) goto done; cont: @@ -290,7 +290,7 @@ static int nf_tables_gettable(struct sock *nlsk, struct sk_buff *skb, return -ENOMEM; err = nf_tables_fill_table_info(skb2, NETLINK_CB(skb).portid, - nlh->nlmsg_seq, NFT_MSG_NEWTABLE, + nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0, family, table); if (err < 0) goto err; @@ -524,7 +524,7 @@ static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { }; static int nf_tables_fill_chain_info(struct sk_buff *skb, u32 portid, u32 seq, - int event, int family, + int event, u32 flags, int family, const struct nft_table *table, const struct nft_chain *chain) { @@ -532,10 +532,9 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, u32 portid, u32 seq, struct nfgenmsg *nfmsg; event |= NFNL_SUBSYS_NFTABLES << 8; - nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0); + nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); if (nlh == NULL) goto nla_put_failure; - nlh->nlmsg_flags = portid ? NLM_F_MULTI : 0; nfmsg = nlmsg_data(nlh); nfmsg->nfgen_family = family; @@ -604,8 +603,8 @@ static int nf_tables_chain_notify(const struct sk_buff *oskb, if (skb == NULL) goto err; - err = nf_tables_fill_chain_info(skb, portid, seq, event, family, table, - chain); + err = nf_tables_fill_chain_info(skb, portid, seq, event, 0, family, + table, chain); if (err < 0) { kfree_skb(skb); goto err; @@ -642,7 +641,7 @@ static int nf_tables_dump_chains(struct sk_buff *skb, sizeof(cb->args) - sizeof(cb->args[0])); if (nf_tables_fill_chain_info(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, - NFT_MSG_NEWCHAIN, + NFT_MSG_NEWCHAIN, NLM_F_MULTI, afi->family, table, chain) < 0) goto done; cont: @@ -692,7 +691,7 @@ static int nf_tables_getchain(struct sock *nlsk, struct sk_buff *skb, return -ENOMEM; err = nf_tables_fill_chain_info(skb2, NETLINK_CB(skb).portid, - nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, + nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0, family, table, chain); if (err < 0) goto err; @@ -1141,7 +1140,6 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, u32 portid, u32 seq, flags); if (nlh == NULL) goto nla_put_failure; - nlh->nlmsg_flags = portid ? NLM_F_MULTI : 0; nfmsg = nlmsg_data(nlh); nfmsg->nfgen_family = family; @@ -1238,7 +1236,7 @@ static int nf_tables_dump_rules(struct sk_buff *skb, sizeof(cb->args) - sizeof(cb->args[0])); if (nf_tables_fill_rule_info(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, - NFT_MSG_NEWRULE, 0, + NFT_MSG_NEWRULE, NLM_F_MULTI, afi->family, table, chain, rule) < 0) goto done; cont: -- 1.7.11.7 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 5+ messages in thread
* =?a?q?=5BPATCH=202/3=5D=20netfilter=3A=20nf=5Ftables=3A=20include=20NLM=5FF=5FAPPEND=20in=20rule=20dumps?= 2012-12-27 6:43 [PATCH 0/3] netfilter: nf_tables: minor fixes kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=201/3=5D=20netfilter=3A=20nf=5Ftables=3A=20fix=20NLM=5FF=5FMULTI=20usage=20in=20netlink=20notifications?= kaber @ 2012-12-27 6:43 ` kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=203/3=5D=20netfilter=3A=20nf=5Ftables=3A=20check=20for=20duplicate=20names=20on=20chain=20rename?= kaber 2012-12-30 2:21 ` [PATCH 0/3] netfilter: nf_tables: minor fixes Pablo Neira Ayuso 3 siblings, 0 replies; 5+ messages in thread From: kaber @ 2012-12-27 6:43 UTC (permalink / raw) To: pablo; +Cc: netfilter-devel, Patrick McHardy [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain; charset=a, Size: 1124 bytes --] From: Patrick McHardy <kaber@trash.net> Since the rule database is ordered, include NLM_F_APPEND in rule dumps. Signed-off-by: Patrick McHardy <kaber@trash.net> --- net/netfilter/nf_tables_api.c | 3 ++- 1 Datei geändert, 2 Zeilen hinzugefügt(+), 1 Zeile entfernt(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 27f7155..801ead5 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1236,7 +1236,8 @@ static int nf_tables_dump_rules(struct sk_buff *skb, sizeof(cb->args) - sizeof(cb->args[0])); if (nf_tables_fill_rule_info(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, - NFT_MSG_NEWRULE, NLM_F_MULTI, + NFT_MSG_NEWRULE, + NLM_F_MULTI | NLM_F_APPEND, afi->family, table, chain, rule) < 0) goto done; cont: -- 1.7.11.7 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 5+ messages in thread
* =?a?q?=5BPATCH=203/3=5D=20netfilter=3A=20nf=5Ftables=3A=20check=20for=20duplicate=20names=20on=20chain=20rename?= 2012-12-27 6:43 [PATCH 0/3] netfilter: nf_tables: minor fixes kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=201/3=5D=20netfilter=3A=20nf=5Ftables=3A=20fix=20NLM=5FF=5FMULTI=20usage=20in=20netlink=20notifications?= kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=202/3=5D=20netfilter=3A=20nf=5Ftables=3A=20include=20NLM=5FF=5FAPPEND=20in=20rule=20dumps?= kaber @ 2012-12-27 6:43 ` kaber 2012-12-30 2:21 ` [PATCH 0/3] netfilter: nf_tables: minor fixes Pablo Neira Ayuso 3 siblings, 0 replies; 5+ messages in thread From: kaber @ 2012-12-27 6:43 UTC (permalink / raw) To: pablo; +Cc: netfilter-devel, Patrick McHardy [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain; charset=a, Size: 1941 bytes --] From: Patrick McHardy <kaber@trash.net> Signed-off-by: Patrick McHardy <kaber@trash.net> --- net/netfilter/nf_tables_api.c | 12 ++++++++---- 1 Datei geändert, 8 Zeilen hinzugefügt(+), 4 Zeilen entfernt(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 801ead5..ccb7d07 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -746,13 +746,14 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, return PTR_ERR(table); chain = NULL; + name = nla[NFTA_CHAIN_NAME]; + if (nla[NFTA_CHAIN_HANDLE]) { handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); chain = nf_tables_chain_lookup_byhandle(table, handle); if (IS_ERR(chain)) return PTR_ERR(chain); } else { - name = nla[NFTA_CHAIN_NAME]; chain = nf_tables_chain_lookup(table, name); if (IS_ERR(chain)) { if (PTR_ERR(chain) != -ENOENT) @@ -767,6 +768,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, if (nlh->nlmsg_flags & NLM_F_REPLACE) return -EOPNOTSUPP; + if (nla[NFTA_CHAIN_HANDLE] && name && + !IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]))) + return -EEXIST; + if (nla[NFTA_CHAIN_POLICY]) { if (!(chain->flags & NFT_BASE_CHAIN)) return -EOPNOTSUPP; @@ -777,9 +782,8 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, return err; } - if (nla[NFTA_CHAIN_HANDLE] && nla[NFTA_CHAIN_NAME]) - nla_strlcpy(chain->name, nla[NFTA_CHAIN_NAME], - NFT_CHAIN_MAXNAMELEN); + if (nla[NFTA_CHAIN_HANDLE] && name) + nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN); goto notify; } -- 1.7.11.7 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 0/3] netfilter: nf_tables: minor fixes 2012-12-27 6:43 [PATCH 0/3] netfilter: nf_tables: minor fixes kaber ` (2 preceding siblings ...) 2012-12-27 6:43 ` =?a?q?=5BPATCH=203/3=5D=20netfilter=3A=20nf=5Ftables=3A=20check=20for=20duplicate=20names=20on=20chain=20rename?= kaber @ 2012-12-30 2:21 ` Pablo Neira Ayuso 3 siblings, 0 replies; 5+ messages in thread From: Pablo Neira Ayuso @ 2012-12-30 2:21 UTC (permalink / raw) To: kaber; +Cc: netfilter-devel On Thu, Dec 27, 2012 at 07:43:25AM +0100, kaber@trash.net wrote: > Hi Pablo, > > the following patches fix two minor netlink issues and add a missing check > for duplicate names on chain renames. > > Please apply, thanks! All applied, thanks Patrick! ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-12-30 2:21 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-12-27 6:43 [PATCH 0/3] netfilter: nf_tables: minor fixes kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=201/3=5D=20netfilter=3A=20nf=5Ftables=3A=20fix=20NLM=5FF=5FMULTI=20usage=20in=20netlink=20notifications?= kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=202/3=5D=20netfilter=3A=20nf=5Ftables=3A=20include=20NLM=5FF=5FAPPEND=20in=20rule=20dumps?= kaber 2012-12-27 6:43 ` =?a?q?=5BPATCH=203/3=5D=20netfilter=3A=20nf=5Ftables=3A=20check=20for=20duplicate=20names=20on=20chain=20rename?= kaber 2012-12-30 2:21 ` [PATCH 0/3] netfilter: nf_tables: minor fixes Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).