[PATCH nftables 1/2] netfilter: nf_tables: don't delete table if in use

[PATCH nftables 1/2] netfilter: nf_tables: don't delete table if in use

[Pablo Neira Ayuso]

Return EBUSY if you try to delete a table that is in use.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/net/netfilter/nf_tables.h |    4 +++-
 net/netfilter/nf_tables_api.c     |    8 ++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 805490d..215edf5 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -440,8 +440,9 @@ extern unsigned int nft_do_chain_pktinfo(struct nft_pktinfo *pkt,
  *	@list: used internally
  *	@chains: chains in the table
  *	@sets: sets in the table
- *	@flags: table flag (see enum nft_table_flags)
  *	@hgenerator: handle generator state
+ *	@use: number of chain references to this table
+ *	@flags: table flag (see enum nft_table_flags)
  *	@name: name of the table
  */
 struct nft_table {
@@ -449,6 +450,7 @@ struct nft_table {
 	struct list_head		chains;
 	struct list_head		sets;
 	u64				hgenerator;
+	u32				use;
 	u16				flags;
 	char				name[];
 };
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2b7bf88..c93ce18 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -448,6 +448,9 @@ static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
 	if (IS_ERR(table))
 		return PTR_ERR(table);
 
+	if (table->use)
+		return -EBUSY;
+
 	list_del(&table->list);
 	nf_tables_table_notify(skb, nlh, table, NFT_MSG_DELTABLE, family);
 	kfree(table);
@@ -832,6 +835,9 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 	if (IS_ERR(table))
 		return PTR_ERR(table);
 
+	if (table->use == UINT_MAX)
+		return -EOVERFLOW;
+
 	chain = NULL;
 	name = nla[NFTA_CHAIN_NAME];
 
@@ -986,6 +992,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 		}
 	}
 	list_add_tail(&chain->list, &table->chains);
+	table->use++;
 notify:
 	nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_NEWCHAIN,
 			       family);
@@ -1031,6 +1038,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
 		return -EBUSY;
 
 	list_del(&chain->list);
+	table->use--;
 
 	if (!(table->flags & NFT_TABLE_F_DORMANT) &&
 	    chain->flags & NFT_BASE_CHAIN)
-- 
1.7.10.4

[PATCH nftables 2/2] netfilter: nft_log: group and qthreshold are 2^16

[Pablo Neira Ayuso]

As defined by struct nf_loginfo.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_log.c |   19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 35a4182..65cc62f 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -39,8 +39,8 @@ static void nft_log_eval(const struct nft_expr *expr,
 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
 	[NFTA_LOG_GROUP]	= { .type = NLA_U32 },
 	[NFTA_LOG_PREFIX]	= { .type = NLA_STRING },
-	[NFTA_LOG_SNAPLEN]	= { .type = NLA_U32 },
-	[NFTA_LOG_QTHRESHOLD]	= { .type = NLA_U32 },
+	[NFTA_LOG_SNAPLEN]	= { .type = NLA_U16 },
+	[NFTA_LOG_QTHRESHOLD]	= { .type = NLA_U16 },
 };
 
 static int nft_log_init(const struct nft_ctx *ctx,
@@ -64,11 +64,14 @@ static int nft_log_init(const struct nft_ctx *ctx,
 
 	li->type = NF_LOG_TYPE_ULOG;
 	if (tb[NFTA_LOG_GROUP] != NULL)
-		li->u.ulog.group = ntohl(nla_get_be32(tb[NFTA_LOG_GROUP]));
+		li->u.ulog.group = ntohs(nla_get_be16(tb[NFTA_LOG_GROUP]));
+
 	if (tb[NFTA_LOG_SNAPLEN] != NULL)
 		li->u.ulog.copy_len = ntohl(nla_get_be32(tb[NFTA_LOG_SNAPLEN]));
-	if (tb[NFTA_LOG_QTHRESHOLD] != NULL)
-		li->u.ulog.qthreshold = ntohl(nla_get_be32(tb[NFTA_LOG_QTHRESHOLD]));
+	if (tb[NFTA_LOG_QTHRESHOLD] != NULL) {
+		li->u.ulog.qthreshold =
+			ntohs(nla_get_be16(tb[NFTA_LOG_QTHRESHOLD]));
+	}
 
 	return 0;
 }
@@ -90,15 +93,15 @@ static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)
 		if (nla_put_string(skb, NFTA_LOG_PREFIX, priv->prefix))
 			goto nla_put_failure;
 	if (li->u.ulog.group)
-		if (nla_put_be32(skb, NFTA_LOG_GROUP, htonl(li->u.ulog.group)))
+		if (nla_put_be16(skb, NFTA_LOG_GROUP, htons(li->u.ulog.group)))
 			goto nla_put_failure;
 	if (li->u.ulog.copy_len)
 		if (nla_put_be32(skb, NFTA_LOG_SNAPLEN,
 				 htonl(li->u.ulog.copy_len)))
 			goto nla_put_failure;
 	if (li->u.ulog.qthreshold)
-		if (nla_put_be32(skb, NFTA_LOG_QTHRESHOLD,
-				 htonl(li->u.ulog.qthreshold)))
+		if (nla_put_be16(skb, NFTA_LOG_QTHRESHOLD,
+				 htons(li->u.ulog.qthreshold)))
 			goto nla_put_failure;
 	return 0;
 
-- 
1.7.10.4