* [PATCH nf] netfilter: nf_tables: skip netdev hook unregistration if table is dormant
@ 2024-03-07 2:24 Pablo Neira Ayuso
2024-03-07 3:24 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-07 2:24 UTC (permalink / raw)
To: netfilter-devel
Skip hook unregistration when adding or deleting devices from an
existing netdev basechain. Otherwise, commit/abort path try to
unregister hooks which not enabled.
Fixes: 7d937b107108 ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 1683dc196b59..59d1b3dbd6a7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10174,9 +10174,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
if (nft_trans_chain_update(trans)) {
nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
&nft_trans_chain_hooks(trans));
- nft_netdev_unregister_hooks(net,
- &nft_trans_chain_hooks(trans),
- true);
+ if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
+ nft_netdev_unregister_hooks(net,
+ &nft_trans_chain_hooks(trans),
+ true);
+ }
} else {
nft_chain_del(trans->ctx.chain);
nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
@@ -10448,9 +10450,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
break;
case NFT_MSG_NEWCHAIN:
if (nft_trans_chain_update(trans)) {
- nft_netdev_unregister_hooks(net,
- &nft_trans_chain_hooks(trans),
- true);
+ if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
+ nft_netdev_unregister_hooks(net,
+ &nft_trans_chain_hooks(trans),
+ true);
+ }
free_percpu(nft_trans_chain_stats(trans));
kfree(nft_trans_chain_name(trans));
nft_trans_destroy(trans);
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nf] netfilter: nf_tables: skip netdev hook unregistration if table is dormant
2024-03-07 2:24 [PATCH nf] netfilter: nf_tables: skip netdev hook unregistration if table is dormant Pablo Neira Ayuso
@ 2024-03-07 3:24 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-07 3:24 UTC (permalink / raw)
To: netfilter-devel
On Thu, Mar 07, 2024 at 03:24:07AM +0100, Pablo Neira Ayuso wrote:
> Skip hook unregistration when adding or deleting devices from an
> existing netdev basechain. Otherwise, commit/abort path try to
> unregister hooks which not enabled.
This patch needs a v2. Interaction with dormant flag and netdev hooks
need a closer look.
> Fixes: 7d937b107108 ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
> Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> net/netfilter/nf_tables_api.c | 16 ++++++++++------
> 1 file changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 1683dc196b59..59d1b3dbd6a7 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -10174,9 +10174,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
> if (nft_trans_chain_update(trans)) {
> nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
> &nft_trans_chain_hooks(trans));
> - nft_netdev_unregister_hooks(net,
> - &nft_trans_chain_hooks(trans),
> - true);
> + if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
> + nft_netdev_unregister_hooks(net,
> + &nft_trans_chain_hooks(trans),
> + true);
> + }
> } else {
> nft_chain_del(trans->ctx.chain);
> nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
> @@ -10448,9 +10450,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
> break;
> case NFT_MSG_NEWCHAIN:
> if (nft_trans_chain_update(trans)) {
> - nft_netdev_unregister_hooks(net,
> - &nft_trans_chain_hooks(trans),
> - true);
> + if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
> + nft_netdev_unregister_hooks(net,
> + &nft_trans_chain_hooks(trans),
> + true);
> + }
> free_percpu(nft_trans_chain_stats(trans));
> kfree(nft_trans_chain_name(trans));
> nft_trans_destroy(trans);
> --
> 2.30.2
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-03-07 3:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-07 2:24 [PATCH nf] netfilter: nf_tables: skip netdev hook unregistration if table is dormant Pablo Neira Ayuso
2024-03-07 3:24 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).