* [PATCH nf] netfilter: nf_tables: cancel register tracking if .reduce is not defined
@ 2022-03-10 22:37 Pablo Neira Ayuso
2022-03-10 22:42 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-10 22:37 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
Cancel all register tracking if the the reduce function is not defined.
Add missing reduce function to cmp since this is a read-only operation.
This unbreaks selftests/netfilter/nft_nat_zones.sh.
Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 2 ++
net/netfilter/nft_cmp.c | 8 ++++++++
2 files changed, 10 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c86748b3873b..861a3a36024a 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8311,6 +8311,8 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha
expr->ops->reduce(&track, expr)) {
expr = track.cur;
continue;
+ } else if (expr->ops->reduce == NULL) {
+ memset(track.regs, 0, sizeof(track.regs));
}
if (WARN_ON_ONCE(data + expr->ops->size > data_boundary))
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index 47b6d05f1ae6..23bef7df48f1 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -187,12 +187,19 @@ static int nft_cmp_offload(struct nft_offload_ctx *ctx,
return __nft_cmp_offload(ctx, flow, priv);
}
+static bool nft_cmp_reduce(struct nft_regs_track *track,
+ const struct nft_expr *expr)
+{
+ return false;
+}
+
static const struct nft_expr_ops nft_cmp_ops = {
.type = &nft_cmp_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr)),
.eval = nft_cmp_eval,
.init = nft_cmp_init,
.dump = nft_cmp_dump,
+ .reduce = nft_cmp_reduce,
.offload = nft_cmp_offload,
};
@@ -269,6 +276,7 @@ const struct nft_expr_ops nft_cmp_fast_ops = {
.eval = NULL, /* inlined */
.init = nft_cmp_fast_init,
.dump = nft_cmp_fast_dump,
+ .reduce = nft_cmp_reduce,
.offload = nft_cmp_fast_offload,
};
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter: nf_tables: cancel register tracking if .reduce is not defined
2022-03-10 22:37 [PATCH nf] netfilter: nf_tables: cancel register tracking if .reduce is not defined Pablo Neira Ayuso
@ 2022-03-10 22:42 ` Pablo Neira Ayuso
2022-03-10 22:46 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-10 22:42 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
On Thu, Mar 10, 2022 at 11:37:37PM +0100, Pablo Neira Ayuso wrote:
> Cancel all register tracking if the the reduce function is not defined.
> Add missing reduce function to cmp since this is a read-only operation.
>
> This unbreaks selftests/netfilter/nft_nat_zones.sh.
>
> Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
> Suggested-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
Actually intended to nf-next.
> net/netfilter/nf_tables_api.c | 2 ++
> net/netfilter/nft_cmp.c | 8 ++++++++
> 2 files changed, 10 insertions(+)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index c86748b3873b..861a3a36024a 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -8311,6 +8311,8 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha
> expr->ops->reduce(&track, expr)) {
> expr = track.cur;
> continue;
> + } else if (expr->ops->reduce == NULL) {
> + memset(track.regs, 0, sizeof(track.regs));
> }
>
> if (WARN_ON_ONCE(data + expr->ops->size > data_boundary))
> diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
> index 47b6d05f1ae6..23bef7df48f1 100644
> --- a/net/netfilter/nft_cmp.c
> +++ b/net/netfilter/nft_cmp.c
> @@ -187,12 +187,19 @@ static int nft_cmp_offload(struct nft_offload_ctx *ctx,
> return __nft_cmp_offload(ctx, flow, priv);
> }
>
> +static bool nft_cmp_reduce(struct nft_regs_track *track,
> + const struct nft_expr *expr)
> +{
> + return false;
> +}
> +
> static const struct nft_expr_ops nft_cmp_ops = {
> .type = &nft_cmp_type,
> .size = NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr)),
> .eval = nft_cmp_eval,
> .init = nft_cmp_init,
> .dump = nft_cmp_dump,
> + .reduce = nft_cmp_reduce,
> .offload = nft_cmp_offload,
> };
>
> @@ -269,6 +276,7 @@ const struct nft_expr_ops nft_cmp_fast_ops = {
> .eval = NULL, /* inlined */
> .init = nft_cmp_fast_init,
> .dump = nft_cmp_fast_dump,
> + .reduce = nft_cmp_reduce,
> .offload = nft_cmp_fast_offload,
> };
>
> --
> 2.30.2
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter: nf_tables: cancel register tracking if .reduce is not defined
2022-03-10 22:42 ` Pablo Neira Ayuso
@ 2022-03-10 22:46 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-10 22:46 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
On Thu, Mar 10, 2022 at 11:42:17PM +0100, Pablo Neira Ayuso wrote:
> On Thu, Mar 10, 2022 at 11:37:37PM +0100, Pablo Neira Ayuso wrote:
> > Cancel all register tracking if the the reduce function is not defined.
> > Add missing reduce function to cmp since this is a read-only operation.
> >
> > This unbreaks selftests/netfilter/nft_nat_zones.sh.
> >
> > Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
> > Suggested-by: Florian Westphal <fw@strlen.de>
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
>
> Actually intended to nf-next.
Oh, this is nf material indeed. Sorry for the confusion.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-03-10 22:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-03-10 22:37 [PATCH nf] netfilter: nf_tables: cancel register tracking if .reduce is not defined Pablo Neira Ayuso
2022-03-10 22:42 ` Pablo Neira Ayuso
2022-03-10 22:46 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).