Skip to content

L
linux
Commit 128ad332 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files
Options

netfilter: nf_tables: remove skb and nlh from context structure 

Instead of caching the original skbuff that contains the netlink
messages, this stores the netlink message sequence number, the
netlink portID and the report flag. This helps to prepare the
introduction of the object release via call_rcu.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 35151d84
Hide whitespace changes
Inline Side-by-side
Showing with 52 additions and 59 deletions
include/net/netfilter/nf_tables.h
View file @ 128ad332
...@@ -72,21 +72,23 @@ static inline void nft_data_debug(const struct nft_data *data) ...@@ -72,21 +72,23 @@ static inline void nft_data_debug(const struct nft_data *data)
* struct nft_ctx - nf_tables rule/set context * struct nft_ctx - nf_tables rule/set context
* *
* @net: net namespace * @net: net namespace
* @skb: netlink skb
* @nlh: netlink message header
* @afi: address family info * @afi: address family info
* @table: the table the chain is contained in * @table: the table the chain is contained in
* @chain: the chain the rule is contained in * @chain: the chain the rule is contained in
* @nla: netlink attributes * @nla: netlink attributes
* @portid: netlink portID of the original message
* @seq: netlink sequence number
* @report: notify via unicast netlink message
*/ */
struct nft_ctx { struct nft_ctx {
struct net *net; struct net *net;
const struct sk_buff *skb;
const struct nlmsghdr *nlh;
struct nft_af_info *afi; struct nft_af_info *afi;
struct nft_table *table; struct nft_table *table;
struct nft_chain *chain; struct nft_chain *chain;
const struct nlattr * const *nla; const struct nlattr * const *nla;
u32 portid;
u32 seq;
bool report;
}; };
struct nft_data_desc { struct nft_data_desc {
......
net/netfilter/nf_tables_api.c
View file @ 128ad332
...@@ -96,13 +96,14 @@ static void nft_ctx_init(struct nft_ctx *ctx, ...@@ -96,13 +96,14 @@ static void nft_ctx_init(struct nft_ctx *ctx,
struct nft_chain *chain, struct nft_chain *chain,
const struct nlattr * const *nla) const struct nlattr * const *nla)
{ {
ctx->net = sock_net(skb->sk); ctx->net = sock_net(skb->sk);
ctx->skb = skb; ctx->afi = afi;
ctx->nlh = nlh; ctx->table = table;
ctx->afi = afi; ctx->chain = chain;
ctx->table = table; ctx->nla = nla;
ctx->chain = chain; ctx->portid = NETLINK_CB(skb).portid;
ctx->nla = nla; ctx->report = nlmsg_report(nlh);
ctx->seq = nlh->nlmsg_seq;
} }
static struct nft_trans *nft_trans_alloc(struct nft_ctx *ctx, int msg_type, static struct nft_trans *nft_trans_alloc(struct nft_ctx *ctx, int msg_type,
...@@ -238,14 +239,10 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, u32 portid, u32 seq, ...@@ -238,14 +239,10 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, u32 portid, u32 seq,
static int nf_tables_table_notify(const struct nft_ctx *ctx, int event) static int nf_tables_table_notify(const struct nft_ctx *ctx, int event)
{ {
struct sk_buff *skb; struct sk_buff *skb;
u32 portid = NETLINK_CB(ctx->skb).portid;
u32 seq = ctx->nlh->nlmsg_seq;
struct net *net = sock_net(ctx->skb->sk);
bool report;
int err; int err;
report = nlmsg_report(ctx->nlh); if (!ctx->report &&
if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
return 0; return 0;
err = -ENOBUFS; err = -ENOBUFS;
...@@ -253,18 +250,20 @@ static int nf_tables_table_notify(const struct nft_ctx *ctx, int event) ...@@ -253,18 +250,20 @@ static int nf_tables_table_notify(const struct nft_ctx *ctx, int event)
if (skb == NULL) if (skb == NULL)
goto err; goto err;
err = nf_tables_fill_table_info(skb, portid, seq, event, 0, err = nf_tables_fill_table_info(skb, ctx->portid, ctx->seq, event, 0,
ctx->afi->family, ctx->table); ctx->afi->family, ctx->table);
if (err < 0) { if (err < 0) {
kfree_skb(skb); kfree_skb(skb);
goto err; goto err;
} }
err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
GFP_KERNEL); ctx->report, GFP_KERNEL);
err: err:
if (err < 0) if (err < 0) {
nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err); nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
err);
}
return err; return err;
} }
...@@ -721,14 +720,10 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, u32 portid, u32 seq, ...@@ -721,14 +720,10 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, u32 portid, u32 seq,
static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event) static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
{ {
struct sk_buff *skb; struct sk_buff *skb;
u32 portid = NETLINK_CB(ctx->skb).portid;
struct net *net = sock_net(ctx->skb->sk);
u32 seq = ctx->nlh->nlmsg_seq;
bool report;
int err; int err;
report = nlmsg_report(ctx->nlh); if (!ctx->report &&
if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
return 0; return 0;
err = -ENOBUFS; err = -ENOBUFS;
...@@ -736,7 +731,7 @@ static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event) ...@@ -736,7 +731,7 @@ static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
if (skb == NULL) if (skb == NULL)
goto err; goto err;
err = nf_tables_fill_chain_info(skb, portid, seq, event, 0, err = nf_tables_fill_chain_info(skb, ctx->portid, ctx->seq, event, 0,
ctx->afi->family, ctx->table, ctx->afi->family, ctx->table,
ctx->chain); ctx->chain);
if (err < 0) { if (err < 0) {
...@@ -744,11 +739,13 @@ static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event) ...@@ -744,11 +739,13 @@ static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
goto err; goto err;
} }
err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
GFP_KERNEL); ctx->report, GFP_KERNEL);
err: err:
if (err < 0) if (err < 0) {
nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err); nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
err);
}
return err; return err;
} }
...@@ -1473,16 +1470,11 @@ static int nf_tables_rule_notify(const struct nft_ctx *ctx, ...@@ -1473,16 +1470,11 @@ static int nf_tables_rule_notify(const struct nft_ctx *ctx,
const struct nft_rule *rule, const struct nft_rule *rule,
int event) int event)
{ {
const struct sk_buff *oskb = ctx->skb;
struct sk_buff *skb; struct sk_buff *skb;
u32 portid = NETLINK_CB(oskb).portid;
struct net *net = sock_net(oskb->sk);
u32 seq = ctx->nlh->nlmsg_seq;
bool report;
int err; int err;
report = nlmsg_report(ctx->nlh); if (!ctx->report &&
if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
return 0; return 0;
err = -ENOBUFS; err = -ENOBUFS;
...@@ -1490,7 +1482,7 @@ static int nf_tables_rule_notify(const struct nft_ctx *ctx, ...@@ -1490,7 +1482,7 @@ static int nf_tables_rule_notify(const struct nft_ctx *ctx,
if (skb == NULL) if (skb == NULL)
goto err; goto err;
err = nf_tables_fill_rule_info(skb, portid, seq, event, 0, err = nf_tables_fill_rule_info(skb, ctx->portid, ctx->seq, event, 0,
ctx->afi->family, ctx->table, ctx->afi->family, ctx->table,
ctx->chain, rule); ctx->chain, rule);
if (err < 0) { if (err < 0) {
...@@ -1498,11 +1490,13 @@ static int nf_tables_rule_notify(const struct nft_ctx *ctx, ...@@ -1498,11 +1490,13 @@ static int nf_tables_rule_notify(const struct nft_ctx *ctx,
goto err; goto err;
} }
err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
GFP_KERNEL); ctx->report, GFP_KERNEL);
err: err:
if (err < 0) if (err < 0) {
nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err); nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
err);
}
return err; return err;
} }
...@@ -2141,8 +2135,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, ...@@ -2141,8 +2135,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
struct nfgenmsg *nfmsg; struct nfgenmsg *nfmsg;
struct nlmsghdr *nlh; struct nlmsghdr *nlh;
struct nlattr *desc; struct nlattr *desc;
u32 portid = NETLINK_CB(ctx->skb).portid; u32 portid = ctx->portid;
u32 seq = ctx->nlh->nlmsg_seq; u32 seq = ctx->seq;
event |= NFNL_SUBSYS_NFTABLES << 8; event |= NFNL_SUBSYS_NFTABLES << 8;
nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
...@@ -2194,12 +2188,11 @@ static int nf_tables_set_notify(const struct nft_ctx *ctx, ...@@ -2194,12 +2188,11 @@ static int nf_tables_set_notify(const struct nft_ctx *ctx,
int event) int event)
{ {
struct sk_buff *skb; struct sk_buff *skb;
u32 portid = NETLINK_CB(ctx->skb).portid; u32 portid = ctx->portid;
bool report;
int err; int err;
report = nlmsg_report(ctx->nlh); if (!ctx->report &&
if (!report && !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
return 0; return 0;
err = -ENOBUFS; err = -ENOBUFS;
...@@ -2213,8 +2206,8 @@ static int nf_tables_set_notify(const struct nft_ctx *ctx, ...@@ -2213,8 +2206,8 @@ static int nf_tables_set_notify(const struct nft_ctx *ctx,
goto err; goto err;
} }
err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, report, err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES,
GFP_KERNEL); ctx->report, GFP_KERNEL);
err: err:
if (err < 0) if (err < 0)
nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err); nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err);
...@@ -2956,14 +2949,12 @@ static int nf_tables_setelem_notify(const struct nft_ctx *ctx, ...@@ -2956,14 +2949,12 @@ static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
const struct nft_set_elem *elem, const struct nft_set_elem *elem,
int event, u16 flags) int event, u16 flags)
{ {
const struct sk_buff *oskb = ctx->skb; struct net *net = ctx->net;
struct net *net = sock_net(oskb->sk); u32 portid = ctx->portid;
u32 portid = NETLINK_CB(oskb).portid;
bool report = nlmsg_report(ctx->nlh);
struct sk_buff *skb; struct sk_buff *skb;
int err; int err;
if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
return 0; return 0;
err = -ENOBUFS; err = -ENOBUFS;
...@@ -2978,7 +2969,7 @@ static int nf_tables_setelem_notify(const struct nft_ctx *ctx, ...@@ -2978,7 +2969,7 @@ static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
goto err; goto err;
} }
err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
GFP_KERNEL); GFP_KERNEL);
err: err:
if (err < 0) if (err < 0)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7