mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-27 14:14:24 +08:00
netfilter pull request 24-10-02
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEN9lkrMBJgcdVAPub1V2XiooUIOQFAmb9qqsACgkQ1V2XiooU IOSplRAAsv0Rr2WRA+pDpQwcmMNWoemGtu0qB7L6IchM36P64GvldMhEgfSPCh1h 6HdV8WlkGE5Q/bOPCNbkLg/INBelADoioaOlsdOO5oc+rGUw/Z4Swcq/1PF60Vaz tz8AOU0opAD3X50U5bqD1Z2xToonS9nz9Ql7OWAbTdn9red/2SY+H1fyDz00VIHU X4y2GWND5Hi6KIsAGTu9OiyQKy9hb1oA5xNU1OeNY+gNsr+r+NSbX0BOMSRJTvLv MyY0kzP+S+yTx2FGcDMqgKfo60Sb4Ru6rJXl3XKd6QxhW9Mt6adcmmlqa5edoWU3 bJYkzugl66XKh1pDkC9u7om7zOOzBhjvLObDMbcYfAVJCctsErGcRDJIvS8M+ECB tRsxRFU2CSud4HzIeKfQUP7b16KghnBa4kTsc0r8MLcfU5D/aR/WMR62W/ua00IS noyWqtpdNk/7yR9HMzaCbsjgm+OZbtJbOSWCNaDo4TsXf+g+jQ+cf1Nl26cE73gB xWGcc3LKIkcjQpOU+Zu0fluF7OdnDNNTEoHprnahilBHDOtmSBDMwxAoJichCZMt mEN1CThG0B+YwlWH9yFL1bOQs1zHHFjHfJspdtqCok+UeD20p8QD1V8mlEsAkkT/ alw0Gxa6T2KepuOF9KcMnx4IcpkqwpgkwcGXvwRWWchANgbi1ao= =UUcp -----END PGP SIGNATURE----- Merge tag 'nf-24-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix incorrect documentation in uapi/linux/netfilter/nf_tables.h regarding flowtable hooks, from Phil Sutter. 2) Fix nft_audit.sh selftests with newer nft binaries, due to different (valid) audit output, also from Phil. 3) Disable BH when duplicating packets via nf_dup infrastructure, otherwise race on nf_skb_duplicated for locally generated traffic. From Eric. 4) Missing return in callback of selftest C program, from zhang jiao. netfilter pull request 24-10-02 * tag 'nf-24-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: Add missing return value netfilter: nf_tables: prevent nf_skb_duplicated corruption selftests: netfilter: Fix nft_audit.sh for newer nft binaries netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED ==================== Link: https://patch.msgid.link/20241002202421.1281311-1-pablo@netfilter.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Paolo Abeni
commit
1127c73a8d
@ -1694,7 +1694,7 @@ enum nft_flowtable_flags {
|
||||
*
|
||||
* @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
|
||||
* @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
|
||||
* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
|
||||
* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED)
|
||||
* @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
|
||||
* @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
|
||||
* @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
|
||||
|
||||
@ -53,8 +53,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,
|
||||
{
|
||||
struct iphdr *iph;
|
||||
|
||||
local_bh_disable();
|
||||
if (this_cpu_read(nf_skb_duplicated))
|
||||
return;
|
||||
goto out;
|
||||
/*
|
||||
* Copy the skb, and route the copy. Will later return %XT_CONTINUE for
|
||||
* the original skb, which should continue on its way as if nothing has
|
||||
@ -62,7 +63,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,
|
||||
*/
|
||||
skb = pskb_copy(skb, GFP_ATOMIC);
|
||||
if (skb == NULL)
|
||||
return;
|
||||
goto out;
|
||||
|
||||
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
|
||||
/* Avoid counting cloned packets towards the original connection. */
|
||||
@ -91,6 +92,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,
|
||||
} else {
|
||||
kfree_skb(skb);
|
||||
}
|
||||
out:
|
||||
local_bh_enable();
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(nf_dup_ipv4);
|
||||
|
||||
|
||||
@ -47,11 +47,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,
|
||||
void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum,
|
||||
const struct in6_addr *gw, int oif)
|
||||
{
|
||||
local_bh_disable();
|
||||
if (this_cpu_read(nf_skb_duplicated))
|
||||
return;
|
||||
goto out;
|
||||
skb = pskb_copy(skb, GFP_ATOMIC);
|
||||
if (skb == NULL)
|
||||
return;
|
||||
goto out;
|
||||
|
||||
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
|
||||
nf_reset_ct(skb);
|
||||
@ -69,6 +70,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum,
|
||||
} else {
|
||||
kfree_skb(skb);
|
||||
}
|
||||
out:
|
||||
local_bh_enable();
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(nf_dup_ipv6);
|
||||
|
||||
|
||||
@ -207,6 +207,7 @@ static int conntrack_data_generate_v6(struct mnl_socket *sock,
|
||||
static int count_entries(const struct nlmsghdr *nlh, void *data)
|
||||
{
|
||||
reply_counter++;
|
||||
return MNL_CB_OK;
|
||||
}
|
||||
|
||||
static int conntracK_count_zone(struct mnl_socket *sock, uint16_t zone)
|
||||
|
||||
@ -48,12 +48,31 @@ logread_pid=$!
|
||||
trap 'kill $logread_pid; rm -f $logfile $rulefile' EXIT
|
||||
exec 3<"$logfile"
|
||||
|
||||
lsplit='s/^\(.*\) entries=\([^ ]*\) \(.*\)$/pfx="\1"\nval="\2"\nsfx="\3"/'
|
||||
summarize_logs() {
|
||||
sum=0
|
||||
while read line; do
|
||||
eval $(sed "$lsplit" <<< "$line")
|
||||
[[ $sum -gt 0 ]] && {
|
||||
[[ "$pfx $sfx" == "$tpfx $tsfx" ]] && {
|
||||
let "sum += val"
|
||||
continue
|
||||
}
|
||||
echo "$tpfx entries=$sum $tsfx"
|
||||
}
|
||||
tpfx="$pfx"
|
||||
tsfx="$sfx"
|
||||
sum=$val
|
||||
done
|
||||
echo "$tpfx entries=$sum $tsfx"
|
||||
}
|
||||
|
||||
do_test() { # (cmd, log)
|
||||
echo -n "testing for cmd: $1 ... "
|
||||
cat <&3 >/dev/null
|
||||
$1 >/dev/null || exit 1
|
||||
sleep 0.1
|
||||
res=$(diff -a -u <(echo "$2") - <&3)
|
||||
res=$(diff -a -u <(echo "$2") <(summarize_logs <&3))
|
||||
[ $? -eq 0 ] && { echo "OK"; return; }
|
||||
echo "FAIL"
|
||||
grep -v '^\(---\|+++\|@@\)' <<< "$res"
|
||||
@ -152,31 +171,17 @@ do_test 'nft reset rules t1 c2' \
|
||||
'table=t1 family=2 entries=3 op=nft_reset_rule'
|
||||
|
||||
do_test 'nft reset rules table t1' \
|
||||
'table=t1 family=2 entries=3 op=nft_reset_rule
|
||||
table=t1 family=2 entries=3 op=nft_reset_rule
|
||||
table=t1 family=2 entries=3 op=nft_reset_rule'
|
||||
'table=t1 family=2 entries=9 op=nft_reset_rule'
|
||||
|
||||
do_test 'nft reset rules t2 c3' \
|
||||
'table=t2 family=2 entries=189 op=nft_reset_rule
|
||||
table=t2 family=2 entries=188 op=nft_reset_rule
|
||||
table=t2 family=2 entries=126 op=nft_reset_rule'
|
||||
'table=t2 family=2 entries=503 op=nft_reset_rule'
|
||||
|
||||
do_test 'nft reset rules t2' \
|
||||
'table=t2 family=2 entries=3 op=nft_reset_rule
|
||||
table=t2 family=2 entries=3 op=nft_reset_rule
|
||||
table=t2 family=2 entries=186 op=nft_reset_rule
|
||||
table=t2 family=2 entries=188 op=nft_reset_rule
|
||||
table=t2 family=2 entries=129 op=nft_reset_rule'
|
||||
'table=t2 family=2 entries=509 op=nft_reset_rule'
|
||||
|
||||
do_test 'nft reset rules' \
|
||||
'table=t1 family=2 entries=3 op=nft_reset_rule
|
||||
table=t1 family=2 entries=3 op=nft_reset_rule
|
||||
table=t1 family=2 entries=3 op=nft_reset_rule
|
||||
table=t2 family=2 entries=3 op=nft_reset_rule
|
||||
table=t2 family=2 entries=3 op=nft_reset_rule
|
||||
table=t2 family=2 entries=180 op=nft_reset_rule
|
||||
table=t2 family=2 entries=188 op=nft_reset_rule
|
||||
table=t2 family=2 entries=135 op=nft_reset_rule'
|
||||
'table=t1 family=2 entries=9 op=nft_reset_rule
|
||||
table=t2 family=2 entries=509 op=nft_reset_rule'
|
||||
|
||||
# resetting sets and elements
|
||||
|
||||
@ -200,13 +205,11 @@ do_test 'nft reset counters t1' \
|
||||
'table=t1 family=2 entries=1 op=nft_reset_obj'
|
||||
|
||||
do_test 'nft reset counters t2' \
|
||||
'table=t2 family=2 entries=342 op=nft_reset_obj
|
||||
table=t2 family=2 entries=158 op=nft_reset_obj'
|
||||
'table=t2 family=2 entries=500 op=nft_reset_obj'
|
||||
|
||||
do_test 'nft reset counters' \
|
||||
'table=t1 family=2 entries=1 op=nft_reset_obj
|
||||
table=t2 family=2 entries=341 op=nft_reset_obj
|
||||
table=t2 family=2 entries=159 op=nft_reset_obj'
|
||||
table=t2 family=2 entries=500 op=nft_reset_obj'
|
||||
|
||||
# resetting quotas
|
||||
|
||||
@ -217,13 +220,11 @@ do_test 'nft reset quotas t1' \
|
||||
'table=t1 family=2 entries=1 op=nft_reset_obj'
|
||||
|
||||
do_test 'nft reset quotas t2' \
|
||||
'table=t2 family=2 entries=315 op=nft_reset_obj
|
||||
table=t2 family=2 entries=185 op=nft_reset_obj'
|
||||
'table=t2 family=2 entries=500 op=nft_reset_obj'
|
||||
|
||||
do_test 'nft reset quotas' \
|
||||
'table=t1 family=2 entries=1 op=nft_reset_obj
|
||||
table=t2 family=2 entries=314 op=nft_reset_obj
|
||||
table=t2 family=2 entries=186 op=nft_reset_obj'
|
||||
table=t2 family=2 entries=500 op=nft_reset_obj'
|
||||
|
||||
# deleting rules
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user