stuartl/linux-mainline
1
0
Fork 0
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux synced 2025-09-22 16:39:32 +10:00
Code Issues Releases Wiki Activity

netfilter pull request nf-25-09-04

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJBBAABCAArFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmi5PeoNHGZ3QHN0cmxl
 bi5kZQAKCRBwkajZrV/2AMt2D/9Itwxl8xPlXvdlmCJSZwgTLsKPP6vFPnl2U+8Y
 IxASRmjHZPJvrkftHzGG+45CN9hVUJDcwb/FSsxbs0SpBYvu11iO81wcmv9IiZkM
 +QWBsj9pC6Rvshc29kRiONnfRjtH0BTOeZyq3Onps9RpzcBBkHFgfx4LFnUJqW76
 xBgzMF0mIZPYtxw7KSsoJD2oeJe/u1m8UzsMMLBvK+hGAaCaG9l1lLJL2KBt3ijw
 VZIOWNSbOKpk6762LgtuhbB788LSC39Lttgpyhjc4aHbWpBq9ueqLjCakTr/DuSp
 batT2fy6sCzhfpKxQUKhGe3uAucLp4XXStyHBpiHhFjVSmTNZg3Ul9qVvL6IWnMQ
 tIWqp0paYO3BCgo8f5MpJAamxZIcvmEleXagVkeGnhywhjBKHsF8I5m7v025wagl
 +eOxSUwgrCXdJ0z+7EbyLlAZzaDEM7JVFqBIHF3PMrubrSoQvqC4tIbLVro/YGZj
 Gp7F7vtNUHUdttQbsCvPKwzAW02z7qTDyXUx6EHDu9q30SdOL1i/OBlO7iqd13mZ
 tyauM9OJYcCSxUEOTu+6PmtJjna0qTpuqKxH9S7DsTlOrUHKFMCOujpQYf3qWyRG
 gu+37KW91LqdJFU4XbLDpACuKKK77+CkjrCgN8nHmkTKq8P4ux6jjmOBTOL5iCb4
 SFA2RQ==
 =Js9/
 -----END PGP SIGNATURE-----

Merge tag 'nf-25-09-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Florian Westphal says:

====================
netfilter: updates for net

1) Fix a silly bug in conntrack selftest, busyloop may get optimized to
   for (;;), reported by Yi Chen.

2) Introduce new NFTA_DEVICE_PREFIX attribute in nftables netlink api,
   re-using old NFTA_DEVICE_NAME led to confusion with different
   kernel/userspace versions.  This refines the wildcard interface
   support added in 6.16 release.  From Phil Sutter.

* tag 'nf-25-09-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX
  selftests: netfilter: fix udpclash tool hang
====================

Link: https://patch.msgid.link/20250904072548.3267-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2025-09-04 06:59:27 -07:00
commit d93b10e894
5 changed files with 38 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/uapi/linux/netfilter/nf_tables.h
View File

@ -1784,10 +1784,12 @@ enum nft_synproxy_attributes {
* enum nft_device_attributes - nf_tables device netlink attributes
*
* @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
* @NFTA_DEVICE_PREFIX: device name prefix, a simple wildcard (NLA_STRING)
*/
enum nft_devices_attributes {
NFTA_DEVICE_UNSPEC,
NFTA_DEVICE_NAME,
NFTA_DEVICE_PREFIX,
__NFTA_DEVICE_MAX
};
#define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1)

42
net/netfilter/nf_tables_api.c
View File

@ -1959,6 +1959,18 @@ nla_put_failure:
return -ENOSPC;
}
static bool hook_is_prefix(struct nft_hook *hook)
{
return strlen(hook->ifname) >= hook->ifnamelen;
}
static int nft_nla_put_hook_dev(struct sk_buff *skb, struct nft_hook *hook)
{
int attr = hook_is_prefix(hook) ? NFTA_DEVICE_PREFIX : NFTA_DEVICE_NAME;
return nla_put_string(skb, attr, hook->ifname);
}
static int nft_dump_basechain_hook(struct sk_buff *skb,
const struct net *net, int family,
const struct nft_base_chain *basechain,
@ -1990,16 +2002,15 @@ static int nft_dump_basechain_hook(struct sk_buff *skb,
if (!first)
first = hook;
if (nla_put(skb, NFTA_DEVICE_NAME,
hook->ifnamelen, hook->ifname))
if (nft_nla_put_hook_dev(skb, hook))
goto nla_put_failure;
n++;
}
nla_nest_end(skb, nest_devs);
if (n == 1 &&
nla_put(skb, NFTA_HOOK_DEV,
first->ifnamelen, first->ifname))
!hook_is_prefix(first) &&
nla_put_string(skb, NFTA_HOOK_DEV, first->ifname))
goto nla_put_failure;
}
nla_nest_end(skb, nest);
@ -2310,7 +2321,8 @@ void nf_tables_chain_destroy(struct nft_chain *chain)
}
static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
const struct nlattr *attr)
const struct nlattr *attr,
bool prefix)
{
struct nf_hook_ops *ops;
struct net_device *dev;
@ -2327,7 +2339,8 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
if (err < 0)
goto err_hook_free;
hook->ifnamelen = nla_len(attr);
/* include the terminating NUL-char when comparing non-prefixes */
hook->ifnamelen = strlen(hook->ifname) + !prefix;
/* nf_tables_netdev_event() is called under rtnl_mutex, this is
* indirectly serializing all the other holders of the commit_mutex with
@ -2374,14 +2387,22 @@ static int nf_tables_parse_netdev_hooks(struct net *net,
struct nft_hook *hook, *next;
const struct nlattr *tmp;
int rem, n = 0, err;
bool prefix;
nla_for_each_nested(tmp, attr, rem) {
if (nla_type(tmp) != NFTA_DEVICE_NAME) {
switch (nla_type(tmp)) {
case NFTA_DEVICE_NAME:
prefix = false;
break;
case NFTA_DEVICE_PREFIX:
prefix = true;
break;
default:
err = -EINVAL;
goto err_hook;
}
hook = nft_netdev_hook_alloc(net, tmp);
hook = nft_netdev_hook_alloc(net, tmp, prefix);
if (IS_ERR(hook)) {
NL_SET_BAD_ATTR(extack, tmp);
err = PTR_ERR(hook);
@ -2427,7 +2448,7 @@ static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[],
int err;
if (tb[NFTA_HOOK_DEV]) {
hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV], false);
if (IS_ERR(hook)) {
NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]);
return PTR_ERR(hook);
@ -9458,8 +9479,7 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
list_for_each_entry_rcu(hook, hook_list, list,
lockdep_commit_lock_is_held(net)) {
if (nla_put(skb, NFTA_DEVICE_NAME,
hook->ifnamelen, hook->ifname))
if (nft_nla_put_hook_dev(skb, hook))
goto nla_put_failure;
}
nla_nest_end(skb, nest_devs);

2
tools/testing/selftests/net/netfilter/conntrack_clash.sh
View File

@ -99,7 +99,7 @@ run_one_clash_test()
local entries
local cre
if ! ip netns exec "$ns" ./udpclash $daddr $dport;then
if ! ip netns exec "$ns" timeout 30 ./udpclash $daddr $dport;then
echo "INFO: did not receive expected number of replies for $daddr:$dport"
ip netns exec "$ctns" conntrack -S
# don't fail: check if clash resolution triggered after all.

5
tools/testing/selftests/net/netfilter/conntrack_resize.sh
View File

@ -187,7 +187,7 @@ ct_udpclash()
[ -x udpclash ] || return
while [ $now -lt $end ]; do
ip netns exec "$ns" ./udpclash 127.0.0.1 $((RANDOM%65536)) > /dev/null 2>&1
ip netns exec "$ns" timeout 30 ./udpclash 127.0.0.1 $((RANDOM%65536)) > /dev/null 2>&1
now=$(date +%s)
done
@ -277,6 +277,7 @@ check_taint()
insert_flood()
{
local n="$1"
local timeout="$2"
local r=0
r=$((RANDOM%$insert_count))
@ -302,7 +303,7 @@ test_floodresize_all()
read tainted_then < /proc/sys/kernel/tainted
for n in "$nsclient1" "$nsclient2";do
insert_flood "$n" &
insert_flood "$n" "$timeout" &
done
# resize table constantly while flood/insert/dump/flushs

2
tools/testing/selftests/net/netfilter/udpclash.c
View File

@ -29,7 +29,7 @@ struct thread_args {
int sockfd;
};
static int wait = 1;
static volatile int wait = 1;
static void *thread_main(void *varg)
{