Skip to content

Commit

Permalink
netfilter: nf_tables: extended netlink error reporting for netdevice
Browse files Browse the repository at this point in the history 
Flowtable and netdev chains are bound to one or several netdevice,
extend netlink error reporting to specify the the netdevice that
triggers the error.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Pablo Neira Ayuso committed Apr 21, 2023
1 parent c7d15aa commit c3c060a
Showing 1 changed file with 24 additions and 14 deletions.
38 changes: 24 additions & 14 deletions net/netfilter/nf_tables_api.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1954,7 +1954,8 @@ static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,

static int nf_tables_parse_netdev_hooks(struct net *net,
const struct nlattr *attr,
struct list_head *hook_list)
struct list_head *hook_list,
struct netlink_ext_ack *extack)
{
struct nft_hook *hook, *next;
const struct nlattr *tmp;
Expand All @@ -1968,10 +1969,12 @@ static int nf_tables_parse_netdev_hooks(struct net *net,

hook = nft_netdev_hook_alloc(net, tmp);
if (IS_ERR(hook)) {
NL_SET_BAD_ATTR(extack, tmp);
err = PTR_ERR(hook);
goto err_hook;
}
if (nft_hook_list_find(hook_list, hook)) {
NL_SET_BAD_ATTR(extack, tmp);
kfree(hook);
err = -EEXIST;
goto err_hook;
Expand Down Expand Up @@ -2004,20 +2007,23 @@ struct nft_chain_hook {

static int nft_chain_parse_netdev(struct net *net,
struct nlattr *tb[],
struct list_head *hook_list)
struct list_head *hook_list,
struct netlink_ext_ack *extack)
{
struct nft_hook *hook;
int err;

if (tb[NFTA_HOOK_DEV]) {
hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
if (IS_ERR(hook))
if (IS_ERR(hook)) {
NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]);
return PTR_ERR(hook);
}

list_add_tail(&hook->list, hook_list);
} else if (tb[NFTA_HOOK_DEVS]) {
err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
hook_list);
hook_list, extack);
if (err < 0)
return err;

Expand Down Expand Up @@ -2085,7 +2091,7 @@ static int nft_chain_parse_hook(struct net *net,

INIT_LIST_HEAD(&hook->list);
if (nft_base_chain_netdev(family, hook->num)) {
err = nft_chain_parse_netdev(net, ha, &hook->list);
err = nft_chain_parse_netdev(net, ha, &hook->list, extack);
if (err < 0) {
module_put(type->owner);
return err;
Expand Down Expand Up @@ -7560,7 +7566,8 @@ static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX
static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
const struct nlattr *attr,
struct nft_flowtable_hook *flowtable_hook,
struct nft_flowtable *flowtable, bool add)
struct nft_flowtable *flowtable,
struct netlink_ext_ack *extack, bool add)
{
struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
struct nft_hook *hook;
Expand Down Expand Up @@ -7607,7 +7614,8 @@ static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
err = nf_tables_parse_netdev_hooks(ctx->net,
tb[NFTA_FLOWTABLE_HOOK_DEVS],
&flowtable_hook->list);
&flowtable_hook->list,
extack);
if (err < 0)
return err;
}
Expand Down Expand Up @@ -7750,7 +7758,8 @@ static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
}

static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
struct nft_flowtable *flowtable)
struct nft_flowtable *flowtable,
struct netlink_ext_ack *extack)
{
const struct nlattr * const *nla = ctx->nla;
struct nft_flowtable_hook flowtable_hook;
Expand All @@ -7761,7 +7770,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
int err;

err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
&flowtable_hook, flowtable, false);
&flowtable_hook, flowtable, extack, false);
if (err < 0)
return err;

Expand Down Expand Up @@ -7866,7 +7875,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb,

nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);

return nft_flowtable_update(&ctx, info->nlh, flowtable);
return nft_flowtable_update(&ctx, info->nlh, flowtable, extack);
}

nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
Expand Down Expand Up @@ -7907,7 +7916,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
goto err3;

err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
&flowtable_hook, flowtable, true);
&flowtable_hook, flowtable, extack, true);
if (err < 0)
goto err4;

Expand Down Expand Up @@ -7959,7 +7968,8 @@ static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook
}

static int nft_delflowtable_hook(struct nft_ctx *ctx,
struct nft_flowtable *flowtable)
struct nft_flowtable *flowtable,
struct netlink_ext_ack *extack)
{
const struct nlattr * const *nla = ctx->nla;
struct nft_flowtable_hook flowtable_hook;
Expand All @@ -7969,7 +7979,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
int err;

err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
&flowtable_hook, flowtable, false);
&flowtable_hook, flowtable, extack, false);
if (err < 0)
return err;

Expand Down Expand Up @@ -8051,7 +8061,7 @@ static int nf_tables_delflowtable(struct sk_buff *skb,
nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);

if (nla[NFTA_FLOWTABLE_HOOK])
return nft_delflowtable_hook(&ctx, flowtable);
return nft_delflowtable_hook(&ctx, flowtable, extack);

if (flowtable->use > 0) {
NL_SET_BAD_ATTR(extack, attr);
Expand Down

0 comments on commit c3c060a

Please sign in to comment.