History

Merge tag 'nf-next-23-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next 1) Allow slightly larger IPVS connection table size from Kconfig for 64-bit arch, from Abhijeet Rastogi. 2) Since IPVS connection table might be larger than 2^20 after previous patch, allow to limit it depending on the available memory. Moreover, use kvmalloc. From Julian Anastasov. 3) Do not rebuild VLAN header in nft_payload when matching source and destination MAC address. 4) Remove nested rcu read lock side in ip_set_test(), from Florian Westphal. 5) Allow to update set size, also from Florian. 6) Improve NAT tuple selection when connection is closing, from Florian Westphal. 7) Support for resetting set element stateful expression, from Phil Sutter. 8) Use NLA_POLICY_MAX to narrow down maximum attribute value in nf_tables, from Florian Westphal. * tag 'nf-next-23-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_tables: limit allowed range via nla_policy netfilter: nf_tables: Introduce NFT_MSG_GETSETELEM_RESET netfilter: snat: evict closing tcp entries on reply tuple collision netfilter: nf_tables: permit update of set size netfilter: ipset: remove rcu_read_lock_bh pair from ip_set_test netfilter: nft_payload: rebuild vlan header when needed ipvs: dynamically limit the connection hash table ipvs: increase ip_vs_conn_tab_bits range for 64BIT ====================

Jakub Kicinski committed 3 years ago

Commit 61dc6512 parents 771ca3d a412dbf23 files · +199 −70Browse files

Unified · Split

23 files
  1. include/net/netfilter/nf_tables.h +3 −0
  2. include/uapi/linux/netfilter/nf_tables.h +2 −0
  3. net/netfilter/ipset/ip_set_core.c +0 −2
  4. net/netfilter/ipvs/Kconfig +14 −13
  5. net/netfilter/ipvs/ip_vs_conn.c +17 −9
  6. net/netfilter/nf_nat_core.c +88 −4
  7. net/netfilter/nf_tables_api.c +52 −20
  8. net/netfilter/nft_bitwise.c +1 −1
  9. net/netfilter/nft_byteorder.c +3 −3
  10. net/netfilter/nft_ct.c +1 −1
  11. net/netfilter/nft_dynset.c +1 −1
  12. net/netfilter/nft_exthdr.c +2 −2
  13. net/netfilter/nft_fwd_netdev.c +1 −1
  14. net/netfilter/nft_hash.c +1 −1
  15. net/netfilter/nft_meta.c +1 −1
  16. net/netfilter/nft_payload.c +2 −1
  17. net/netfilter/nft_range.c +1 −1
  18. net/netfilter/nft_reject.c +1 −1
  19. net/netfilter/nft_rt.c +1 −1
  20. net/netfilter/nft_socket.c +2 −2
  21. net/netfilter/nft_tproxy.c +1 −1
  22. net/netfilter/nft_tunnel.c +2 −2
  23. net/netfilter/nft_xfrm.c +2 −2
include/net/netfilter/nf_tables.h+3−0
@@ -1611,6 +1611,7 @@ struct nft_trans_set { · 1610 unmodified lines
1611 u64 timeout;1611 u64 timeout;
1612 bool update;1612 bool update;
1613 bool bound;1613 bool bound;
1614 u32 size;
1614};1615};
1615 1616
1616#define nft_trans_set(trans) \1617#define nft_trans_set(trans) \
@@ -1625,6 +1626,8 @@ struct nft_trans_set { · 8 unmodified lines
1625 (((struct nft_trans_set *)trans->data)->timeout)1626 (((struct nft_trans_set *)trans->data)->timeout)
1626#define nft_trans_set_gc_int(trans) \1627#define nft_trans_set_gc_int(trans) \
1627 (((struct nft_trans_set *)trans->data)->gc_int)1628 (((struct nft_trans_set *)trans->data)->gc_int)
1629#define nft_trans_set_size(trans) \
1630 (((struct nft_trans_set *)trans->data)->size)
1628 1631
1629struct nft_trans_chain {1632struct nft_trans_chain {
1630 struct nft_chain *chain;1633 struct nft_chain *chain;
include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -105,6 +105,7 @@ enum nft_verdicts { · 104 unmodified lines
105 * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum nft_set_elem_attributes)105 * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum nft_set_elem_attributes)
106 * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum nft_object_attributes)106 * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum nft_object_attributes)
107 * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum nft_flowtable_attributes)107 * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum nft_flowtable_attributes)
108 * @NFT_MSG_GETSETELEM_RESET: get set elements and reset attached stateful expressions (enum nft_set_elem_attributes)
108 */109 */
109enum nf_tables_msg_types {110enum nf_tables_msg_types {
110 NFT_MSG_NEWTABLE,111 NFT_MSG_NEWTABLE,
@@ -140,6 +141,7 @@ enum nf_tables_msg_types { · 29 unmodified lines
140 NFT_MSG_DESTROYSETELEM,141 NFT_MSG_DESTROYSETELEM,
141 NFT_MSG_DESTROYOBJ,142 NFT_MSG_DESTROYOBJ,
142 NFT_MSG_DESTROYFLOWTABLE,143 NFT_MSG_DESTROYFLOWTABLE,
144 NFT_MSG_GETSETELEM_RESET,
143 NFT_MSG_MAX,145 NFT_MSG_MAX,
144};146};
145 147
net/netfilter/ipset/ip_set_core.c+0−2
@@ -739,9 +739,7 @@ ip_set_test(ip_set_id_t index, const struct sk_buff *skb, · 738 unmodified lines
739 !(opt->family == set->family || set->family == NFPROTO_UNSPEC))739 !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
740 return 0;740 return 0;
741 741
742 rcu_read_lock_bh();
743 ret = set->variant->kadt(set, skb, par, IPSET_TEST, opt);742 ret = set->variant->kadt(set, skb, par, IPSET_TEST, opt);
744 rcu_read_unlock_bh();
745 743
746 if (ret == -EAGAIN) {744 if (ret == -EAGAIN) {
747 /* Type requests element to be completed */745 /* Type requests element to be completed */
net/netfilter/ipvs/Kconfig+14−13
@@ -44,7 +44,8 @@ config IP_VS_DEBUG · 43 unmodified lines
44 44
45config IP_VS_TAB_BITS45config IP_VS_TAB_BITS
46 int "IPVS connection table size (the Nth power of 2)"46 int "IPVS connection table size (the Nth power of 2)"
47 range 8 2047 range 8 20 if !64BIT
48 range 8 27 if 64BIT
48 default 1249 default 12
49 help50 help
50 The IPVS connection hash table uses the chaining scheme to handle51 The IPVS connection hash table uses the chaining scheme to handle
@@ -54,24 +55,24 @@ config IP_VS_TAB_BITS · 3 unmodified lines
54 55
55 Note the table size must be power of 2. The table size will be the56 Note the table size must be power of 2. The table size will be the
56 value of 2 to the your input number power. The number to choose is57 value of 2 to the your input number power. The number to choose is
57 from 8 to 20, the default number is 12, which means the table size58 from 8 to 27 for 64BIT(20 otherwise), the default number is 12,
58 is 4096. Don't input the number too small, otherwise you will lose59 which means the table size is 4096. Don't input the number too
59 performance on it. You can adapt the table size yourself, according60 small, otherwise you will lose performance on it. You can adapt the
60 to your virtual server application. It is good to set the table size61 table size yourself, according to your virtual server application.
61 not far less than the number of connections per second multiplying62 It is good to set the table size not far less than the number of
62 average lasting time of connection in the table. For example, your63 connections per second multiplying average lasting time of
63 virtual server gets 200 connections per second, the connection lasts64 connection in the table. For example, your virtual server gets 200
64 for 200 seconds in average in the connection table, the table size65 connections per second, the connection lasts for 200 seconds in
65 should be not far less than 200x200, it is good to set the table66 average in the connection table, the table size should be not far
66 size 32768 (2**15).67 less than 200x200, it is good to set the table size 32768 (2**15).
67 68
68 Another note that each connection occupies 128 bytes effectively and69 Another note that each connection occupies 128 bytes effectively and
69 each hash entry uses 8 bytes, so you can estimate how much memory is70 each hash entry uses 8 bytes, so you can estimate how much memory is
70 needed for your box.71 needed for your box.
71 72
72 You can overwrite this number setting conn_tab_bits module parameter73 You can overwrite this number setting conn_tab_bits module parameter
73 or by appending ip_vs.conn_tab_bits=? to the kernel command line74 or by appending ip_vs.conn_tab_bits=? to the kernel command line if
74 if IP VS was compiled built-in.75 IP VS was compiled built-in.
75 76
76comment "IPVS transport protocol load balancing support"77comment "IPVS transport protocol load balancing support"
77 78
net/netfilter/ipvs/ip_vs_conn.c+17−9
@@ -26,7 +26,6 @@ · 25 unmodified lines
26#include <linux/net.h>26#include <linux/net.h>
27#include <linux/kernel.h>27#include <linux/kernel.h>
28#include <linux/module.h>28#include <linux/module.h>
29#include <linux/vmalloc.h>
30#include <linux/proc_fs.h> /* for proc_net_* */29#include <linux/proc_fs.h> /* for proc_net_* */
31#include <linux/slab.h>30#include <linux/slab.h>
32#include <linux/seq_file.h>31#include <linux/seq_file.h>
@@ -1482,13 +1481,21 @@ void __net_exit ip_vs_conn_net_cleanup(struct netns_ipvs *ipvs) · 1449 unmodified lines
1482int __init ip_vs_conn_init(void)1481int __init ip_vs_conn_init(void)
1483{1482{
1484 size_t tab_array_size;1483 size_t tab_array_size;
1484 int max_avail;
1485#if BITS_PER_LONG > 32
1486 int max = 27;
1487#else
1488 int max = 20;
1489#endif
1490 int min = 8;
1485 int idx;1491 int idx;
1486 1492
1487 /* Compute size and mask */1493 max_avail = order_base_2(totalram_pages()) + PAGE_SHIFT;
1488 if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) {1494 max_avail -= 2; /* ~4 in hash row */
1489 pr_info("conn_tab_bits not in [8, 20]. Using default value\n");1495 max_avail -= 1; /* IPVS up to 1/2 of mem */
1490 ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;1496 max_avail -= order_base_2(sizeof(struct ip_vs_conn));
1491 }1497 max = clamp(max, min, max_avail);
1498 ip_vs_conn_tab_bits = clamp_val(ip_vs_conn_tab_bits, min, max);
1492 ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;1499 ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
1493 ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;1500 ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
1494 1501
@@ -1497,7 +1504,8 @@ int __init ip_vs_conn_init(void) · 2 unmodified lines
1497 */1504 */
1498 tab_array_size = array_size(ip_vs_conn_tab_size,1505 tab_array_size = array_size(ip_vs_conn_tab_size,
1499 sizeof(*ip_vs_conn_tab));1506 sizeof(*ip_vs_conn_tab));
1500 ip_vs_conn_tab = vmalloc(tab_array_size);1507 ip_vs_conn_tab = kvmalloc_array(ip_vs_conn_tab_size,
1508 sizeof(*ip_vs_conn_tab), GFP_KERNEL);
1501 if (!ip_vs_conn_tab)1509 if (!ip_vs_conn_tab)
1502 return -ENOMEM;1510 return -ENOMEM;
1503 1511
@@ -1506,7 +1514,7 @@ int __init ip_vs_conn_init(void) · 2 unmodified lines
1506 sizeof(struct ip_vs_conn), 0,1514 sizeof(struct ip_vs_conn), 0,
1507 SLAB_HWCACHE_ALIGN, NULL);1515 SLAB_HWCACHE_ALIGN, NULL);
1508 if (!ip_vs_conn_cachep) {1516 if (!ip_vs_conn_cachep) {
1509 vfree(ip_vs_conn_tab);1517 kvfree(ip_vs_conn_tab);
1510 return -ENOMEM;1518 return -ENOMEM;
1511 }1519 }
1512 1520
@@ -1534,5 +1542,5 @@ void ip_vs_conn_cleanup(void) · 21 unmodified lines
1534 rcu_barrier();1542 rcu_barrier();
1535 /* Release the empty cache */1543 /* Release the empty cache */
1536 kmem_cache_destroy(ip_vs_conn_cachep);1544 kmem_cache_destroy(ip_vs_conn_cachep);
1537 vfree(ip_vs_conn_tab);1545 kvfree(ip_vs_conn_tab);
1538}1546}
net/netfilter/nf_nat_core.c+88−4
@@ -27,6 +27,9 @@ · 26 unmodified lines
27 27
28#include "nf_internals.h"28#include "nf_internals.h"
29 29
30#define NF_NAT_MAX_ATTEMPTS 128
31#define NF_NAT_HARDER_THRESH (NF_NAT_MAX_ATTEMPTS / 4)
32
30static spinlock_t nf_nat_locks[CONNTRACK_LOCKS];33static spinlock_t nf_nat_locks[CONNTRACK_LOCKS];
31 34
32static DEFINE_MUTEX(nf_nat_proto_mutex);35static DEFINE_MUTEX(nf_nat_proto_mutex);
@@ -197,6 +200,88 @@ nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple, · 164 unmodified lines
197 return nf_conntrack_tuple_taken(&reply, ignored_conntrack);200 return nf_conntrack_tuple_taken(&reply, ignored_conntrack);
198}201}
199 202
203static bool nf_nat_may_kill(struct nf_conn *ct, unsigned long flags)
204{
205 static const unsigned long flags_refuse = IPS_FIXED_TIMEOUT |
206 IPS_DYING;
207 static const unsigned long flags_needed = IPS_SRC_NAT;
208 enum tcp_conntrack old_state;
209
210 old_state = READ_ONCE(ct->proto.tcp.state);
211 if (old_state < TCP_CONNTRACK_TIME_WAIT)
212 return false;
213
214 if (flags & flags_refuse)
215 return false;
216
217 return (flags & flags_needed) == flags_needed;
218}
219
220/* reverse direction will send packets to new source, so
221 * make sure such packets are invalid.
222 */
223static bool nf_seq_has_advanced(const struct nf_conn *old, const struct nf_conn *new)
224{
225 return (__s32)(new->proto.tcp.seen[0].td_end -
226 old->proto.tcp.seen[0].td_end) > 0;
227}
228
229static int
230nf_nat_used_tuple_harder(const struct nf_conntrack_tuple *tuple,
231 const struct nf_conn *ignored_conntrack,
232 unsigned int attempts_left)
233{
234 static const unsigned long flags_offload = IPS_OFFLOAD | IPS_HW_OFFLOAD;
235 struct nf_conntrack_tuple_hash *thash;
236 const struct nf_conntrack_zone *zone;
237 struct nf_conntrack_tuple reply;
238 unsigned long flags;
239 struct nf_conn *ct;
240 bool taken = true;
241 struct net *net;
242
243 nf_ct_invert_tuple(&reply, tuple);
244
245 if (attempts_left > NF_NAT_HARDER_THRESH ||
246 tuple->dst.protonum != IPPROTO_TCP ||
247 ignored_conntrack->proto.tcp.state != TCP_CONNTRACK_SYN_SENT)
248 return nf_conntrack_tuple_taken(&reply, ignored_conntrack);
249
250 /* :ast few attempts to find a free tcp port. Destructive
251 * action: evict colliding if its in timewait state and the
252 * tcp sequence number has advanced past the one used by the
253 * old entry.
254 */
255 net = nf_ct_net(ignored_conntrack);
256 zone = nf_ct_zone(ignored_conntrack);
257
258 thash = nf_conntrack_find_get(net, zone, &reply);
259 if (!thash)
260 return false;
261
262 ct = nf_ct_tuplehash_to_ctrack(thash);
263
264 if (thash->tuple.dst.dir == IP_CT_DIR_ORIGINAL)
265 goto out;
266
267 if (WARN_ON_ONCE(ct == ignored_conntrack))
268 goto out;
269
270 flags = READ_ONCE(ct->status);
271 if (!nf_nat_may_kill(ct, flags))
272 goto out;
273
274 if (!nf_seq_has_advanced(ct, ignored_conntrack))
275 goto out;
276
277 /* Even if we can evict do not reuse if entry is offloaded. */
278 if (nf_ct_kill(ct))
279 taken = flags & flags_offload;
280out:
281 nf_ct_put(ct);
282 return taken;
283}
284
200static bool nf_nat_inet_in_range(const struct nf_conntrack_tuple *t,285static bool nf_nat_inet_in_range(const struct nf_conntrack_tuple *t,
201 const struct nf_nat_range2 *range)286 const struct nf_nat_range2 *range)
202{287{
@@ -385,7 +470,6 @@ static void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple, · 182 unmodified lines
385 unsigned int range_size, min, max, i, attempts;470 unsigned int range_size, min, max, i, attempts;
386 __be16 *keyptr;471 __be16 *keyptr;
387 u16 off;472 u16 off;
388 static const unsigned int max_attempts = 128;
389 473
390 switch (tuple->dst.protonum) {474 switch (tuple->dst.protonum) {
391 case IPPROTO_ICMP:475 case IPPROTO_ICMP:
@@ -471,8 +555,8 @@ find_free_id: · 79 unmodified lines
471 off = get_random_u16();555 off = get_random_u16();
472 556
473 attempts = range_size;557 attempts = range_size;
474 if (attempts > max_attempts)558 if (attempts > NF_NAT_MAX_ATTEMPTS)
475 attempts = max_attempts;559 attempts = NF_NAT_MAX_ATTEMPTS;
476 560
477 /* We are in softirq; doing a search of the entire range risks561 /* We are in softirq; doing a search of the entire range risks
478 * soft lockup when all tuples are already used.562 * soft lockup when all tuples are already used.
@@ -483,7 +567,7 @@ find_free_id: · 4 unmodified lines
483another_round:567another_round:
484 for (i = 0; i < attempts; i++, off++) {568 for (i = 0; i < attempts; i++, off++) {
485 *keyptr = htons(min + off % range_size);569 *keyptr = htons(min + off % range_size);
486 if (!nf_nat_used_tuple(tuple, ct))570 if (!nf_nat_used_tuple_harder(tuple, ct, attempts - i))
487 return;571 return;
488 }572 }
489 573
net/netfilter/nf_tables_api.c+52−20
@@ -567,6 +567,7 @@ static int __nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, · 566 unmodified lines
567 nft_trans_set_update(trans) = true;567 nft_trans_set_update(trans) = true;
568 nft_trans_set_gc_int(trans) = desc->gc_int;568 nft_trans_set_gc_int(trans) = desc->gc_int;
569 nft_trans_set_timeout(trans) = desc->timeout;569 nft_trans_set_timeout(trans) = desc->timeout;
570 nft_trans_set_size(trans) = desc->size;
570 }571 }
571 nft_trans_commit_list_add_tail(ctx->net, trans);572 nft_trans_commit_list_add_tail(ctx->net, trans);
572 573
@@ -5442,7 +5443,8 @@ static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + · 4869 unmodified lines
5442 5443
5443static int nft_set_elem_expr_dump(struct sk_buff *skb,5444static int nft_set_elem_expr_dump(struct sk_buff *skb,
5444 const struct nft_set *set,5445 const struct nft_set *set,
5445 const struct nft_set_ext *ext)5446 const struct nft_set_ext *ext,
5447 bool reset)
5446{5448{
5447 struct nft_set_elem_expr *elem_expr;5449 struct nft_set_elem_expr *elem_expr;
5448 u32 size, num_exprs = 0;5450 u32 size, num_exprs = 0;
@@ -5455,7 +5457,7 @@ static int nft_set_elem_expr_dump(struct sk_buff *skb, · 6 unmodified lines
5455 5457
5456 if (num_exprs == 1) {5458 if (num_exprs == 1) {
5457 expr = nft_setelem_expr_at(elem_expr, 0);5459 expr = nft_setelem_expr_at(elem_expr, 0);
5458 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, false) < 0)5460 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, reset) < 0)
5459 return -1;5461 return -1;
5460 5462
5461 return 0;5463 return 0;
@@ -5466,7 +5468,7 @@ static int nft_set_elem_expr_dump(struct sk_buff *skb, · 4 unmodified lines
5466 5468
5467 nft_setelem_expr_foreach(expr, elem_expr, size) {5469 nft_setelem_expr_foreach(expr, elem_expr, size) {
5468 expr = nft_setelem_expr_at(elem_expr, size);5470 expr = nft_setelem_expr_at(elem_expr, size);
5469 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, false) < 0)5471 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0)
5470 goto nla_put_failure;5472 goto nla_put_failure;
5471 }5473 }
5472 nla_nest_end(skb, nest);5474 nla_nest_end(skb, nest);
@@ -5479,11 +5481,13 @@ nla_put_failure: · 6 unmodified lines
5479 5481
5480static int nf_tables_fill_setelem(struct sk_buff *skb,5482static int nf_tables_fill_setelem(struct sk_buff *skb,
5481 const struct nft_set *set,5483 const struct nft_set *set,
5482 const struct nft_set_elem *elem)5484 const struct nft_set_elem *elem,
5485 bool reset)
5483{5486{
5484 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);5487 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5485 unsigned char *b = skb_tail_pointer(skb);5488 unsigned char *b = skb_tail_pointer(skb);
5486 struct nlattr *nest;5489 struct nlattr *nest;
5490 u64 timeout = 0;
5487 5491
5488 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);5492 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
5489 if (nest == NULL)5493 if (nest == NULL)
@@ -5506,7 +5510,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, · 16 unmodified lines
5506 goto nla_put_failure;5510 goto nla_put_failure;
5507 5511
5508 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) &&5512 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) &&
5509 nft_set_elem_expr_dump(skb, set, ext))5513 nft_set_elem_expr_dump(skb, set, ext, reset))
5510 goto nla_put_failure;5514 goto nla_put_failure;
5511 5515
5512 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&5516 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
@@ -5519,11 +5523,15 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, · 6 unmodified lines
5519 htonl(*nft_set_ext_flags(ext))))5523 htonl(*nft_set_ext_flags(ext))))
5520 goto nla_put_failure;5524 goto nla_put_failure;
5521 5525
5522 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&5526 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) {
5523 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,5527 timeout = *nft_set_ext_timeout(ext);
5524 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),5528 if (nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
5525 NFTA_SET_ELEM_PAD))5529 nf_jiffies64_to_msecs(timeout),
5526 goto nla_put_failure;5530 NFTA_SET_ELEM_PAD))
5531 goto nla_put_failure;
5532 } else if (set->flags & NFT_SET_TIMEOUT) {
5533 timeout = READ_ONCE(set->timeout);
5534 }
5527 5535
5528 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {5536 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
5529 u64 expires, now = get_jiffies_64();5537 u64 expires, now = get_jiffies_64();
@@ -5538,6 +5546,9 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, · 8 unmodified lines
5538 nf_jiffies64_to_msecs(expires),5546 nf_jiffies64_to_msecs(expires),
5539 NFTA_SET_ELEM_PAD))5547 NFTA_SET_ELEM_PAD))
5540 goto nla_put_failure;5548 goto nla_put_failure;
5549
5550 if (reset)
5551 *nft_set_ext_expiration(ext) = now + timeout;
5541 }5552 }
5542 5553
5543 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {5554 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
@@ -5561,6 +5572,7 @@ struct nft_set_dump_args { · 17 unmodified lines
5561 const struct netlink_callback *cb;5572 const struct netlink_callback *cb;
5562 struct nft_set_iter iter;5573 struct nft_set_iter iter;
5563 struct sk_buff *skb;5574 struct sk_buff *skb;
5575 bool reset;
5564};5576};
5565 5577
5566static int nf_tables_dump_setelem(const struct nft_ctx *ctx,5578static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
@@ -5571,7 +5583,7 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx, · 4 unmodified lines
5571 struct nft_set_dump_args *args;5583 struct nft_set_dump_args *args;
5572 5584
5573 args = container_of(iter, struct nft_set_dump_args, iter);5585 args = container_of(iter, struct nft_set_dump_args, iter);
5574 return nf_tables_fill_setelem(args->skb, set, elem);5586 return nf_tables_fill_setelem(args->skb, set, elem, args->reset);
5575}5587}
5576 5588
5577struct nft_set_dump_ctx {5589struct nft_set_dump_ctx {
@@ -5580,7 +5592,7 @@ struct nft_set_dump_ctx { · 2 unmodified lines
5580};5592};
5581 5593
5582static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb,5594static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb,
5583 const struct nft_set *set)5595 const struct nft_set *set, bool reset)
5584{5596{
5585 struct nft_set_elem_catchall *catchall;5597 struct nft_set_elem_catchall *catchall;
5586 u8 genmask = nft_genmask_cur(net);5598 u8 genmask = nft_genmask_cur(net);
@@ -5595,7 +5607,7 @@ static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb, · 8 unmodified lines
5595 continue;5607 continue;
5596 5608
5597 elem.priv = catchall->elem;5609 elem.priv = catchall->elem;
5598 ret = nf_tables_fill_setelem(skb, set, &elem);5610 ret = nf_tables_fill_setelem(skb, set, &elem, reset);
5599 break;5611 break;
5600 }5612 }
5601 5613
@@ -5613,6 +5625,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) · 11 unmodified lines
5613 bool set_found = false;5625 bool set_found = false;
5614 struct nlmsghdr *nlh;5626 struct nlmsghdr *nlh;
5615 struct nlattr *nest;5627 struct nlattr *nest;
5628 bool reset = false;
5616 u32 portid, seq;5629 u32 portid, seq;
5617 int event;5630 int event;
5618 5631
@@ -5660,8 +5673,12 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) · 41 unmodified lines
5660 if (nest == NULL)5673 if (nest == NULL)
5661 goto nla_put_failure;5674 goto nla_put_failure;
5662 5675
5676 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETSETELEM_RESET)
5677 reset = true;
5678
5663 args.cb = cb;5679 args.cb = cb;
5664 args.skb = skb;5680 args.skb = skb;
5681 args.reset = reset;
5665 args.iter.genmask = nft_genmask_cur(net);5682 args.iter.genmask = nft_genmask_cur(net);
5666 args.iter.skip = cb->args[0];5683 args.iter.skip = cb->args[0];
5667 args.iter.count = 0;5684 args.iter.count = 0;
@@ -5670,7 +5687,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) · 2 unmodified lines
5670 set->ops->walk(&dump_ctx->ctx, set, &args.iter);5687 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
5671 5688
5672 if (!args.iter.err && args.iter.count == cb->args[0])5689 if (!args.iter.err && args.iter.count == cb->args[0])
5673 args.iter.err = nft_set_catchall_dump(net, skb, set);5690 args.iter.err = nft_set_catchall_dump(net, skb, set, reset);
5674 rcu_read_unlock();5691 rcu_read_unlock();
5675 5692
5676 nla_nest_end(skb, nest);5693 nla_nest_end(skb, nest);
@@ -5708,7 +5725,8 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb, · 31 unmodified lines
5708 const struct nft_ctx *ctx, u32 seq,5725 const struct nft_ctx *ctx, u32 seq,
5709 u32 portid, int event, u16 flags,5726 u32 portid, int event, u16 flags,
5710 const struct nft_set *set,5727 const struct nft_set *set,
5711 const struct nft_set_elem *elem)5728 const struct nft_set_elem *elem,
5729 bool reset)
5712{5730{
5713 struct nlmsghdr *nlh;5731 struct nlmsghdr *nlh;
5714 struct nlattr *nest;5732 struct nlattr *nest;
@@ -5729,7 +5747,7 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb, · 14 unmodified lines
5729 if (nest == NULL)5747 if (nest == NULL)
5730 goto nla_put_failure;5748 goto nla_put_failure;
5731 5749
5732 err = nf_tables_fill_setelem(skb, set, elem);5750 err = nf_tables_fill_setelem(skb, set, elem, reset);
5733 if (err < 0)5751 if (err < 0)
5734 goto nla_put_failure;5752 goto nla_put_failure;
5735 5753
@@ -5835,7 +5853,7 @@ static int nft_setelem_get(struct nft_ctx *ctx, struct nft_set *set, · 99 unmodified lines
5835}5853}
5836 5854
5837static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,5855static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
5838 const struct nlattr *attr)5856 const struct nlattr *attr, bool reset)
5839{5857{
5840 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];5858 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5841 struct nft_set_elem elem;5859 struct nft_set_elem elem;
@@ -5879,7 +5897,8 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, · 37 unmodified lines
5879 return err;5897 return err;
5880 5898
5881 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,5899 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
5882 NFT_MSG_NEWSETELEM, 0, set, &elem);5900 NFT_MSG_NEWSETELEM, 0, set, &elem,
5901 reset);
5883 if (err < 0)5902 if (err < 0)
5884 goto err_fill_setelem;5903 goto err_fill_setelem;
5885 5904
@@ -5903,6 +5922,7 @@ static int nf_tables_getsetelem(struct sk_buff *skb, · 17 unmodified lines
5903 struct nft_set *set;5922 struct nft_set *set;
5904 struct nlattr *attr;5923 struct nlattr *attr;
5905 struct nft_ctx ctx;5924 struct nft_ctx ctx;
5925 bool reset = false;
5906 int rem, err = 0;5926 int rem, err = 0;
5907 5927
5908 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,5928 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
@@ -5937,8 +5957,11 @@ static int nf_tables_getsetelem(struct sk_buff *skb, · 28 unmodified lines
5937 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])5957 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
5938 return -EINVAL;5958 return -EINVAL;
5939 5959
5960 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETSETELEM_RESET)
5961 reset = true;
5962
5940 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {5963 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5941 err = nft_get_set_elem(&ctx, set, attr);5964 err = nft_get_set_elem(&ctx, set, attr, reset);
5942 if (err < 0) {5965 if (err < 0) {
5943 NL_SET_BAD_ATTR(extack, attr);5966 NL_SET_BAD_ATTR(extack, attr);
5944 break;5967 break;
@@ -5971,7 +5994,7 @@ static void nf_tables_setelem_notify(const struct nft_ctx *ctx, · 26 unmodified lines
5971 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL);5994 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL);
5972 5995
5973 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,5996 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
5974 set, elem);5997 set, elem, false);
5975 if (err < 0) {5998 if (err < 0) {
5976 kfree_skb(skb);5999 kfree_skb(skb);
5977 goto err;6000 goto err;
@@ -8920,6 +8943,12 @@ static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { · 2942 unmodified lines
8920 .attr_count = NFTA_SET_ELEM_LIST_MAX,8943 .attr_count = NFTA_SET_ELEM_LIST_MAX,
8921 .policy = nft_set_elem_list_policy,8944 .policy = nft_set_elem_list_policy,
8922 },8945 },
8946 [NFT_MSG_GETSETELEM_RESET] = {
8947 .call = nf_tables_getsetelem,
8948 .type = NFNL_CB_RCU,
8949 .attr_count = NFTA_SET_ELEM_LIST_MAX,
8950 .policy = nft_set_elem_list_policy,
8951 },
8923 [NFT_MSG_DELSETELEM] = {8952 [NFT_MSG_DELSETELEM] = {
8924 .call = nf_tables_delsetelem,8953 .call = nf_tables_delsetelem,
8925 .type = NFNL_CB_BATCH,8954 .type = NFNL_CB_BATCH,
@@ -9670,6 +9699,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) · 744 unmodified lines
9670 9699
9671 WRITE_ONCE(set->timeout, nft_trans_set_timeout(trans));9700 WRITE_ONCE(set->timeout, nft_trans_set_timeout(trans));
9672 WRITE_ONCE(set->gc_int, nft_trans_set_gc_int(trans));9701 WRITE_ONCE(set->gc_int, nft_trans_set_gc_int(trans));
9702
9703 if (nft_trans_set_size(trans))
9704 WRITE_ONCE(set->size, nft_trans_set_size(trans));
9673 } else {9705 } else {
9674 nft_clear(net, nft_trans_set(trans));9706 nft_clear(net, nft_trans_set(trans));
9675 /* This avoids hitting -EBUSY when deleting the table9707 /* This avoids hitting -EBUSY when deleting the table
net/netfilter/nft_bitwise.c+1−1
@@ -86,7 +86,7 @@ static const struct nla_policy nft_bitwise_policy[NFTA_BITWISE_MAX + 1] = { · 85 unmodified lines
86 [NFTA_BITWISE_LEN] = { .type = NLA_U32 },86 [NFTA_BITWISE_LEN] = { .type = NLA_U32 },
87 [NFTA_BITWISE_MASK] = { .type = NLA_NESTED },87 [NFTA_BITWISE_MASK] = { .type = NLA_NESTED },
88 [NFTA_BITWISE_XOR] = { .type = NLA_NESTED },88 [NFTA_BITWISE_XOR] = { .type = NLA_NESTED },
89 [NFTA_BITWISE_OP] = { .type = NLA_U32 },89 [NFTA_BITWISE_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
90 [NFTA_BITWISE_DATA] = { .type = NLA_NESTED },90 [NFTA_BITWISE_DATA] = { .type = NLA_NESTED },
91};91};
92 92
net/netfilter/nft_byteorder.c+3−3
@@ -88,9 +88,9 @@ void nft_byteorder_eval(const struct nft_expr *expr, · 87 unmodified lines
88static const struct nla_policy nft_byteorder_policy[NFTA_BYTEORDER_MAX + 1] = {88static const struct nla_policy nft_byteorder_policy[NFTA_BYTEORDER_MAX + 1] = {
89 [NFTA_BYTEORDER_SREG] = { .type = NLA_U32 },89 [NFTA_BYTEORDER_SREG] = { .type = NLA_U32 },
90 [NFTA_BYTEORDER_DREG] = { .type = NLA_U32 },90 [NFTA_BYTEORDER_DREG] = { .type = NLA_U32 },
91 [NFTA_BYTEORDER_OP] = { .type = NLA_U32 },91 [NFTA_BYTEORDER_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
92 [NFTA_BYTEORDER_LEN] = { .type = NLA_U32 },92 [NFTA_BYTEORDER_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
93 [NFTA_BYTEORDER_SIZE] = { .type = NLA_U32 },93 [NFTA_BYTEORDER_SIZE] = NLA_POLICY_MAX(NLA_BE32, 255),
94};94};
95 95
96static int nft_byteorder_init(const struct nft_ctx *ctx,96static int nft_byteorder_init(const struct nft_ctx *ctx,
net/netfilter/nft_ct.c+1−1
@@ -332,7 +332,7 @@ static void nft_ct_set_eval(const struct nft_expr *expr, · 331 unmodified lines
332 332
333static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {333static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
334 [NFTA_CT_DREG] = { .type = NLA_U32 },334 [NFTA_CT_DREG] = { .type = NLA_U32 },
335 [NFTA_CT_KEY] = { .type = NLA_U32 },335 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
336 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },336 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
337 [NFTA_CT_SREG] = { .type = NLA_U32 },337 [NFTA_CT_SREG] = { .type = NLA_U32 },
338};338};
net/netfilter/nft_dynset.c+1−1
@@ -148,7 +148,7 @@ static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = { · 147 unmodified lines
148 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING,148 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING,
149 .len = NFT_SET_MAXNAMELEN - 1 },149 .len = NFT_SET_MAXNAMELEN - 1 },
150 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 },150 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 },
151 [NFTA_DYNSET_OP] = { .type = NLA_U32 },151 [NFTA_DYNSET_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
152 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 },152 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 },
153 [NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 },153 [NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 },
154 [NFTA_DYNSET_TIMEOUT] = { .type = NLA_U64 },154 [NFTA_DYNSET_TIMEOUT] = { .type = NLA_U64 },
net/netfilter/nft_exthdr.c+2−2
@@ -487,9 +487,9 @@ static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = { · 486 unmodified lines
487 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },487 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
488 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },488 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
489 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },489 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
490 [NFTA_EXTHDR_LEN] = { .type = NLA_U32 },490 [NFTA_EXTHDR_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
491 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },491 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
492 [NFTA_EXTHDR_OP] = { .type = NLA_U32 },492 [NFTA_EXTHDR_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
493 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },493 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
494};494};
495 495
net/netfilter/nft_fwd_netdev.c+1−1
@@ -40,7 +40,7 @@ static void nft_fwd_netdev_eval(const struct nft_expr *expr, · 39 unmodified lines
40static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {40static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {
41 [NFTA_FWD_SREG_DEV] = { .type = NLA_U32 },41 [NFTA_FWD_SREG_DEV] = { .type = NLA_U32 },
42 [NFTA_FWD_SREG_ADDR] = { .type = NLA_U32 },42 [NFTA_FWD_SREG_ADDR] = { .type = NLA_U32 },
43 [NFTA_FWD_NFPROTO] = { .type = NLA_U32 },43 [NFTA_FWD_NFPROTO] = NLA_POLICY_MAX(NLA_BE32, 255),
44};44};
45 45
46static int nft_fwd_netdev_init(const struct nft_ctx *ctx,46static int nft_fwd_netdev_init(const struct nft_ctx *ctx,
net/netfilter/nft_hash.c+1−1
@@ -59,7 +59,7 @@ static void nft_symhash_eval(const struct nft_expr *expr, · 58 unmodified lines
59static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {59static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
60 [NFTA_HASH_SREG] = { .type = NLA_U32 },60 [NFTA_HASH_SREG] = { .type = NLA_U32 },
61 [NFTA_HASH_DREG] = { .type = NLA_U32 },61 [NFTA_HASH_DREG] = { .type = NLA_U32 },
62 [NFTA_HASH_LEN] = { .type = NLA_U32 },62 [NFTA_HASH_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
63 [NFTA_HASH_MODULUS] = { .type = NLA_U32 },63 [NFTA_HASH_MODULUS] = { .type = NLA_U32 },
64 [NFTA_HASH_SEED] = { .type = NLA_U32 },64 [NFTA_HASH_SEED] = { .type = NLA_U32 },
65 [NFTA_HASH_OFFSET] = { .type = NLA_U32 },65 [NFTA_HASH_OFFSET] = { .type = NLA_U32 },
net/netfilter/nft_meta.c+1−1
@@ -458,7 +458,7 @@ EXPORT_SYMBOL_GPL(nft_meta_set_eval); · 457 unmodified lines
458 458
459const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {459const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
460 [NFTA_META_DREG] = { .type = NLA_U32 },460 [NFTA_META_DREG] = { .type = NLA_U32 },
461 [NFTA_META_KEY] = { .type = NLA_U32 },461 [NFTA_META_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
462 [NFTA_META_SREG] = { .type = NLA_U32 },462 [NFTA_META_SREG] = { .type = NLA_U32 },
463};463};
464EXPORT_SYMBOL_GPL(nft_meta_policy);464EXPORT_SYMBOL_GPL(nft_meta_policy);
net/netfilter/nft_payload.c+2−1
@@ -171,7 +171,8 @@ void nft_payload_eval(const struct nft_expr *expr, · 170 unmodified lines
171 if (!skb_mac_header_was_set(skb))171 if (!skb_mac_header_was_set(skb))
172 goto err;172 goto err;
173 173
174 if (skb_vlan_tag_present(skb)) {174 if (skb_vlan_tag_present(skb) &&
175 priv->offset >= offsetof(struct ethhdr, h_proto)) {
175 if (!nft_payload_copy_vlan(dest, skb,176 if (!nft_payload_copy_vlan(dest, skb,
176 priv->offset, priv->len))177 priv->offset, priv->len))
177 goto err;178 goto err;
net/netfilter/nft_range.c+1−1
@@ -42,7 +42,7 @@ void nft_range_eval(const struct nft_expr *expr, · 41 unmodified lines
42 42
43static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = {43static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = {
44 [NFTA_RANGE_SREG] = { .type = NLA_U32 },44 [NFTA_RANGE_SREG] = { .type = NLA_U32 },
45 [NFTA_RANGE_OP] = { .type = NLA_U32 },45 [NFTA_RANGE_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
46 [NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED },46 [NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED },
47 [NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED },47 [NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED },
48};48};
net/netfilter/nft_reject.c+1−1
@@ -18,7 +18,7 @@ · 17 unmodified lines
18#include <linux/icmpv6.h>18#include <linux/icmpv6.h>
19 19
20const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {20const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
21 [NFTA_REJECT_TYPE] = { .type = NLA_U32 },21 [NFTA_REJECT_TYPE] = NLA_POLICY_MAX(NLA_BE32, 255),
22 [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 },22 [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 },
23};23};
24EXPORT_SYMBOL_GPL(nft_reject_policy);24EXPORT_SYMBOL_GPL(nft_reject_policy);
net/netfilter/nft_rt.c+1−1
@@ -104,7 +104,7 @@ err: · 103 unmodified lines
104 104
105static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {105static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
106 [NFTA_RT_DREG] = { .type = NLA_U32 },106 [NFTA_RT_DREG] = { .type = NLA_U32 },
107 [NFTA_RT_KEY] = { .type = NLA_U32 },107 [NFTA_RT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
108};108};
109 109
110static int nft_rt_get_init(const struct nft_ctx *ctx,110static int nft_rt_get_init(const struct nft_ctx *ctx,
net/netfilter/nft_socket.c+2−2
@@ -138,9 +138,9 @@ static void nft_socket_eval(const struct nft_expr *expr, · 137 unmodified lines
138}138}
139 139
140static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {140static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {
141 [NFTA_SOCKET_KEY] = { .type = NLA_U32 },141 [NFTA_SOCKET_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
142 [NFTA_SOCKET_DREG] = { .type = NLA_U32 },142 [NFTA_SOCKET_DREG] = { .type = NLA_U32 },
143 [NFTA_SOCKET_LEVEL] = { .type = NLA_U32 },143 [NFTA_SOCKET_LEVEL] = NLA_POLICY_MAX(NLA_BE32, 255),
144};144};
145 145
146static int nft_socket_init(const struct nft_ctx *ctx,146static int nft_socket_init(const struct nft_ctx *ctx,
net/netfilter/nft_tproxy.c+1−1
@@ -183,7 +183,7 @@ static void nft_tproxy_eval(const struct nft_expr *expr, · 182 unmodified lines
183}183}
184 184
185static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {185static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
186 [NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },186 [NFTA_TPROXY_FAMILY] = NLA_POLICY_MAX(NLA_BE32, 255),
187 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },187 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
188 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },188 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
189};189};
net/netfilter/nft_tunnel.c+2−2
@@ -66,9 +66,9 @@ static void nft_tunnel_get_eval(const struct nft_expr *expr, · 65 unmodified lines
66}66}
67 67
68static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = {68static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = {
69 [NFTA_TUNNEL_KEY] = { .type = NLA_U32 },69 [NFTA_TUNNEL_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
70 [NFTA_TUNNEL_DREG] = { .type = NLA_U32 },70 [NFTA_TUNNEL_DREG] = { .type = NLA_U32 },
71 [NFTA_TUNNEL_MODE] = { .type = NLA_U32 },71 [NFTA_TUNNEL_MODE] = NLA_POLICY_MAX(NLA_BE32, 255),
72};72};
73 73
74static int nft_tunnel_get_init(const struct nft_ctx *ctx,74static int nft_tunnel_get_init(const struct nft_ctx *ctx,
net/netfilter/nft_xfrm.c+2−2
@@ -16,9 +16,9 @@ · 15 unmodified lines
16#include <net/xfrm.h>16#include <net/xfrm.h>
17 17
18static const struct nla_policy nft_xfrm_policy[NFTA_XFRM_MAX + 1] = {18static const struct nla_policy nft_xfrm_policy[NFTA_XFRM_MAX + 1] = {
19 [NFTA_XFRM_KEY] = { .type = NLA_U32 },19 [NFTA_XFRM_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
20 [NFTA_XFRM_DIR] = { .type = NLA_U8 },20 [NFTA_XFRM_DIR] = { .type = NLA_U8 },
21 [NFTA_XFRM_SPNUM] = { .type = NLA_U32 },21 [NFTA_XFRM_SPNUM] = NLA_POLICY_MAX(NLA_BE32, 255),
22 [NFTA_XFRM_DREG] = { .type = NLA_U32 },22 [NFTA_XFRM_DREG] = { .type = NLA_U32 },
23};23};
24 24