History

netfilter: nfnetlink: allow to check for generation ID

This patch allows userspace to specify the generation ID that has been used to build an incremental batch update. If userspace specifies the generation ID in the batch message as attribute, then nfnetlink compares it to the current generation ID so you make sure that you work against the right baseline. Otherwise, bail out with ERESTART so userspace knows that its changeset is stale and needs to respin. Userspace can do this transparently at the cost of taking slightly more time to refresh caches and rework the changeset. This check is optional, if there is no NFNL_BATCH_GENID attribute in the batch begin message, then no check is performed.

Pablo Neira Ayuso committed 9 years ago

Commit 8c4d4e81 parent 48656833 files · +40 −4Browse files

Showing the changes to include/uapi/linux (1 of 3 files). Show all

Unified · Split

include/uapi/linux/netfilter/nfnetlink.h+12−0
@@ -65,4 +65,16 @@ struct nfgenmsg { · 64 unmodified lines
65#define NFNL_MSG_BATCH_BEGIN NLMSG_MIN_TYPE65#define NFNL_MSG_BATCH_BEGIN NLMSG_MIN_TYPE
66#define NFNL_MSG_BATCH_END NLMSG_MIN_TYPE+166#define NFNL_MSG_BATCH_END NLMSG_MIN_TYPE+1
67 67
68/**
69 * enum nfnl_batch_attributes - nfnetlink batch netlink attributes
70 *
71 * @NFNL_BATCH_GENID: generation ID for this changeset (NLA_U32)
72 */
73enum nfnl_batch_attributes {
74 NFNL_BATCH_UNSPEC,
75 NFNL_BATCH_GENID,
76 __NFNL_BATCH_MAX
77};
78#define NFNL_BATCH_MAX (__NFNL_BATCH_MAX - 1)
79
68#endif /* _UAPI_NFNETLINK_H */80#endif /* _UAPI_NFNETLINK_H */