netdev - Re: [PATCH net-next 9/9] netfilter: nf_tables: add support to destroy operation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b26f9820-dec7-848c-3d00-8df03119b9d0@riseup.net>
Date:   Fri, 20 Jan 2023 11:06:56 +0100
From:   "Fernando F. Mancera" <ffmancera@...eup.net>
To:     Vlad Buslov <vladbu@...dia.com>, Florian Westphal <fw@...len.de>
Cc:     netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Maor Dickman <maord@...dia.com>, yangyingliang@...wei.com
Subject: Re: [PATCH net-next 9/9] netfilter: nf_tables: add support to destroy
 operation

On 20/01/2023 10:58, Fernando F. Mancera wrote:
> Hi Vlad,
> 
> On 19/01/2023 08:29, Vlad Buslov wrote:
>> On Wed 18 Jan 2023 at 13:32, Florian Westphal <fw@...len.de> wrote:
>>> From: Fernando Fernandez Mancera <ffmancera@...eup.net>
>>>
>>> Introduce NFT_MSG_DESTROY* message type. The destroy operation 
>>> performs a
>>> delete operation but ignoring the ENOENT errors.
>>>
>>> This is useful for the transaction semantics, where failing to delete an
>>> object which does not exist results in aborting the transaction.
>>>
>>> This new command allows the transaction to proceed in case the object
>>> does not exist.
>>>
>>> Signed-off-by: Fernando Fernandez Mancera <ffmancera@...eup.net>
>>> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
>>> Signed-off-by: Florian Westphal <fw@...len.de>
>>> ---
>>>   include/uapi/linux/netfilter/nf_tables.h |  14 +++
>>>   net/netfilter/nf_tables_api.c            | 111 +++++++++++++++++++++--
>>>   2 files changed, 117 insertions(+), 8 deletions(-)
>>>
>>> diff --git a/include/uapi/linux/netfilter/nf_tables.h 
>>> b/include/uapi/linux/netfilter/nf_tables.h
>>> index cfa844da1ce6..ff677f3a6cad 100644
>>> --- a/include/uapi/linux/netfilter/nf_tables.h
>>> +++ b/include/uapi/linux/netfilter/nf_tables.h
>>> @@ -98,6 +98,13 @@ enum nft_verdicts {
>>>    * @NFT_MSG_GETFLOWTABLE: get flow table (enum 
>>> nft_flowtable_attributes)
>>>    * @NFT_MSG_DELFLOWTABLE: delete flow table (enum 
>>> nft_flowtable_attributes)
>>>    * @NFT_MSG_GETRULE_RESET: get rules and reset stateful expressions 
>>> (enum nft_obj_attributes)
>>> + * @NFT_MSG_DESTROYTABLE: destroy a table (enum nft_table_attributes)
>>> + * @NFT_MSG_DESTROYCHAIN: destroy a chain (enum nft_chain_attributes)
>>> + * @NFT_MSG_DESTROYRULE: destroy a rule (enum nft_rule_attributes)
>>> + * @NFT_MSG_DESTROYSET: destroy a set (enum nft_set_attributes)
>>> + * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum 
>>> nft_set_elem_attributes)
>>> + * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum 
>>> nft_object_attributes)
>>> + * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum 
>>> nft_flowtable_attributes)
>>>    */
>>>   enum nf_tables_msg_types {
>>>       NFT_MSG_NEWTABLE,
>>> @@ -126,6 +133,13 @@ enum nf_tables_msg_types {
>>>       NFT_MSG_GETFLOWTABLE,
>>>       NFT_MSG_DELFLOWTABLE,
>>>       NFT_MSG_GETRULE_RESET,
>>> +    NFT_MSG_DESTROYTABLE,
>>> +    NFT_MSG_DESTROYCHAIN,
>>> +    NFT_MSG_DESTROYRULE,
>>> +    NFT_MSG_DESTROYSET,
>>> +    NFT_MSG_DESTROYSETELEM,
>>> +    NFT_MSG_DESTROYOBJ,
>>> +    NFT_MSG_DESTROYFLOWTABLE,
>>>       NFT_MSG_MAX,
>>>   };
>>> diff --git a/net/netfilter/nf_tables_api.c 
>>> b/net/netfilter/nf_tables_api.c
>>> index 8c09e4d12ac1..974b95dece1d 100644
>>> --- a/net/netfilter/nf_tables_api.c
>>> +++ b/net/netfilter/nf_tables_api.c
>>> @@ -1401,6 +1401,10 @@ static int nf_tables_deltable(struct sk_buff 
>>> *skb, const struct nfnl_info *info,
>>>       }
>>>       if (IS_ERR(table)) {
>>> +        if (PTR_ERR(table) == -ENOENT &&
>>> +            NFNL_MSG_TYPE(info->nlh->nlmsg_type) == 
>>> NFT_MSG_DESTROYTABLE)
>>> +            return 0;
>>> +
>>>           NL_SET_BAD_ATTR(extack, attr);
>>>           return PTR_ERR(table);
>>>       }
>>> @@ -2639,6 +2643,10 @@ static int nf_tables_delchain(struct sk_buff 
>>> *skb, const struct nfnl_info *info,
>>>           chain = nft_chain_lookup(net, table, attr, genmask);
>>>       }
>>>       if (IS_ERR(chain)) {
>>> +        if (PTR_ERR(chain) == -ENOENT &&
>>> +            NFNL_MSG_TYPE(info->nlh->nlmsg_type) == 
>>> NFT_MSG_DESTROYCHAIN)
>>> +            return 0;
>>> +
>>>           NL_SET_BAD_ATTR(extack, attr);
>>>           return PTR_ERR(chain);
>>>       }
>>> @@ -3716,6 +3724,10 @@ static int nf_tables_delrule(struct sk_buff 
>>> *skb, const struct nfnl_info *info,
>>>           chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
>>>                        genmask);
>>>           if (IS_ERR(chain)) {
>>> +            if (PTR_ERR(rule) == -ENOENT &&
>>
>> Coverity complains that at this point rule is not initialized yet, which
>> looks like to be the case to me.
>>
> 
> Thanks, I am sending a patch fixing this.
> 
>> [...]
>>

There is already a patch sent by Yang Yingliang, 
https://lore.kernel.org/netfilter-devel/20230119075125.3598627-1-yangyingliang@huawei.com/T/#u