Changes in nft_range.c

7ea0522e - netfilter: nf_tables: pass context structure to nft_parse_register_load

Tue, 20 Aug 2024 09:56:12 +0000

netfilter: nf_tables: pass context structure to nft_parse_register_loadMechanical transformation, no logical changes intended.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

a412dbf4 - netfilter: nf_tables: limit allowed range via nla_policy

Wed, 21 Jun 2023 19:11:03 +0000

netfilter: nf_tables: limit allowed range via nla_policyThese NLA_U32 types get stored in u8 fields, reject invalid valuesinstead of silently casting to u8.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

7d34aa3e - netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters

Fri, 14 Oct 2022 21:45:58 +0000

netfilter: nf_tables: Extend nft_expr_ops::dump callback parametersAdd a 'reset' flag just like with nft_object_ops::dump. This will beuseful to reset "anonymous stateful objects", e.g. simple rule counters.No functional change intended.Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

341b6941 - netfilter: nf_tables: upfront validation of data via nft_data_init()

Mon, 08 Aug 2022 17:30:06 +0000

netfilter: nf_tables: upfront validation of data via nft_data_init()Instead of parsing the data and then validate that type and length arecorrect, pass a description of the expected data so it can be validatedupfront before parsing it to bail out earlier.This patch adds a new .size field to specify the maximum size of thedata area. The .len field is optional and it is used as an input/outputfield, it provides the specific length of the expected data in the inputpath. If then .len field is not specified, then obtained length from thenetlink attribute is stored. This is required by cmp, bitwise, range andimmediate, which provide no netlink attribute that describes the datalength. The immediate expression uses the destination register type toinfer the expected data type.Relying on opencoded validation of the expected data might lead tosubtle bugs as described in 7e6bc1f6cabc ("netfilter: nf_tables:stricter validation of element data").Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

b2d30654 - netfilter: nf_tables: do not reduce read-only expressions

Mon, 14 Mar 2022 17:23:00 +0000

netfilter: nf_tables: do not reduce read-only expressionsSkip register tracking for expressions that perform read-only operationson the registers. Define and use a cookie pointer NFT_REDUCE_READONLY toavoid defining stubs for these expressions.This patch re-enables register tracking which was disabled in ed5f85d42290("netfilter: nf_tables: disable register tracking"). Follow up patchesadd remaining register tracking for existing expressions.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

4f16d25c - netfilter: nftables: add nft_parse_register_load() and use it

Mon, 25 Jan 2021 16:28:18 +0000

netfilter: nftables: add nft_parse_register_load() and use itThis new function combines the netlink register attribute parserand the load validation function.This update requires to replace: enum nft_registers sreg:8;in many of the expression private areas otherwise compiler complainswith: error: cannot take address of bit-field ‘sreg’when passing the register field as reference.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

0d2c96af - netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()

Fri, 06 Dec 2019 21:09:14 +0000

netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()Userspace might bogusly sent NFT_DATA_VERDICT in several netlinkattributes that assume NFT_DATA_VALUE. Moreover, make sure that errorpath invokes nft_data_release() to decrement the reference count on thechain object.Fixes: 96518518cc41 ("netfilter: add nftables")Fixes: 0f3cd9b36977 ("netfilter: nf_tables: add range expression")Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

d2912cb1 - treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

Tue, 04 Jun 2019 08:11:33 +0000

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500Based on 2 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation #extracted by the scancode license scanner the SPDX license identifier GPL-2.0-onlyhas been chosen to replace the boilerplate/reference in 4122 file(s).Signed-off-by: Thomas Gleixner Reviewed-by: Enrico Weigelt Reviewed-by: Kate Stewart Reviewed-by: Allison Randal Cc: linux-spdx@vger.kernel.orgLink: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.deSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/netfilter/nft_range.c

10870dd8 - netfilter: nf_tables: add direct calls for all builtin expressions

Tue, 08 Jan 2019 16:35:34 +0000

netfilter: nf_tables: add direct calls for all builtin expressionsWith CONFIG_RETPOLINE its faster to add an if (ptr == &foo_func)check and and use direct calls for all the built-in expressions.~15% improvement in pathological cases.checkpatch doesn't like the X macro due to the embedded return statement,but the macro has a very limited scope so I don't think its a problem.I would like to avoid bugs of the form If (e->ops->eval == (unsigned long)nft_foo_eval) nft_bar_eval();and open-coded if ()/else if()/else cascade, thus the macro.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

59105446 - netfilter: nf_tables: revisit chain/object refcounting from elements

Mon, 15 May 2017 10:17:34 +0000

netfilter: nf_tables: revisit chain/object refcounting from elementsAndreas reports that the following incremental update using our commitprotocol doesn't work. # nft -f incremental-update.nft delete element ip filter client_to_any { 10.180.86.22 : goto CIn_1 } delete chain ip filter CIn_1 ... Error: Could not process rule: Device or resource busyThe existing code is not well-integrated into the commit phase protocol,since element deletions do not result in refcount decrement from thepreparation phase. This results in bogus EBUSY errors like the oneabove.Two new functions come with this patch:* nft_set_elem_activate() function is used from the abort path, to restore the set element refcounting on objects that occurred from the preparation phase.* nft_set_elem_deactivate() that is called from nft_del_setelem() to decrement set element refcounting on objects from the preparation phase in the commit protocol.The nft_data_uninit() has been renamed to nft_data_release() since thisfunction does not uninitialize any data store in the data register,instead just releases the references to objects. Moreover, a newfunction nft_data_hold() has been introduced to be used fromnft_set_elem_activate().Reported-by: Andreas Schultz Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

49cdc4c7 - netfilter: nft_range: add the missing NULL pointer check

Mon, 21 Nov 2016 13:18:23 +0000

netfilter: nft_range: add the missing NULL pointer checkOtherwise, kernel panic will happen if the user does not specifythe related attributes.Fixes: 0f3cd9b36977 ("netfilter: nf_tables: add range expression")Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

4e24877e - netfilter: nf_tables: simplify the basic expressions' init routine

Sun, 06 Nov 2016 13:15:51 +0000

netfilter: nf_tables: simplify the basic expressions' init routineSome basic expressions are built into nf_tables.ko, such as nft_cmp,nft_lookup, nft_range and so on. But these basic expressions' initroutine is a little ugly, too many goto errX labels, and we forgetto call nft_range_module_exit in the exit routine, although it isharmless.Acctually, the init and exit routines of these basic expressionsare same, i.e. do nft_register_expr in the init routine and donft_unregister_expr in the exit routine.So it's better to arrange them into an array and deal with themtogether.Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

d2e4d593 - netfilter: nf_tables: avoid uninitialized variable warning

Mon, 17 Oct 2016 22:05:30 +0000

netfilter: nf_tables: avoid uninitialized variable warningThe newly added nft_range_eval() function handles the two possiblenft range operations, but as the compiler warning points out,any unexpected value would lead to the 'mismatch' variable beingused without being initialized:net/netfilter/nft_range.c: In function 'nft_range_eval':net/netfilter/nft_range.c:45:5: error: 'mismatch' may be used uninitialized in this function [-Werror=maybe-uninitialized]This removes the variable in question and instead moves thecondition into the switch itself, which is potentially moreefficient than adding a bogus 'default' clause as in myfirst approach, and is nicer than using the 'uninitialized_var'macro.Fixes: 0f3cd9b36977 ("netfilter: nf_tables: add range expression")Link: http://patchwork.ozlabs.org/patch/677114/Signed-off-by: Arnd Bergmann Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

ccca6607 - netfilter: nft_range: validate operation netlink attribute

Thu, 13 Oct 2016 06:42:17 +0000

netfilter: nft_range: validate operation netlink attributeUse nft_parse_u32_check() to make sure we don't get a value over theunsigned 8-bit integer. Moreover, make sure this value doesn't go overthe two supported range comparison modes.Fixes: 9286c2eb1fda ("netfilter: nft_range: validate operation netlink attribute")Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c

0f3cd9b3 - netfilter: nf_tables: add range expression

Fri, 23 Sep 2016 13:23:33 +0000

netfilter: nf_tables: add range expressionInverse ranges != [a,b] are not currently possible because rules arecomposites of && operations, and we need to express this: data < a || data > bThis patch adds a new range expression. Positive ranges can be alreadythrough two cmp expressions: cmp(sreg, data, >=) cmp(sreg, data, <=)This new range expression provides an alternative way to express this.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_range.c