Commit d93b10e8 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'nf-25-09-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Florian Westphal says:

====================
netfilter: updates for net

1) Fix a silly bug in conntrack selftest, busyloop may get optimized to
   for (;;), reported by Yi Chen.

2) Introduce new NFTA_DEVICE_PREFIX attribute in nftables netlink api,
   re-using old NFTA_DEVICE_NAME led to confusion with different
   kernel/userspace versions.  This refines the wildcard interface
   support added in 6.16 release.  From Phil Sutter.

* tag 'nf-25-09-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX
  selftests: netfilter: fix udpclash tool hang
====================

Link: https://patch.msgid.link/20250904072548.3267-1-fw@strlen.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 0a228624 4039ce7e

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -1784,10 +1784,12 @@ enum nft_synproxy_attributes { 
 * enum nft_device_attributes - nf_tables device netlink attributes

 *

 * @NFTA_DEVICE_NAME: name of this device (NLA_STRING)

 * @NFTA_DEVICE_PREFIX: device name prefix, a simple wildcard (NLA_STRING)

 */

enum nft_devices_attributes {

	NFTA_DEVICE_UNSPEC,

	NFTA_DEVICE_NAME,

	NFTA_DEVICE_PREFIX,

	__NFTA_DEVICE_MAX

};

#define NFTA_DEVICE_MAX		(__NFTA_DEVICE_MAX - 1)

net/netfilter/nf_tables_api.c

+31 −11
Original line number Diff line number Diff line
@@ -1959,6 +1959,18 @@ static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 
	return -ENOSPC;

}



static bool hook_is_prefix(struct nft_hook *hook)

{

	return strlen(hook->ifname) >= hook->ifnamelen;

}



static int nft_nla_put_hook_dev(struct sk_buff *skb, struct nft_hook *hook)

{

	int attr = hook_is_prefix(hook) ? NFTA_DEVICE_PREFIX : NFTA_DEVICE_NAME;



	return nla_put_string(skb, attr, hook->ifname);

}



static int nft_dump_basechain_hook(struct sk_buff *skb,

				   const struct net *net, int family,

				   const struct nft_base_chain *basechain,
@@ -1990,16 +2002,15 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, 
			if (!first)

				first = hook;



			if (nla_put(skb, NFTA_DEVICE_NAME,

				    hook->ifnamelen, hook->ifname))

			if (nft_nla_put_hook_dev(skb, hook))

				goto nla_put_failure;

			n++;

		}

		nla_nest_end(skb, nest_devs);



		if (n == 1 &&

		    nla_put(skb, NFTA_HOOK_DEV,

			    first->ifnamelen, first->ifname))

		    !hook_is_prefix(first) &&

		    nla_put_string(skb, NFTA_HOOK_DEV, first->ifname))

			goto nla_put_failure;

	}

	nla_nest_end(skb, nest);
@@ -2310,7 +2321,8 @@ void nf_tables_chain_destroy(struct nft_chain *chain) 
}



static struct nft_hook *nft_netdev_hook_alloc(struct net *net,

					      const struct nlattr *attr)

					      const struct nlattr *attr,

					      bool prefix)

{

	struct nf_hook_ops *ops;

	struct net_device *dev;
@@ -2327,7 +2339,8 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 
	if (err < 0)

		goto err_hook_free;



	hook->ifnamelen = nla_len(attr);

	/* include the terminating NUL-char when comparing non-prefixes */

	hook->ifnamelen = strlen(hook->ifname) + !prefix;



	/* nf_tables_netdev_event() is called under rtnl_mutex, this is

	 * indirectly serializing all the other holders of the commit_mutex with
@@ -2374,14 +2387,22 @@ static int nf_tables_parse_netdev_hooks(struct net *net, 
	struct nft_hook *hook, *next;

	const struct nlattr *tmp;

	int rem, n = 0, err;

	bool prefix;



	nla_for_each_nested(tmp, attr, rem) {

		if (nla_type(tmp) != NFTA_DEVICE_NAME) {

		switch (nla_type(tmp)) {

		case NFTA_DEVICE_NAME:

			prefix = false;

			break;

		case NFTA_DEVICE_PREFIX:

			prefix = true;

			break;

		default:

			err = -EINVAL;

			goto err_hook;

		}



		hook = nft_netdev_hook_alloc(net, tmp);

		hook = nft_netdev_hook_alloc(net, tmp, prefix);

		if (IS_ERR(hook)) {

			NL_SET_BAD_ATTR(extack, tmp);

			err = PTR_ERR(hook);
@@ -2427,7 +2448,7 @@ static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[], 
	int err;



	if (tb[NFTA_HOOK_DEV]) {

		hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);

		hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV], false);

		if (IS_ERR(hook)) {

			NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]);

			return PTR_ERR(hook);
@@ -9458,8 +9479,7 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 


	list_for_each_entry_rcu(hook, hook_list, list,

				lockdep_commit_lock_is_held(net)) {

		if (nla_put(skb, NFTA_DEVICE_NAME,

			    hook->ifnamelen, hook->ifname))

		if (nft_nla_put_hook_dev(skb, hook))

			goto nla_put_failure;

	}

	nla_nest_end(skb, nest_devs);

tools/testing/selftests/net/netfilter/conntrack_clash.sh

+1 −1
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ run_one_clash_test() 
	local entries

	local cre



	if ! ip netns exec "$ns" ./udpclash $daddr $dport;then

	if ! ip netns exec "$ns" timeout 30 ./udpclash $daddr $dport;then

		echo "INFO: did not receive expected number of replies for $daddr:$dport"

		ip netns exec "$ctns" conntrack -S

		# don't fail: check if clash resolution triggered after all.

tools/testing/selftests/net/netfilter/conntrack_resize.sh

+3 −2
Original line number Diff line number Diff line
@@ -187,7 +187,7 @@ ct_udpclash() 
	[ -x udpclash ] || return



        while [ $now -lt $end ]; do

		ip netns exec "$ns" ./udpclash 127.0.0.1 $((RANDOM%65536)) > /dev/null 2>&1

		ip netns exec "$ns" timeout 30 ./udpclash 127.0.0.1 $((RANDOM%65536)) > /dev/null 2>&1



		now=$(date +%s)

	done
@@ -277,6 +277,7 @@ check_taint() 
insert_flood()

{

	local n="$1"

	local timeout="$2"

	local r=0



	r=$((RANDOM%$insert_count))
@@ -302,7 +303,7 @@ test_floodresize_all() 
	read tainted_then < /proc/sys/kernel/tainted



	for n in "$nsclient1" "$nsclient2";do

		insert_flood "$n" &

		insert_flood "$n" "$timeout" &

	done



	# resize table constantly while flood/insert/dump/flushs

tools/testing/selftests/net/netfilter/udpclash.c

+1 −1
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ struct thread_args { 
	int sockfd;

};



static int wait = 1;

static volatile int wait = 1;



static void *thread_main(void *varg)

{