Commit e0d45931 authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: make nftables drops visible in net dropmonitor 



net_dropmonitor blames core.c:nf_hook_slow.
Add NF_DROP_REASON() helper and use it in nft_do_chain().

The helper releases the skb, so exact drop location becomes
available. Calling code will observe the NF_STOLEN verdict
instead.

Adjust nf_hook_slow so we can embed an erro value wih
NF_STOLEN verdicts, just like we do for NF_DROP.

After this, drop in nftables can be pinpointed to a drop due
to a rule or the chain policy.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 35c038b0

include/linux/netfilter.h

+10 −0
Original line number Diff line number Diff line
@@ -22,6 +22,16 @@ static inline int NF_DROP_GETERR(int verdict) 
	return -(verdict >> NF_VERDICT_QBITS);

}



static __always_inline int

NF_DROP_REASON(struct sk_buff *skb, enum skb_drop_reason reason, u32 err)

{

	BUILD_BUG_ON(err > 0xffff);



	kfree_skb_reason(skb, reason);



	return ((err << 16) | NF_STOLEN);

}



static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,

				   const union nf_inet_addr *a2)

{

net/netfilter/core.c

+3 −3
Original line number Diff line number Diff line
@@ -639,10 +639,10 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, 
			if (ret == 1)

				continue;

			return ret;

		case NF_STOLEN:

			return NF_DROP_GETERR(verdict);

		default:

			/* Implicit handling for NF_STOLEN, as well as any other

			 * non conventional verdicts.

			 */

			WARN_ON_ONCE(1);

			return 0;

		}

	}

net/netfilter/nf_tables_core.c

+5 −1
Original line number Diff line number Diff line
@@ -308,10 +308,11 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 


	switch (regs.verdict.code & NF_VERDICT_MASK) {

	case NF_ACCEPT:

	case NF_DROP:

	case NF_QUEUE:

	case NF_STOLEN:

		return regs.verdict.code;

	case NF_DROP:

		return NF_DROP_REASON(pkt->skb, SKB_DROP_REASON_NETFILTER_DROP, EPERM);

	}



	switch (regs.verdict.code) {
@@ -342,6 +343,9 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 
	if (static_branch_unlikely(&nft_counters_enabled))

		nft_update_chain_stats(basechain, pkt);



	if (nft_base_chain(basechain)->policy == NF_DROP)

		return NF_DROP_REASON(pkt->skb, SKB_DROP_REASON_NETFILTER_DROP, EPERM);



	return nft_base_chain(basechain)->policy;

}

EXPORT_SYMBOL_GPL(nft_do_chain);