Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea4bd995 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add transaction helper functions 



Add some helper functions for building the genmask as preparation for
set transactions.

Also add a little documentation how this stuff actually works.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b2832dd6

include/net/netfilter/nf_tables.h

+28 −0
Original line number Diff line number Diff line
@@ -720,6 +720,34 @@ void nft_unregister_expr(struct nft_expr_type *); 
#define MODULE_ALIAS_NFT_SET() \

	MODULE_ALIAS("nft-set")



/*

 * The gencursor defines two generations, the currently active and the

 * next one. Objects contain a bitmask of 2 bits specifying the generations

 * they're active in. A set bit means they're inactive in the generation

 * represented by that bit.

 *

 * New objects start out as inactive in the current and active in the

 * next generation. When committing the ruleset the bitmask is cleared,

 * meaning they're active in all generations. When removing an object,

 * it is set inactive in the next generation. After committing the ruleset,

 * the objects are removed.

 */

static inline unsigned int nft_gencursor_next(const struct net *net)

{

	return net->nft.gencursor + 1 == 1 ? 1 : 0;

}



static inline u8 nft_genmask_next(const struct net *net)

{

	return 1 << nft_gencursor_next(net);

}



static inline u8 nft_genmask_cur(const struct net *net)

{

	/* Use ACCESS_ONCE() to prevent refetching the value for atomicity */

	return 1 << ACCESS_ONCE(net->nft.gencursor);

}



/**

 *	struct nft_trans - nf_tables object update in transaction

 *

net/netfilter/nf_tables_api.c

+6 −11
Original line number Diff line number Diff line
@@ -198,36 +198,31 @@ static int nft_delchain(struct nft_ctx *ctx) 
static inline bool

nft_rule_is_active(struct net *net, const struct nft_rule *rule)

{

	return (rule->genmask & (1 << net->nft.gencursor)) == 0;

}



static inline int gencursor_next(struct net *net)

{

	return net->nft.gencursor+1 == 1 ? 1 : 0;

	return (rule->genmask & nft_genmask_cur(net)) == 0;

}



static inline int

nft_rule_is_active_next(struct net *net, const struct nft_rule *rule)

{

	return (rule->genmask & (1 << gencursor_next(net))) == 0;

	return (rule->genmask & nft_genmask_next(net)) == 0;

}



static inline void

nft_rule_activate_next(struct net *net, struct nft_rule *rule)

{

	/* Now inactive, will be active in the future */

	rule->genmask = (1 << net->nft.gencursor);

	rule->genmask = nft_genmask_cur(net);

}



static inline void

nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)

{

	rule->genmask = (1 << gencursor_next(net));

	rule->genmask = nft_genmask_next(net);

}



static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)

{

	rule->genmask &= ~(1 << gencursor_next(net));

	rule->genmask &= ~nft_genmask_next(net);

}



static int
@@ -3626,7 +3621,7 @@ static int nf_tables_commit(struct sk_buff *skb) 
	while (++net->nft.base_seq == 0);



	/* A new generation has just started */

	net->nft.gencursor = gencursor_next(net);

	net->nft.gencursor = nft_gencursor_next(net);



	/* Make sure all packets have left the previous generation before

	 * purging old rules.

net/netfilter/nf_tables_core.c

+1 −5
Original line number Diff line number Diff line
@@ -121,11 +121,7 @@ nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops) 
	struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];

	struct nft_stats *stats;

	int rulenum;

	/*

	 * Cache cursor to avoid problems in case that the cursor is updated

	 * while traversing the ruleset.

	 */

	unsigned int gencursor = ACCESS_ONCE(net->nft.gencursor);

	unsigned int gencursor = nft_genmask_cur(net);



do_chain:

	rulenum = 0;