netfilter: nf_tables: make validation state per table

We only need to validate tables that saw changes in the current
transaction.

The existing code revalidates all tables, but this isn't needed as
cross-table jumps are not allowed (chains have table scope).

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index f476fd030626de355bc55f7864a0c918141274be..ec347d9cff9e28f7ece4111edf897b61e5c110f2 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1209,6 +1209,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
  *     @genmask: generation mask
  *     @afinfo: address family info
  *     @name: name of the table
+ *     @validate_state: internal, set when transaction adds jumps
  */
 struct nft_table {
        struct list_head                list;
@@ -1227,6 +1228,7 @@ struct nft_table {
        char                            *name;
        u16                             udlen;
        u8                              *udata;
+       u8                              validate_state;
 };
 
 static inline bool nft_table_has_owner(const struct nft_table *table)
@@ -1698,7 +1700,6 @@ struct nftables_pernet {
        struct mutex            commit_mutex;
        u64                     table_handle;
        unsigned int            base_seq;
-       u8                      validate_state;
 };
 
 extern unsigned int nf_tables_net_id;

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 21eb273d2740976a84011dc6b65c747e65a1fc29..44ebc5f9598e455e8983e6a758a746f58255eb45 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -102,11 +102,9 @@ static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types
        [NFT_MSG_DELFLOWTABLE]  = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
 };
 
-static void nft_validate_state_update(struct net *net, u8 new_validate_state)
+static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state)
 {
-       struct nftables_pernet *nft_net = nft_pernet(net);
-
-       switch (nft_net->validate_state) {
+       switch (table->validate_state) {
        case NFT_VALIDATE_SKIP:
                WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
                break;
@@ -117,7 +115,7 @@ static void nft_validate_state_update(struct net *net, u8 new_validate_state)
                        return;
        }
 
-       nft_net->validate_state = new_validate_state;
+       table->validate_state = new_validate_state;
 }
 static void nf_tables_trans_destroy_work(struct work_struct *w);
 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
@@ -1224,6 +1222,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
        if (table == NULL)
                goto err_kzalloc;
 
+       table->validate_state = NFT_VALIDATE_SKIP;
        table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT);
        if (table->name == NULL)
                goto err_strdup;
@@ -3660,7 +3659,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
                }
 
                if (expr_info[i].ops->validate)
-                       nft_validate_state_update(net, NFT_VALIDATE_NEED);
+                       nft_validate_state_update(table, NFT_VALIDATE_NEED);
 
                expr_info[i].ops = NULL;
                expr = nft_expr_next(expr);
@@ -3710,7 +3709,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
        if (flow)
                nft_trans_flow_rule(trans) = flow;
 
-       if (nft_net->validate_state == NFT_VALIDATE_DO)
+       if (table->validate_state == NFT_VALIDATE_DO)
                return nft_table_validate(net, table);
 
        return 0;
@@ -6312,7 +6311,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                        if (desc.type == NFT_DATA_VERDICT &&
                            (elem.data.val.verdict.code == NFT_GOTO ||
                             elem.data.val.verdict.code == NFT_JUMP))
-                               nft_validate_state_update(ctx->net,
+                               nft_validate_state_update(ctx->table,
                                                          NFT_VALIDATE_NEED);
                }
 
@@ -6437,7 +6436,6 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
                                const struct nfnl_info *info,
                                const struct nlattr * const nla[])
 {
-       struct nftables_pernet *nft_net = nft_pernet(info->net);
        struct netlink_ext_ack *extack = info->extack;
        u8 genmask = nft_genmask_next(info->net);
        u8 family = info->nfmsg->nfgen_family;
@@ -6476,7 +6474,7 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
                }
        }
 
-       if (nft_net->validate_state == NFT_VALIDATE_DO)
+       if (table->validate_state == NFT_VALIDATE_DO)
                return nft_table_validate(net, table);
 
        return 0;
@@ -8628,19 +8626,20 @@ static int nf_tables_validate(struct net *net)
        struct nftables_pernet *nft_net = nft_pernet(net);
        struct nft_table *table;
 
-       switch (nft_net->validate_state) {
-       case NFT_VALIDATE_SKIP:
-               break;
-       case NFT_VALIDATE_NEED:
-               nft_validate_state_update(net, NFT_VALIDATE_DO);
-               fallthrough;
-       case NFT_VALIDATE_DO:
-               list_for_each_entry(table, &nft_net->tables, list) {
+       list_for_each_entry(table, &nft_net->tables, list) {
+               switch (table->validate_state) {
+               case NFT_VALIDATE_SKIP:
+                       continue;
+               case NFT_VALIDATE_NEED:
+                       nft_validate_state_update(table, NFT_VALIDATE_DO);
+                       fallthrough;
+               case NFT_VALIDATE_DO:
                        if (nft_table_validate(net, table) < 0)
                                return -EAGAIN;
+
+                       nft_validate_state_update(table, NFT_VALIDATE_SKIP);
                }
 
-               nft_validate_state_update(net, NFT_VALIDATE_SKIP);
                break;
        }
 
@@ -10355,7 +10354,6 @@ static int __net_init nf_tables_init_net(struct net *net)
        INIT_LIST_HEAD(&nft_net->notify_list);
        mutex_init(&nft_net->commit_mutex);
        nft_net->base_seq = 1;
-       nft_net->validate_state = NFT_VALIDATE_SKIP;
 
        return 0;
 }