Skip to content

Commit

Permalink
netfilter: nf_tables: implement set transaction support
Browse files Browse the repository at this point in the history 
Set elements are the last object type not supporting transaction support.
Implement similar to the existing rule transactions:

The global transaction counter keeps track of two generations, current
and next. Each element contains a bitmask specifying in which generations
it is inactive.

New elements start out as inactive in the current generation and active
in the next. On commit, the previous next generation becomes the current
generation and the element becomes active. The bitmask is then cleared
to indicate that the element is active in all future generations. If the
transaction is aborted, the element is removed from the set before it
becomes active.

When removing an element, it gets marked as inactive in the next generation.
On commit the next generation becomes active and the therefor the element
inactive. It is then taken out of then set and released. On abort, the
element is marked as active for the next generation again.

Lookups ignore elements not active in the current generation.

The current set types (hash/rbtree) both use a field in the extension area
to store the generation mask. This (currently) does not require any
additional memory since we have some free space in there.

Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
  • Loading branch information
@kaber @ummakynes
kaber authored and ummakynes committed Mar 26, 2015
1 parent ea4bd99 commit cc02e45
Show file tree
Hide file tree
Showing 4 changed files with 112 additions and 40 deletions.
33 changes: 26 additions & 7 deletions include/net/netfilter/nf_tables.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,15 +138,10 @@ struct nft_userdata {
/**
* struct nft_set_elem - generic representation of set elements
*
* @cookie: implementation specific element cookie
* @key: element key
* @priv: element private data and extensions
*
* The cookie can be used to store a handle to the element for subsequent
* removal.
*/
struct nft_set_elem {
void *cookie;
struct nft_data key;
void *priv;
};
Expand Down Expand Up @@ -207,6 +202,8 @@ struct nft_set_ext;
*
* @lookup: look up an element within the set
* @insert: insert new element into set
* @activate: activate new element in the next generation
* @deactivate: deactivate element in the next generation
* @remove: remove element from set
* @walk: iterate over all set elemeennts
* @privsize: function to return size of set private data
Expand All @@ -221,10 +218,12 @@ struct nft_set_ops {
bool (*lookup)(const struct nft_set *set,
const struct nft_data *key,
const struct nft_set_ext **ext);
int (*get)(const struct nft_set *set,
struct nft_set_elem *elem);
int (*insert)(const struct nft_set *set,
const struct nft_set_elem *elem);
void (*activate)(const struct nft_set *set,
const struct nft_set_elem *elem);
void * (*deactivate)(const struct nft_set *set,
const struct nft_set_elem *elem);
void (*remove)(const struct nft_set *set,
const struct nft_set_elem *elem);
void (*walk)(const struct nft_ctx *ctx,
Expand Down Expand Up @@ -261,6 +260,7 @@ void nft_unregister_set(struct nft_set_ops *ops);
* @nelems: number of elements
* @policy: set parameterization (see enum nft_set_policies)
* @ops: set ops
* @pnet: network namespace
* @flags: set flags
* @klen: key length
* @dlen: data length
Expand All @@ -277,6 +277,7 @@ struct nft_set {
u16 policy;
/* runtime data below here */
const struct nft_set_ops *ops ____cacheline_aligned;
possible_net_t pnet;
u16 flags;
u8 klen;
u8 dlen;
Expand Down Expand Up @@ -355,10 +356,12 @@ struct nft_set_ext_tmpl {
/**
* struct nft_set_ext - set extensions
*
* @genmask: generation mask
* @offset: offsets of individual extension types
* @data: beginning of extension data
*/
struct nft_set_ext {
u8 genmask;
u8 offset[NFT_SET_EXT_NUM];
char data[0];
};
Expand Down Expand Up @@ -748,6 +751,22 @@ static inline u8 nft_genmask_cur(const struct net *net)
return 1 << ACCESS_ONCE(net->nft.gencursor);
}

/*
* Set element transaction helpers
*/

static inline bool nft_set_elem_active(const struct nft_set_ext *ext,
u8 genmask)
{
return !(ext->genmask & genmask);
}

static inline void nft_set_elem_change_active(const struct nft_set *set,
struct nft_set_ext *ext)
{
ext->genmask ^= nft_genmask_next(read_pnet(&set->pnet));
}

/**
* struct nft_trans - nf_tables object update in transaction
*
Expand Down
33 changes: 20 additions & 13 deletions net/netfilter/nf_tables_api.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2690,6 +2690,7 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
goto err2;

INIT_LIST_HEAD(&set->bindings);
write_pnet(&set->pnet, net);
set->ops = ops;
set->ktype = ktype;
set->klen = desc.klen;
Expand Down Expand Up @@ -3221,10 +3222,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
goto err2;

err = -EEXIST;
if (set->ops->get(set, &elem) == 0)
goto err2;

nft_set_ext_add(&tmpl, NFT_SET_EXT_KEY);

if (nla[NFTA_SET_ELEM_DATA] != NULL) {
Expand Down Expand Up @@ -3266,6 +3263,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
if (trans == NULL)
goto err4;

ext->genmask = nft_genmask_cur(ctx->net);
err = set->ops->insert(set, &elem);
if (err < 0)
goto err5;
Expand Down Expand Up @@ -3353,19 +3351,24 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
goto err2;

err = set->ops->get(set, &elem);
if (err < 0)
goto err2;

trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
if (trans == NULL) {
err = -ENOMEM;
goto err2;
}

elem.priv = set->ops->deactivate(set, &elem);
if (elem.priv == NULL) {
err = -ENOENT;
goto err3;
}

nft_trans_elem(trans) = elem;
list_add_tail(&trans->list, &ctx->net->nft.commit_list);
return 0;

err3:
kfree(trans);
err2:
nft_data_uninit(&elem.key, desc.type);
err1:
Expand Down Expand Up @@ -3692,9 +3695,11 @@ static int nf_tables_commit(struct sk_buff *skb)
NFT_MSG_DELSET, GFP_KERNEL);
break;
case NFT_MSG_NEWSETELEM:
nf_tables_setelem_notify(&trans->ctx,
nft_trans_elem_set(trans),
&nft_trans_elem(trans),
te = (struct nft_trans_elem *)trans->data;

te->set->ops->activate(te->set, &te->elem);
nf_tables_setelem_notify(&trans->ctx, te->set,
&te->elem,
NFT_MSG_NEWSETELEM, 0);
nft_trans_destroy(trans);
break;
Expand All @@ -3704,7 +3709,6 @@ static int nf_tables_commit(struct sk_buff *skb)
nf_tables_setelem_notify(&trans->ctx, te->set,
&te->elem,
NFT_MSG_DELSETELEM, 0);
te->set->ops->get(te->set, &te->elem);
te->set->ops->remove(te->set, &te->elem);
break;
}
Expand Down Expand Up @@ -3812,11 +3816,14 @@ static int nf_tables_abort(struct sk_buff *skb)
nft_trans_elem_set(trans)->nelems--;
te = (struct nft_trans_elem *)trans->data;

te->set->ops->get(te->set, &te->elem);
te->set->ops->remove(te->set, &te->elem);
break;
case NFT_MSG_DELSETELEM:
te = (struct nft_trans_elem *)trans->data;

nft_trans_elem_set(trans)->nelems++;
te->set->ops->activate(te->set, &te->elem);

nft_trans_destroy(trans);
break;
}
Expand Down
38 changes: 28 additions & 10 deletions net/netfilter/nft_hash.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ struct nft_hash_elem {
struct nft_hash_cmp_arg {
const struct nft_set *set;
const struct nft_data *key;
u8 genmask;
};

static const struct rhashtable_params nft_hash_params;
Expand All @@ -61,6 +62,8 @@ static inline int nft_hash_cmp(struct rhashtable_compare_arg *arg,

if (nft_data_cmp(nft_set_ext_key(&he->ext), x->key, x->set->klen))
return 1;
if (!nft_set_elem_active(&he->ext, x->genmask))
return 1;
return 0;
}

Expand All @@ -71,6 +74,7 @@ static bool nft_hash_lookup(const struct nft_set *set,
struct nft_hash *priv = nft_set_priv(set);
const struct nft_hash_elem *he;
struct nft_hash_cmp_arg arg = {
.genmask = nft_genmask_cur(read_pnet(&set->pnet)),
.set = set,
.key = key,
};
Expand All @@ -88,6 +92,7 @@ static int nft_hash_insert(const struct nft_set *set,
struct nft_hash *priv = nft_set_priv(set);
struct nft_hash_elem *he = elem->priv;
struct nft_hash_cmp_arg arg = {
.genmask = nft_genmask_next(read_pnet(&set->pnet)),
.set = set,
.key = &elem->key,
};
Expand All @@ -96,30 +101,39 @@ static int nft_hash_insert(const struct nft_set *set,
nft_hash_params);
}

static void nft_hash_remove(const struct nft_set *set,
const struct nft_set_elem *elem)
static void nft_hash_activate(const struct nft_set *set,
const struct nft_set_elem *elem)
{
struct nft_hash *priv = nft_set_priv(set);
struct nft_hash_elem *he = elem->priv;

rhashtable_remove_fast(&priv->ht, elem->cookie, nft_hash_params);
nft_set_elem_change_active(set, &he->ext);
}

static int nft_hash_get(const struct nft_set *set, struct nft_set_elem *elem)
static void *nft_hash_deactivate(const struct nft_set *set,
const struct nft_set_elem *elem)
{
struct nft_hash *priv = nft_set_priv(set);
struct nft_hash_elem *he;
struct nft_hash_cmp_arg arg = {
.genmask = nft_genmask_next(read_pnet(&set->pnet)),
.set = set,
.key = &elem->key,
};

he = rhashtable_lookup_fast(&priv->ht, &arg, nft_hash_params);
if (!he)
return -ENOENT;
if (he != NULL)
nft_set_elem_change_active(set, &he->ext);

elem->priv = he;
return he;
}

return 0;
static void nft_hash_remove(const struct nft_set *set,
const struct nft_set_elem *elem)
{
struct nft_hash *priv = nft_set_priv(set);
struct nft_hash_elem *he = elem->priv;

rhashtable_remove_fast(&priv->ht, &he->node, nft_hash_params);
}

static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
Expand All @@ -129,6 +143,7 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
struct nft_hash_elem *he;
struct rhashtable_iter hti;
struct nft_set_elem elem;
u8 genmask = nft_genmask_cur(read_pnet(&set->pnet));
int err;

err = rhashtable_walk_init(&priv->ht, &hti);
Expand All @@ -155,6 +170,8 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,

if (iter->count < iter->skip)
goto cont;
if (!nft_set_elem_active(&he->ext, genmask))
goto cont;

elem.priv = he;

Expand Down Expand Up @@ -241,8 +258,9 @@ static struct nft_set_ops nft_hash_ops __read_mostly = {
.estimate = nft_hash_estimate,
.init = nft_hash_init,
.destroy = nft_hash_destroy,
.get = nft_hash_get,
.insert = nft_hash_insert,
.activate = nft_hash_activate,
.deactivate = nft_hash_deactivate,
.remove = nft_hash_remove,
.lookup = nft_hash_lookup,
.walk = nft_hash_walk,
Expand Down
Loading

0 comments on commit cc02e45

Please sign in to comment.