From patchwork Thu Feb 28 23:08:18 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 224197 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id E99AF2C029F for ; Fri, 1 Mar 2013 10:08:38 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756464Ab3B1XIg (ORCPT ); Thu, 28 Feb 2013 18:08:36 -0500 Received: from mail.us.es ([193.147.175.20]:33355 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758001Ab3B1XIf (ORCPT ); Thu, 28 Feb 2013 18:08:35 -0500 Received: (qmail 5400 invoked from network); 1 Mar 2013 00:08:34 +0100 Received: from unknown (HELO us.es) (192.168.2.13) by us.es with SMTP; 1 Mar 2013 00:08:34 +0100 Received: (qmail 27265 invoked by uid 507); 28 Feb 2013 23:08:34 -0000 X-Qmail-Scanner-Diagnostics: from 127.0.0.1 by antivirus3 (envelope-from , uid 501) with qmail-scanner-2.10 (clamdscan: 0.97.6/16762. spamassassin: 3.3.2. Clear:RC:1(127.0.0.1):SA:0(-97.0/7.5):. Processed in 1.676399 secs); 28 Feb 2013 23:08:34 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on antivirus3 X-Spam-Level: X-Spam-Status: No, score=-97.0 required=7.5 tests=BAYES_50, RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_DYNAMIC, USER_IN_WHITELIST autolearn=disabled version=3.3.2 X-Envelope-From: pablo@netfilter.org Received: from unknown (HELO antivirus3) (127.0.0.1) by us.es with SMTP; 28 Feb 2013 23:08:32 -0000 Received: from 192.168.1.13 (192.168.1.13) by antivirus3 (F-Secure/fsigk_smtp/407/antivirus3); Fri, 01 Mar 2013 00:08:32 +0100 (CET) X-Virus-Status: clean(F-Secure/fsigk_smtp/407/antivirus3) Received: (qmail 18225 invoked from network); 1 Mar 2013 00:08:32 +0100 Received: from 22.229.78.188.dynamic.jazztel.es (HELO soleta.pb.local) (pneira@us.es@188.78.229.22) by us.es with SMTP; 1 Mar 2013 00:08:32 +0100 From: pablo@netfilter.org To: netfilter-devel@vger.kernel.org Cc: kaber@trash.net, tomasz.bursztyka@linux.intel.com Subject: [PATCH 2/2] netfilter: nf_tables: don't skip inactive rules and dump generation mask Date: Fri, 1 Mar 2013 00:08:18 +0100 Message-Id: <1362092898-23306-2-git-send-email-pablo@netfilter.org> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1362092898-23306-1-git-send-email-pablo@netfilter.org> References: <1362092898-23306-1-git-send-email-pablo@netfilter.org> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Pablo Neira Ayuso The user-space program gets the full rule-set, including active and inactive ones plus the generation mask to know what the current state of the rule is. Signed-off-by: Pablo Neira Ayuso --- include/uapi/linux/netfilter/nf_tables.h | 1 + net/netfilter/nf_tables_api.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 76b215f..66d5bde 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -101,6 +101,7 @@ enum nft_rule_attributes { NFTA_RULE_EXPRESSIONS, NFTA_RULE_FLAGS, NFTA_RULE_COMPAT, + NFTA_RULE_GENMASK, __NFTA_RULE_MAX }; #define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index beace28..fd2c8b6 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1287,6 +1287,8 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, u32 portid, u32 seq, goto nla_put_failure; if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle))) goto nla_put_failure; + if (nla_put_be32(skb, NFTA_RULE_GENMASK, htonl(rule->genmask))) + return -1; list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS); if (list == NULL) @@ -1401,8 +1403,6 @@ static int nf_tables_dump_rules(struct sk_buff *skb, list_for_each_entry(table, &afi->tables, list) { list_for_each_entry(chain, &table->chains, list) { list_for_each_entry(rule, &chain->rules, list) { - if (!nft_rule_is_active(net, rule)) - goto cont; if (idx < s_idx) goto cont; if (idx > s_idx)