From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: phil@nwl.cc, fw@strlen.de
Subject: [PATCH iptables 6/6] nft: ensure cache consistency
Date: Mon, 20 May 2019 14:26:46 +0200 [thread overview]
Message-ID: <20190520122646.17788-7-pablo@netfilter.org> (raw)
In-Reply-To: <20190520122646.17788-1-pablo@netfilter.org>
Check for generation ID before and after fetching the cache to ensure
consistency.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
iptables/nft.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/iptables/nft.c b/iptables/nft.c
index 063637e22fb8..172beec9ae27 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -63,7 +63,7 @@ static void *nft_fn;
static int genid_cb(const struct nlmsghdr *nlh, void *data)
{
- struct nft_handle *h = data;
+ uint32_t *genid = data;
struct nftnl_gen *gen;
gen = nftnl_gen_alloc();
@@ -73,7 +73,7 @@ static int genid_cb(const struct nlmsghdr *nlh, void *data)
if (nftnl_gen_nlmsg_parse(nlh, gen) < 0)
goto out;
- h->nft_genid = nftnl_gen_get_u32(gen, NFTNL_GEN_ID);
+ *genid = nftnl_gen_get_u32(gen, NFTNL_GEN_ID);
nftnl_gen_free(gen);
return MNL_CB_STOP;
@@ -82,13 +82,13 @@ out:
return MNL_CB_ERROR;
}
-static int mnl_genid_get(struct nft_handle *h)
+static int mnl_genid_get(struct nft_handle *h, uint32_t *genid)
{
char buf[MNL_SOCKET_BUFFER_SIZE];
struct nlmsghdr *nlh;
nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETGEN, 0, 0, h->seq);
- return mnl_talk(h, nlh, genid_cb, h);
+ return mnl_talk(h, nlh, genid_cb, genid);
}
int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
@@ -1595,12 +1595,22 @@ static int fetch_rule_cache(struct nft_handle *h)
static void __nft_build_cache(struct nft_handle *h)
{
- mnl_genid_get(h);
+ uint32_t genid_start, genid_stop;
+
+retry:
+ mnl_genid_get(h, &genid_start);
fetch_chain_cache(h);
fetch_rule_cache(h);
h->have_cache = true;
-}
+ mnl_genid_get(h, &genid_stop);
+ if (genid_start != genid_stop) {
+ flush_chain_cache(h, NULL);
+ goto retry;
+ }
+
+ h->nft_genid = genid_start;
+}
void nft_build_cache(struct nft_handle *h)
{
--
2.11.0
prev parent reply other threads:[~2019-05-20 12:27 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-20 12:26 [PATCH iptables 0/6] cache rework Pablo Neira Ayuso
2019-05-20 12:26 ` [PATCH iptables 1/6] nft: add struct nft_cache Pablo Neira Ayuso
2019-05-20 12:26 ` [PATCH iptables 2/6] nft: statify nft_rebuild_cache() Pablo Neira Ayuso
2019-05-20 12:26 ` [PATCH iptables 3/6] nft: add __nft_table_builtin_find() Pablo Neira Ayuso
2019-05-20 12:26 ` [PATCH iptables 4/6] nft: add flush_cache() Pablo Neira Ayuso
2019-05-20 12:26 ` [PATCH iptables 5/6] nft: cache table list Pablo Neira Ayuso
2019-05-20 12:26 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190520122646.17788-7-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).