netfilter: nf_tables_offload: undo updates if transaction fails

The nft_flow_rule_offload_commit() function might fail after several
successful commands, thus, leaving the hardware filtering policy in
inconsistent state.

This patch adds nft_flow_rule_offload_abort() function which undoes the
updates that have been already processed if one command in this
transaction fails. Hence, the hardware ruleset is left as it was before
this aborted transaction.

The deletion path needs to create the flow_rule object too, in case that
an existing rule needs to be re-added from the abort path.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2dc636faa322c497cefb4f96b227dbe7ec033852..4f0d880a8496564bd1fb5594c540d0557e4afcb3 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -361,6 +361,7 @@ static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
 
 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
 {
+       struct nft_flow_rule *flow;
        struct nft_trans *trans;
        int err;
 
@@ -368,6 +369,16 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
        if (trans == NULL)
                return -ENOMEM;
 
+       if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
+               flow = nft_flow_rule_create(ctx->net, rule);
+               if (IS_ERR(flow)) {
+                       nft_trans_destroy(trans);
+                       return PTR_ERR(flow);
+               }
+
+               nft_trans_flow_rule(trans) = flow;
+       }
+
        err = nf_tables_delrule_deactivate(ctx, rule);
        if (err < 0) {
                nft_trans_destroy(trans);

diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 6d5f3cd7f1b742d8fd4067651fe86f4c3de2f9b5..68f17a6921d825f014d0a32b29495e90185c9d4b 100644 (file)
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -389,6 +389,55 @@ static int nft_flow_offload_chain(struct nft_chain *chain, u8 *ppolicy,
        return nft_flow_block_chain(basechain, NULL, cmd);
 }
 
+static void nft_flow_rule_offload_abort(struct net *net,
+                                       struct nft_trans *trans)
+{
+       int err = 0;
+
+       list_for_each_entry_continue_reverse(trans, &net->nft.commit_list, list) {
+               if (trans->ctx.family != NFPROTO_NETDEV)
+                       continue;
+
+               switch (trans->msg_type) {
+               case NFT_MSG_NEWCHAIN:
+                       if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
+                           nft_trans_chain_update(trans))
+                               continue;
+
+                       err = nft_flow_offload_chain(trans->ctx.chain, NULL,
+                                                    FLOW_BLOCK_UNBIND);
+                       break;
+               case NFT_MSG_DELCHAIN:
+                       if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
+                               continue;
+
+                       err = nft_flow_offload_chain(trans->ctx.chain, NULL,
+                                                    FLOW_BLOCK_BIND);
+                       break;
+               case NFT_MSG_NEWRULE:
+                       if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
+                               continue;
+
+                       err = nft_flow_offload_rule(trans->ctx.chain,
+                                                   nft_trans_rule(trans),
+                                                   NULL, FLOW_CLS_DESTROY);
+                       break;
+               case NFT_MSG_DELRULE:
+                       if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
+                               continue;
+
+                       err = nft_flow_offload_rule(trans->ctx.chain,
+                                                   nft_trans_rule(trans),
+                                                   nft_trans_flow_rule(trans),
+                                                   FLOW_CLS_REPLACE);
+                       break;
+               }
+
+               if (WARN_ON_ONCE(err))
+                       break;
+       }
+}
+
 int nft_flow_rule_offload_commit(struct net *net)
 {
        struct nft_trans *trans;
@@ -441,8 +490,10 @@ int nft_flow_rule_offload_commit(struct net *net)
                        break;
                }
 
-               if (err)
+               if (err) {
+                       nft_flow_rule_offload_abort(net, trans);
                        break;
+               }
        }
 
        list_for_each_entry(trans, &net->nft.commit_list, list) {
@@ -451,6 +502,7 @@ int nft_flow_rule_offload_commit(struct net *net)
 
                switch (trans->msg_type) {
                case NFT_MSG_NEWRULE:
+               case NFT_MSG_DELRULE:
                        if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
                                continue;