netfilter: nf_tables: Tolerate chains with no remaining hooks

Do not drop a netdev-family chain if the last interface it is registered
for vanishes. Users dumping and storing the ruleset upon shutdown to
restore it upon next boot may otherwise lose the chain and all contained
rules. They will still lose the list of devices, a later patch will fix
that. For now, this aligns the event handler's behaviour with that for
flowtables.
The controversal situation at netns exit should be no problem here:
event handler will unregister the hooks, core nftables cleanup code will
drop the chain itself.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index bd93d085b6fb49e1fc271b7f5f4cafaaa7ece976..60d5dcdb289c9ca00a9588e1e60db7f5c8311caa 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1238,8 +1238,6 @@ static inline bool nft_is_base_chain(const struct nft_chain *chain)
        return chain->flags & NFT_CHAIN_BASE;
 }
 
-int __nft_release_basechain(struct nft_ctx *ctx);
-
 unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
 
 static inline bool nft_use_inc(u32 *use)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ed15c52e3c6513f40a331b7798d0ed6f9e1bd2df..667459256e4c5eacd32dc8f72e24e8558b4a97d9 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -11741,47 +11741,6 @@ int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
 }
 EXPORT_SYMBOL_GPL(nft_data_dump);
 
-static void __nft_release_basechain_now(struct nft_ctx *ctx)
-{
-       struct nft_rule *rule, *nr;
-
-       list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
-               list_del(&rule->list);
-               nf_tables_rule_release(ctx, rule);
-       }
-       nf_tables_chain_destroy(ctx->chain);
-}
-
-int __nft_release_basechain(struct nft_ctx *ctx)
-{
-       struct nft_rule *rule;
-
-       if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain)))
-               return 0;
-
-       nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
-       list_for_each_entry(rule, &ctx->chain->rules, list)
-               nft_use_dec(&ctx->chain->use);
-
-       nft_chain_del(ctx->chain);
-       nft_use_dec(&ctx->table->use);
-
-       if (!maybe_get_net(ctx->net)) {
-               __nft_release_basechain_now(ctx);
-               return 0;
-       }
-
-       /* wait for ruleset dumps to complete.  Owning chain is no longer in
-        * lists, so new dumps can't find any of these rules anymore.
-        */
-       synchronize_rcu();
-
-       __nft_release_basechain_now(ctx);
-       put_net(ctx->net);
-       return 0;
-}
-EXPORT_SYMBOL_GPL(__nft_release_basechain);
-
 static void __nft_release_hook(struct net *net, struct nft_table *table)
 {
        struct nft_flowtable *flowtable;

diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 7010541fcca66f27382bb49297e97a3ca613ad39..543f258b7c6bae89a00b1e71cfa5e68051c01451 100644 (file)
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -322,34 +322,19 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev,
                             struct nft_ctx *ctx)
 {
        struct nft_base_chain *basechain = nft_base_chain(ctx->chain);
-       struct nft_hook *hook, *found = NULL;
-       int n = 0;
+       struct nft_hook *hook;
 
        list_for_each_entry(hook, &basechain->hook_list, list) {
-               if (hook->ops.dev == dev)
-                       found = hook;
-
-               n++;
-       }
-       if (!found)
-               return;
+               if (hook->ops.dev != dev)
+                       continue;
 
-       if (n > 1) {
                if (!(ctx->chain->table->flags & NFT_TABLE_F_DORMANT))
-                       nf_unregister_net_hook(ctx->net, &found->ops);
+                       nf_unregister_net_hook(ctx->net, &hook->ops);
 
-               list_del_rcu(&found->list);
-               kfree_rcu(found, rcu);
-               return;
+               list_del_rcu(&hook->list);
+               kfree_rcu(hook, rcu);
+               break;
        }
-
-       /* UNREGISTER events are also happening on netns exit.
-        *
-        * Although nf_tables core releases all tables/chains, only this event
-        * handler provides guarantee that hook->ops.dev is still accessible,
-        * so we cannot skip exiting net namespaces.
-        */
-       __nft_release_basechain(ctx);
 }
 
 static int nf_tables_netdev_event(struct notifier_block *this,