Commit 25e94a99 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails 



The underlying nlmsg_multicast() already sets sk->sk_err for us to
notify socket overruns, so we should not do anything with this return
value. So we just call nfnetlink_set_err() if:

1) We fail to allocate the netlink message.

or

2) We don't have enough space in the netlink message to place attributes,
   which means that we likely need to allocate a larger message.

Before this patch, the internal ESRCH netlink error code was propagated
to userspace, which is quite misleading. Netlink semantics mandate that
listeners just hit ENOBUFS if the socket buffer overruns.

Reported-by: default avatarAlexander Alemayhu <alexander@alemayhu.com>
Tested-by: default avatarAlexander Alemayhu <alexander@alemayhu.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f9121355

include/net/netfilter/nf_tables.h

+3 −3
Original line number Original line Diff line number Diff line
@@ -988,7 +988,7 @@ struct nft_object *nf_tables_obj_lookup(const struct nft_table *table, 
					const struct nlattr *nla, u32 objtype,

					const struct nlattr *nla, u32 objtype,

					u8 genmask);

					u8 genmask);





int nft_obj_notify(struct net *net, struct nft_table *table,

void nft_obj_notify(struct net *net, struct nft_table *table,

		    struct nft_object *obj, u32 portid, u32 seq,

		    struct nft_object *obj, u32 portid, u32 seq,

		    int event, int family, int report, gfp_t gfp);

		    int event, int family, int report, gfp_t gfp);

net/netfilter/nf_tables_api.c

+55 −78
Original line number Original line Diff line number Diff line
@@ -461,16 +461,15 @@ nla_put_failure: 
	return -1;

	return -1;

}

}





static int nf_tables_table_notify(const struct nft_ctx *ctx, int event)

static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)

{

{

	struct sk_buff *skb;

	struct sk_buff *skb;

	int err;

	int err;





	if (!ctx->report &&

	if (!ctx->report &&

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

		return 0;

		return;





	err = -ENOBUFS;

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	if (skb == NULL)

	if (skb == NULL)

		goto err;

		goto err;
@@ -482,14 +481,11 @@ static int nf_tables_table_notify(const struct nft_ctx *ctx, int event) 
		goto err;

		goto err;

	}

	}





	err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,

	nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,

		       ctx->report, GFP_KERNEL);

		       ctx->report, GFP_KERNEL);

	return;

err:

err:

	if (err < 0) {

	nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);

		nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,

				  err);

	}

	return err;

}

}





static int nf_tables_dump_tables(struct sk_buff *skb,

static int nf_tables_dump_tables(struct sk_buff *skb,
@@ -1050,16 +1046,15 @@ nla_put_failure: 
	return -1;

	return -1;

}

}





static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event)

static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)

{

{

	struct sk_buff *skb;

	struct sk_buff *skb;

	int err;

	int err;





	if (!ctx->report &&

	if (!ctx->report &&

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

		return 0;

		return;





	err = -ENOBUFS;

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	if (skb == NULL)

	if (skb == NULL)

		goto err;

		goto err;
@@ -1072,14 +1067,11 @@ static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event) 
		goto err;

		goto err;

	}

	}





	err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,

	nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,

		       ctx->report, GFP_KERNEL);

		       ctx->report, GFP_KERNEL);

	return;

err:

err:

	if (err < 0) {

	nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);

		nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,

				  err);

	}

	return err;

}

}





static int nf_tables_dump_chains(struct sk_buff *skb,

static int nf_tables_dump_chains(struct sk_buff *skb,
@@ -1934,18 +1926,16 @@ nla_put_failure: 
	return -1;

	return -1;

}

}





static int nf_tables_rule_notify(const struct nft_ctx *ctx,

static void nf_tables_rule_notify(const struct nft_ctx *ctx,

				 const struct nft_rule *rule,

				  const struct nft_rule *rule, int event)

				 int event)

{

{

	struct sk_buff *skb;

	struct sk_buff *skb;

	int err;

	int err;





	if (!ctx->report &&

	if (!ctx->report &&

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

		return 0;

		return;





	err = -ENOBUFS;

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	if (skb == NULL)

	if (skb == NULL)

		goto err;

		goto err;
@@ -1958,14 +1948,11 @@ static int nf_tables_rule_notify(const struct nft_ctx *ctx, 
		goto err;

		goto err;

	}

	}





	err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,

	nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,

		       ctx->report, GFP_KERNEL);

		       ctx->report, GFP_KERNEL);

	return;

err:

err:

	if (err < 0) {

	nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);

		nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,

				  err);

	}

	return err;

}

}





struct nft_rule_dump_ctx {

struct nft_rule_dump_ctx {
@@ -2696,9 +2683,9 @@ nla_put_failure: 
	return -1;

	return -1;

}

}





static int nf_tables_set_notify(const struct nft_ctx *ctx,

static void nf_tables_set_notify(const struct nft_ctx *ctx,

				const struct nft_set *set,

				 const struct nft_set *set, int event,

				int event, gfp_t gfp_flags)

			         gfp_t gfp_flags)

{

{

	struct sk_buff *skb;

	struct sk_buff *skb;

	u32 portid = ctx->portid;

	u32 portid = ctx->portid;
@@ -2706,9 +2693,8 @@ static int nf_tables_set_notify(const struct nft_ctx *ctx, 




	if (!ctx->report &&

	if (!ctx->report &&

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))

		return 0;

		return;





	err = -ENOBUFS;

	skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);

	skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);

	if (skb == NULL)

	if (skb == NULL)

		goto err;

		goto err;
@@ -2719,12 +2705,11 @@ static int nf_tables_set_notify(const struct nft_ctx *ctx, 
		goto err;

		goto err;

	}

	}





	err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES,

	nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,

			     ctx->report, gfp_flags);

		       gfp_flags);

	return;

err:

err:

	if (err < 0)

	nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);

		nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err);

	return err;

}

}





static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)

static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
@@ -3504,7 +3489,7 @@ nla_put_failure: 
	return -1;

	return -1;

}

}





static int nf_tables_setelem_notify(const struct nft_ctx *ctx,

static void nf_tables_setelem_notify(const struct nft_ctx *ctx,

				     const struct nft_set *set,

				     const struct nft_set *set,

				     const struct nft_set_elem *elem,

				     const struct nft_set_elem *elem,

				     int event, u16 flags)

				     int event, u16 flags)
@@ -3515,9 +3500,8 @@ static int nf_tables_setelem_notify(const struct nft_ctx *ctx, 
	int err;

	int err;





	if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))

	if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))

		return 0;

		return;





	err = -ENOBUFS;

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	if (skb == NULL)

	if (skb == NULL)

		goto err;

		goto err;
@@ -3529,12 +3513,11 @@ static int nf_tables_setelem_notify(const struct nft_ctx *ctx, 
		goto err;

		goto err;

	}

	}





	err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,

	nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,

		       GFP_KERNEL);

		       GFP_KERNEL);

	return;

err:

err:

	if (err < 0)

	nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);

		nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);

	return err;

}

}





static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,

static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
@@ -4476,7 +4459,7 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk, 
	return nft_delobj(&ctx, obj);

	return nft_delobj(&ctx, obj);

}

}





int nft_obj_notify(struct net *net, struct nft_table *table,

void nft_obj_notify(struct net *net, struct nft_table *table,

		    struct nft_object *obj, u32 portid, u32 seq, int event,

		    struct nft_object *obj, u32 portid, u32 seq, int event,

		    int family, int report, gfp_t gfp)

		    int family, int report, gfp_t gfp)

{

{
@@ -4485,9 +4468,8 @@ int nft_obj_notify(struct net *net, struct nft_table *table, 




	if (!report &&

	if (!report &&

	    !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))

	    !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))

		return 0;

		return;





	err = -ENOBUFS;

	skb = nlmsg_new(NLMSG_GOODSIZE, gfp);

	skb = nlmsg_new(NLMSG_GOODSIZE, gfp);

	if (skb == NULL)

	if (skb == NULL)

		goto err;

		goto err;
@@ -4499,21 +4481,18 @@ int nft_obj_notify(struct net *net, struct nft_table *table, 
		goto err;

		goto err;

	}

	}





	err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);

	nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);

	return;

err:

err:

	if (err < 0) {

	nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);

		nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);

	}

	return err;

}

}

EXPORT_SYMBOL_GPL(nft_obj_notify);

EXPORT_SYMBOL_GPL(nft_obj_notify);





static int nf_tables_obj_notify(const struct nft_ctx *ctx,

static void nf_tables_obj_notify(const struct nft_ctx *ctx,

				 struct nft_object *obj, int event)

				 struct nft_object *obj, int event)

{

{

	return nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid,

	nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,

			      ctx->seq, event, ctx->afi->family, ctx->report,

		       ctx->afi->family, ctx->report, GFP_KERNEL);

			      GFP_KERNEL);

}

}





static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,

static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
@@ -4543,7 +4522,8 @@ nla_put_failure: 
	return -EMSGSIZE;

	return -EMSGSIZE;

}

}





static int nf_tables_gen_notify(struct net *net, struct sk_buff *skb, int event)

static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,

				 int event)

{

{

	struct nlmsghdr *nlh = nlmsg_hdr(skb);

	struct nlmsghdr *nlh = nlmsg_hdr(skb);

	struct sk_buff *skb2;

	struct sk_buff *skb2;
@@ -4551,9 +4531,8 @@ static int nf_tables_gen_notify(struct net *net, struct sk_buff *skb, int event) 




	if (nlmsg_report(nlh) &&

	if (nlmsg_report(nlh) &&

	    !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))

	    !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))

		return 0;

		return;





	err = -ENOBUFS;

	skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);

	if (skb2 == NULL)

	if (skb2 == NULL)

		goto err;

		goto err;
@@ -4565,14 +4544,12 @@ static int nf_tables_gen_notify(struct net *net, struct sk_buff *skb, int event) 
		goto err;

		goto err;

	}

	}





	err = nfnetlink_send(skb2, net, NETLINK_CB(skb).portid,

	nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,

			     NFNLGRP_NFTABLES, nlmsg_report(nlh), GFP_KERNEL);

		       nlmsg_report(nlh), GFP_KERNEL);

	return;

err:

err:

	if (err < 0) {

	nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,

	nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,

				  err);

			  -ENOBUFS);

	}

	return err;

}

}





static int nf_tables_getgen(struct net *net, struct sock *nlsk,

static int nf_tables_getgen(struct net *net, struct sock *nlsk,

CRA Git | Maintained and supported by SUSTech CRA and CCSE