Commit 478b360a authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: fix nf_trace always-on with XT_TRACE=n 



When using nftables with CONFIG_NETFILTER_XT_TARGET_TRACE=n, we get
lots of "TRACE: filter:output:policy:1 IN=..." warnings as several
places will leave skb->nf_trace uninitialised.

Unlike iptables tracing functionality is not conditional in nftables,
so always copy/zero nf_trace setting when nftables is enabled.

Move this into __nf_copy() helper.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2b7a79ba

include/linux/skbuff.h

+4 −1
Original line number Diff line number Diff line
@@ -2725,7 +2725,7 @@ static inline void nf_reset(struct sk_buff *skb) 


static inline void nf_reset_trace(struct sk_buff *skb)

{

#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)

#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)

	skb->nf_trace = 0;

#endif

}
@@ -2742,6 +2742,9 @@ static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src) 
	dst->nf_bridge  = src->nf_bridge;

	nf_bridge_get(src->nf_bridge);

#endif

#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)

	dst->nf_trace = src->nf_trace;

#endif

}



static inline void nf_copy(struct sk_buff *dst, const struct sk_buff *src)

net/core/skbuff.c

+0 −3
Original line number Diff line number Diff line
@@ -707,9 +707,6 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old) 
	new->mark		= old->mark;

	new->skb_iif		= old->skb_iif;

	__nf_copy(new, old);

#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)

	new->nf_trace		= old->nf_trace;

#endif

#ifdef CONFIG_NET_SCHED

	new->tc_index		= old->tc_index;

#ifdef CONFIG_NET_CLS_ACT

net/ipv4/ip_output.c

+0 −3
Original line number Diff line number Diff line
@@ -422,9 +422,6 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) 
	to->tc_index = from->tc_index;

#endif

	nf_copy(to, from);

#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)

	to->nf_trace = from->nf_trace;

#endif

#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)

	to->ipvs_property = from->ipvs_property;

#endif

net/ipv6/ip6_output.c

+0 −3
Original line number Diff line number Diff line
@@ -517,9 +517,6 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from) 
	to->tc_index = from->tc_index;

#endif

	nf_copy(to, from);

#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)

	to->nf_trace = from->nf_trace;

#endif

	skb_copy_secmark(to, from);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE