From 01b27b6d961d548c25f0fc185fd05fc3d2380080 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 16 Sep 2014 18:58:11 +0200 Subject: mnl: consistency checks across several netlink dumps Obtain the generation ID before dumping the object lists. Then, check for generation ID updates when dumping the several lists that this needs. In case of interference, nft has to remove the stale objects and retry from scratch. This is complementary to the NLM_F_DUMP_INTR flag which is local to one single netlink dump. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/nf_tables.h | 16 ++++++++++++++++ include/mnl.h | 1 + include/netlink.h | 1 + 3 files changed, 18 insertions(+) (limited to 'include') diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 66d66dd3..b72ccfea 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -51,6 +51,8 @@ enum nft_verdicts { * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes) * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes) * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes) + * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes) + * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes) */ enum nf_tables_msg_types { NFT_MSG_NEWTABLE, @@ -68,6 +70,8 @@ enum nf_tables_msg_types { NFT_MSG_NEWSETELEM, NFT_MSG_GETSETELEM, NFT_MSG_DELSETELEM, + NFT_MSG_NEWGEN, + NFT_MSG_GETGEN, NFT_MSG_MAX, }; @@ -812,4 +816,16 @@ enum nft_masq_attributes { }; #define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1) +/** + * enum nft_gen_attributes - nf_tables ruleset generation attributes + * + * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32) + */ +enum nft_gen_attributes { + NFTA_GEN_UNSPEC, + NFTA_GEN_ID, + __NFTA_GEN_MAX +}; +#define NFTA_GEN_MAX (__NFTA_GEN_MAX - 1) + #endif /* _LINUX_NF_TABLES_H */ diff --git a/include/mnl.h b/include/mnl.h index ed5a718b..03d1876e 100644 --- a/include/mnl.h +++ b/include/mnl.h @@ -6,6 +6,7 @@ struct mnl_socket; uint32_t mnl_seqnum_alloc(void); +void mnl_genid_get(struct mnl_socket *nf_sock); struct mnl_err { struct list_head head; diff --git a/include/netlink.h b/include/netlink.h index 2df37422..4f794707 100644 --- a/include/netlink.h +++ b/include/netlink.h @@ -138,6 +138,7 @@ extern void netlink_dump_set(struct nft_set *nls); extern int netlink_batch_send(struct list_head *err_list); +extern void netlink_genid_get(void); extern void netlink_restart(void); #define netlink_abi_error() \ __netlink_abi_error(__FILE__, __LINE__, strerror(errno)); -- cgit v1.2.3