From f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c Mon Sep 17 00:00:00 2001 From: Brett Mastbergen Date: Wed, 12 Sep 2018 15:04:55 -0400 Subject: kernel: generic: Fix nftables inet table breakage Commit b7265c59ab7d ("kernel: backport a series of netfilter cleanup patches to 4.14") added patch 302-netfilter-nf_tables_inet-don-t-use- multihook-infrast.patch. That patch switches the netfilter core in the kernel to use the new native NFPROTO_INET support. Unfortunately, the new native NFPROTO_INET support does not exist in 4.14 and was not backported along with this patchset. As such, nftables inet tables never see any traffic. As an example the following nft counter rule should increment for every packet coming into the box, but never will: nft add table inet foo nft add chain inet foo bar { type filter hook input priority 0\; } nft add rule inet foo bar counter This commit pulls in the required backport patches to add the new native NFPROTO_INET support, and thus restore nftables inet table functionality. Tested on Turris Omnia (mvebu) Fixes: b7265c59ab7d ("kernel: backport a series of netfilter cleanup ...") Signed-off-by: Brett Mastbergen --- ...ore-pass-hook-number-family-and-device-to.patch | 98 ++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 target/linux/generic/backport-4.14/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch (limited to 'target/linux/generic/backport-4.14/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch') diff --git a/target/linux/generic/backport-4.14/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch b/target/linux/generic/backport-4.14/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch new file mode 100644 index 0000000000..7d450f95f0 --- /dev/null +++ b/target/linux/generic/backport-4.14/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch @@ -0,0 +1,98 @@ +From 62a0fe46e2aaba1812d3cbcae014a41539f9eb09 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Sat, 9 Dec 2017 15:23:51 +0100 +Subject: [PATCH 09/11] netfilter: core: pass hook number, family and device to + nf_find_hook_list() + +Instead of passing struct nf_hook_ops, this is needed by follow up +patches to handle NFPROTO_INET from the core. + +Signed-off-by: Pablo Neira Ayuso +--- + net/netfilter/core.c | 36 +++++++++++++++++++----------------- + 1 file changed, 19 insertions(+), 17 deletions(-) + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -262,36 +262,38 @@ out_assign: + return old; + } + +-static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg) ++static struct nf_hook_entries __rcu ** ++nf_hook_entry_head(struct net *net, int pf, unsigned int hooknum, ++ struct net_device *dev) + { +- switch (reg->pf) { ++ switch (pf) { + case NFPROTO_NETDEV: + break; + #ifdef CONFIG_NETFILTER_FAMILY_ARP + case NFPROTO_ARP: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= hooknum)) + return NULL; +- return net->nf.hooks_arp + reg->hooknum; ++ return net->nf.hooks_arp + hooknum; + #endif + #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE + case NFPROTO_BRIDGE: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= hooknum)) + return NULL; +- return net->nf.hooks_bridge + reg->hooknum; ++ return net->nf.hooks_bridge + hooknum; + #endif + case NFPROTO_IPV4: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= hooknum)) + return NULL; +- return net->nf.hooks_ipv4 + reg->hooknum; ++ return net->nf.hooks_ipv4 + hooknum; + case NFPROTO_IPV6: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= hooknum)) + return NULL; +- return net->nf.hooks_ipv6 + reg->hooknum; ++ return net->nf.hooks_ipv6 + hooknum; + #if IS_ENABLED(CONFIG_DECNET) + case NFPROTO_DECNET: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= hooknum)) + return NULL; +- return net->nf.hooks_decnet + reg->hooknum; ++ return net->nf.hooks_decnet + hooknum; + #endif + default: + WARN_ON_ONCE(1); +@@ -299,9 +301,9 @@ static struct nf_hook_entries __rcu **nf + } + + #ifdef CONFIG_NETFILTER_INGRESS +- if (reg->hooknum == NF_NETDEV_INGRESS) { +- if (reg->dev && dev_net(reg->dev) == net) +- return ®->dev->nf_hooks_ingress; ++ if (hooknum == NF_NETDEV_INGRESS) { ++ if (dev && dev_net(dev) == net) ++ return &dev->nf_hooks_ingress; + } + #endif + WARN_ON_ONCE(1); +@@ -323,7 +325,7 @@ int nf_register_net_hook(struct net *net + return -EINVAL; + } + +- pp = nf_hook_entry_head(net, reg); ++ pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev); + if (!pp) + return -EINVAL; + +@@ -397,7 +399,7 @@ void nf_unregister_net_hook(struct net * + struct nf_hook_entries __rcu **pp; + struct nf_hook_entries *p; + +- pp = nf_hook_entry_head(net, reg); ++ pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev); + if (!pp) + return; + -- cgit v1.2.3