rpms/nftables
7
0
Fork 0
Code Issues Pull Requests Releases Activity
c9
nftables/SOURCES/0283-cache-Include-chains-flowtables-and-objects-in-netli.patch
AlmaLinux RelEng Bot 0ea6bbe225 import CS git nftables-1.0.9-9.el9_8
2026-08-26 08:03:54 -04:00

230 lines
6.9 KiB
Diff
Raw Permalink Blame History

From acd0619c4f9c6e480d68aa1006d38bc3540b8cbe Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Fri, 17 Jul 2026 11:20:05 +0200
Subject: [PATCH] cache: Include chains, flowtables and objects in netlink
debug output
JIRA: https://issues.redhat.com/browse/RHEL-190549
Upstream Status: nftables commit 43e82d7e79dc28fd63d5959c397e001a47d7c844
commit 43e82d7e79dc28fd63d5959c397e001a47d7c844
Author: Phil Sutter <phil@nwl.cc>
Date: Wed Feb 25 20:16:57 2026 +0100
cache: Include chains, flowtables and objects in netlink debug output
In order to test cache filter effectiveness, netlink debug output is
useful as it shows what is actually received from the kernel and maybe
discarded immediately by user space. Therefore add dump calls for these
rule set elements as well.
While at it, move the netlink_dump_rule() call to an earlier spot,
namely into the nft_mnl_talk() callback to match other netlink dump
calls.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Tested-by: Eric Garver <eric@garver.life>
Signed-off-by: Phil Sutter <psutter@redhat.com>
---
src/cache.c | 1 -
src/mnl.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++-------
2 files changed, 52 insertions(+), 9 deletions(-)
diff --git a/src/cache.c b/src/cache.c
index 5b6f46f..04a7c94 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -711,7 +711,6 @@ static int list_rule_cb(struct nftnl_rule *nlr, void *data)
(h->chain.name && strcmp(chain, h->chain.name) != 0))
return 0;
- netlink_dump_rule(nlr, ctx);
rule = netlink_delinearize_rule(ctx, nlr);
assert(rule);
list_add_tail(&rule->list, &ctx->list);
diff --git a/src/mnl.c b/src/mnl.c
index ec423e2..56c3fcf 100644
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -647,9 +647,15 @@ int mnl_nft_rule_del(struct netlink_ctx *ctx, struct cmd *cmd)
* Rule
*/
+struct rule_cb_args {
+ struct netlink_ctx *ctx;
+ struct nftnl_rule_list *list;
+};
+
static int rule_cb(const struct nlmsghdr *nlh, void *data)
{
- struct nftnl_rule_list *nlr_list = data;
+ struct rule_cb_args *args = data;
+ struct nftnl_rule_list *nlr_list = args->list;
struct nftnl_rule *r;
if (check_genid(nlh) < 0)
@@ -662,6 +668,8 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
if (nftnl_rule_nlmsg_parse(nlh, r) < 0)
goto err_free;
+ netlink_dump_rule(r, args->ctx);
+
nftnl_rule_list_add_tail(r, nlr_list);
return MNL_CB_OK;
@@ -679,6 +687,7 @@ struct nftnl_rule_list *mnl_nft_rule_dump(struct netlink_ctx *ctx, int family,
char buf[MNL_SOCKET_BUFFER_SIZE];
struct nftnl_rule_list *nlr_list;
struct nftnl_rule *nlr = NULL;
+ struct rule_cb_args args;
struct nlmsghdr *nlh;
int msg_type, ret;
@@ -710,7 +719,9 @@ struct nftnl_rule_list *mnl_nft_rule_dump(struct netlink_ctx *ctx, int family,
nftnl_rule_free(nlr);
}
- ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, rule_cb, nlr_list);
+ args.list = nlr_list;
+ args.ctx = ctx;
+ ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, rule_cb, &args);
if (ret < 0)
goto err;
@@ -983,9 +994,15 @@ int mnl_nft_chain_del(struct netlink_ctx *ctx, struct cmd *cmd)
return 0;
}
+struct chain_cb_args {
+ struct netlink_ctx *ctx;
+ struct nftnl_chain_list *list;
+};
+
static int chain_cb(const struct nlmsghdr *nlh, void *data)
{
- struct nftnl_chain_list *nlc_list = data;
+ struct chain_cb_args *args = data;
+ struct nftnl_chain_list *nlc_list = args->list;
struct nftnl_chain *c;
if (check_genid(nlh) < 0)
@@ -998,6 +1015,8 @@ static int chain_cb(const struct nlmsghdr *nlh, void *data)
if (nftnl_chain_nlmsg_parse(nlh, c) < 0)
goto err_free;
+ netlink_dump_chain(c, args->ctx);
+
nftnl_chain_list_add_tail(c, nlc_list);
return MNL_CB_OK;
@@ -1013,6 +1032,7 @@ struct nftnl_chain_list *mnl_nft_chain_dump(struct netlink_ctx *ctx,
char buf[MNL_SOCKET_BUFFER_SIZE];
struct nftnl_chain_list *nlc_list;
struct nftnl_chain *nlc = NULL;
+ struct chain_cb_args args;
struct nlmsghdr *nlh;
int ret;
@@ -1036,7 +1056,9 @@ struct nftnl_chain_list *mnl_nft_chain_dump(struct netlink_ctx *ctx,
nftnl_chain_free(nlc);
}
- ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, chain_cb, nlc_list);
+ args.list = nlc_list;
+ args.ctx = ctx;
+ ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, chain_cb, &args);
if (ret < 0 && errno != ENOENT)
goto err;
@@ -1614,9 +1636,15 @@ int mnl_nft_obj_del(struct netlink_ctx *ctx, struct cmd *cmd, int type)
return 0;
}
+struct obj_cb_args {
+ struct netlink_ctx *ctx;
+ struct nftnl_obj_list *list;
+};
+
static int obj_cb(const struct nlmsghdr *nlh, void *data)
{
- struct nftnl_obj_list *nln_list = data;
+ struct obj_cb_args *args = data;
+ struct nftnl_obj_list *nln_list = args->list;
struct nftnl_obj *n;
if (check_genid(nlh) < 0)
@@ -1629,6 +1657,8 @@ static int obj_cb(const struct nlmsghdr *nlh, void *data)
if (nftnl_obj_nlmsg_parse(nlh, n) < 0)
goto err_free;
+ netlink_dump_obj(n, args->ctx);
+
nftnl_obj_list_add_tail(n, nln_list);
return MNL_CB_OK;
@@ -1646,6 +1676,7 @@ mnl_nft_obj_dump(struct netlink_ctx *ctx, int family,
uint16_t nl_flags = dump ? NLM_F_DUMP : NLM_F_ACK;
struct nftnl_obj_list *nln_list;
char buf[MNL_SOCKET_BUFFER_SIZE];
+ struct obj_cb_args args;
struct nlmsghdr *nlh;
struct nftnl_obj *n;
int msg_type, ret;
@@ -1674,7 +1705,9 @@ mnl_nft_obj_dump(struct netlink_ctx *ctx, int family,
if (nln_list == NULL)
memory_allocation_error();
- ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, obj_cb, nln_list);
+ args.list = nln_list;
+ args.ctx = ctx;
+ ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, obj_cb, &args);
if (ret < 0)
goto err;
@@ -1950,9 +1983,15 @@ int mnl_nft_setelem_get(struct netlink_ctx *ctx, struct nftnl_set *nls,
return nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, set_elem_cb, nls);
}
+struct flowtable_cb_args {
+ struct netlink_ctx *ctx;
+ struct nftnl_flowtable_list *list;
+};
+
static int flowtable_cb(const struct nlmsghdr *nlh, void *data)
{
- struct nftnl_flowtable_list *nln_list = data;
+ struct flowtable_cb_args *args = data;
+ struct nftnl_flowtable_list *nln_list = args->list;
struct nftnl_flowtable *n;
if (check_genid(nlh) < 0)
@@ -1965,6 +2004,8 @@ static int flowtable_cb(const struct nlmsghdr *nlh, void *data)
if (nftnl_flowtable_nlmsg_parse(nlh, n) < 0)
goto err_free;
+ netlink_dump_flowtable(n, args->ctx);
+
nftnl_flowtable_list_add_tail(n, nln_list);
return MNL_CB_OK;
@@ -1979,6 +2020,7 @@ mnl_nft_flowtable_dump(struct netlink_ctx *ctx, int family,
{
struct nftnl_flowtable_list *nln_list;
char buf[MNL_SOCKET_BUFFER_SIZE];
+ struct flowtable_cb_args args;
struct nftnl_flowtable *n;
int flags = NLM_F_DUMP;
struct nlmsghdr *nlh;
@@ -2003,7 +2045,9 @@ mnl_nft_flowtable_dump(struct netlink_ctx *ctx, int family,
if (nln_list == NULL)
memory_allocation_error();
- ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, flowtable_cb, nln_list);
+ args.list = nln_list;
+ args.ctx = ctx;
+ ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, flowtable_cb, &args);
if (ret < 0 && errno != ENOENT)
goto err;
Reference in New Issue View Git Blame Copy Permalink