netfilter: nf_tables: zero timeout means element never times out

This patch uses zero as timeout marker for those elements that never expire
when the element is created.

If userspace provides no timeout for an element, then the default set
timeout applies. However, if no default set timeout is specified and
timeout flag is set on, then timeout extension is allocated and timeout
is set to zero to allow for future updates.

Use of zero a never timeout marker has been suggested by Phil Sutter.

Note that, in older kernels, it is already possible to define elements
that never expire by declaring a set with the set timeout flag set on
and no global set timeout, in this case, new element with no explicit
timeout never expire do not allocate the timeout extension, hence, they
never expire. This approach makes it complicated to accomodate element
timeout update, because element extensions do not support reallocations.
Therefore, allocate the timeout extension and use the new marker for
this case, but do not expose it to userspace to retain backward
compatibility in the set listing.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 1e9b5e1659a1fc6fba85ef20f8f2a3275ee5e9c5..7511918dce6f705b4e142a6d03437b49ae46904d 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -832,8 +832,11 @@ static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ex
 static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext,
                                          u64 tstamp)
 {
-       return nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
-              time_after_eq64(tstamp, READ_ONCE(nft_set_ext_timeout(ext)->expiration));
+       if (!nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) ||
+           nft_set_ext_timeout(ext)->timeout == 0)
+               return false;
+
+       return time_after_eq64(tstamp, READ_ONCE(nft_set_ext_timeout(ext)->expiration));
 }
 
 static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 639894ed1b9732b95dc263cc0526ce5325e401a2..d6476ca5d7a69d75bed048f0ac9a1cd06ce8b63f 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -436,7 +436,7 @@ enum nft_set_elem_flags {
  * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
  * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
  * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
- * @NFTA_SET_ELEM_TIMEOUT: timeout value (NLA_U64)
+ * @NFTA_SET_ELEM_TIMEOUT: timeout value, zero means never times out (NLA_U64)
  * @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
  * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
  * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c295d6e6c1fb2b3dde35a0dd12e8eb586d61a2ea..ed85b10edb32566e1b9d11cc7870e128b003cb10 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5815,24 +5815,31 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
                goto nla_put_failure;
 
        if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) {
-               u64 expires, now = get_jiffies_64();
+               u64 timeout = nft_set_ext_timeout(ext)->timeout;
+               u64 set_timeout = READ_ONCE(set->timeout);
+               __be64 msecs = 0;
+
+               if (set_timeout != timeout) {
+                       msecs = nf_jiffies64_to_msecs(timeout);
+                       if (nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, msecs,
+                                        NFTA_SET_ELEM_PAD))
+                               goto nla_put_failure;
+               }
 
-               if (nft_set_ext_timeout(ext)->timeout != READ_ONCE(set->timeout) &&
-                   nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
-                                nf_jiffies64_to_msecs(nft_set_ext_timeout(ext)->timeout),
-                                NFTA_SET_ELEM_PAD))
-                       goto nla_put_failure;
+               if (timeout > 0) {
+                       u64 expires, now = get_jiffies_64();
 
-               expires = READ_ONCE(nft_set_ext_timeout(ext)->expiration);
-               if (time_before64(now, expires))
-                       expires -= now;
-               else
-                       expires = 0;
+                       expires = READ_ONCE(nft_set_ext_timeout(ext)->expiration);
+                       if (time_before64(now, expires))
+                               expires -= now;
+                       else
+                               expires = 0;
 
-               if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
-                                nf_jiffies64_to_msecs(expires),
-                                NFTA_SET_ELEM_PAD))
-                       goto nla_put_failure;
+                       if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
+                                        nf_jiffies64_to_msecs(expires),
+                                        NFTA_SET_ELEM_PAD))
+                               goto nla_put_failure;
+               }
        }
 
        if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
@@ -7015,7 +7022,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                        goto err_parse_key_end;
        }
 
-       if (timeout > 0) {
+       if (set->flags & NFT_SET_TIMEOUT) {
                err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
                if (err < 0)
                        goto err_parse_key_end;

diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index ed8d692bebe302edc9ce52298d92a28a8278c4db..6a10305de24b355d15867e716e3b4a29b335abfb 100644 (file)
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -94,7 +94,8 @@ void nft_dynset_eval(const struct nft_expr *expr,
        if (set->ops->update(set, &regs->data[priv->sreg_key], nft_dynset_new,
                             expr, regs, &ext)) {
                if (priv->op == NFT_DYNSET_OP_UPDATE &&
-                   nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) {
+                   nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
+                   nft_set_ext_timeout(ext)->timeout != 0) {
                        timeout = priv->timeout ? : READ_ONCE(set->timeout);
                        WRITE_ONCE(nft_set_ext_timeout(ext)->expiration, get_jiffies_64() + timeout);
                }