[PATCH 1/2 nf-next] netfilter: nf_tables: Introduce stateful object update operation

[Fernando Fernandez Mancera]

This patch adds the infrastructure needed for the stateful object update
support.

Signed-off-by: Fernando Fernandez Mancera <ffmanc...@riseup.net>
---
 include/net/netfilter/nf_tables.h |  6 +++
 net/netfilter/nf_tables_api.c     | 71 ++++++++++++++++++++++++++++---
 2 files changed, 70 insertions(+), 7 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h 
b/include/net/netfilter/nf_tables.h
index dc301e3d6739..dc4e32040ea9 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1123,6 +1123,9 @@ struct nft_object_ops {
        int                             (*dump)(struct sk_buff *skb,
                                                struct nft_object *obj,
                                                bool reset);
+       int                             (*update)(const struct nft_ctx *ctx,
+                                                 const struct nlattr *const 
tb[],
+                                                 struct nft_object *obj);
        const struct nft_object_type    *type;
 };
 
@@ -1405,10 +1408,13 @@ struct nft_trans_elem {
 
 struct nft_trans_obj {
        struct nft_object               *obj;
+       bool                            update;
 };
 
 #define nft_trans_obj(trans)   \
        (((struct nft_trans_obj *)trans->data)->obj)
+#define nft_trans_obj_update(trans)    \
+       (((struct nft_trans_obj *)trans->data)->update)
 
 struct nft_trans_flowtable {
        struct nft_flowtable            *flowtable;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index fe3b7b0c6c66..5ab4b0636213 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5122,6 +5122,46 @@ nft_obj_type_get(struct net *net, u32 objtype)
        return ERR_PTR(-ENOENT);
 }
 
+static int nf_tables_updobj(const struct nft_ctx *ctx,
+                           const struct nft_object_type *type,
+                           const struct nlattr *attr,
+                           struct nft_object *obj)
+{
+       struct nft_trans *trans;
+       struct nlattr **tb;
+       int err = -ENOMEM;
+
+       trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
+                               sizeof(struct nft_trans_obj));
+       if (!trans)
+               return -ENOMEM;
+
+       tb = kcalloc(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
+       if (!tb)
+               goto err;
+
+       if (attr) {
+               err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
+                                                 type->policy, NULL);
+               if (err < 0)
+                       goto err;       
+       }
+
+       err = obj->ops->update(ctx, (const struct nlattr * const *)tb, obj);
+       if (err < 0)
+               goto err;
+
+       nft_trans_obj_update(trans) = true;
+       list_add_tail(&trans->list, &ctx->net->nft.commit_list);
+
+       kfree(tb);
+       return 0;
+
+err:
+       nft_trans_destroy(trans);
+       return err;
+}
+
 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
                            struct sk_buff *skb, const struct nlmsghdr *nlh,
                            const struct nlattr * const nla[],
@@ -5161,7 +5201,13 @@ static int nf_tables_newobj(struct net *net, struct sock 
*nlsk,
                        NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
                        return -EEXIST;
                }
-               return 0;
+               if (nlh->nlmsg_flags & NLM_F_REPLACE)
+                       return -EOPNOTSUPP;
+
+               type = nft_obj_type_get(net, objtype);
+               nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
+
+               return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
        }
 
        nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
@@ -6786,10 +6832,17 @@ static int nf_tables_commit(struct net *net, struct 
sk_buff *skb)
                        te->set->ndeact--;
                        break;
                case NFT_MSG_NEWOBJ:
-                       nft_clear(net, nft_trans_obj(trans));
-                       nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
-                                            NFT_MSG_NEWOBJ);
-                       nft_trans_destroy(trans);
+                       if (nft_trans_obj_update(trans)) {
+                               nf_tables_obj_notify(&trans->ctx,
+                                                    nft_trans_obj(trans),
+                                                    NFT_MSG_NEWOBJ);
+                       } else {
+                               nft_clear(net, nft_trans_obj(trans));
+                               nf_tables_obj_notify(&trans->ctx,
+                                                    nft_trans_obj(trans),
+                                                    NFT_MSG_NEWOBJ);
+                               nft_trans_destroy(trans);
+                       }
                        break;
                case NFT_MSG_DELOBJ:
                        nft_obj_del(nft_trans_obj(trans));
@@ -6936,8 +6989,12 @@ static int __nf_tables_abort(struct net *net)
                        nft_trans_destroy(trans);
                        break;
                case NFT_MSG_NEWOBJ:
-                       trans->ctx.table->use--;
-                       nft_obj_del(nft_trans_obj(trans));
+                       if (nft_trans_obj_update(trans)) {
+                               nft_trans_destroy(trans);
+                       } else {
+                               trans->ctx.table->use--;
+                               nft_obj_del(nft_trans_obj(trans));
+                       }
                        break;
                case NFT_MSG_DELOBJ:
                        trans->ctx.table->use++;
-- 
2.20.1