On Tue, Aug 29, 2023 at 07:51:58PM +0200, Phil Sutter wrote:
> Resetting rules' stateful data happens outside of the transaction logic,
> so 'get' and 'dump' handlers have to emit audit log entries themselves.
>
> Cc: Richard Guy Briggs <rgb@xxxxxxxxxx>
> Fixes: 8daa8fde3fc3f ("netfilter: nf_tables: Introduce NFT_MSG_GETRULE_RESET")
> Signed-off-by: Phil Sutter <phil@xxxxxx>
> ---
> include/linux/audit.h | 1 +
> kernel/auditsc.c | 1 +
> net/netfilter/nf_tables_api.c | 18 ++++++++++++++++++
> 3 files changed, 20 insertions(+)
>
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 192bf03aacc52..51b1b7054a233 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -118,6 +118,7 @@ enum audit_nfcfgop {
> AUDIT_NFT_OP_FLOWTABLE_REGISTER,
> AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
> AUDIT_NFT_OP_SETELEM_RESET,
> + AUDIT_NFT_OP_RULE_RESET,
> AUDIT_NFT_OP_INVALID,
> };
>
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 38481e3181975..fc0c7c03eeabe 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -144,6 +144,7 @@ static const struct audit_nfcfgop_tab audit_nfcfgs[] = {
> { AUDIT_NFT_OP_FLOWTABLE_REGISTER, "nft_register_flowtable" },
> { AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, "nft_unregister_flowtable" },
> { AUDIT_NFT_OP_SETELEM_RESET, "nft_reset_setelem" },
> + { AUDIT_NFT_OP_RULE_RESET, "nft_reset_rule" },
> { AUDIT_NFT_OP_INVALID, "nft_invalid" },
> };
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index a1218ea4e0c3d..2aa7b9a55cca4 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -3432,6 +3432,18 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx,
> nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
> }
>
> +static void audit_log_rule_reset(const struct nft_table *table,
> + unsigned int base_seq,
> + unsigned int nentries)
> +{
> + char *buf = kasprintf(GFP_ATOMIC, "%s:%u",
> + table->name, base_seq);
No check for NULL.
