netfilter: nf_tables: audit log object reset once per table

Browse source

When resetting multiple objects at once (via dump request), emit a log
message per table (or filled skb) and resurrect the 'entries' parameter
to contain the number of objects being logged for.

To test the skb exhaustion path, perform some bulk counter and quota
adds in the kselftest.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
Signed-off-by: Florian Westphal <fw@strlen.de>

...

This commit is contained in:

Phil Sutter 2023-10-11 17:06:59 +02:00 • committed by Florian Westphal

parent 2915240edd

commit 1baf0152f7

2 changed files with 74 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

50

net/netfilter/nf_tables_api.c

View file

46

tools/testing/selftests/netfilter/nft_audit.sh

View file