netfilter: nf_tables: audit log object reset once per table
authorPhil Sutter <phil@nwl.cc>
Wed, 11 Oct 2023 15:06:59 +0000 (17:06 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Nov 2023 13:11:01 +0000 (14:11 +0100)
commit0f2840dabfea81b4770f0327dfb2705fedba85cf
treee96d00d13a853dff09baccb328c337cd8704912a
parentec80ad4585d7163dcf8cad7c95f6b5d526b107dd
netfilter: nf_tables: audit log object reset once per table

[ Upstream commit 1baf0152f7707c6c7e4ea815dcc1f431c0e603f9 ]

When resetting multiple objects at once (via dump request), emit a log
message per table (or filled skb) and resurrect the 'entries' parameter
to contain the number of objects being logged for.

To test the skb exhaustion path, perform some bulk counter and quota
adds in the kselftest.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nf_tables_api.c
tools/testing/selftests/netfilter/nft_audit.sh