netfilter: nf_tables: audit log object reset once per table
authorPhil Sutter <phil@nwl.cc>
Wed, 11 Oct 2023 15:06:59 +0000 (17:06 +0200)
committerFlorian Westphal <fw@strlen.de>
Wed, 18 Oct 2023 11:43:40 +0000 (13:43 +0200)
commit1baf0152f7707c6c7e4ea815dcc1f431c0e603f9
treeb76d2af3563128233301ea9d2d161ac62b2f6898
parent2915240eddba96b37de4c7e9a3d0ac6f9548454b
netfilter: nf_tables: audit log object reset once per table

When resetting multiple objects at once (via dump request), emit a log
message per table (or filled skb) and resurrect the 'entries' parameter
to contain the number of objects being logged for.

To test the skb exhaustion path, perform some bulk counter and quota
adds in the kselftest.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
Signed-off-by: Florian Westphal <fw@strlen.de>
net/netfilter/nf_tables_api.c
tools/testing/selftests/netfilter/nft_audit.sh