netfilter: nf_tables: reset table validation state on abort

If a transaction fails the final validation in the commit hook, the table
validation state is changed to NFT_VALIDATE_DO and a replay of the batch is
performed.  Every rule insert will then do a graph validation.

This is much slower, but provides better error reporting to the user
because we can point at the rule that introduces the validation issue.

Without this reset the affected table(s) remain in full validation mode,
i.e. on next transaction we start with slow-mode.

This makes the next transaction after a failed incremental update very slow:

 # time iptables-restore < /tmp/ruleset
 real    0m0.496s [..]
 # time iptables -A CALLEE -j CALLER
 iptables v1.8.11 (nf_tables):  RULE_APPEND failed (Too many links): rule in chain CALLEE
 real    0m0.022s [..]
 # time iptables-restore < /tmp/ruleset
 real    1m22.355s [..]

After this patch, 2nd iptables-restore is back to ~0.5s.

Fixes: 9a32e9850686 ("netfilter: nf_tables: don't write table validation state without mutex")
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 729a92781a1a4702298ba3fbda97b80cf3b51b18..027bab30c2381a897099f523f759a8b3d367fca5 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -11536,6 +11536,13 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb,
        ret = __nf_tables_abort(net, action);
        nft_gc_seq_end(nft_net, gc_seq);
 
+       if (action == NFNL_ABORT_NONE) {
+               struct nft_table *table;
+
+               list_for_each_entry(table, &nft_net->tables, list)
+                       table->validate_state = NFT_VALIDATE_SKIP;
+       }
+
        WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
 
        /* module autoload needs to happen after GC sequence update because it