Skip to contentSkip to conversation

netfilter: nf_tables: add set_elem notifications

PATCH Superseded Arturo Borrero Gonzalez 3 participants 5 messages Apr 1, 2014 – Apr 3, 2014

Subsystems (2)
Networking netfilter

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Arturo Borrero Gonzalez

author
#0 lore raw

PATCH 1/1 netfilter: nf_tables: add set_elem notifications

This patch adds set_elems notifications.

When a set_elem is added/deleted, all listening peers in userspace will receive the corresponding notification.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 net/netfilter/nf_tables_api.c |   82 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
net/netfilter/nf_tables_api.c +82 -0
index 33045a5..9791c49 100644
@@ -2723,6 +2723,85 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
 	return -EOPNOTSUPP;
 }
 
+static int nf_tables_fill_setelem_info(const struct nft_ctx *ctx,
+				       struct sk_buff *skb;
+				       const struct nft_set *set,
+				       const struct nft_set_elem *elem,
+				       int event, u16 flags)
+{
+	u32 seq = ctx->nlh->nlmsg_seq;
+	struct nfgenmsg *nfmsg;
+	struct nlmsghdr *nlh;
+	struct nlattr *nest;
+
+	event |= NFNL_SUBSYS_NFTABLES << 8;
+	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+			flags);
+	if (nlh == NULL)
+		goto nla_put_failure;
+
+	nfmsg = nlmsg_data(nlh);
+	nfmsg->nfgen_family	= ctx->afi->family;
+	nfmsg->version		= NFNETLINK_V0;
+	nfmsg->res_id		= 0;
+
+	if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+		goto nla_put_failure;
+
+	if (nla_put_string(skb, NFTA_SET_NAME, set->name))
+		goto nla_put_failure;
+
+	nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
+	if (nest == NULL)
+		goto nla_put_failure;
+
+	err = nf_tables_fill_setelem(skb, set, elem);
+	if (err < 0)
+		goto nla_put_failure;
+
+	nla_nest_end(skb, nest);
+
+	return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+	nlmsg_trim(skb, nlh);
+	return -1;
+}
+
+static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
+				    const struct nft_set *set,
+				    const struct nft_set_elem *elem,
+				    int event, u16 flags)
+{
+	const struct sk_buff *oskb = ctx->skb;
+	struct net *net = sock_net(oskb->sk);
+	u32 portid = NETLINK_CB(oskb).portid;
+	bool report = nlmsg_report(ctx->nlh);
+	struct sk_buff *skb;
+	int err;
+
+	if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
+		return 0;
+
+	err = -ENOBUFS;
+	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+	if (skb == NULL)
+		goto err;
+
+	err = nf_tables_fill_setelem_info(skb, ctx, set, elem, evet, flags);
+	if (err < 0) {
+		kfree_skb(skb);
+		goto err;
+	}
+
+	err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
+			     GFP_KERNEL);
+err:
+	if (err < 0)
+		nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
+	return err;
+}
+
 static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
 			    const struct nlattr *attr)
 {

@@ -2799,6 +2878,7 @@ static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
 	if (err < 0)
 		goto err3;
 
+	nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_NEWSETELEM, 0);
 	return 0;
 
 err3:

@@ -2868,6 +2948,8 @@ static int nft_del_setelem(const struct nft_ctx *ctx, struct nft_set *set,
 
 	set->ops->remove(set, &elem);
 
+	nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_DELSETELEM, 0);
+
 	nft_data_uninit(&elem.key, NFT_DATA_VALUE);
 	if (set->flags & NFT_SET_MAP)
 		nft_data_uninit(&elem.data, set->dtype);
maintainer
#2 lore raw
In reply to Arturo Borrero Gonzalez
Quoted 15 lines · Arturo Borrero Gonzalez

This patch adds set_elems notifications.

When a set_elem is added/deleted, all listening peers in userspace will receive the corresponding notification.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 net/netfilter/nf_tables_api.c |   82 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
net/netfilter/nf_tables_api.c +0 -0
index 33045a5..9791c49 100644

net/netfilter/nf_tables_api.c static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, · line 2727

Quoted 5 lines
net/netfilter/nf_tables_api.c +2 -0
@@ -2723,6 +2723,85 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
 	return -EOPNOTSUPP;
 }
 
+static int nf_tables_fill_setelem_info(const struct nft_ctx *ctx,
+				       struct sk_buff *skb;

                                                          ^

Did you send me the final patch version?

net/netfilter/nf_tables_api.c static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, · line 2738

Quoted 11 lines
net/netfilter/nf_tables_api.c +11 -0
+				       const struct nft_set *set,
+				       const struct nft_set_elem *elem,
+				       int event, u16 flags)
+{
+	u32 seq = ctx->nlh->nlmsg_seq;
+	struct nfgenmsg *nfmsg;
+	struct nlmsghdr *nlh;
+	struct nlattr *nest;
+
+	event |= NFNL_SUBSYS_NFTABLES << 8;
+	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),

It also complains about unexisting portid variable and so on. This doesn't compile :-(

maintainer Acked-by Patrick McHardy
#3 lore raw
Quoted 19 lines · Pablo Neira Ayuso
Quoted 18 lines · Arturo Borrero Gonzalez

This patch adds set_elems notifications.

When a set_elem is added/deleted, all listening peers in userspace will receive the corresponding notification.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 net/netfilter/nf_tables_api.c |   82 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
net/netfilter/nf_tables_api.c +0 -0
index 33045a5..9791c49 100644
@@ -2723,6 +2723,85 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
 	return -EOPNOTSUPP;
 }
Quoted 5 lines

net/netfilter/nf_tables_api.c static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, · line 2727

Quoted 2 lines
net/netfilter/nf_tables_api.c +2 -0
+static int nf_tables_fill_setelem_info(const struct nft_ctx *ctx,
+				       struct sk_buff *skb;

                                                          ^

Did you send me the final patch version?

Just revamped your patch to make it compile. I need it to rebase my transaction infrastructure upon it.

Find it attached, compile tested only. Please, put a bit more care next time. Thanks.

Quoted 1 line

From 112423d94f59ae850fc891e442cae882fc75d656 Mon Sep 17 00:00:00 2001

From: Arturo Borrero <[email protected]>
Date: Tue, 1 Apr 2014 14:06:07 +0200
Subject: [PATCH] netfilter: nf_tables: add set_elem notifications

This patch adds set_elems notifications. When a set_elem is added/deleted, all listening peers in userspace will receive the corresponding notification.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
Acked-by Patrick McHardy <[email protected]>
Signed-off-by Pablo Neira Ayuso <[email protected]>
---
 net/netfilter/nf_tables_api.c |   83 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)
net/netfilter/nf_tables_api.c +83 -0
index bd3381e..0dcc99c 100644
@@ -2807,6 +2807,86 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
 	return -EOPNOTSUPP;
 }
 
+static int nf_tables_fill_setelem_info(struct sk_buff *skb,
+				       const struct nft_ctx *ctx, u32 portid,
+				       int event, u32 flags,
+				       const struct nft_set *set,
+				       const struct nft_set_elem *elem)
+{
+	u32 seq = ctx->nlh->nlmsg_seq;
+	struct nfgenmsg *nfmsg;
+	struct nlmsghdr *nlh;
+	struct nlattr *nest;
+	int err;
+
+	event |= NFNL_SUBSYS_NFTABLES << 8;
+	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+			flags);
+	if (nlh == NULL)
+		goto nla_put_failure;
+
+	nfmsg = nlmsg_data(nlh);
+	nfmsg->nfgen_family	= ctx->afi->family;
+	nfmsg->version		= NFNETLINK_V0;
+	nfmsg->res_id		= 0;
+
+	if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+		goto nla_put_failure;
+
+	if (nla_put_string(skb, NFTA_SET_NAME, set->name))
+		goto nla_put_failure;
+
+	nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
+	if (nest == NULL)
+		goto nla_put_failure;
+
+	err = nf_tables_fill_setelem(skb, set, elem);
+	if (err < 0)
+		goto nla_put_failure;
+
+	nla_nest_end(skb, nest);
+
+	return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+	nlmsg_trim(skb, nlh);
+	return -1;
+}
+
+static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
+				    const struct nft_set *set,
+				    const struct nft_set_elem *elem,
+				    int event, u16 flags)
+{
+	const struct sk_buff *oskb = ctx->skb;
+	struct net *net = sock_net(oskb->sk);
+	u32 portid = NETLINK_CB(oskb).portid;
+	bool report = nlmsg_report(ctx->nlh);
+	struct sk_buff *skb;
+	int err;
+
+	if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
+		return 0;
+
+	err = -ENOBUFS;
+	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+	if (skb == NULL)
+		goto err;
+
+	err = nf_tables_fill_setelem_info(skb, ctx, 0, event, flags, set, elem);
+	if (err < 0) {
+		kfree_skb(skb);
+		goto err;
+	}
+
+	err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
+			     GFP_KERNEL);
+err:
+	if (err < 0)
+		nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
+	return err;
+}
+
 static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
 			    const struct nlattr *attr)
 {

@@ -2887,6 +2967,7 @@ static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
 		goto err3;
 	set->nelems++;
 
+	nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_NEWSETELEM, 0);
 	return 0;
 
 err3:

@@ -2957,6 +3038,8 @@ static int nft_del_setelem(const struct nft_ctx *ctx, struct nft_set *set,
 	set->ops->remove(set, &elem);
 	set->nelems--;
 
+	nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_DELSETELEM, 0);
+
 	nft_data_uninit(&elem.key, NFT_DATA_VALUE);
 	if (set->flags & NFT_SET_MAP)
 		nft_data_uninit(&elem.data, set->dtype);
Signature · 1 line
1.7.10.4
author
#4 lore raw
In reply to Pablo Neira Ayuso
Quoted 3 lines · Pablo Neira Ayuso

Did you send me the final patch version?

No, I'm sorry.

I had the kernel running with the changes, but forget to refresh the patch before sending.
I will test yours and send back.

Thanks, regards.

Signature · 5 lines
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html