* [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications @ 2014-04-01 12:06 Arturo Borrero Gonzalez 2014-04-02 11:48 ` Patrick McHardy 2014-04-03 10:07 ` Pablo Neira Ayuso 0 siblings, 2 replies; 5+ messages in thread From: Arturo Borrero Gonzalez @ 2014-04-01 12:06 UTC (permalink / raw) To: netfilter-devel; +Cc: kaber, pablo This patch adds set_elems notifications. When a set_elem is added/deleted, all listening peers in userspace will receive the corresponding notification. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> --- net/netfilter/nf_tables_api.c | 82 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 33045a5..9791c49 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2723,6 +2723,85 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, return -EOPNOTSUPP; } +static int nf_tables_fill_setelem_info(const struct nft_ctx *ctx, + struct sk_buff *skb; + const struct nft_set *set, + const struct nft_set_elem *elem, + int event, u16 flags) +{ + u32 seq = ctx->nlh->nlmsg_seq; + struct nfgenmsg *nfmsg; + struct nlmsghdr *nlh; + struct nlattr *nest; + + event |= NFNL_SUBSYS_NFTABLES << 8; + nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), + flags); + if (nlh == NULL) + goto nla_put_failure; + + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = ctx->afi->family; + nfmsg->version = NFNETLINK_V0; + nfmsg->res_id = 0; + + if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) + goto nla_put_failure; + + if (nla_put_string(skb, NFTA_SET_NAME, set->name)) + goto nla_put_failure; + + nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS); + if (nest == NULL) + goto nla_put_failure; + + err = nf_tables_fill_setelem(skb, set, elem); + if (err < 0) + goto nla_put_failure; + + nla_nest_end(skb, nest); + + return nlmsg_end(skb, nlh); + +nla_put_failure: + nlmsg_trim(skb, nlh); + return -1; +} + +static int nf_tables_setelem_notify(const struct nft_ctx *ctx, + const struct nft_set *set, + const struct nft_set_elem *elem, + int event, u16 flags) +{ + const struct sk_buff *oskb = ctx->skb; + struct net *net = sock_net(oskb->sk); + u32 portid = NETLINK_CB(oskb).portid; + bool report = nlmsg_report(ctx->nlh); + struct sk_buff *skb; + int err; + + if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) + return 0; + + err = -ENOBUFS; + skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); + if (skb == NULL) + goto err; + + err = nf_tables_fill_setelem_info(skb, ctx, set, elem, evet, flags); + if (err < 0) { + kfree_skb(skb); + goto err; + } + + err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, + GFP_KERNEL); +err: + if (err < 0) + nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err); + return err; +} + static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set, const struct nlattr *attr) { @@ -2799,6 +2878,7 @@ static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set, if (err < 0) goto err3; + nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_NEWSETELEM, 0); return 0; err3: @@ -2868,6 +2948,8 @@ static int nft_del_setelem(const struct nft_ctx *ctx, struct nft_set *set, set->ops->remove(set, &elem); + nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_DELSETELEM, 0); + nft_data_uninit(&elem.key, NFT_DATA_VALUE); if (set->flags & NFT_SET_MAP) nft_data_uninit(&elem.data, set->dtype); ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications 2014-04-01 12:06 [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications Arturo Borrero Gonzalez @ 2014-04-02 11:48 ` Patrick McHardy 2014-04-03 10:07 ` Pablo Neira Ayuso 1 sibling, 0 replies; 5+ messages in thread From: Patrick McHardy @ 2014-04-02 11:48 UTC (permalink / raw) To: Arturo Borrero Gonzalez; +Cc: netfilter-devel, pablo On Tue, Apr 01, 2014 at 02:06:07PM +0200, Arturo Borrero Gonzalez wrote: > This patch adds set_elems notifications. > > When a set_elem is added/deleted, all listening peers in userspace will > receive the corresponding notification. > > Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Patrick McHardy <kaber@trash.net> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications 2014-04-01 12:06 [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications Arturo Borrero Gonzalez 2014-04-02 11:48 ` Patrick McHardy @ 2014-04-03 10:07 ` Pablo Neira Ayuso 2014-04-03 10:19 ` Pablo Neira Ayuso 2014-04-03 10:28 ` Arturo Borrero Gonzalez 1 sibling, 2 replies; 5+ messages in thread From: Pablo Neira Ayuso @ 2014-04-03 10:07 UTC (permalink / raw) To: Arturo Borrero Gonzalez; +Cc: netfilter-devel, kaber On Tue, Apr 01, 2014 at 02:06:07PM +0200, Arturo Borrero Gonzalez wrote: > This patch adds set_elems notifications. > > When a set_elem is added/deleted, all listening peers in userspace will > receive the corresponding notification. > > Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> > --- > net/netfilter/nf_tables_api.c | 82 +++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 82 insertions(+) > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c > index 33045a5..9791c49 100644 > --- a/net/netfilter/nf_tables_api.c > +++ b/net/netfilter/nf_tables_api.c > @@ -2723,6 +2723,85 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, > return -EOPNOTSUPP; > } > > +static int nf_tables_fill_setelem_info(const struct nft_ctx *ctx, > + struct sk_buff *skb; ^ Did you send me the final patch version? > + const struct nft_set *set, > + const struct nft_set_elem *elem, > + int event, u16 flags) > +{ > + u32 seq = ctx->nlh->nlmsg_seq; > + struct nfgenmsg *nfmsg; > + struct nlmsghdr *nlh; > + struct nlattr *nest; > + > + event |= NFNL_SUBSYS_NFTABLES << 8; > + nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), It also complains about unexisting portid variable and so on. This doesn't compile :-( ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications 2014-04-03 10:07 ` Pablo Neira Ayuso @ 2014-04-03 10:19 ` Pablo Neira Ayuso 2014-04-03 10:28 ` Arturo Borrero Gonzalez 1 sibling, 0 replies; 5+ messages in thread From: Pablo Neira Ayuso @ 2014-04-03 10:19 UTC (permalink / raw) To: Arturo Borrero Gonzalez; +Cc: netfilter-devel, kaber [-- Attachment #1: Type: text/plain, Size: 1266 bytes --] On Thu, Apr 03, 2014 at 12:07:30PM +0200, Pablo Neira Ayuso wrote: > On Tue, Apr 01, 2014 at 02:06:07PM +0200, Arturo Borrero Gonzalez wrote: > > This patch adds set_elems notifications. > > > > When a set_elem is added/deleted, all listening peers in userspace will > > receive the corresponding notification. > > > > Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> > > --- > > net/netfilter/nf_tables_api.c | 82 +++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 82 insertions(+) > > > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c > > index 33045a5..9791c49 100644 > > --- a/net/netfilter/nf_tables_api.c > > +++ b/net/netfilter/nf_tables_api.c > > @@ -2723,6 +2723,85 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, > > return -EOPNOTSUPP; > > } > > > > +static int nf_tables_fill_setelem_info(const struct nft_ctx *ctx, > > + struct sk_buff *skb; > ^ > > Did you send me the final patch version? Just revamped your patch to make it compile. I need it to rebase my transaction infrastructure upon it. Find it attached, compile tested only. Please, put a bit more care next time. Thanks. [-- Attachment #2: 0001-netfilter-nf_tables-add-set_elem-notifications.patch --] [-- Type: text/x-diff, Size: 3657 bytes --] >From 112423d94f59ae850fc891e442cae882fc75d656 Mon Sep 17 00:00:00 2001 From: Arturo Borrero <arturo.borrero.glez@gmail.com> Date: Tue, 1 Apr 2014 14:06:07 +0200 Subject: [PATCH] netfilter: nf_tables: add set_elem notifications This patch adds set_elems notifications. When a set_elem is added/deleted, all listening peers in userspace will receive the corresponding notification. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org> --- net/netfilter/nf_tables_api.c | 83 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index bd3381e..0dcc99c 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2807,6 +2807,86 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, return -EOPNOTSUPP; } +static int nf_tables_fill_setelem_info(struct sk_buff *skb, + const struct nft_ctx *ctx, u32 portid, + int event, u32 flags, + const struct nft_set *set, + const struct nft_set_elem *elem) +{ + u32 seq = ctx->nlh->nlmsg_seq; + struct nfgenmsg *nfmsg; + struct nlmsghdr *nlh; + struct nlattr *nest; + int err; + + event |= NFNL_SUBSYS_NFTABLES << 8; + nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), + flags); + if (nlh == NULL) + goto nla_put_failure; + + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = ctx->afi->family; + nfmsg->version = NFNETLINK_V0; + nfmsg->res_id = 0; + + if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) + goto nla_put_failure; + + if (nla_put_string(skb, NFTA_SET_NAME, set->name)) + goto nla_put_failure; + + nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS); + if (nest == NULL) + goto nla_put_failure; + + err = nf_tables_fill_setelem(skb, set, elem); + if (err < 0) + goto nla_put_failure; + + nla_nest_end(skb, nest); + + return nlmsg_end(skb, nlh); + +nla_put_failure: + nlmsg_trim(skb, nlh); + return -1; +} + +static int nf_tables_setelem_notify(const struct nft_ctx *ctx, + const struct nft_set *set, + const struct nft_set_elem *elem, + int event, u16 flags) +{ + const struct sk_buff *oskb = ctx->skb; + struct net *net = sock_net(oskb->sk); + u32 portid = NETLINK_CB(oskb).portid; + bool report = nlmsg_report(ctx->nlh); + struct sk_buff *skb; + int err; + + if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) + return 0; + + err = -ENOBUFS; + skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); + if (skb == NULL) + goto err; + + err = nf_tables_fill_setelem_info(skb, ctx, 0, event, flags, set, elem); + if (err < 0) { + kfree_skb(skb); + goto err; + } + + err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, + GFP_KERNEL); +err: + if (err < 0) + nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err); + return err; +} + static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set, const struct nlattr *attr) { @@ -2887,6 +2967,7 @@ static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set, goto err3; set->nelems++; + nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_NEWSETELEM, 0); return 0; err3: @@ -2957,6 +3038,8 @@ static int nft_del_setelem(const struct nft_ctx *ctx, struct nft_set *set, set->ops->remove(set, &elem); set->nelems--; + nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_DELSETELEM, 0); + nft_data_uninit(&elem.key, NFT_DATA_VALUE); if (set->flags & NFT_SET_MAP) nft_data_uninit(&elem.data, set->dtype); -- 1.7.10.4 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications 2014-04-03 10:07 ` Pablo Neira Ayuso 2014-04-03 10:19 ` Pablo Neira Ayuso @ 2014-04-03 10:28 ` Arturo Borrero Gonzalez 1 sibling, 0 replies; 5+ messages in thread From: Arturo Borrero Gonzalez @ 2014-04-03 10:28 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: Netfilter Development Mailing list, Patrick McHardy On 3 April 2014 12:07, Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > Did you send me the final patch version? > No, I'm sorry. I had the kernel running with the changes, but forget to refresh the patch before sending. I will test yours and send back. Thanks, regards. -- Arturo Borrero González -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2014-04-03 10:28 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-04-01 12:06 [nf_tables PATCH] netfilter: nf_tables: add set_elem notifications Arturo Borrero Gonzalez 2014-04-02 11:48 ` Patrick McHardy 2014-04-03 10:07 ` Pablo Neira Ayuso 2014-04-03 10:19 ` Pablo Neira Ayuso 2014-04-03 10:28 ` Arturo Borrero Gonzalez
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.