* [nf-next PATCH] netfilter: nf_tables: Return info of added rules back to user space
@ 2017-05-04 12:34 Phil Sutter
2017-05-04 13:35 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Phil Sutter @ 2017-05-04 12:34 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, Florian Westphal
This allows user space to reliably match kernel generated handles with
added rules for reference.
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
net/netfilter/nf_tables_api.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 1c6482d2c4dcf..71bce5d024409 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2142,6 +2142,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
struct nft_userdata *udata;
struct nft_trans *trans = NULL;
struct nft_expr *expr;
+ struct sk_buff *skb2;
struct nft_ctx ctx;
struct nlattr *tmp;
unsigned int size, i, n, ulen = 0, usize = 0;
@@ -2281,8 +2282,24 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
goto err3;
}
chain->use++;
- return 0;
+ skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
+ if (!skb2) {
+ err = -ENOMEM;
+ goto err4;
+ }
+ err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
+ nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
+ nfmsg->nfgen_family, table, chain, rule);
+ if (err < 0)
+ goto err5;
+
+ return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
+
+err5:
+ kfree_skb(skb2);
+err4:
+ chain->use--;
err3:
list_del_rcu(&rule->list);
err2:
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [nf-next PATCH] netfilter: nf_tables: Return info of added rules back to user space
2017-05-04 12:34 [nf-next PATCH] netfilter: nf_tables: Return info of added rules back to user space Phil Sutter
@ 2017-05-04 13:35 ` Pablo Neira Ayuso
2017-05-04 14:47 ` Phil Sutter
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-05-04 13:35 UTC (permalink / raw)
To: Phil Sutter; +Cc: netfilter-devel, Florian Westphal
On Thu, May 04, 2017 at 02:34:17PM +0200, Phil Sutter wrote:
> This allows user space to reliably match kernel generated handles with
> added rules for reference.
>
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
> net/netfilter/nf_tables_api.c | 19 ++++++++++++++++++-
> 1 file changed, 18 insertions(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 1c6482d2c4dcf..71bce5d024409 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -2142,6 +2142,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
> struct nft_userdata *udata;
> struct nft_trans *trans = NULL;
> struct nft_expr *expr;
> + struct sk_buff *skb2;
> struct nft_ctx ctx;
> struct nlattr *tmp;
> unsigned int size, i, n, ulen = 0, usize = 0;
> @@ -2281,8 +2282,24 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
> goto err3;
> }
> chain->use++;
> - return 0;
>
> + skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
> + if (!skb2) {
> + err = -ENOMEM;
> + goto err4;
> + }
> + err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
> + nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
> + nfmsg->nfgen_family, table, chain, rule);
> + if (err < 0)
> + goto err5;
> +
> + return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
You can achieve this already via NLM_F_ECHO.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [nf-next PATCH] netfilter: nf_tables: Return info of added rules back to user space
2017-05-04 13:35 ` Pablo Neira Ayuso
@ 2017-05-04 14:47 ` Phil Sutter
0 siblings, 0 replies; 3+ messages in thread
From: Phil Sutter @ 2017-05-04 14:47 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, Florian Westphal
On Thu, May 04, 2017 at 03:35:44PM +0200, Pablo Neira Ayuso wrote:
> On Thu, May 04, 2017 at 02:34:17PM +0200, Phil Sutter wrote:
> > This allows user space to reliably match kernel generated handles with
> > added rules for reference.
> >
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> > net/netfilter/nf_tables_api.c | 19 ++++++++++++++++++-
> > 1 file changed, 18 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > index 1c6482d2c4dcf..71bce5d024409 100644
> > --- a/net/netfilter/nf_tables_api.c
> > +++ b/net/netfilter/nf_tables_api.c
> > @@ -2142,6 +2142,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
> > struct nft_userdata *udata;
> > struct nft_trans *trans = NULL;
> > struct nft_expr *expr;
> > + struct sk_buff *skb2;
> > struct nft_ctx ctx;
> > struct nlattr *tmp;
> > unsigned int size, i, n, ulen = 0, usize = 0;
> > @@ -2281,8 +2282,24 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
> > goto err3;
> > }
> > chain->use++;
> > - return 0;
> >
> > + skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
> > + if (!skb2) {
> > + err = -ENOMEM;
> > + goto err4;
> > + }
> > + err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
> > + nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
> > + nfmsg->nfgen_family, table, chain, rule);
> > + if (err < 0)
> > + goto err5;
> > +
> > + return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
>
> You can achieve this already via NLM_F_ECHO.
Oh, thanks for the pointer!
Cheers, Phil
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-05-04 14:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-04 12:34 [nf-next PATCH] netfilter: nf_tables: Return info of added rules back to user space Phil Sutter
2017-05-04 13:35 ` Pablo Neira Ayuso
2017-05-04 14:47 ` Phil Sutter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).