[PATCH v2 6/7] netfilter: nf_tables: Add notications for hook changes

[Phil Sutter <phil@nwl.cc>]

If netdev hooks are updated due to netdev add/remove events, notify user
space via the usual netlink notification mechanism.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 include/net/netfilter/nf_tables.h |  4 ++++
 net/netfilter/nf_tables_api.c     | 21 +++++++++++++++++----
 net/netfilter/nft_chain_filter.c  | 16 +++++++++++++---
 3 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 9cbef71f0462..bfa6cb7b2fd7 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -223,6 +223,8 @@ struct nft_ctx {
 	bool				report;
 };
 
+void nft_commit_notify(struct net *net, u32 portid);
+
 enum nft_data_desc_flags {
 	NFT_DATA_DESC_SETELEM	= (1 << 0),
 };
@@ -1123,6 +1125,8 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,
 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set);
 int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
 void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
+void nf_tables_chain_notify(const struct nft_ctx *ctx, int event,
+			    const struct list_head *hook_list);
 
 enum nft_chain_types {
 	NFT_CHAIN_T_DEFAULT = 0,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b3a5a2878459..39202166c2a2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1903,8 +1903,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
 	return -1;
 }
 
-static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event,
-				   const struct list_head *hook_list)
+void nf_tables_chain_notify(const struct nft_ctx *ctx, int event,
+			    const struct list_head *hook_list)
 {
 	struct nftables_pernet *nft_net;
 	struct sk_buff *skb;
@@ -9246,6 +9246,7 @@ static int nf_tables_flowtable_event(struct notifier_block *this,
 	struct nftables_pernet *nft_net;
 	struct nft_table *table;
 	struct net *net;
+	int rc = 0;
 
 	if (event == NETDEV_CHANGENAME) {
 		nf_tables_flowtable_event(this, NETDEV_UNREGISTER, ptr);
@@ -9260,11 +9261,23 @@ static int nf_tables_flowtable_event(struct notifier_block *this,
 	mutex_lock(&nft_net->commit_mutex);
 	list_for_each_entry(table, &nft_net->tables, list) {
 		list_for_each_entry(flowtable, &table->flowtables, list) {
-			if (nft_flowtable_event(event, dev, flowtable))
+			rc = nft_flowtable_event(event, dev, flowtable);
+			if (rc)
 				goto out_unlock;
 		}
 	}
 out_unlock:
+	if (rc == 1) {
+		struct nft_ctx ctx = {
+			.net = net,
+			.family = flowtable->table->family
+		};
+
+		nf_tables_flowtable_notify(&ctx, flowtable,
+					   &flowtable->hook_list,
+					   NFT_MSG_NEWFLOWTABLE);
+		nft_commit_notify(ctx.net, ctx.portid);
+	}
 	mutex_unlock(&nft_net->commit_mutex);
 
 	return NOTIFY_DONE;
@@ -10148,7 +10161,7 @@ static void nf_tables_commit_release(struct net *net)
 	mutex_unlock(&nft_net->commit_mutex);
 }
 
-static void nft_commit_notify(struct net *net, u32 portid)
+void nft_commit_notify(struct net *net, u32 portid)
 {
 	struct nftables_pernet *nft_net = nft_pernet(net);
 	struct sk_buff *batch_skb = NULL, *nskb, *skb;
diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index cc0cf47503f4..f6bea21dab16 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -342,6 +342,7 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev,
 {
 	struct nft_base_chain *basechain = nft_base_chain(ctx->chain);
 	struct nft_hook *hook;
+	bool notify = false;
 
 	if (event != NETDEV_UNREGISTER &&
 	    event != NETDEV_REGISTER)
@@ -350,21 +351,29 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev,
 	list_for_each_entry(hook, &basechain->hook_list, list) {
 		switch (event) {
 		case NETDEV_UNREGISTER:
-			if (hook->ops.dev == dev)
+			if (hook->ops.dev == dev) {
 				nft_netdev_hook_dev_update(hook, NULL);
+				notify = true;
+			}
 			break;
 		case NETDEV_REGISTER:
 			if (hook->ops.dev ||
 			    strncmp(hook->ifname, dev->name, hook->ifnamelen))
 				break;
-			if (!nft_netdev_hook_dev_update(hook, dev))
-				return;
+			if (!nft_netdev_hook_dev_update(hook, dev)) {
+				notify = true;
+				goto out_notify;
+			}
 
 			printk(KERN_ERR "chain %s: Can't hook into device %s\n",
 			       ctx->chain->name, dev->name);
 			break;
 		}
 	}
+out_notify:
+	if (notify)
+		nf_tables_chain_notify(ctx, NFT_MSG_NEWCHAIN,
+				       &basechain->hook_list);
 }
 
 static int nf_tables_netdev_event(struct notifier_block *this,
@@ -409,6 +418,7 @@ static int nf_tables_netdev_event(struct notifier_block *this,
 			nft_netdev_event(event, dev, &ctx);
 		}
 	}
+	nft_commit_notify(ctx.net, ctx.portid);
 	mutex_unlock(&nft_net->commit_mutex);
 
 	return NOTIFY_DONE;
-- 
2.43.0