From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from orbyte.nwl.cc (orbyte.nwl.cc [151.80.46.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3CFAA1A42CA for ; Thu, 12 Sep 2024 12:45:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=151.80.46.58 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726145144; cv=none; b=aOCj9MobsLQOK+myfNN5u6bI3tlKBC+IwX0R2m26vc6rUq9s0HIJrCMggwDqEslXmspgTb9nJq2TGC/A0Zu20HzYyrCgnK9jWjN8QRn2llJ7duC8bYhiQ+IqB76ZQmnZdoCurx31hzLnsSXm6updGVzqN/9PNBJJLJRKdF+JHY8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726145144; c=relaxed/simple; bh=CyO8qO7SUEQdxeK2cbYL9BvOKbyZ4Sgi0QNlQ/cyePQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W1U3MYNtlR1VC/+0XwCIr6Vg/qe+F2U6klVGvv4D+Gq+nDWd8ZTNs5sVc/RAQ9DinMdt47+8XbFUJzAQVGIV93bf30K9jNtrrDecfZzySGfeDM65b+z4kmrWzc2P5o3CFMKZKO4TvdfeOHr/9P4Pev4u0z/rSMQZT8u0Rgh0O1Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=nwl.cc; spf=pass smtp.mailfrom=nwl.cc; dkim=pass (2048-bit key) header.d=nwl.cc header.i=@nwl.cc header.b=d0u9u7xA; arc=none smtp.client-ip=151.80.46.58 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=nwl.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nwl.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=nwl.cc header.i=@nwl.cc header.b="d0u9u7xA" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=yGYNlF7Hju0hi63FK674X44pR83gftzWViqeNTffo6c=; b=d0u9u7xAxiMOIUblHSfTacyv9a l7WVk1BkajGdDkxJO/dxlYeZrxB6nbm7tVpheYOJSBtHutLXfj4Ld4MMgMmLJNRxOHZlBrsEXFBEI M+T/dTPNgcKLqEaQjKVcMnvLSODjMmXemlZ787cQJVVsVtdotQqDk5JkmMiglbANJZCAHxHQPrKzb vKuch7yWUihTOm7x/HNteVBTssOBo3ZHDYU/qA2ts2VE8hyrVRseYgf/HzAxGGXxpr+3KYEMhbqRX SwE8PPM8S2EflCDay1Gqr4PCuvFRWT7USMD8YCR9Q+AX08mERMnv5f3Mp4ypEDZscvMbroJ2D3I/E 4JbhtuUA==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.97.1) (envelope-from ) id 1soipi-000000004EC-1Vd9; Thu, 12 Sep 2024 14:21:58 +0200 From: Phil Sutter To: Pablo Neira Ayuso Cc: netfilter-devel@vger.kernel.org, Florian Westphal , Eric Garver Subject: [nf-next PATCH v3 15/16] netfilter: nf_tables: Add notications for hook changes Date: Thu, 12 Sep 2024 14:21:47 +0200 Message-ID: <20240912122148.12159-16-phil@nwl.cc> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240912122148.12159-1-phil@nwl.cc> References: <20240912122148.12159-1-phil@nwl.cc> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Notify user space if netdev hooks are updated due to netdev add/remove events. Send minimal notification messages by introducing NFT_MSG_NEWDEV/DELDEV message types describing a single device only. Signed-off-by: Phil Sutter --- include/net/netfilter/nf_tables.h | 2 + include/uapi/linux/netfilter/nf_tables.h | 5 +++ net/netfilter/nf_tables_api.c | 57 ++++++++++++++++++++++++ net/netfilter/nft_chain_filter.c | 1 + 4 files changed, 65 insertions(+) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 991b8d5e52f1..3ebdb46b3993 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1131,6 +1131,8 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set); int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); +void nf_tables_chain_device_notify(const struct nft_chain *chain, + const struct net_device *dev, int event); enum nft_chain_types { NFT_CHAIN_T_DEFAULT = 0, diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 639894ed1b97..0f350f2fc807 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -142,6 +142,8 @@ enum nf_tables_msg_types { NFT_MSG_DESTROYOBJ, NFT_MSG_DESTROYFLOWTABLE, NFT_MSG_GETSETELEM_RESET, + NFT_MSG_NEWDEV, + NFT_MSG_DELDEV, NFT_MSG_MAX, }; @@ -1772,6 +1774,9 @@ enum nft_synproxy_attributes { enum nft_devices_attributes { NFTA_DEVICE_UNSPEC, NFTA_DEVICE_NAME, + NFTA_DEVICE_TABLE, + NFTA_DEVICE_FLOWTABLE, + NFTA_DEVICE_CHAIN, __NFTA_DEVICE_MAX }; #define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3632be26d73a..cdca5dfbe0b5 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -9306,6 +9306,62 @@ struct nf_hook_ops *nft_hook_find_ops(const struct nft_hook *hook, } EXPORT_SYMBOL_GPL(nft_hook_find_ops); +static void +nf_tables_device_notify(const struct nft_table *table, int attr, + const char *name, const struct net_device *dev, + int event) +{ + struct net *net = dev_net(dev); + struct nlmsghdr *nlh; + struct sk_buff *skb; + u16 flags = 0; + + if (!nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) + return; + + skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb) + goto err; + + event = event == NETDEV_REGISTER ? NFT_MSG_NEWDEV : NFT_MSG_DELDEV; + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); + nlh = nfnl_msg_put(skb, 0, 0, event, flags, table->family, + NFNETLINK_V0, nft_base_seq(net)); + if (!nlh) + goto err; + + if (nla_put_string(skb, NFTA_DEVICE_TABLE, table->name) || + nla_put_string(skb, attr, name) || + nla_put_string(skb, NFTA_DEVICE_NAME, dev->name)) + goto err; + + nlmsg_end(skb, nlh); + nfnetlink_send(skb, net, 0, NFNLGRP_NFTABLES, + nlmsg_report(nlh), GFP_KERNEL); + return; +err: + if (skb) + kfree_skb(skb); + nfnetlink_set_err(net, 0, NFNLGRP_NFTABLES, -ENOBUFS); +} + +void +nf_tables_chain_device_notify(const struct nft_chain *chain, + const struct net_device *dev, int event) +{ + nf_tables_device_notify(chain->table, NFTA_DEVICE_CHAIN, + chain->name, dev, event); +} + +static void +nf_tables_flowtable_device_notify(const struct nft_flowtable *ft, + const struct net_device *dev, int event) +{ + nf_tables_device_notify(ft->table, NFTA_DEVICE_FLOWTABLE, + ft->name, dev, event); +} + + static void nft_flowtable_event(unsigned long event, struct net_device *dev, struct nft_flowtable *flowtable) { @@ -9348,6 +9404,7 @@ static void nft_flowtable_event(unsigned long event, struct net_device *dev, kfree(ops); continue; } + nf_tables_flowtable_device_notify(flowtable, dev, event); } } diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c index d691f8354049..c9de9b12f772 100644 --- a/net/netfilter/nft_chain_filter.c +++ b/net/netfilter/nft_chain_filter.c @@ -357,6 +357,7 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev, kfree(ops); continue; } + nf_tables_chain_device_notify(ctx->chain, dev, event); } } -- 2.43.0