Re: [PATCH nf-next 0/3] netfilter: nf_tables: reject loads from uninitialized registers

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Hmm, this will get messy.
> > 
> > I only see two alternatives:
> > 
> > - place the bitmask in the pernet structure.
> > - add struct nft_expr_ctx as a container structure, which has
> >   nft_ctx as first member and the bitmask as second member, to
> >   be used for NEWRULE and NEWSETELEM instead of nft_ctx.
> 
> Can the 'level' field be moved to this nft_expr_ctx structure? This
> field is only used from the preparation phase (not in the commit
> phase).
> 
> Probably we need to rename nft_ctx to nft_trans_ctx, so it contains
> the fields that are needed from the commit phase. Then, re-add a
> nft_ctx again which contains nft_trans_ctx at the beginning, then the
> register bitmap and the level field. Thus, any future fields only
> required by preparation phase only will go in nft_ctx, and fields that
> are specifically are set up from preparation phase and consumed from
> commit step go in nft_trans_ctx.
> 
> It is a bit of churn, but it is probably good to tidy up this for
> future extensions?

Yes, its a lot of churn, I can have a look at how intrusive this will
be.  Problem is that we have a bunch of helpers that take
'struct nft_ctx *', which are fed via '&trans->ctx'.

I'd like to avoid 'union nf_ctx_any *' tricks...