Re: [PATCH] entry_data

[Pablo Neira Ayuso <pablo@netfilter.org>]

Massimiliano Hofer wrote:
> On Tuesday 13 June 2006 5:19 pm, Pablo Neira Ayuso wrote:
> 
> 
>>> static int
>>> match(const struct sk_buff *skb, const struct net_device *in,
>>>-      const struct net_device *out, const void *matchinfo, int offset,
>>>-      unsigned int protoff, int *hotdrop)
>>>+      const struct net_device *out, const struct xt_match *match,
>>>+      const void *matchinfo, int offset,
>>>+      unsigned int protoff, int *hotdrop, void *entry_data)
>>
>>Hm, then you must have a patch to modify the interface match()?
> 
> 
> Of course. I sent a patch in the previous message:
> https://lists.netfilter.org/pipermail/netfilter-devel/2006-June/024656.html
> 
> The patches are available here:
> https://lists.netfilter.org/pipermail/netfilter-devel/attachments/20060605/94b0d808/2.6.17-rc5-entry_data_core-0001.bin
> https://lists.netfilter.org/pipermail/netfilter-devel/attachments/20060605/94b0d808/2.6.17-rc5-entry_data_matches-0001.bin

Unfortunately, your patch breaks old iptables binaries, so it can't 
guarantee backward compatibility :(

pablo@Decadence:~$ head -10 2.6.17-rc5-entry_data_core-0001.bin
diff -Nru linux-2.6.17-rc5/include/linux/netfilter/x_tables.h 
linux-2.6.17-rc5.entry_data_core/include/linux/netfilter/x_tables.h
--- linux-2.6.17-rc5/include/linux/netfilter/x_tables.h 2006-06-04 
21:30:58.000000000 +0200
+++ linux-2.6.17-rc5.entry_data_core/include/linux/netfilter/x_tables.h 
2006-06-04 21:34:03.000000000 +0200
@@ -20,6 +20,7 @@

                         /* Used inside the kernel */
                         struct xt_match *match;
+                       void *entry_data;
                 } kernel;

You can't modify the layout of xt_entry_[match|target] since this 
structure is shared between userspace (iptables) and kernel space.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris