* [PATCH 1/2 v2 net-next] netfilter: xt_bpf: add mising opaque struct sk_filter definition
@ 2014-07-29 16:12 Pablo Neira Ayuso
2014-07-29 16:40 ` Willem de Bruijn
2014-07-31 2:57 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2014-07-29 16:12 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, ast, keescook, willemb, dborkman
This structure is not exposed to userspace, so fix this by defining
struct sk_filter; so we skip the casting in kernelspace. This is safe
since userspace has no way to lurk with that internal pointer.
Fixes: e6f30c7 ("netfilter: x_tables: add xt_bpf match")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: address Willem's feedback, we still need uapi/linux/filter.h for
userspace iptables builds.
include/uapi/linux/netfilter/xt_bpf.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/include/uapi/linux/netfilter/xt_bpf.h b/include/uapi/linux/netfilter/xt_bpf.h
index 5dda450..2ec9fbc 100644
--- a/include/uapi/linux/netfilter/xt_bpf.h
+++ b/include/uapi/linux/netfilter/xt_bpf.h
@@ -6,6 +6,8 @@
#define XT_BPF_MAX_NUM_INSTR 64
+struct sk_filter;
+
struct xt_bpf_info {
__u16 bpf_program_num_elem;
struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];
--
1.7.10.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH 1/2 v2 net-next] netfilter: xt_bpf: add mising opaque struct sk_filter definition
2014-07-29 16:12 [PATCH 1/2 v2 net-next] netfilter: xt_bpf: add mising opaque struct sk_filter definition Pablo Neira Ayuso
@ 2014-07-29 16:40 ` Willem de Bruijn
2014-07-31 2:57 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Willem de Bruijn @ 2014-07-29 16:40 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, David Miller, Network Development,
Alexei Starovoitov, Kees Cook, Daniel Borkmann
On Tue, Jul 29, 2014 at 12:12 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> This structure is not exposed to userspace, so fix this by defining
> struct sk_filter; so we skip the casting in kernelspace. This is safe
> since userspace has no way to lurk with that internal pointer.
>
> Fixes: e6f30c7 ("netfilter: x_tables: add xt_bpf match")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Willem de Bruijn <willemb@google.com>
> ---
> v2: address Willem's feedback, we still need uapi/linux/filter.h for
> userspace iptables builds.
>
> include/uapi/linux/netfilter/xt_bpf.h | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/include/uapi/linux/netfilter/xt_bpf.h b/include/uapi/linux/netfilter/xt_bpf.h
> index 5dda450..2ec9fbc 100644
> --- a/include/uapi/linux/netfilter/xt_bpf.h
> +++ b/include/uapi/linux/netfilter/xt_bpf.h
> @@ -6,6 +6,8 @@
>
> #define XT_BPF_MAX_NUM_INSTR 64
>
> +struct sk_filter;
> +
> struct xt_bpf_info {
> __u16 bpf_program_num_elem;
> struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];
> --
> 1.7.10.4
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH 1/2 v2 net-next] netfilter: xt_bpf: add mising opaque struct sk_filter definition
2014-07-29 16:12 [PATCH 1/2 v2 net-next] netfilter: xt_bpf: add mising opaque struct sk_filter definition Pablo Neira Ayuso
2014-07-29 16:40 ` Willem de Bruijn
@ 2014-07-31 2:57 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2014-07-31 2:57 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, ast, keescook, willemb, dborkman
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 29 Jul 2014 18:12:15 +0200
> This structure is not exposed to userspace, so fix this by defining
> struct sk_filter; so we skip the casting in kernelspace. This is safe
> since userspace has no way to lurk with that internal pointer.
>
> Fixes: e6f30c7 ("netfilter: x_tables: add xt_bpf match")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> v2: address Willem's feedback, we still need uapi/linux/filter.h for
> userspace iptables builds.
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-07-31 2:57 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-07-29 16:12 [PATCH 1/2 v2 net-next] netfilter: xt_bpf: add mising opaque struct sk_filter definition Pablo Neira Ayuso
2014-07-29 16:40 ` Willem de Bruijn
2014-07-31 2:57 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).