Re: [PATCH V2] net: Allow xt_owner in any user namespace

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jun 13, 2016 at 09:06:55PM -0500, Eric W. Biederman wrote:
> Florian Westphal <fw@strlen.de> writes:
> 
> > Kevin Cernekee <cernekee@chromium.org> wrote:
> >> @@ -35,6 +63,7 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
> >>  	const struct xt_owner_match_info *info = par->matchinfo;
> >>  	const struct file *filp;
> >>  	struct sock *sk = skb_to_full_sk(skb);
> >> +	const struct net *net;
> >>  
> >>  	if (sk == NULL || sk->sk_socket == NULL)
> >>  		return (info->match ^ info->invert) == 0;
> >> @@ -50,9 +79,10 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
> >>  		return ((info->match ^ info->invert) &
> >>  		       (XT_OWNER_UID | XT_OWNER_GID)) == 0;
> >>  
> >> +	net = sock_net(skb->sk);
> >
> > I think you need to use sock_net(sk) as skb_to_full_sk(skb) can return something
> > other than skb->sk.
> 
> Actually this should be "par->net".  That did not exist a few years ago
> when the patch was written but it does now, and that should simplify
> things a little bit, and remove any guess work or uncertainty.

Right.

BTW, could you also send a follow up patch to update
net/netfilter/nft_meta.c? We have similar support for socket owner in
nf_tables as well (actually it will be a more simple patch that this,
I would expect).

Thanks.