From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc: Shmulik Ladkani <shmulik@nsof.io>,
netfilter-devel <netfilter-devel@vger.kernel.org>,
Willem de Bruijn <willemb@google.com>,
Network Development <netdev@vger.kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Rafael Buchbinder <rafi@rbk.ms>,
Shmulik Ladkani <shmulik.ladkani@gmail.com>
Subject: Re: [PATCH] netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1'
Date: Mon, 9 Oct 2017 13:57:36 +0200 [thread overview]
Message-ID: <20171009115736.GA31826@salvia> (raw)
In-Reply-To: <20171009111823.GA30637@salvia>
On Mon, Oct 09, 2017 at 01:18:23PM +0200, Pablo Neira Ayuso wrote:
> On Fri, Oct 06, 2017 at 01:40:13PM -0400, Willem de Bruijn wrote:
> > On Fri, Oct 6, 2017 at 12:02 PM, Shmulik Ladkani <shmulik@nsof.io> wrote:
> > > From: Shmulik Ladkani <shmulik.ladkani@gmail.com>
> > >
> > > Commit 2c16d6033264 ("netfilter: xt_bpf: support ebpf") introduced
> > > support for attaching an eBPF object by an fd, with the
> > > 'bpf_mt_check_v1' ABI expecting the '.fd' to be specified upon each
> > > IPT_SO_SET_REPLACE call.
> > >
> > > However this breaks subsequent iptables calls:
> > >
> > > # iptables -A INPUT -m bpf --object-pinned /sys/fs/bpf/xxx -j ACCEPT
> > > # iptables -A INPUT -s 5.6.7.8 -j ACCEPT
> > > iptables: Invalid argument. Run `dmesg' for more information.
> [...]
> > >
> > > References: [1] https://marc.info/?l=netfilter-devel&m=150564724607440&w=2
> > > [2] https://marc.info/?l=netfilter-devel&m=150575727129880&w=2
> > >
> > > Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> > > Cc: Willem de Bruijn <willemb@google.com>
> > > Reported-by: Rafael Buchbinder <rafi@rbk.ms>
> > > Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
> >
> > Acked-by: Willem de Bruijn <willemb@google.com>
>
> Applied, thanks.
Hm, I have to keep this back. Compilation breaks here.
net/netfilter/xt_bpf.c: In function ‘__bpf_mt_check_path’:
net/netfilter/xt_bpf.c:59:2: error: implicit declaration of function
‘bpf_obj_get_user’ [-Werror=implicit-function-declaration]
fd = bpf_obj_get_user(path);
^
next prev parent reply other threads:[~2017-10-09 11:57 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-06 16:02 [PATCH] netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1' Shmulik Ladkani
2017-10-06 17:40 ` Willem de Bruijn
2017-10-09 11:18 ` Pablo Neira Ayuso
2017-10-09 11:57 ` Pablo Neira Ayuso [this message]
2017-10-09 12:01 ` Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171009115736.GA31826@salvia \
--to=pablo@netfilter.org \
--cc=daniel@iogearbox.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=rafi@rbk.ms \
--cc=shmulik.ladkani@gmail.com \
--cc=shmulik@nsof.io \
--cc=willemb@google.com \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).