xt_target checkentry()/destroy() semantics

xt_target checkentry()/destroy() semantics

[Richard Weinberger]

[-- Attachment #1: Type: text/plain, Size: 2679 bytes --]

Hi!

I always thought that checkentry()/destroy() are being called upon rule insertion/deletion.
So I assumed that this command sequence prints three times "test_tg_check" and then three times
"test_tg_destroy". But it's not the case.

$ iptables -A INPUT -j TEST
$ iptables -A INPUT -j TEST
$ iptables -A INPUT -j TEST
$ iptables -D INPUT -j TEST
$ iptables -D INPUT -j TEST
$ iptables -D INPUT -j TEST

This is the real output:
(On 3.2.0-rc6)

[90330.168306] test_tg_destroy
[90330.171099] test_tg_destroy
[90330.173901] test_tg_destroy
[90343.768654] test_tg_check
[90345.773073] test_tg_check
[90345.775691] test_tg_check
[90345.778330] test_tg_destroy
[90347.782798] test_tg_check
[90347.785417] test_tg_check
[90347.788044] test_tg_check
[90347.790663] test_tg_destroy
[90347.793454] test_tg_destroy
[90372.581020] test_tg_check
[90372.583639] test_tg_check
[90372.586275] test_tg_destroy
[90372.589059] test_tg_destroy
[90372.591843] test_tg_destroy
[90374.596452] test_tg_check
[90374.599080] test_tg_destroy
[90374.601875] test_tg_destroy
[90376.606409] test_tg_destroy

How comes that?
Is there a way to detect the insertion/removal of a rule using my TEST target?

The comments in x_tables.h are not really helpful.
        /* Called when user tries to insert an entry of this type:
           hook_mask is a bitmask of hooks from which it can be
           called. */
        /* Should return 0 on success or an error code otherwise (-Exxxx). */
        int (*checkentry)(const struct xt_tgchk_param *);

        /* Called when entry of this type deleted. */
        void (*destroy)(const struct xt_tgdtor_param *);

Thanks,
//richard

P.s: The TEST target is attached.

---
static unsigned int
test_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
        return XT_CONTINUE;
}

static int test_tg_check(const struct xt_tgchk_param *par)
{
        printk(KERN_ERR "test_tg_check\n");
        return 0;
}

static void test_tg_destroy(const struct xt_tgdtor_param *par)
{
        printk(KERN_ERR "test_tg_destroy\n");
}

static struct xt_target test_tg_reg __read_mostly = {
        .name           = "TEST",
        .family         = NFPROTO_IPV4,
        .target         = test_tg,
        .targetsize     = 0,
        .checkentry     = test_tg_check,
        .destroy        = test_tg_destroy,
        .me             = THIS_MODULE,
};

static void __exit test_exit(void)
{
        xt_unregister_target(&test_tg_reg);
}
module_exit(test_exit);

static int __init test_init(void)
{
        return xt_register_target(&test_tg_reg);
}
module_init(test_init);


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 490 bytes --]

Re: xt_target checkentry()/destroy() semantics

[Jan Engelhardt]

On Wednesday 2012-01-11 02:32, Richard Weinberger wrote:

>Hi!
>
>I always thought that checkentry()/destroy() are being called upon rule insertion/deletion.
>So I assumed that this command sequence prints three times "test_tg_check" and then three times
>"test_tg_destroy". But it's not the case.

One table-replace operation implies add-delete of all rules.

>[90345.773073] test_tg_check
>[90345.775691] test_tg_check
>[90345.778330] test_tg_destroy
>[90347.782798] test_tg_check
>[90347.785417] test_tg_check
>[90347.788044] test_tg_check
>[90347.790663] test_tg_destroy
>[90347.793454] test_tg_destroy
>[90372.581020] test_tg_check
>[90372.583639] test_tg_check
>[90372.586275] test_tg_destroy
>
>Is there a way to detect the insertion/removal of a rule using my TEST target?

test_tg_destroy.

Re: xt_target checkentry()/destroy() semantics

[Richard Weinberger]

[-- Attachment #1: Type: text/plain, Size: 587 bytes --]

Am 11.01.2012 07:45, schrieb Jan Engelhardt:
> On Wednesday 2012-01-11 02:32, Richard Weinberger wrote:
> 
>> Hi!
>>
>> I always thought that checkentry()/destroy() are being called upon rule insertion/deletion.
>> So I assumed that this command sequence prints three times "test_tg_check" and then three times
>> "test_tg_destroy". But it's not the case.
> 
> One table-replace operation implies add-delete of all rules.

Okay, I did not know that my simple command sequence is causing a table-replacement.
Why?

I thought it appends (-A) only...

Thanks,
//richard


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 490 bytes --]

Re: xt_target checkentry()/destroy() semantics

[Maciej Żenczykowski]

every change, whether addition or deletion is done via table-replacement.
the only modification operation supported is table replacement.
so you're making 6 table replecaments with those 6 commands.


On Wed, Jan 11, 2012 at 01:52, Richard Weinberger <richard@nod.at> wrote:
> Am 11.01.2012 07:45, schrieb Jan Engelhardt:
>> On Wednesday 2012-01-11 02:32, Richard Weinberger wrote:
>>
>>> Hi!
>>>
>>> I always thought that checkentry()/destroy() are being called upon rule insertion/deletion.
>>> So I assumed that this command sequence prints three times "test_tg_check" and then three times
>>> "test_tg_destroy". But it's not the case.
>>
>> One table-replace operation implies add-delete of all rules.
>
> Okay, I did not know that my simple command sequence is causing a table-replacement.
> Why?
>
> I thought it appends (-A) only...
>
> Thanks,
> //richard
>

Re: xt_target checkentry()/destroy() semantics

[Richard Weinberger]

[-- Attachment #1: Type: text/plain, Size: 359 bytes --]

Am 11.01.2012 11:27, schrieb Maciej Żenczykowski:
> every change, whether addition or deletion is done via table-replacement.
> the only modification operation supported is table replacement.
> so you're making 6 table replecaments with those 6 commands.

So the table is read-only and is being recreated on each change, right?

Thanks,
//richard


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 490 bytes --]

Re: xt_target checkentry()/destroy() semantics

[Jan Engelhardt]

On Wednesday 2012-01-11 11:38, Richard Weinberger wrote:

>Am 11.01.2012 11:27, schrieb Maciej Żenczykowski:
>> every change, whether addition or deletion is done via table-replacement.
>> the only modification operation supported is table replacement.
>> so you're making 6 table replecaments with those 6 commands.
>
>So the table is read-only and is being recreated on each change, right?

There is nothing that makes it read only. It is simply the atomicity 
guarantee that requires placing a new table inplace before the old one 
can be freed.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html