Re: [PATCH] netfilter: nft_socket: socket expressions for GID & UID

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Apr 27, 2022 at 05:42:19PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Looks like skb->sk is NULL? Patch attached.
> 
> > diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
> > index 6d9e8e0a3a7d..d6da68a3b739 100644
> > --- a/net/netfilter/nft_socket.c
> > +++ b/net/netfilter/nft_socket.c
> > @@ -59,21 +59,27 @@ static void nft_socket_eval(const struct nft_expr *expr,
> >  			    const struct nft_pktinfo *pkt)
> >  {
> >  	const struct nft_socket *priv = nft_expr_priv(expr);
> > +	u32 *dest = &regs->data[priv->dreg];
> >  	struct sk_buff *skb = pkt->skb;
> > +	const struct net_device *dev;
> >  	struct sock *sk = skb->sk;
> > -	u32 *dest = &regs->data[priv->dreg];
> >  
> >  	if (sk && !net_eq(nft_net(pkt), sock_net(sk)))
> >  		sk = NULL;
> >  
> > -	if (!sk)
> > +	if (nft_hook(pkt) == NF_INET_LOCAL_OUT)
> > +		dev = nft_out(pkt);
> > +	else
> > +		dev = nft_in(pkt);
> 
> I think its better to just NFT_BREAK for NF_INET_LOCAL_OUT && skb->sk == NULL,
> I don't see how nf_sk_lookup_slow_.() could provide meaningful result
> here, they assume packet header daddr/dport are the local, not the
> remote addresses.
> 
> Or, check nft_in(pkt) == NULL || !sk -> BREAK, whatever seems simpler to
> you.

Makes sense.

I'll let you follow up on this.

I'll tag

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20220427153333.18424-1-pablo@netfilter.org/

as changed requested too