linux-kernel - Re: [PATCH] netfilter: add per-namespace logging to nfnetlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Jul 2011 12:22:15 +0100
From:	Rainer Weikusat <rweikusat@...ileactivedefense.com>
To:	kaber@...sh.net
Cc:	netfilter-devel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] netfilter: add per-namespace logging to nfnetlink_log.c (updated)

Rainer Weikusat <rw@...phire.mobileactivedefense.com> writes:
> Presently, the nfnetlink_log.c file contains only very nominal support
> for network namespaces:

I'm going to do a second 'updated' version of that which rectifies a
couple of more-or-less minor issues with the first one (purpose of
this mail is to document the changes). Specifically,

	- the instances_via_skb function should now also compile when
          network namespace support is not supposed to be included in
          a kernel and the compiler doesn't remove the 'dead code'
          before compiling it (Some kernel data structures include a
          struct net * unconditionally, some include it only
          conditionally. In particular, struct sock and struct
          net_device belong to the latter group)

	- the nfulnl_recv_config routine now gets the net namespace to
          use by examining the ctnl argument since it is kind of
          stupid to use the more complicated route via struct skbuff
          if a simpler alternative is available

	- the unregister_pernet_subsys call has been moved to the end
          of nfnetlink_log_fini so that the init and fini codepaths
          are again axis-symmetric to each other

NB: Except in the fairly unlikely case that something like an actual
error turns up in this code, I won't send this patch again (or over
and over again :-) because I cannot possibly justify making more
essentially cosmetic changes to something which is working code I need
to solve a specifc problem I've encountered as part of my present job.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/