linux-kernel - Re: [Outreachy kernel] [PATCH v3] net: netfilter: Add nfnl_msg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20170406220633.GA1762@salvia>
Date:   Fri, 7 Apr 2017 00:06:33 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Arushi Singhal <arushisinghal19971997@...il.com>
Cc:     outreachy-kernel@...glegroups.com,
        Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>,
        davem@...emloft.net, netfilter-devel@...r.kernel.org,
        coreteam@...filter.org, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [Outreachy kernel] [PATCH v3] net: netfilter: Add
 nfnl_msg_type() helper function

Hi,

On Tue, Mar 28, 2017 at 10:27:32PM +0530, Arushi Singhal wrote:
> To remove complexity of code the function is added in nfnetlink.h
> to make code more clear and readable.
> This is opencoded in a way that makes it error prone for future
> netfilter netlink subsystems.
> 
> Signed-off-by: Arushi Singhal <arushisinghal19971997@...il.com>
> ---
> changes in v3
>  -make the subject more clear.
> 
>  include/linux/netfilter/nfnetlink.h  |  6 ++++++
>  net/netfilter/nf_conntrack_netlink.c | 12 +++++++-----
>  net/netfilter/nfnetlink_acct.c       |  2 +-
>  net/netfilter/nfnetlink_cthelper.c   |  2 +-
>  net/netfilter/nfnetlink_cttimeout.c  |  4 ++--
>  5 files changed, 17 insertions(+), 9 deletions(-)
> 
> diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
> index 1b49209dd5c7..9a36a7c3145d 100644
> --- a/include/linux/netfilter/nfnetlink.h
> +++ b/include/linux/netfilter/nfnetlink.h
> @@ -50,6 +50,12 @@ static inline bool lockdep_nfnl_is_held(__u8 subsys_id)
>  {
>  	return true;
>  }
> +
> +static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
> +{
> +	return subsys << 8 | msg_type;
> +}

This is not right. You have placed this new function definition inside
the CONFIG_PROVE_LOCKING.

So this is only defined iff CONFIG_PROVE_LOCKING is set on.

>  #endif /* CONFIG_PROVE_LOCKING */
>  
>  /*
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> index aa344c5868c5..67f6f88a3e92 100644
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -467,7 +467,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
>  	struct nlattr *nest_parms;
>  	unsigned int flags = portid ? NLM_F_MULTI : 0, event;
>  
> -	event = NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_NEW;

I can find many more spots to be replaced via:

git grep NFNL_SUBSYS_ net/netfilter/

Patch attached.

View attachment "0001-netfilter-Add-nfnl_msg_type-helper-function.patch" of type "text/x-diff" (12671 bytes)