netdev - Re: [PATCH 08/23] netfilter: nft_ct: load both IPv4 and IPv6 conntrack modules for NFPROTO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <52D05AC6.20000@cogentembedded.com>
Date:	Fri, 10 Jan 2014 23:40:38 +0300
From:	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:	Pablo Neira Ayuso <pablo@...filter.org>,
	netfilter-devel@...r.kernel.org
CC:	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH 08/23] netfilter: nft_ct: load both IPv4 and IPv6 conntrack
 modules for NFPROTO_INET

On 01/10/2014 03:35 AM, Pablo Neira Ayuso wrote:

> From: Patrick McHardy <kaber@...sh.net>

> The ct expression can currently not be used in the inet family since
> we don't have a conntrack module for NFPROTO_INET, so
> nf_ct_l3proto_try_module_get() fails. Add some manual handling to
> load the modules for both NFPROTO_IPV4 and NFPROTO_IPV6 if the
> ct expression is used in the inet family.

> Signed-off-by: Patrick McHardy <kaber@...sh.net>
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
> ---
>   net/netfilter/nft_ct.c |   39 ++++++++++++++++++++++++++++++++++++---
>   1 file changed, 36 insertions(+), 3 deletions(-)

> diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
> index 955f4e6..3727a32 100644
> --- a/net/netfilter/nft_ct.c
> +++ b/net/netfilter/nft_ct.c
[...]
> +static void nft_ct_l3proto_module_put(uint8_t family)
> +{
> +	if (family == NFPROTO_INET) {
> +		nf_ct_l3proto_module_put(NFPROTO_IPV4);
> +		nf_ct_l3proto_module_put(NFPROTO_IPV6);
> +	} else
> +		nf_ct_l3proto_module_put(family);

    According to Documentation/CodingStyle, there should be {} in the *else* 
arm, as the other arm of *if* statement has it.

> +}
> +

WBR, Sergei

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html