netdev - Re: [PATCH 5/5] netfilter: add netfilter ingress hook after handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <55538302.5080702@plumgrid.com>
Date:	Wed, 13 May 2015 09:59:46 -0700
From:	Alexei Starovoitov <ast@...mgrid.com>
To:	Pablo Neira Ayuso <pablo@...filter.org>,
	netfilter-devel@...r.kernel.org
CC:	davem@...emloft.net, netdev@...r.kernel.org, jhs@...atatu.com,
	daniel@...earbox.net, eric.dumazet@...il.com, kaber@...sh.net
Subject: Re: [PATCH 5/5] netfilter: add netfilter ingress hook after handle_ing()
 under unique static key

On 5/13/15 9:19 AM, Pablo Neira Ayuso wrote:
> This patch adds the Netfilter ingress hook just after the existing tc ingress
> hook, that seems to be the consensus solution for this.

Looks good to me.
Acked-by: Alexei Starovoitov <ast@...mgrid.com>

> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index 2b39235..6c256f8 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -1659,6 +1659,9 @@ struct net_device {
>   	struct tcf_proto __rcu  *ingress_cl_list;
>   #endif
>   	struct netdev_queue __rcu *ingress_queue;
> +#ifdef CONFIG_NETFILTER_INGRESS
> +	struct list_head	nf_hooks_ingress;
> +#endif
...
> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> index f70e34a..db1c674 100644
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -1,6 +1,13 @@
>   menu "Core Netfilter Configuration"
>   	depends on NET && INET && NETFILTER
>
> +config NETFILTER_INGRESS
> +	bool "Netfilter ingress support"
> +	select NET_INGRESS
> +	help
> +	  This allows you to classify packets from ingress using the Netfilter
> +	  infrastructure.
> +

should be some default hint as well?
not sure why you want to do it under another config flag.
Just makes it harder to test all config combinations.
I think under global CONFIG_NETFILTER it would be fine as well.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html