netdev - Re: [PATCH next 28/30] netfilter: Pass struct net into the netfilter hooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <55FAE992.9060103@6wind.com>
Date:	Thu, 17 Sep 2015 18:25:54 +0200
From:	Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Pablo Neira Ayuso <pablo@...filter.org>,
	David Miller <davem@...emloft.net>
Cc:	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH next 28/30] netfilter: Pass struct net into the netfilter
 hooks

Le 16/09/2015 03:04, Eric W. Biederman a écrit :
> Pass a network namespace parameter into the netfilter hooks.  At the
> call site of the netfilter hooks the path a packet is taking through
> the network stack is well known which allows the network namespace to
> be easily and reliabily.
>
> This allows the replacement of magic code like
> "dev_net(state->in?:state->out)" that appears at the start of most
> netfilter hooks with "state->net".
>
> In almost all cases the network namespace passed in is derived
> from the first network device passed in, guaranteeing those
> paths will not see any changes in practice.
>
> The exceptions are:
> xfrm/xfrm_output.c:xfrm_output_resume()         xs_net(skb_dst(skb)->xfrm)
> ipvs/ip_vs_xmit.c:ip_vs_nat_send_or_cont()      ip_vs_conn_net(cp)
> ipvs/ip_vs_xmit.c:ip_vs_send_or_cont()          ip_vs_conn_net(cp)
> ipv4/raw.c:raw_send_hdrinc()                    sock_net(sk)
> ipv6/ip6_output.c:ip6_xmit()			sock_net(sk)
> ipv6/ndisc.c:ndisc_send_skb()                   dev_net(skb->dev) not dev_net(dst->dev)
> ipv6/raw.c:raw6_send_hdrinc()                   sock_net(sk)
> br_netfilter_hooks.c:br_nf_pre_routing_finish() dev_net(skb->dev) before skb->dev is set to nf_bridge->physindev
>
> In all cases these exceptions seem to be a better expression for the
> network namespace the packet is being processed in then the historic
> "dev_net(in?in:out)".  I am documenting them in case something odd
> pops up and someone starts trying to track down what happened.
>
> Signed-off-by: "Eric W. Biederman" <ebiederm@...ssion.com>
> ---
[snip]
>   int br_forward_finish(struct sock *sk, struct sk_buff *skb)
>   {
> -	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, sk, skb,
> -		       NULL, skb->dev,
> +	struct net *net = dev_net(skb->dev);
nit: blank line after the declaration

> +	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING,
> +		       net, sk, skb, NULL, skb->dev,
>   		       br_dev_queue_push_xmit);
>
>   }
[snip]
>   int xfrm4_output(struct sock *sk, struct sk_buff *skb)
>   {
> -	return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, sk, skb,
> -			    NULL, skb_dst(skb)->dev, __xfrm4_output,
> +	struct net *net = dev_net(skb_dst(skb)->dev);
nit: same here

> +	return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
> +			    net, sk, skb, NULL, skb_dst(skb)->dev,
> +			    __xfrm4_output,
>   			    !(IPCB(skb)->flags & IPSKB_REROUTED));
>   }
[snip]
>   int xfrm6_output(struct sock *sk, struct sk_buff *skb)
>   {
> -	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, sk, skb,
> -			    NULL, skb_dst(skb)->dev, __xfrm6_output,
> +	struct net *net = dev_net(skb_dst(skb)->dev);
nit: same here

> +	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
> +			    net, sk, skb,  NULL, skb_dst(skb)->dev,
> +			    __xfrm6_output,
>   			    !(IP6CB(skb)->flags & IP6SKB_REROUTED));
>   }
[snip]
>   int xfrm_output_resume(struct sk_buff *skb, int err)
>   {
> +	struct net *net = xs_net(skb_dst(skb)->xfrm);
nit: same here

>   	while (likely((err = xfrm_output_one(skb, err)) == 0)) {
>   		nf_reset(skb);

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html