* [PATCH] netfilter: explicit module dependency between br_netfilter and physdev
@ 2014-10-02 9:41 Pablo Neira Ayuso
2014-10-02 10:51 ` Florian Westphal
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2014-10-02 9:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: stephen, fw, kaber
You can use physdev to match the physical interface enslaved to the
bridge device. This information is stored in skb->nf_bridge and it is
set up by br_netfilter. So, this is only available when iptables is
used from the bridge netfilter path.
Since 34666d4 ("netfilter: bridge: move br_netfilter out of the core"),
the br_netfilter code is modular. To reduce the impact of this change,
we can autoload the br_netfilter if the physdev match is used since
we assume that the users need br_netfilter in place.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/br_netfilter.h | 7 +++++++
net/bridge/br_netfilter.c | 17 +++++++++++++++++
net/netfilter/xt_physdev.c | 10 ++++++++++
3 files changed, 34 insertions(+)
create mode 100644 include/net/netfilter/br_netfilter.h
diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h
new file mode 100644
index 0000000..13e7359
--- /dev/null
+++ b/include/net/netfilter/br_netfilter.h
@@ -0,0 +1,7 @@
+#ifndef _BR_NETFILTER_H_
+#define _BR_NETFILTER_H_
+
+bool br_netfilter_module_get(void);
+void br_netfilter_module_put(void);
+
+#endif /* _BR_NETFILTER_H_ */
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 97e4393..fa96627 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -856,6 +856,23 @@ static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops,
return NF_ACCEPT;
}
+static struct module *me = THIS_MODULE;
+
+bool br_netfilter_module_get(void)
+{
+ if (!try_module_get(me))
+ return false;
+
+ return true;
+}
+EXPORT_SYMBOL_GPL(br_netfilter_module_get);
+
+void br_netfilter_module_put(void)
+{
+ module_put(me);
+}
+EXPORT_SYMBOL_GPL(br_netfilter_module_put);
+
/* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
* br_dev_queue_push_xmit is called afterwards */
static struct nf_hook_ops br_nf_ops[] __read_mostly = {
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index d7ca16b..403fd44 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -13,6 +13,7 @@
#include <linux/netfilter_bridge.h>
#include <linux/netfilter/xt_physdev.h>
#include <linux/netfilter/x_tables.h>
+#include <net/netfilter/br_netfilter.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
@@ -87,6 +88,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
{
const struct xt_physdev_info *info = par->matchinfo;
+ if (!br_netfilter_module_get())
+ return -EOPNOTSUPP;
+
if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
info->bitmask & ~XT_PHYSDEV_OP_MASK)
return -EINVAL;
@@ -104,11 +108,17 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
return 0;
}
+static void physdev_mt_destroy(const struct xt_mtdtor_param *par)
+{
+ br_netfilter_module_put();
+}
+
static struct xt_match physdev_mt_reg __read_mostly = {
.name = "physdev",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = physdev_mt_check,
+ .destroy = physdev_mt_destroy,
.match = physdev_mt,
.matchsize = sizeof(struct xt_physdev_info),
.me = THIS_MODULE,
--
1.7.10.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] netfilter: explicit module dependency between br_netfilter and physdev
2014-10-02 9:41 [PATCH] netfilter: explicit module dependency between br_netfilter and physdev Pablo Neira Ayuso
@ 2014-10-02 10:51 ` Florian Westphal
2014-10-02 11:16 ` Patrick McHardy
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2014-10-02 10:51 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, stephen, fw, kaber
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> You can use physdev to match the physical interface enslaved to the
> bridge device. This information is stored in skb->nf_bridge and it is
> set up by br_netfilter. So, this is only available when iptables is
> used from the bridge netfilter path.
>
> Since 34666d4 ("netfilter: bridge: move br_netfilter out of the core"),
> the br_netfilter code is modular. To reduce the impact of this change,
> we can autoload the br_netfilter if the physdev match is used since
> we assume that the users need br_netfilter in place.
Good idea. I'd suggest to add a dummy dependency and have userspace take
care of this -- just like we do for nf_defrag.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] netfilter: explicit module dependency between br_netfilter and physdev
2014-10-02 10:51 ` Florian Westphal
@ 2014-10-02 11:16 ` Patrick McHardy
0 siblings, 0 replies; 3+ messages in thread
From: Patrick McHardy @ 2014-10-02 11:16 UTC (permalink / raw)
To: Florian Westphal, Pablo Neira Ayuso; +Cc: netfilter-devel, stephen
Am 2. Oktober 2014 12:51:03 MESZ, schrieb Florian Westphal <fw@strlen.de>:
>Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> You can use physdev to match the physical interface enslaved to the
>> bridge device. This information is stored in skb->nf_bridge and it is
>> set up by br_netfilter. So, this is only available when iptables is
>> used from the bridge netfilter path.
>>
>> Since 34666d4 ("netfilter: bridge: move br_netfilter out of the
>core"),
>> the br_netfilter code is modular. To reduce the impact of this
>change,
>> we can autoload the br_netfilter if the physdev match is used since
>> we assume that the users need br_netfilter in place.
>
>Good idea. I'd suggest to add a dummy dependency and have userspace
>take
>care of this -- just like we do for nf_defrag.
Yes, the symbol dependency is enough, we don't need any manual module refcounting.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-10-02 11:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-10-02 9:41 [PATCH] netfilter: explicit module dependency between br_netfilter and physdev Pablo Neira Ayuso
2014-10-02 10:51 ` Florian Westphal
2014-10-02 11:16 ` Patrick McHardy
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.