Skip to contentSkip to conversation

nfnetlink parses attributes

RFC PATCH In review Pablo Neira 2 participants 2 messages Jun 30, 2005 – Jul 2, 2005

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

RFC PATCH 1/1 nfnetlink parses attributes

Hi,

Please do not apply this patch, just a RFC.

I think that we can could nfnetlink_check_attributes from nfnetlink itself, so the subsystems receive the attributes already parsed. Almost
all the operations in ip_conntrack_netlink always call
check_attributes first to parse attributes.

--
Pablo

net/netfilter/nfnetlink.c +27 -10
Index: davem-2.6/net/netfilter/nfnetlink.c
===================================================================
@@ -103,19 +103,23 @@
 	return 0;
 }
 
-struct nfnl_callback *nfnetlink_find_client(u_int16_t nlmsg_type)
+static inline struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t type)
 {
-	struct nfnetlink_subsystem *ss;
-	u_int8_t subsys_id = NFNL_SUBSYS_ID(nlmsg_type);
-	u_int8_t type = NFNL_MSG_TYPE(nlmsg_type);
+	u_int8_t subsys_id = NFNL_SUBSYS_ID(type);
 
 	if (subsys_id >= NFNL_SUBSYS_COUNT
 	    || subsys_table[subsys_id] == NULL)
 		return NULL;
 
-	ss = subsys_table[subsys_id];
+	return subsys_table[subsys_id];
+}
 
-	if (type >= ss->cb_count) {
+static inline struct nfnl_callback *
+nfnetlink_find_client(u_int16_t type, struct nfnetlink_subsystem *ss)
+{
+	u_int8_t cb_id = NFNL_MSG_TYPE(type);
+	
+	if (cb_id >= ss->cb_count) {
 		DEBUGP("msgtype %u >= %u, returning\n", type, ss->cb_count);
 		return NULL;
 	}
@@ -209,6 +213,7 @@
 				    struct nlmsghdr *nlh, int *errp)
 {
 	struct nfnl_callback *nc;
+	struct nfnetlink_subsystem *ss;
 	int type, err = 0;
 
 	DEBUGP("entered; subsys=%u, msgtype=%u\n",
@@ -228,7 +233,11 @@
 	}
 
 	type = nlh->nlmsg_type;
-	nc = nfnetlink_find_client(type);
+	ss = nfnetlink_get_subsys(type);
+	if (!ss)
+		goto err_inval;
+
+	nc = nfnetlink_find_client(type, ss);
 	if (!nc) {
 		DEBUGP("unable to find client for type %d\n", type);
 		goto err_inval;
@@ -241,9 +250,17 @@
 		return -1;
 	}
 
-	err = nc->call(nfnl, skb, nlh, errp);
-	*errp = err;
-	return err;
+	{
+		struct nfattr *cda[ss->attr_count];
+		
+		err = nfnetlink_check_attributes(ss, nlh, cda);
+		if (err < 0)
+			goto err_inval;
+		
+		err = nc->call(nfnl, skb, nlh, cda, errp);
+		*errp = err;
+		return err;
+	}
 
 err_inval:
 	*errp = -EINVAL;
include/linux/netfilter/nfnetlink.h +1 -1
Index: davem-2.6/include/linux/netfilter/nfnetlink.h
===================================================================
@@ -60,7 +60,7 @@
 {
 	kernel_cap_t cap_required; /* capabilities required for this msg */
 	int (*call)(struct sock *nl, struct sk_buff *skb, 
-		struct nlmsghdr *nlh, int *errp);
+		struct nlmsghdr *nlh, struct nfattr *cda[], int *errp);
 };
 
 struct nfnetlink_subsystem
#1 lore raw
Quoted 6 lines · Pablo Neira

Hi,

I think that we can could nfnetlink_check_attributes from nfnetlink itself, so the subsystems receive the attributes already parsed. Almost all the operations in ip_conntrack_netlink always call check_attributes first to parse attributes.

Sure, I think I wanted to change it like that at some point in the past.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie