Skip to content

xt_cgroups fix

Daniel Borkmann netfilter-devel 2 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v2 Latest2 patches 10 repliesIn review
  2. v12 patches 9 repliesSuperseded

Changes in v2 from the cover letter

- patch1 as is
- patch2 checks for full socket

Patches in v2 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2netfilter: x_tables: refactor lookup helpers from xt_socketnet/netfilter/xt_sk_helper.h net/netfilter/xt_socket.c+300 -2752 replies
2/2netfilter: x_tables: fix cgroup's NF_INET_LOCAL_IN sk lookupsnet/netfilter/Kconfig net/netfilter/xt_cgroup.c+79 -186 replies

Reviews trailers per patch

None of the 2 patches has a Reviewed-by or Acked-by.

PatchDaniel Mack
1/2
2/2T-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v2 thread

Cover letter [PATCH nf-next v2 0/2] xt_cgroups fix

Hi Pablo,

here's a possible fix for xt_cgroups that was previously reported by Daniel Mack.

I respinned the set based on your previous feedback wrt tw sockets.

The first patch refactors common helpers, which is later on being used by the actual fix. Please see individual patches for details.

I have rebased it against nf-next as in the previous version.

Thanks a lot!

v1->v2:
- patch1 as is
- patch2 checks for full socket

Daniel Borkmann (2):
netfilter: x_tables: refactor lookup helpers from xt_socket
netfilter: x_tables: fix cgroup's NF_INET_LOCAL_IN sk lookups

 net/netfilter/Kconfig        |   5 +
 net/netfilter/xt_cgroup.c    |  92 +++++++++++---
 net/netfilter/xt_sk_helper.h | 282 +++++++++++++++++++++++++++++++++++++++++
 net/netfilter/xt_socket.c    | 293 +++----------------------------------------
 4 files changed, 379 insertions(+), 293 deletions(-)
 create mode 100644 net/netfilter/xt_sk_helper.h
Signature · 1 line
1.9.3

Read the cover letter in its thread