| Message ID | 20120507060422.19528.20723.sendpatchset@localhost.localdomain |
|---|---|
| State | Superseded |
| Headers | show |
Krishna Kumar <krkumar2@in.ibm.com> wrote: > Define xt_NFQ_info_v3 to get fail-open argument from iptables. Also > enable FAIL_OPEN. > > Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com> > diff -ruNp org/include/linux/netfilter/xt_NFQUEUE.h new/include/linux/netfilter/xt_NFQUEUE.h > --- org/include/linux/netfilter/xt_NFQUEUE.h 2012-05-07 10:17:28.117870787 +0530 > +++ new/include/linux/netfilter/xt_NFQUEUE.h 2012-05-07 09:20:53.783813702 +0530 > @@ -26,4 +26,11 @@ struct xt_NFQ_info_v2 { > __u16 bypass; > }; > > +struct xt_NFQ_info_v3 { > + __u16 queuenum; > + __u16 queues_total; > + __u16 bypass; > + __u16 fail_open; > +}; Minor nit: This shouldn't be necessary; bypass is always 0 or 1. You could just rename it to "options" or something like that. Would also mean that you could have the v2 target revision use the same target callback as v3 (since struct layout would be the same). -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, May 07, 2012 at 09:56:47AM +0200, Florian Westphal wrote: > Krishna Kumar <krkumar2@in.ibm.com> wrote: > > Define xt_NFQ_info_v3 to get fail-open argument from iptables. Also > > enable FAIL_OPEN. > > > > Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com> > > diff -ruNp org/include/linux/netfilter/xt_NFQUEUE.h new/include/linux/netfilter/xt_NFQUEUE.h > > --- org/include/linux/netfilter/xt_NFQUEUE.h 2012-05-07 10:17:28.117870787 +0530 > > +++ new/include/linux/netfilter/xt_NFQUEUE.h 2012-05-07 09:20:53.783813702 +0530 > > @@ -26,4 +26,11 @@ struct xt_NFQ_info_v2 { > > __u16 bypass; > > }; > > > > +struct xt_NFQ_info_v3 { > > + __u16 queuenum; > > + __u16 queues_total; > > + __u16 bypass; > > + __u16 fail_open; > > +}; > > Minor nit: > > This shouldn't be necessary; bypass is always 0 or 1. > You could just rename it to "options" or something > like that. Would also mean that you could have the v2 target > revision use the same target callback as v3 (since struct layout would > be the same). Yes, something like "flags" can make it. Where flag (1 << 0) is bypass to ensure backward compatibility. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff -ruNp org/include/linux/netfilter/xt_NFQUEUE.h new/include/linux/netfilter/xt_NFQUEUE.h --- org/include/linux/netfilter/xt_NFQUEUE.h 2012-05-07 10:17:28.117870787 +0530 +++ new/include/linux/netfilter/xt_NFQUEUE.h 2012-05-07 09:20:53.783813702 +0530 @@ -26,4 +26,11 @@ struct xt_NFQ_info_v2 { __u16 bypass; }; +struct xt_NFQ_info_v3 { + __u16 queuenum; + __u16 queues_total; + __u16 bypass; + __u16 fail_open; +}; + #endif /* _XT_NFQ_TARGET_H */ diff -ruNp org/net/netfilter/xt_NFQUEUE.c new/net/netfilter/xt_NFQUEUE.c --- org/net/netfilter/xt_NFQUEUE.c 2012-05-07 09:20:53.871815019 +0530 +++ new/net/netfilter/xt_NFQUEUE.c 2012-05-07 09:20:53.808751034 +0530 @@ -94,6 +94,17 @@ nfqueue_tg_v2(struct sk_buff *skb, const return ret; } +static unsigned int +nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par) +{ + const struct xt_NFQ_info_v3 *info = par->targinfo; + unsigned int ret = nfqueue_tg_v1(skb, par); + + if (info->fail_open) + ret |= NF_VERDICT_FLAG_FAIL_OPEN; + return ret; +} + static int nfqueue_tg_check(const struct xt_tgchk_param *par) { const struct xt_NFQ_info_v2 *info = par->targinfo; @@ -144,6 +155,14 @@ static struct xt_target nfqueue_tg_reg[] .targetsize = sizeof(struct xt_NFQ_info_v2), .me = THIS_MODULE, }, + { + .name = "NFQUEUE", + .revision = 3, + .family = NFPROTO_UNSPEC, + .target = nfqueue_tg_v3, + .targetsize = sizeof(struct xt_NFQ_info_v3), + .me = THIS_MODULE, + }, }; static int __init nfqueue_tg_init(void)
Define xt_NFQ_info_v3 to get fail-open argument from iptables. Also enable FAIL_OPEN. Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com> --- include/linux/netfilter/xt_NFQUEUE.h | 7 +++++++ net/netfilter/xt_NFQUEUE.c | 19 +++++++++++++++++++ 2 files changed, 26 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html