| Message ID | 1398330071-3463-1-git-send-email-fw@strlen.de |
|---|---|
| State | Accepted |
| Headers | show |
On Thu, Apr 24, 2014 at 11:01:11AM +0200, Florian Westphal wrote: > There is confusion on what this command actually does and why > examples commonly PF_UNBIND at startup. > > Since these are obsolete document that its not needed at all > from 3.8 onwards and remove the unbind from the example program. > > Signed-off-by: Florian Westphal <fw@strlen.de> > --- > I'll push it later today if noone objets. > > diff --git a/examples/nf-queue.c b/examples/nf-queue.c > index 1f465ad..4e0b227 100644 > --- a/examples/nf-queue.c > +++ b/examples/nf-queue.c > @@ -136,17 +136,9 @@ int main(int argc, char *argv[]) > exit(EXIT_FAILURE); > } > > - nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0); > - nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_UNBIND); > - > - if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { > - perror("mnl_socket_send"); > - exit(EXIT_FAILURE); > - } > - > + /* PF_BIND is not needed with kernels 3.8 and later */ My only concern is that people using old kernels won't manage to run this example, I think there are quite a lot of people running < 3.8, so we may hit confusion from the other side. I like the remaining part of the patch, but this part, I would just leave it with a big fat comment like from here to there you can remove this code since the NFQNL_CFG_CMD_PF_UNBIND is noop in >= 3.8. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > - nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0); > > - nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_UNBIND); > > - > > - if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { > > - perror("mnl_socket_send"); > > - exit(EXIT_FAILURE); > > - } > > - > > + /* PF_BIND is not needed with kernels 3.8 and later */ > > My only concern is that people using old kernels won't manage to run > this example, I think there are quite a lot of people running < 3.8, > so we may hit confusion from the other side. I pushed the patch without the UNBIND removal. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/examples/nf-queue.c b/examples/nf-queue.c index 1f465ad..4e0b227 100644 --- a/examples/nf-queue.c +++ b/examples/nf-queue.c @@ -136,17 +136,9 @@ int main(int argc, char *argv[]) exit(EXIT_FAILURE); } - nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0); - nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_UNBIND); - - if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { - perror("mnl_socket_send"); - exit(EXIT_FAILURE); - } - + /* PF_BIND is not needed with kernels 3.8 and later */ nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0); nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_BIND); - if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { perror("mnl_socket_send"); exit(EXIT_FAILURE); diff --git a/src/libnetfilter_queue.c b/src/libnetfilter_queue.c index 32725d1..740b340 100644 --- a/src/libnetfilter_queue.c +++ b/src/libnetfilter_queue.c @@ -455,8 +455,9 @@ EXPORT_SYMBOL(nfq_close); * \param h Netfilter queue connection handle obtained via call to nfq_open() * \param pf protocol family to bind to nfqueue handler obtained from nfq_open() * - * Binds the given queue connection handle to process packets belonging to + * Binds the given queue connection handle to process packets belonging to * the given protocol family (ie. PF_INET, PF_INET6, etc). + * This call is obsolete, Linux kernels from 3.8 onwards ignore it. * * \return integer inferior to 0 in case of failure */ @@ -473,6 +474,8 @@ EXPORT_SYMBOL(nfq_bind_pf); * * Unbinds the given queue connection handle from processing packets belonging * to the given protocol family. + * + * This call is obsolete, Linux kernels from 3.8 onwards ignore it. */ int nfq_unbind_pf(struct nfq_handle *h, u_int16_t pf) { diff --git a/src/nlmsg.c b/src/nlmsg.c index 81e170e..aebdd5e 100644 --- a/src/nlmsg.c +++ b/src/nlmsg.c @@ -77,10 +77,13 @@ EXPORT_SYMBOL(nfq_nlmsg_verdict_put_pkt); * subsystem is working. * - NFQNL_CFG_CMD_BIND: Binds the program to a specific queue. * - NFQNL_CFG_CMD_UNBIND: Unbinds the program to a specifiq queue. + * + * Obsolete commands: * - NFQNL_CFG_CMD_PF_BIND: Binds to process packets belonging to the given * protocol family (ie. PF_INET, PF_INET6, etc). * - NFQNL_CFG_CMD_PF_UNBIND: Unbinds from processing packets belonging to the - * given protocol family. + * given protocol family. Both commands are ignored by Linux kernel 3.8 and + * later versions. */ void nfq_nlmsg_cfg_put_cmd(struct nlmsghdr *nlh, uint16_t pf, uint8_t cmd) {
There is confusion on what this command actually does and why examples commonly PF_UNBIND at startup. Since these are obsolete document that its not needed at all from 3.8 onwards and remove the unbind from the example program. Signed-off-by: Florian Westphal <fw@strlen.de> --- I'll push it later today if noone objets.