Message ID | 1295368755-20931-1-git-send-email-ian.molton@collabora.co.uk |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
Le mardi 18 janvier 2011 à 16:39 +0000, Ian Molton a écrit : > From: Alban Crequy <alban.crequy@collabora.co.uk> > > Linux Socket Filters can already be successfully attached and detached on unix > sockets with setsockopt(sockfd, SOL_SOCKET, SO_{ATTACH,DETACH}_FILTER, ...). > See: Documentation/networking/filter.txt > > But the filter was never used in the unix socket code so it did not work. This > patch uses sk_filter() to filter buffers before delivery. > > This short program demonstrates the problem on SOCK_DGRAM. Any idea on performance cost adding sk_filter() call ? Hmm, looking at it, I have no idea why sk_filter() needs to block BH. I'll send a patch to relax this requirement. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Le Tue, 18 Jan 2011 18:22:41 +0100, Eric Dumazet <eric.dumazet@gmail.com> a écrit : > Le mardi 18 janvier 2011 à 16:39 +0000, Ian Molton a écrit : > > From: Alban Crequy <alban.crequy@collabora.co.uk> > > > > Linux Socket Filters can already be successfully attached and > > detached on unix sockets with setsockopt(sockfd, SOL_SOCKET, > > SO_{ATTACH,DETACH}_FILTER, ....). See: > > Documentation/networking/filter.txt > > > > But the filter was never used in the unix socket code so it did not > > work. This patch uses sk_filter() to filter buffers before delivery. > > > > This short program demonstrates the problem on SOCK_DGRAM. By the way, the patch implements socket filters on SOCK_DGRAM and SOCK_SEQPACKET but not SOCK_STREAM. Socket filters does not make sense to me when there is no packet boundaries. But if there is a need for it, the code for SOCK_STREAM could be added easily. > Any idea on performance cost adding sk_filter() call ? Ian will write a performance test and repost the patch with some stats. I don't know about the performance cost. > Hmm, looking at it, I have no idea why sk_filter() needs to block BH. I don't know neither. > I'll send a patch to relax this requirement. Thanks for your review! Alban -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Le mardi 18 janvier 2011 à 17:51 +0000, Alban Crequy a écrit : > Le Tue, 18 Jan 2011 18:22:41 +0100, > Eric Dumazet <eric.dumazet@gmail.com> a écrit : > > Any idea on performance cost adding sk_filter() call ? > > Ian will write a performance test and repost the patch with some stats. > I don't know about the performance cost. Dont spend time on this, it was more a question for myself ;) Cost should be very small, unless complex filter is used, and I have a JIT compiler for BPF on x86_64, will post it when net-next-2.6 reopens. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Ian Molton <ian.molton@collabora.co.uk> Date: Tue, 18 Jan 2011 16:39:15 +0000 > From: Alban Crequy <alban.crequy@collabora.co.uk> > > Linux Socket Filters can already be successfully attached and detached on unix > sockets with setsockopt(sockfd, SOL_SOCKET, SO_{ATTACH,DETACH}_FILTER, ...). > See: Documentation/networking/filter.txt > > But the filter was never used in the unix socket code so it did not work. This > patch uses sk_filter() to filter buffers before delivery. > > This short program demonstrates the problem on SOCK_DGRAM. ... > Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk> > Reviewed-by: Ian Molton <ian.molton@collabora.co.uk> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index dd419d2..8d9bbba 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1475,6 +1475,12 @@ restart: goto out_free; } + if (sk_filter(other, skb) < 0) { + /* Toss the packet but do not return any error to the sender */ + err = len; + goto out_free; + } + unix_state_lock(other); err = -EPERM; if (!unix_may_send(sk, other))