[PATCH v2 1/2] netfilter: nf_tables: add SECMARK support

Christian G?ttsche [off-list ref] wrote:

Add the ability to set the security context of packets within the nf_tables framework.
Add a nft_object for holding security contexts in the kernel and manipulating packets on the wire.

Convert the security context strings at rule addition time to security identifiers.
This is the same behavior like in xt_SECMARK and offers better performance than computing it per packet.

Set the maximum security context length to 256.

Looks good, one minor suggestion.

+#ifdef CONFIG_NETWORK_SECMARK
+
+struct nft_secmark {
+	char ctx[NFT_SECMARK_CTX_MAXLEN];
+	int len;
+	u32 secid;
+};

Can you change this to:

struct nft_secmark {
	u32 secid;
	char *ctx;
};

?
We don't need ctx in the packetpath, so better to keep
the struct size small.

+	nla_strlcpy(priv->ctx, tb[NFTA_SECMARK_CTX], NFT_SECMARK_CTX_MAXLEN);

You can change this to
	priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL);
	if (!priv->ctx)
		return -ENOMEM;

+	err = nft_secmark_secconversion(priv);
+	if (err) {

		kfree(priv->ctx);

+static void nft_secmark_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
+{

	kfree(priv->ctx);

But other than this i think this is ready to be applied,
thanks a lot for making this happen.