Re: [PATCH 18/29] netfilter: notify about NF_QUEUE vs emergency skbs
From: Patrick McHardy <hidden>
Date: 2007-02-24 15:27:21
Also in:
linux-mm, lkml
Peter Zijlstra wrote:
quoted hunk ↗ jump to hunk
Emergency skbs should never touch user-space, however NF_QUEUE is fully user configurable. Notify the user of his mistake and try to continue.--- linux-2.6-git.orig/net/netfilter/core.c 2007-02-14 12:09:07.000000000 +0100 +++ linux-2.6-git/net/netfilter/core.c 2007-02-14 12:09:18.000000000 +0100@@ -187,6 +187,11 @@ next_hook: kfree_skb(*pskb); ret = -EPERM; } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { + if (unlikely((*pskb)->emergency)) { + printk(KERN_ERR "nf_hook: NF_QUEUE encountered for " + "emergency skb - skipping rule.\n"); + goto next_hook; + }
If I'm not mistaken any skb on the receive side might get allocated from the reserve. I don't see how the user could avoid this except by not using queueing at all. I also didn't see a patch dropping packets allocated from the reserve that are forwarded or processed directly without getting queued to a socket, so this would allow them to bypass userspace queueing and still go through. I think the user should just exclude packets necessary for swapping from queueing manually, based on IP addresses, port numbers or something like that.