Re: [PATCH 1/2 v2 net-next] netfilter: xt_bpf: add mising opaque struct sk_filter definition
From: Willem de Bruijn <willemb@google.com>
Date: 2014-07-29 16:41:01
Also in:
netfilter-devel
On Tue, Jul 29, 2014 at 12:12 PM, Pablo Neira Ayuso [off-list ref] wrote:
This structure is not exposed to userspace, so fix this by defining
struct sk_filter; so we skip the casting in kernelspace. This is safe
since userspace has no way to lurk with that internal pointer.
Fixes: e6f30c7 ("netfilter: x_tables: add xt_bpf match")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>Acked-by: Willem de Bruijn <willemb@google.com>
quoted hunk ↗ jump to hunk
--- v2: address Willem's feedback, we still need uapi/linux/filter.h for userspace iptables builds. include/uapi/linux/netfilter/xt_bpf.h | 2 ++ 1 file changed, 2 insertions(+)diff --git a/include/uapi/linux/netfilter/xt_bpf.h b/include/uapi/linux/netfilter/xt_bpf.h index 5dda450..2ec9fbc 100644 --- a/include/uapi/linux/netfilter/xt_bpf.h +++ b/include/uapi/linux/netfilter/xt_bpf.h@@ -6,6 +6,8 @@ #define XT_BPF_MAX_NUM_INSTR 64 +struct sk_filter; + struct xt_bpf_info { __u16 bpf_program_num_elem; struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR]; --1.7.10.4