On Tue, Jul 29, 2014 at 12:12 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> This structure is not exposed to userspace, so fix this by defining
> struct sk_filter; so we skip the casting in kernelspace. This is safe
> since userspace has no way to lurk with that internal pointer.
>
> Fixes: e6f30c7 ("netfilter: x_tables: add xt_bpf match")
> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Acked-by: Willem de Bruijn <willemb@xxxxxxxxxx>
> ---
> v2: address Willem's feedback, we still need uapi/linux/filter.h for
> userspace iptables builds.
>
> include/uapi/linux/netfilter/xt_bpf.h | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/include/uapi/linux/netfilter/xt_bpf.h b/include/uapi/linux/netfilter/xt_bpf.h
> index 5dda450..2ec9fbc 100644
> --- a/include/uapi/linux/netfilter/xt_bpf.h
> +++ b/include/uapi/linux/netfilter/xt_bpf.h
> @@ -6,6 +6,8 @@
>
> #define XT_BPF_MAX_NUM_INSTR 64
>
> +struct sk_filter;
> +
> struct xt_bpf_info {
> __u16 bpf_program_num_elem;
> struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];
> --
> 1.7.10.4
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
