Currently netfilter hooks have a function signature that is huge and has many arguments. This propagates from the hook entry points down into the individual hook implementations themselves. This means that if, for example, we want to change the type of one of these arguments then we have to touch hundreds of locations. The main initial motivation behind this is that we'd like to change the signature of "okfn" so that a socket pointer can be passed in (and reference counted properly) for the sake of using the proper socket context in the case of tunnels whilst not releasing the top level user socket from skb->sk (and thus releasing it's socket memory quota usage) in order to accomodate this. This also makes it clear who actually uses 'okfn', nf_queue(). It is absolutely critical to make this obvious because any user of 'okfn' down in these hook chains have the be strictly audited for escapability. Specifically, escapability of references to objects outside of the packet processing path. And that's exactly what nf_queue() does via it's packet reinjection framework. In fact this points out a bug in Jiri's original attempt to push the socket pointer down through netfilter's okfn. It didn't grab and drop a reference to the socket in net/netfilter/nf_queue.c as needed. Furthermore, so many code paths are simplified, and should in fact be more efficient because we aren't passing in arguments that often are simply not used by the netfilter hook at all. Further simplifications are probably possible, but this series takes care of the main cases. Unfortunately I couldn't convert ebt_do_table() because ebtables is complete and utter crap and uses ebt_do_table() outside of the hook call chains. But that should not be news to anyone. Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
