Message ID | 1377667379-2315-4-git-send-email-amwang@redhat.com |
---|---|
State | Changes Requested, archived |
Delegated to: | David Miller |
Headers | show |
On Wed, 28 Aug 2013 13:22:51 +0800 Cong Wang <amwang@redhat.com> wrote: > +struct ipv6_stub { > + int (*ipv6_sock_mc_join)(struct sock *sk, int ifindex, > + const struct in6_addr *addr); > + int (*ipv6_sock_mc_drop)(struct sock *sk, int ifindex, > + const struct in6_addr *addr); > + int (*ipv6_dst_lookup)(struct sock *sk, struct dst_entry **dst, > + struct flowi6 *fl6); > + void (*udpv6_encap_enable)(void); > +}; > +extern const struct ipv6_stub *ipv6_stub __read_mostly; > + Since IPv6 really can't ever be safely unloaded. why not: * admit that, and get rid of ipv6_module exit. * then this stub can be a static const table. You see virtual function tables that are writeable are potential malware targets, although eliminating all of them is impossible, I hate to see adding new ones. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, 2013-08-28 at 09:12 -0700, Stephen Hemminger wrote: > On Wed, 28 Aug 2013 13:22:51 +0800 > Cong Wang <amwang@redhat.com> wrote: > > > +struct ipv6_stub { > > + int (*ipv6_sock_mc_join)(struct sock *sk, int ifindex, > > + const struct in6_addr *addr); > > + int (*ipv6_sock_mc_drop)(struct sock *sk, int ifindex, > > + const struct in6_addr *addr); > > + int (*ipv6_dst_lookup)(struct sock *sk, struct dst_entry **dst, > > + struct flowi6 *fl6); > > + void (*udpv6_encap_enable)(void); > > +}; > > +extern const struct ipv6_stub *ipv6_stub __read_mostly; > > + > > Since IPv6 really can't ever be safely unloaded. why not: > * admit that, and get rid of ipv6_module exit. > * then this stub can be a static const table. > > You see virtual function tables that are writeable are potential malware > targets, although eliminating all of them is impossible, I hate to > see adding new ones. I think getting rid of ipv6 exit deserves another thread for discussion, not in this thread. Actually I raised same question before, but no one replied me. If you want, I can send another patch for it after this patchset gets merged. Thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 43fa31a..5339cab 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -141,6 +141,21 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group, const struct in6_addr *src_addr); void ipv6_mc_dad_complete(struct inet6_dev *idev); + +/* A stub used by vxlan module. This is ugly, ideally these + * symbols should be built into the core kernel. + */ +struct ipv6_stub { + int (*ipv6_sock_mc_join)(struct sock *sk, int ifindex, + const struct in6_addr *addr); + int (*ipv6_sock_mc_drop)(struct sock *sk, int ifindex, + const struct in6_addr *addr); + int (*ipv6_dst_lookup)(struct sock *sk, struct dst_entry **dst, + struct flowi6 *fl6); + void (*udpv6_encap_enable)(void); +}; +extern const struct ipv6_stub *ipv6_stub __read_mostly; + /* * identify MLD packets for MLD filter exceptions */ diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c index d2f8742..93b24c6 100644 --- a/net/ipv6/addrconf_core.c +++ b/net/ipv6/addrconf_core.c @@ -98,3 +98,6 @@ int inet6addr_notifier_call_chain(unsigned long val, void *v) return atomic_notifier_call_chain(&inet6addr_chain, val, v); } EXPORT_SYMBOL(inet6addr_notifier_call_chain); + +const struct ipv6_stub *ipv6_stub __read_mostly; +EXPORT_SYMBOL_GPL(ipv6_stub); diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index 0d1a9b1..0c9c22f 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -810,6 +810,13 @@ static struct pernet_operations inet6_net_ops = { .exit = inet6_net_exit, }; +static const struct ipv6_stub ipv6_stub_impl = { + .ipv6_sock_mc_join = ipv6_sock_mc_join, + .ipv6_sock_mc_drop = ipv6_sock_mc_drop, + .ipv6_dst_lookup = ip6_dst_lookup, + .udpv6_encap_enable = udpv6_encap_enable, +}; + static int __init inet6_init(void) { struct list_head *r; @@ -884,6 +891,9 @@ static int __init inet6_init(void) err = igmp6_init(); if (err) goto igmp_fail; + + ipv6_stub = &ipv6_stub_impl; + err = ipv6_netfilter_init(); if (err) goto netfilter_fail; @@ -1040,6 +1050,7 @@ static void __exit inet6_exit(void) raw6_proc_exit(); #endif ipv6_netfilter_fini(); + ipv6_stub = NULL; igmp6_cleanup(); ndisc_cleanup(); ip6_mr_cleanup();