Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-15 09:34:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

netfilter: connlabels: change nf_connlabels_get bit arg to 'highest used'

Browse Source 
nf_connlabel_set() takes the bit number that we would like to set.
nf_connlabels_get() however took the number of bits that we want to
support.

So e.g. nf_connlabels_get(32) support bits 0 to 31, but not 32.
This changes nf_connlabels_get() to take the highest bit that we want
to set.

Callers then don't have to cope with a potential integer wrap
when using nf_connlabels_get(bit + 1) anymore.

Current callers are fine, this change is only to make folloup
nft ct label set support simpler.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2016-04-12 18:14:25 +02:00 committed by Pablo Neira Ayuso
parent 5a8145f7b2
commit adff6c6560
5 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/net/netfilter/nf_conntrack_labels.h
View File

@ -53,11 +53,11 @@ int nf_connlabels_replace(struct nf_conn *ct,
#ifdef CONFIG_NF_CONNTRACK_LABELS #ifdef CONFIG_NF_CONNTRACK_LABELS
int nf_conntrack_labels_init(void); int nf_conntrack_labels_init(void);
void nf_conntrack_labels_fini(void); void nf_conntrack_labels_fini(void);
int nf_connlabels_get(struct net *net, unsigned int n_bits); int nf_connlabels_get(struct net *net, unsigned int bit);
void nf_connlabels_put(struct net *net); void nf_connlabels_put(struct net *net);
#else #else
static inline int nf_conntrack_labels_init(void) { return 0; } static inline int nf_conntrack_labels_init(void) { return 0; }
static inline void nf_conntrack_labels_fini(void) {} static inline void nf_conntrack_labels_fini(void) {}
static inline int nf_connlabels_get(struct net *net, unsigned int n_bits) { return 0; } static inline int nf_connlabels_get(struct net *net, unsigned int bit) { return 0; }
static inline void nf_connlabels_put(struct net *net) {} static inline void nf_connlabels_put(struct net *net) {}
#endif #endif

9
net/netfilter/nf_conntrack_labels.c
View File

@ -78,15 +78,14 @@ int nf_connlabels_replace(struct nf_conn *ct,
} }
EXPORT_SYMBOL_GPL(nf_connlabels_replace); EXPORT_SYMBOL_GPL(nf_connlabels_replace);
int nf_connlabels_get(struct net *net, unsigned int n_bits) int nf_connlabels_get(struct net *net, unsigned int bits)
{ {
size_t words; size_t words;
if (n_bits > (NF_CT_LABELS_MAX_SIZE * BITS_PER_BYTE)) words = BIT_WORD(bits) + 1;
if (words > NF_CT_LABELS_MAX_SIZE / sizeof(long))
return -ERANGE; return -ERANGE;
words = BITS_TO_LONGS(n_bits);
spin_lock(&nf_connlabels_lock); spin_lock(&nf_connlabels_lock);
net->ct.labels_used++; net->ct.labels_used++;
if (words > net->ct.label_words) if (words > net->ct.label_words)
@ -115,6 +114,8 @@ static struct nf_ct_ext_type labels_extend __read_mostly = {
int nf_conntrack_labels_init(void) int nf_conntrack_labels_init(void)
{ {
BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE / sizeof(long) >= U8_MAX);
spin_lock_init(&nf_connlabels_lock); spin_lock_init(&nf_connlabels_lock);
return nf_ct_extend_register(&labels_extend); return nf_ct_extend_register(&labels_extend);
} }

2
net/netfilter/nft_ct.c
View File

@ -484,6 +484,8 @@ static struct nft_expr_type nft_ct_type __read_mostly = {
static int __init nft_ct_module_init(void) static int __init nft_ct_module_init(void)
{ {
BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
return nft_register_expr(&nft_ct_type); return nft_register_expr(&nft_ct_type);
} }

2
net/netfilter/xt_connlabel.c
View File

@ -65,7 +65,7 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par)
return ret; return ret;
} }
ret = nf_connlabels_get(par->net, info->bit + 1); ret = nf_connlabels_get(par->net, info->bit);
if (ret < 0) if (ret < 0)
nf_ct_l3proto_module_put(par->family); nf_ct_l3proto_module_put(par->family);
return ret; return ret;

2
net/openvswitch/conntrack.c
View File

@ -1344,7 +1344,7 @@ void ovs_ct_init(struct net *net)
unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
struct ovs_net *ovs_net = net_generic(net, ovs_net_id); struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
if (nf_connlabels_get(net, n_bits)) { if (nf_connlabels_get(net, n_bits - 1)) {
ovs_net->xt_label = false; ovs_net->xt_label = false;
OVS_NLERR(true, "Failed to set connlabel length"); OVS_NLERR(true, "Failed to set connlabel length");
} else { } else {