Commit 23014011 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: support a fixed size of 128 distinct labels 



The conntrack label extension is currently variable-sized, e.g. if
only 2 labels are used by iptables rules then the labels->bits[] array
will only contain one element.

We track size of each label storage area in the 'words' member.

But in nftables and openvswitch we always have to ask for worst-case
since we don't know what bit will be used at configuration time.

As most arches are 64bit we need to allocate 24 bytes in this case:

struct nf_conn_labels {
    u8            words;   /*     0     1 */
    /* XXX 7 bytes hole, try to pack */
    long unsigned bits[2]; /*     8     24 */

Make bits a fixed size and drop the words member, it simplifies
the code and only increases memory requirements on x86 when
less than 64bit labels are required.

We still only allocate the extension if its needed.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6e1f760e

include/net/netfilter/nf_conntrack_labels.h

+4 −12
Original line number Diff line number Diff line
@@ -10,8 +10,7 @@ 
#define NF_CT_LABELS_MAX_SIZE ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)



struct nf_conn_labels {

	u8 words;

	unsigned long bits[];

	unsigned long bits[NF_CT_LABELS_MAX_SIZE / sizeof(long)];

};



static inline struct nf_conn_labels *nf_ct_labels_find(const struct nf_conn *ct)
@@ -26,20 +25,13 @@ static inline struct nf_conn_labels *nf_ct_labels_find(const struct nf_conn *ct) 
static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)

{

#ifdef CONFIG_NF_CONNTRACK_LABELS

	struct nf_conn_labels *cl_ext;

	struct net *net = nf_ct_net(ct);

	u8 words;



	words = ACCESS_ONCE(net->ct.label_words);

	if (words == 0)

	if (net->ct.labels_used == 0)

		return NULL;



	cl_ext = nf_ct_ext_add_length(ct, NF_CT_EXT_LABELS,

				      words * sizeof(long), GFP_ATOMIC);

	if (cl_ext != NULL)

		cl_ext->words = words;



	return cl_ext;

	return nf_ct_ext_add_length(ct, NF_CT_EXT_LABELS,

				    sizeof(struct nf_conn_labels), GFP_ATOMIC);

#else

	return NULL;

#endif

net/netfilter/nf_conntrack_labels.c

+3 −10
Original line number Diff line number Diff line
@@ -20,7 +20,7 @@ int nf_connlabel_set(struct nf_conn *ct, u16 bit) 
{

	struct nf_conn_labels *labels = nf_ct_labels_find(ct);



	if (!labels || BIT_WORD(bit) >= labels->words)

	if (!labels)

		return -ENOSPC;



	if (test_bit(bit, labels->bits))
@@ -60,7 +60,7 @@ int nf_connlabels_replace(struct nf_conn *ct, 
	if (!labels)

		return -ENOSPC;



	size = labels->words * sizeof(long);

	size = sizeof(labels->bits);

	if (size < (words32 * sizeof(u32)))

		words32 = size / sizeof(u32);
@@ -80,16 +80,11 @@ EXPORT_SYMBOL_GPL(nf_connlabels_replace); 


int nf_connlabels_get(struct net *net, unsigned int bits)

{

	size_t words;



	words = BIT_WORD(bits) + 1;

	if (words > NF_CT_LABELS_MAX_SIZE / sizeof(long))

	if (BIT_WORD(bits) >= NF_CT_LABELS_MAX_SIZE / sizeof(long))

		return -ERANGE;



	spin_lock(&nf_connlabels_lock);

	net->ct.labels_used++;

	if (words > net->ct.label_words)

		net->ct.label_words = words;

	spin_unlock(&nf_connlabels_lock);



	return 0;
@@ -100,8 +95,6 @@ void nf_connlabels_put(struct net *net) 
{

	spin_lock(&nf_connlabels_lock);

	net->ct.labels_used--;

	if (net->ct.labels_used == 0)

		net->ct.label_words = 0;

	spin_unlock(&nf_connlabels_lock);

}

EXPORT_SYMBOL_GPL(nf_connlabels_put);

net/netfilter/nf_conntrack_netlink.c

+5 −5
Original line number Diff line number Diff line
@@ -346,25 +346,25 @@ static inline int ctnetlink_label_size(const struct nf_conn *ct) 


	if (!labels)

		return 0;

	return nla_total_size(labels->words * sizeof(long));

	return nla_total_size(sizeof(labels->bits));

}



static int

ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)

{

	struct nf_conn_labels *labels = nf_ct_labels_find(ct);

	unsigned int len, i;

	unsigned int i;



	if (!labels)

		return 0;



	len = labels->words * sizeof(long);

	i = 0;

	do {

		if (labels->bits[i] != 0)

			return nla_put(skb, CTA_LABELS, len, labels->bits);

			return nla_put(skb, CTA_LABELS, sizeof(labels->bits),

				       labels->bits);

		i++;

	} while (i < labels->words);

	} while (i < ARRAY_SIZE(labels->bits));



	return 0;

}

net/netfilter/nft_ct.c

+3 −10
Original line number Diff line number Diff line
@@ -113,20 +113,13 @@ static void nft_ct_get_eval(const struct nft_expr *expr, 
#ifdef CONFIG_NF_CONNTRACK_LABELS

	case NFT_CT_LABELS: {

		struct nf_conn_labels *labels = nf_ct_labels_find(ct);

		unsigned int size;



		if (!labels) {

		if (labels)

			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);

		else

			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);

		return;

	}



		size = labels->words * sizeof(long);

		memcpy(dest, labels->bits, size);

		if (size < NF_CT_LABELS_MAX_SIZE)

			memset(((char *) dest) + size, 0,

			       NF_CT_LABELS_MAX_SIZE - size);

		return;

	}

#endif

	case NFT_CT_BYTES: /* fallthrough */

	case NFT_CT_PKTS: {

net/netfilter/xt_connlabel.c

+1 −1
Original line number Diff line number Diff line
@@ -25,7 +25,7 @@ static bool connlabel_match(const struct nf_conn *ct, u16 bit) 
	if (!labels)

		return false;



	return BIT_WORD(bit) < labels->words && test_bit(bit, labels->bits);

	return test_bit(bit, labels->bits);

}



static bool

CRA Git | Maintained and supported by SUSTech CRA and CCSE