mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 08:19:28 +00:00
c56716c69c
Multiple netfilter extensions store pointers to external data in their extension area struct. Examples: 1. Timeout policies 2. Connection tracking helpers. No references are taken for these. When a helper or timeout policy is removed, the conntrack table gets traversed and affected extensions are cleared. Conntrack entries not yet in the hashtable are referenced via a special list, the unconfirmed list. On removal of a policy or connection tracking helper, the unconfirmed list gets traversed an all entries are marked as dying, this prevents them from getting committed to the table at insertion time: core checks for dying bit, if set, the conntrack entry gets destroyed at confirm time. The disadvantage is that each new conntrack has to be added to the percpu unconfirmed list, and each insertion needs to remove it from this list. The list is only ever needed when a policy or helper is removed -- a rare occurrence. Add a generation ID count: Instead of adding to the list and then traversing that list on policy/helper removal, increment a counter that is stored in the extension area. For unconfirmed conntracks, the extension has the genid valid at ct allocation time. Removal of a helper/policy etc. increments the counter. At confirmation time, validate that ext->genid == global_id. If the stored number is not the same, do not allow the conntrack insertion, just like as if a confirmed-list traversal would have flagged the entry as dying. After insertion, the genid is no longer relevant (conntrack entries are now reachable via the conntrack table iterators and is set to 0. This allows removal of the percpu unconfirmed list. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
63 lines
1.7 KiB
C
63 lines
1.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
#ifndef _NF_CONNTRACK_LABELS_H
|
|
#define _NF_CONNTRACK_LABELS_H
|
|
|
|
#include <linux/netfilter/nf_conntrack_common.h>
|
|
#include <linux/netfilter/nf_conntrack_tuple_common.h>
|
|
#include <linux/types.h>
|
|
#include <net/net_namespace.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <net/netfilter/nf_conntrack_extend.h>
|
|
#include <uapi/linux/netfilter/xt_connlabel.h>
|
|
|
|
#define NF_CT_LABELS_MAX_SIZE ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)
|
|
|
|
struct nf_conn_labels {
|
|
unsigned long bits[NF_CT_LABELS_MAX_SIZE / sizeof(long)];
|
|
};
|
|
|
|
/* Can't use nf_ct_ext_find(), flow dissector cannot use symbols
|
|
* exported by nf_conntrack module.
|
|
*/
|
|
static inline struct nf_conn_labels *nf_ct_labels_find(const struct nf_conn *ct)
|
|
{
|
|
#ifdef CONFIG_NF_CONNTRACK_LABELS
|
|
struct nf_ct_ext *ext = ct->ext;
|
|
|
|
if (!ext || !__nf_ct_ext_exist(ext, NF_CT_EXT_LABELS))
|
|
return NULL;
|
|
|
|
return (void *)ct->ext + ct->ext->offset[NF_CT_EXT_LABELS];
|
|
#else
|
|
return NULL;
|
|
#endif
|
|
}
|
|
|
|
static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
|
|
{
|
|
#ifdef CONFIG_NF_CONNTRACK_LABELS
|
|
struct net *net = nf_ct_net(ct);
|
|
|
|
if (net->ct.labels_used == 0)
|
|
return NULL;
|
|
|
|
return nf_ct_ext_add(ct, NF_CT_EXT_LABELS, GFP_ATOMIC);
|
|
#else
|
|
return NULL;
|
|
#endif
|
|
}
|
|
|
|
int nf_connlabels_replace(struct nf_conn *ct,
|
|
const u32 *data, const u32 *mask, unsigned int words);
|
|
|
|
#ifdef CONFIG_NF_CONNTRACK_LABELS
|
|
int nf_conntrack_labels_init(void);
|
|
int nf_connlabels_get(struct net *net, unsigned int bit);
|
|
void nf_connlabels_put(struct net *net);
|
|
#else
|
|
static inline int nf_connlabels_get(struct net *net, unsigned int bit) { return 0; }
|
|
static inline void nf_connlabels_put(struct net *net) {}
|
|
#endif
|
|
|
|
#endif /* _NF_CONNTRACK_LABELS_H */
|