Skip to content

Commit 5f31edc

Browse files
Florian Westphalummakynes
Florian Westphal
authored and
ummakynes
committed
netfilter: conntrack: move extension sizes into core
No need to specify this in the registration modules, we already collect all sizes for build-time checks on the maximum combined size. After this change, all extensions except nat have no meaningful content in their nf_ct_ext_type struct definition. Next patch handles nat, this will then allow to remove the dynamic register api completely. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent bb62a76 commit 5f31edc

13 files changed

+76
-58
lines changed

‎include/net/netfilter/nf_conntrack_extend.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,6 @@ struct nf_ct_ext_type {
8383
void (*destroy)(struct nf_conn *ct);
8484

8585
enum nf_ct_ext_id id;
86-
u8 len;
8786
};
8887

8988
int nf_ct_extend_register(const struct nf_ct_ext_type *type);

‎net/netfilter/nf_conntrack_acct.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ module_param_named(acct, nf_ct_acct, bool, 0644);
2323
MODULE_PARM_DESC(acct, "Enable connection tracking flow accounting.");
2424

2525
static const struct nf_ct_ext_type acct_extend = {
26-
.len = sizeof(struct nf_conn_acct),
2726
.id = NF_CT_EXT_ACCT,
2827
};
2928

‎net/netfilter/nf_conntrack_core.c‎

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@
4848
#include <net/netfilter/nf_conntrack_timeout.h>
4949
#include <net/netfilter/nf_conntrack_labels.h>
5050
#include <net/netfilter/nf_conntrack_synproxy.h>
51-
#include <net/netfilter/nf_conntrack_act_ct.h>
5251
#include <net/netfilter/nf_nat.h>
5352
#include <net/netfilter/nf_nat_helper.h>
5453
#include <net/netns/hash.h>
@@ -2629,49 +2628,13 @@ int nf_conntrack_set_hashsize(const char *val, const struct kernel_param *kp)
26292628
return nf_conntrack_hash_resize(hashsize);
26302629
}
26312630

2632-
static __always_inline unsigned int total_extension_size(void)
2633-
{
2634-
/* remember to add new extensions below */
2635-
BUILD_BUG_ON(NF_CT_EXT_NUM > 10);
2636-
2637-
return sizeof(struct nf_ct_ext) +
2638-
sizeof(struct nf_conn_help)
2639-
#if IS_ENABLED(CONFIG_NF_NAT)
2640-
+ sizeof(struct nf_conn_nat)
2641-
#endif
2642-
+ sizeof(struct nf_conn_seqadj)
2643-
+ sizeof(struct nf_conn_acct)
2644-
#ifdef CONFIG_NF_CONNTRACK_EVENTS
2645-
+ sizeof(struct nf_conntrack_ecache)
2646-
#endif
2647-
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
2648-
+ sizeof(struct nf_conn_tstamp)
2649-
#endif
2650-
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
2651-
+ sizeof(struct nf_conn_timeout)
2652-
#endif
2653-
#ifdef CONFIG_NF_CONNTRACK_LABELS
2654-
+ sizeof(struct nf_conn_labels)
2655-
#endif
2656-
#if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)
2657-
+ sizeof(struct nf_conn_synproxy)
2658-
#endif
2659-
#if IS_ENABLED(CONFIG_NET_ACT_CT)
2660-
+ sizeof(struct nf_conn_act_ct_ext)
2661-
#endif
2662-
;
2663-
};
2664-
26652631
int nf_conntrack_init_start(void)
26662632
{
26672633
unsigned long nr_pages = totalram_pages();
26682634
int max_factor = 8;
26692635
int ret = -ENOMEM;
26702636
int i;
26712637

2672-
/* struct nf_ct_ext uses u8 to store offsets/size */
2673-
BUILD_BUG_ON(total_extension_size() > 255u);
2674-
26752638
seqcount_spinlock_init(&nf_conntrack_generation,
26762639
&nf_conntrack_locks_all_lock);
26772640

‎net/netfilter/nf_conntrack_ecache.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,6 @@ void nf_conntrack_ecache_work(struct net *net, enum nf_ct_ecache_state state)
305305
static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
306306

307307
static const struct nf_ct_ext_type event_extend = {
308-
.len = sizeof(struct nf_conntrack_ecache),
309308
.id = NF_CT_EXT_ECACHE,
310309
};
311310

‎net/netfilter/nf_conntrack_extend.c‎

Lines changed: 76 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,82 @@
1313
#include <linux/skbuff.h>
1414
#include <net/netfilter/nf_conntrack_extend.h>
1515

16+
#include <net/netfilter/nf_conntrack_helper.h>
17+
#include <net/netfilter/nf_conntrack_acct.h>
18+
#include <net/netfilter/nf_conntrack_seqadj.h>
19+
#include <net/netfilter/nf_conntrack_ecache.h>
20+
#include <net/netfilter/nf_conntrack_zones.h>
21+
#include <net/netfilter/nf_conntrack_timestamp.h>
22+
#include <net/netfilter/nf_conntrack_timeout.h>
23+
#include <net/netfilter/nf_conntrack_labels.h>
24+
#include <net/netfilter/nf_conntrack_synproxy.h>
25+
#include <net/netfilter/nf_conntrack_act_ct.h>
26+
#include <net/netfilter/nf_nat.h>
27+
1628
static struct nf_ct_ext_type __rcu *nf_ct_ext_types[NF_CT_EXT_NUM];
1729
static DEFINE_MUTEX(nf_ct_ext_type_mutex);
1830
#define NF_CT_EXT_PREALLOC 128u /* conntrack events are on by default */
1931

32+
static const u8 nf_ct_ext_type_len[NF_CT_EXT_NUM] = {
33+
[NF_CT_EXT_HELPER] = sizeof(struct nf_conn_help),
34+
#if IS_ENABLED(CONFIG_NF_NAT)
35+
[NF_CT_EXT_NAT] = sizeof(struct nf_conn_nat),
36+
#endif
37+
[NF_CT_EXT_SEQADJ] = sizeof(struct nf_conn_seqadj),
38+
[NF_CT_EXT_ACCT] = sizeof(struct nf_conn_acct),
39+
#ifdef CONFIG_NF_CONNTRACK_EVENTS
40+
[NF_CT_EXT_ECACHE] = sizeof(struct nf_conntrack_ecache),
41+
#endif
42+
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
43+
[NF_CT_EXT_TSTAMP] = sizeof(struct nf_conn_acct),
44+
#endif
45+
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
46+
[NF_CT_EXT_TIMEOUT] = sizeof(struct nf_conn_tstamp),
47+
#endif
48+
#ifdef CONFIG_NF_CONNTRACK_LABELS
49+
[NF_CT_EXT_LABELS] = sizeof(struct nf_conn_labels),
50+
#endif
51+
#if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)
52+
[NF_CT_EXT_SYNPROXY] = sizeof(struct nf_conn_synproxy),
53+
#endif
54+
#if IS_ENABLED(CONFIG_NET_ACT_CT)
55+
[NF_CT_EXT_ACT_CT] = sizeof(struct nf_conn_act_ct_ext),
56+
#endif
57+
};
58+
59+
static __always_inline unsigned int total_extension_size(void)
60+
{
61+
/* remember to add new extensions below */
62+
BUILD_BUG_ON(NF_CT_EXT_NUM > 10);
63+
64+
return sizeof(struct nf_ct_ext) +
65+
sizeof(struct nf_conn_help)
66+
#if IS_ENABLED(CONFIG_NF_NAT)
67+
+ sizeof(struct nf_conn_nat)
68+
#endif
69+
+ sizeof(struct nf_conn_seqadj)
70+
+ sizeof(struct nf_conn_acct)
71+
#ifdef CONFIG_NF_CONNTRACK_EVENTS
72+
+ sizeof(struct nf_conntrack_ecache)
73+
#endif
74+
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
75+
+ sizeof(struct nf_conn_tstamp)
76+
#endif
77+
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
78+
+ sizeof(struct nf_conn_timeout)
79+
#endif
80+
#ifdef CONFIG_NF_CONNTRACK_LABELS
81+
+ sizeof(struct nf_conn_labels)
82+
#endif
83+
#if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)
84+
+ sizeof(struct nf_conn_synproxy)
85+
#endif
86+
#if IS_ENABLED(CONFIG_NET_ACT_CT)
87+
+ sizeof(struct nf_conn_act_ct_ext)
88+
#endif
89+
;
90+
}
91+
2092
void nf_ct_ext_destroy(struct nf_conn *ct)
2193
{
2294
unsigned int i;
@@ -41,7 +113,6 @@ void nf_ct_ext_destroy(struct nf_conn *ct)
41113
void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
42114
{
43115
unsigned int newlen, newoff, oldlen, alloc;
44-
struct nf_ct_ext_type *t;
45116
struct nf_ct_ext *new;
46117

47118
/* Conntrack must not be confirmed to avoid races on reallocation. */
@@ -58,16 +129,8 @@ void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
58129
oldlen = sizeof(*new);
59130
}
60131

61-
rcu_read_lock();
62-
t = rcu_dereference(nf_ct_ext_types[id]);
63-
if (!t) {
64-
rcu_read_unlock();
65-
return NULL;
66-
}
67-
68132
newoff = ALIGN(oldlen, __alignof__(struct nf_ct_ext));
69-
newlen = newoff + t->len;
70-
rcu_read_unlock();
133+
newlen = newoff + nf_ct_ext_type_len[id];
71134

72135
alloc = max(newlen, NF_CT_EXT_PREALLOC);
73136
new = krealloc(ct->ext, alloc, gfp);
@@ -91,6 +154,9 @@ int nf_ct_extend_register(const struct nf_ct_ext_type *type)
91154
{
92155
int ret = 0;
93156

157+
/* struct nf_ct_ext uses u8 to store offsets/size */
158+
BUILD_BUG_ON(total_extension_size() > 255u);
159+
94160
mutex_lock(&nf_ct_ext_type_mutex);
95161
if (nf_ct_ext_types[type->id]) {
96162
ret = -EBUSY;

‎net/netfilter/nf_conntrack_helper.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -551,7 +551,6 @@ void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat)
551551
EXPORT_SYMBOL_GPL(nf_nat_helper_unregister);
552552

553553
static const struct nf_ct_ext_type helper_extend = {
554-
.len = sizeof(struct nf_conn_help),
555554
.id = NF_CT_EXT_HELPER,
556555
};
557556

‎net/netfilter/nf_conntrack_labels.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,6 @@ void nf_connlabels_put(struct net *net)
8080
EXPORT_SYMBOL_GPL(nf_connlabels_put);
8181

8282
static const struct nf_ct_ext_type labels_extend = {
83-
.len = sizeof(struct nf_conn_labels),
8483
.id = NF_CT_EXT_LABELS,
8584
};
8685

‎net/netfilter/nf_conntrack_seqadj.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,6 @@ s32 nf_ct_seq_offset(const struct nf_conn *ct,
234234
EXPORT_SYMBOL_GPL(nf_ct_seq_offset);
235235

236236
static const struct nf_ct_ext_type nf_ct_seqadj_extend = {
237-
.len = sizeof(struct nf_conn_seqadj),
238237
.id = NF_CT_EXT_SEQADJ,
239238
};
240239

‎net/netfilter/nf_conntrack_timeout.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,6 @@ void nf_ct_destroy_timeout(struct nf_conn *ct)
136136
EXPORT_SYMBOL_GPL(nf_ct_destroy_timeout);
137137

138138
static const struct nf_ct_ext_type timeout_extend = {
139-
.len = sizeof(struct nf_conn_timeout),
140139
.id = NF_CT_EXT_TIMEOUT,
141140
};
142141

‎net/netfilter/nf_conntrack_timestamp.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ module_param_named(tstamp, nf_ct_tstamp, bool, 0644);
2020
MODULE_PARM_DESC(tstamp, "Enable connection tracking flow timestamping.");
2121

2222
static const struct nf_ct_ext_type tstamp_extend = {
23-
.len = sizeof(struct nf_conn_tstamp),
2423
.id = NF_CT_EXT_TSTAMP,
2524
};
2625

0 commit comments

Comments
 (0)