Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3a5db10 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: use u8 for extension sizes again 



commit 223b02d9
("netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len")
had to increase size of the extension offsets because total size of the
extensions had increased to a point where u8 did overflow.

3 years later we've managed to diet extensions a bit and we no longer
need u16.  Furthermore we can now add a compile-time assertion for this
problem.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent faec865d

include/net/netfilter/nf_conntrack_extend.h

+2 −2
Original line number Diff line number Diff line
@@ -43,8 +43,8 @@ enum nf_ct_ext_id { 
/* Extensions: optional stuff which isn't permanently in struct. */

struct nf_ct_ext {

	struct rcu_head rcu;

	u16 offset[NF_CT_EXT_NUM];

	u16 len;

	u8 offset[NF_CT_EXT_NUM];

	u8 len;

	char data[0];

};

net/netfilter/nf_conntrack_core.c

+33 −0
Original line number Diff line number Diff line
@@ -1804,12 +1804,45 @@ EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize); 
module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,

		  &nf_conntrack_htable_size, 0600);



static unsigned int total_extension_size(void)

{

	/* remember to add new extensions below */

	BUILD_BUG_ON(NF_CT_EXT_NUM > 9);



	return sizeof(struct nf_ct_ext) +

	       sizeof(struct nf_conn_help)

#if IS_ENABLED(CONFIG_NF_NAT)

		+ sizeof(struct nf_conn_nat)

#endif

		+ sizeof(struct nf_conn_seqadj)

		+ sizeof(struct nf_conn_acct)

#ifdef CONFIG_NF_CONNTRACK_EVENTS

		+ sizeof(struct nf_conntrack_ecache)

#endif

#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP

		+ sizeof(struct nf_conn_tstamp)

#endif

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT

		+ sizeof(struct nf_conn_timeout)

#endif

#ifdef CONFIG_NF_CONNTRACK_LABELS

		+ sizeof(struct nf_conn_labels)

#endif

#if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)

		+ sizeof(struct nf_conn_synproxy)

#endif

	;

};



int nf_conntrack_init_start(void)

{

	int max_factor = 8;

	int ret = -ENOMEM;

	int i;



	/* struct nf_ct_ext uses u8 to store offsets/size */

	BUILD_BUG_ON(total_extension_size() > 255u);



	seqcount_init(&nf_conntrack_generation);



	for (i = 0; i < CONNTRACK_LOCKS; i++)