Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 308ac914 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_conntrack: push zone object into functions 



This patch replaces the zone id which is pushed down into functions
with the actual zone object. It's a bigger one-time change, but
needed for later on extending zones with a direction parameter, and
thus decoupling this additional information from all call-sites.

No functional changes in this patch.

The default zone becomes a global const object, namely nf_ct_zone_dflt
and will be returned directly in various cases, one being, when there's
f.e. no zoning support.

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 3499abb2

include/net/netfilter/nf_conntrack.h

+8 −2
Original line number Diff line number Diff line
@@ -250,8 +250,12 @@ void nf_ct_untracked_status_or(unsigned long bits); 
void nf_ct_iterate_cleanup(struct net *net,

			   int (*iter)(struct nf_conn *i, void *data),

			   void *data, u32 portid, int report);



struct nf_conntrack_zone;



void nf_conntrack_free(struct nf_conn *ct);

struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone,

struct nf_conn *nf_conntrack_alloc(struct net *net,

				   const struct nf_conntrack_zone *zone,

				   const struct nf_conntrack_tuple *orig,

				   const struct nf_conntrack_tuple *repl,

				   gfp_t gfp);
@@ -291,7 +295,9 @@ extern unsigned int nf_conntrack_max; 
extern unsigned int nf_conntrack_hash_rnd;

void init_nf_conntrack_hash_rnd(void);



struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags);

struct nf_conn *nf_ct_tmpl_alloc(struct net *net,

				 const struct nf_conntrack_zone *zone,

				 gfp_t flags);



#define NF_CT_STAT_INC(net, count)	  __this_cpu_inc((net)->ct.stat->count)

#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)

include/net/netfilter/nf_conntrack_core.h

+2 −1
Original line number Diff line number Diff line
@@ -52,7 +52,8 @@ bool nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse, 


/* Find a connection corresponding to a tuple. */

struct nf_conntrack_tuple_hash *

nf_conntrack_find_get(struct net *net, u16 zone,

nf_conntrack_find_get(struct net *net,

		      const struct nf_conntrack_zone *zone,

		      const struct nf_conntrack_tuple *tuple);



int __nf_conntrack_confirm(struct sk_buff *skb);

include/net/netfilter/nf_conntrack_expect.h

+8 −3
Original line number Diff line number Diff line
@@ -4,7 +4,9 @@ 


#ifndef _NF_CONNTRACK_EXPECT_H

#define _NF_CONNTRACK_EXPECT_H



#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_conntrack_zones.h>



extern unsigned int nf_ct_expect_hsize;

extern unsigned int nf_ct_expect_max;
@@ -76,15 +78,18 @@ int nf_conntrack_expect_init(void); 
void nf_conntrack_expect_fini(void);



struct nf_conntrack_expect *

__nf_ct_expect_find(struct net *net, u16 zone,

__nf_ct_expect_find(struct net *net,

		    const struct nf_conntrack_zone *zone,

		    const struct nf_conntrack_tuple *tuple);



struct nf_conntrack_expect *

nf_ct_expect_find_get(struct net *net, u16 zone,

nf_ct_expect_find_get(struct net *net,

		      const struct nf_conntrack_zone *zone,

		      const struct nf_conntrack_tuple *tuple);



struct nf_conntrack_expect *

nf_ct_find_expectation(struct net *net, u16 zone,

nf_ct_find_expectation(struct net *net,

		       const struct nf_conntrack_zone *zone,

		       const struct nf_conntrack_tuple *tuple);



void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,

include/net/netfilter/nf_conntrack_zones.h

+23 −10
Original line number Diff line number Diff line 
#ifndef _NF_CONNTRACK_ZONES_H

#define _NF_CONNTRACK_ZONES_H



#define NF_CT_DEFAULT_ZONE	0



#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)

#include <net/netfilter/nf_conntrack_extend.h>

#define NF_CT_DEFAULT_ZONE_ID	0



struct nf_conntrack_zone {

	u16	id;

};



static inline u16 nf_ct_zone(const struct nf_conn *ct)

extern const struct nf_conntrack_zone nf_ct_zone_dflt;



#if IS_ENABLED(CONFIG_NF_CONNTRACK)

#include <net/netfilter/nf_conntrack_extend.h>



static inline const struct nf_conntrack_zone *

nf_ct_zone(const struct nf_conn *ct)

{

	const struct nf_conntrack_zone *nf_ct_zone = NULL;



#ifdef CONFIG_NF_CONNTRACK_ZONES

	struct nf_conntrack_zone *nf_ct_zone;

	nf_ct_zone = nf_ct_ext_find(ct, NF_CT_EXT_ZONE);

	if (nf_ct_zone)

		return nf_ct_zone->id;

#endif

	return NF_CT_DEFAULT_ZONE;

	return nf_ct_zone ? nf_ct_zone : &nf_ct_zone_dflt;

}



#endif /* CONFIG_NF_CONNTRACK || CONFIG_NF_CONNTRACK_MODULE */

static inline const struct nf_conntrack_zone *

nf_ct_zone_tmpl(const struct nf_conn *tmpl)

{

	return tmpl ? nf_ct_zone(tmpl) : &nf_ct_zone_dflt;

}



static inline bool nf_ct_zone_equal(const struct nf_conn *a,

				    const struct nf_conntrack_zone *b)

{

	return nf_ct_zone(a)->id == b->id;

}

#endif /* IS_ENABLED(CONFIG_NF_CONNTRACK) */

#endif /* _NF_CONNTRACK_ZONES_H */

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -280,7 +280,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len) 
		return -EINVAL;

	}



	h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);

	h = nf_conntrack_find_get(sock_net(sk), &nf_ct_zone_dflt, &tuple);

	if (h) {

		struct sockaddr_in sin;

		struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);