Commit 0d035100 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: conntrack: compute l3proto nla size at compile time

avoids a pointer and allows struct to be const later on.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent eee6ebba
...@@ -20,6 +20,9 @@ struct nf_conntrack_l3proto { ...@@ -20,6 +20,9 @@ struct nf_conntrack_l3proto {
/* L3 Protocol Family number. ex) PF_INET */ /* L3 Protocol Family number. ex) PF_INET */
u_int16_t l3proto; u_int16_t l3proto;
/* size of tuple nlattr, fills a hole */
u16 nla_size;
/* Protocol name */ /* Protocol name */
const char *name; const char *name;
...@@ -49,23 +52,17 @@ struct nf_conntrack_l3proto { ...@@ -49,23 +52,17 @@ struct nf_conntrack_l3proto {
int (*get_l4proto)(const struct sk_buff *skb, unsigned int nhoff, int (*get_l4proto)(const struct sk_buff *skb, unsigned int nhoff,
unsigned int *dataoff, u_int8_t *protonum); unsigned int *dataoff, u_int8_t *protonum);
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
int (*tuple_to_nlattr)(struct sk_buff *skb, int (*tuple_to_nlattr)(struct sk_buff *skb,
const struct nf_conntrack_tuple *t); const struct nf_conntrack_tuple *t);
/* Called when netns wants to use connection tracking */
int (*net_ns_get)(struct net *);
void (*net_ns_put)(struct net *);
/*
* Calculate size of tuple nlattr
*/
int (*nlattr_tuple_size)(void);
int (*nlattr_to_tuple)(struct nlattr *tb[], int (*nlattr_to_tuple)(struct nlattr *tb[],
struct nf_conntrack_tuple *t); struct nf_conntrack_tuple *t);
const struct nla_policy *nla_policy; const struct nla_policy *nla_policy;
#endif
size_t nla_size; /* Called when netns wants to use connection tracking */
int (*net_ns_get)(struct net *);
void (*net_ns_put)(struct net *);
/* Module (if any) which this is connected to. */ /* Module (if any) which this is connected to. */
struct module *me; struct module *me;
......
...@@ -303,11 +303,6 @@ static int ipv4_nlattr_to_tuple(struct nlattr *tb[], ...@@ -303,11 +303,6 @@ static int ipv4_nlattr_to_tuple(struct nlattr *tb[],
return 0; return 0;
} }
static int ipv4_nlattr_tuple_size(void)
{
return nla_policy_len(ipv4_nla_policy, CTA_IP_MAX + 1);
}
#endif #endif
static struct nf_sockopt_ops so_getorigdst = { static struct nf_sockopt_ops so_getorigdst = {
...@@ -365,9 +360,10 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = { ...@@ -365,9 +360,10 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
.get_l4proto = ipv4_get_l4proto, .get_l4proto = ipv4_get_l4proto,
#if IS_ENABLED(CONFIG_NF_CT_NETLINK) #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
.tuple_to_nlattr = ipv4_tuple_to_nlattr, .tuple_to_nlattr = ipv4_tuple_to_nlattr,
.nlattr_tuple_size = ipv4_nlattr_tuple_size,
.nlattr_to_tuple = ipv4_nlattr_to_tuple, .nlattr_to_tuple = ipv4_nlattr_to_tuple,
.nla_policy = ipv4_nla_policy, .nla_policy = ipv4_nla_policy,
.nla_size = NLA_ALIGN(NLA_HDRLEN + sizeof(u32)) + /* CTA_IP_V4_SRC */
NLA_ALIGN(NLA_HDRLEN + sizeof(u32)), /* CTA_IP_V4_DST */
#endif #endif
.net_ns_get = ipv4_hooks_register, .net_ns_get = ipv4_hooks_register,
.net_ns_put = ipv4_hooks_unregister, .net_ns_put = ipv4_hooks_unregister,
...@@ -421,6 +417,11 @@ static int __init nf_conntrack_l3proto_ipv4_init(void) ...@@ -421,6 +417,11 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
need_conntrack(); need_conntrack();
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
if (WARN_ON(nla_policy_len(ipv4_nla_policy, CTA_IP_MAX + 1) !=
nf_conntrack_l3proto_ipv4.nla_size))
return -EINVAL;
#endif
ret = nf_register_sockopt(&so_getorigdst); ret = nf_register_sockopt(&so_getorigdst);
if (ret < 0) { if (ret < 0) {
pr_err("Unable to register netfilter socket option\n"); pr_err("Unable to register netfilter socket option\n");
......
...@@ -308,11 +308,6 @@ static int ipv6_nlattr_to_tuple(struct nlattr *tb[], ...@@ -308,11 +308,6 @@ static int ipv6_nlattr_to_tuple(struct nlattr *tb[],
return 0; return 0;
} }
static int ipv6_nlattr_tuple_size(void)
{
return nla_policy_len(ipv6_nla_policy, CTA_IP_MAX + 1);
}
#endif #endif
static int ipv6_hooks_register(struct net *net) static int ipv6_hooks_register(struct net *net)
...@@ -360,9 +355,10 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = { ...@@ -360,9 +355,10 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
.get_l4proto = ipv6_get_l4proto, .get_l4proto = ipv6_get_l4proto,
#if IS_ENABLED(CONFIG_NF_CT_NETLINK) #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
.tuple_to_nlattr = ipv6_tuple_to_nlattr, .tuple_to_nlattr = ipv6_tuple_to_nlattr,
.nlattr_tuple_size = ipv6_nlattr_tuple_size,
.nlattr_to_tuple = ipv6_nlattr_to_tuple, .nlattr_to_tuple = ipv6_nlattr_to_tuple,
.nla_policy = ipv6_nla_policy, .nla_policy = ipv6_nla_policy,
.nla_size = NLA_ALIGN(NLA_HDRLEN + sizeof(u32[4])) +
NLA_ALIGN(NLA_HDRLEN + sizeof(u32[4])),
#endif #endif
.net_ns_get = ipv6_hooks_register, .net_ns_get = ipv6_hooks_register,
.net_ns_put = ipv6_hooks_unregister, .net_ns_put = ipv6_hooks_unregister,
...@@ -421,6 +417,12 @@ static int __init nf_conntrack_l3proto_ipv6_init(void) ...@@ -421,6 +417,12 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
need_conntrack(); need_conntrack();
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
if (WARN_ON(nla_policy_len(ipv6_nla_policy, CTA_IP_MAX + 1) !=
nf_conntrack_l3proto_ipv6.nla_size))
return -EINVAL;
#endif
ret = nf_register_sockopt(&so_getorigdst6); ret = nf_register_sockopt(&so_getorigdst6);
if (ret < 0) { if (ret < 0) {
pr_err("Unable to register netfilter socket option\n"); pr_err("Unable to register netfilter socket option\n");
......
...@@ -540,7 +540,8 @@ static inline size_t ctnetlink_proto_size(const struct nf_conn *ct) ...@@ -540,7 +540,8 @@ static inline size_t ctnetlink_proto_size(const struct nf_conn *ct)
size_t len = 0; size_t len = 0;
l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct)); l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
len += l3proto->nla_size; len = l3proto->nla_size;
len *= 3u; /* ORIG, REPLY, MASTER */
l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
len += l4proto->nla_size; len += l4proto->nla_size;
......
...@@ -214,10 +214,10 @@ int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto) ...@@ -214,10 +214,10 @@ int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto)
if (proto->l3proto >= NFPROTO_NUMPROTO) if (proto->l3proto >= NFPROTO_NUMPROTO)
return -EBUSY; return -EBUSY;
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
if (proto->tuple_to_nlattr && !proto->nlattr_tuple_size) if (proto->tuple_to_nlattr && proto->nla_size == 0)
return -EINVAL; return -EINVAL;
#endif
mutex_lock(&nf_ct_proto_mutex); mutex_lock(&nf_ct_proto_mutex);
old = rcu_dereference_protected(nf_ct_l3protos[proto->l3proto], old = rcu_dereference_protected(nf_ct_l3protos[proto->l3proto],
lockdep_is_held(&nf_ct_proto_mutex)); lockdep_is_held(&nf_ct_proto_mutex));
...@@ -226,9 +226,6 @@ int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto) ...@@ -226,9 +226,6 @@ int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto)
goto out_unlock; goto out_unlock;
} }
if (proto->nlattr_tuple_size)
proto->nla_size = 3 * proto->nlattr_tuple_size();
rcu_assign_pointer(nf_ct_l3protos[proto->l3proto], proto); rcu_assign_pointer(nf_ct_l3protos[proto->l3proto], proto);
out_unlock: out_unlock:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment