From patchwork Tue Aug 11 22:59:19 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joe Stringer X-Patchwork-Id: 506261 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4E6CC1401F6 for ; Wed, 12 Aug 2015 09:01:38 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932754AbbHKXBU (ORCPT ); Tue, 11 Aug 2015 19:01:20 -0400 Received: from mail-pa0-f52.google.com ([209.85.220.52]:35094 "EHLO mail-pa0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933390AbbHKXAN (ORCPT ); Tue, 11 Aug 2015 19:00:13 -0400 Received: by pacgr6 with SMTP id gr6so153770pac.2 for ; Tue, 11 Aug 2015 16:00:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=PhAmKNt8dUzXmG3VJlGQyU6Lob+Dnucp/rOm64Zr0eY=; b=TTPxNB3a/7iGLhyvgW5X5pETezMDpsX1YWsKhVdWtI9Sru1o4Vh5+UicboHACm8Jqd on5LABFlXJq6NTGVbnAFWZzdN9yVuiO8Y0EJc4bBpUPUkqSbj2O9nQjnpWMyBSP51yS6 f8Q8P6h7kxyAoalWxseBtOX2+f6GeJFqvI/sqptOZ4NlnXse0ecRfXOz3y9Lni6mz5gx RxHEP7GF28aD8sxgUyKduFJ/gaSX/E+EI+A2fJ4/HlIMywCQ7oXyv1Rq87V5yz7egPtp 9HESL/hH6vnMLEQcRjDWChcu3rP1IR3pSvxH6omXGP+6mnxZLph+IrBKA+amNnJu59pa fHQw== X-Gm-Message-State: ALoCoQnZtZZ6eQFZgCv0Z41FQ/THKUq1vi/+unv3tCrjeOxpRNNOJLW6Gl+aCnkylm2eOxuE4Bag X-Received: by 10.68.215.97 with SMTP id oh1mr61551598pbc.67.1439334013182; Tue, 11 Aug 2015 16:00:13 -0700 (PDT) Received: from localhost.localdomain ([208.91.2.4]) by smtp.gmail.com with ESMTPSA id hi1sm3946740pbc.47.2015.08.11.16.00.08 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 11 Aug 2015 16:00:12 -0700 (PDT) From: Joe Stringer To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, pablo@netfilter.org, kaber@trash.net, jpettit@nicira.com, pshelar@nicira.com, azhou@nicira.com, jesse@nicira.com, fwestpha@redhat.com, hannes@redhat.com, tgraf@noironetworks.com Subject: [PATCHv3 net-next 08/10] netfilter: connlabels: Export setting connlabel length Date: Tue, 11 Aug 2015 15:59:19 -0700 Message-Id: <1439333961-24474-9-git-send-email-joestringer@nicira.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1439333961-24474-1-git-send-email-joestringer@nicira.com> References: <1439333961-24474-1-git-send-email-joestringer@nicira.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Add functions to change connlabel length into nf_conntrack_labels.c so they may be reused by other modules like OVS and nftables without needing to jump through xt_match_check() hoops. Suggested-by: Florian Westphal Signed-off-by: Joe Stringer --- v2: Protect connlabel modification with spinlock. Fix reference leak in error case. Style fixups. --- include/net/netfilter/nf_conntrack_labels.h | 4 ++++ net/netfilter/nf_conntrack_labels.c | 32 +++++++++++++++++++++++++++++ net/netfilter/xt_connlabel.c | 16 ++++----------- 3 files changed, 40 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_labels.h b/include/net/netfilter/nf_conntrack_labels.h index dec6336..7e2b1d0 100644 --- a/include/net/netfilter/nf_conntrack_labels.h +++ b/include/net/netfilter/nf_conntrack_labels.h @@ -54,7 +54,11 @@ int nf_connlabels_replace(struct nf_conn *ct, #ifdef CONFIG_NF_CONNTRACK_LABELS int nf_conntrack_labels_init(void); void nf_conntrack_labels_fini(void); +int nf_connlabels_get(struct net *net, unsigned int n_bits); +void nf_connlabels_put(struct net *net); #else static inline int nf_conntrack_labels_init(void) { return 0; } static inline void nf_conntrack_labels_fini(void) {} +static inline int nf_connlabels_get(struct net *net, unsigned int n_bits) { return 0; } +static inline void nf_connlabels_put(struct net *net) {} #endif diff --git a/net/netfilter/nf_conntrack_labels.c b/net/netfilter/nf_conntrack_labels.c index daa7c13..3ce5c31 100644 --- a/net/netfilter/nf_conntrack_labels.c +++ b/net/netfilter/nf_conntrack_labels.c @@ -14,6 +14,8 @@ #include #include +static spinlock_t nf_connlabels_lock; + static unsigned int label_bits(const struct nf_conn_labels *l) { unsigned int longs = l->words; @@ -89,6 +91,35 @@ int nf_connlabels_replace(struct nf_conn *ct, } EXPORT_SYMBOL_GPL(nf_connlabels_replace); +int nf_connlabels_get(struct net *net, unsigned int n_bits) +{ + size_t words; + + if (n_bits > (NF_CT_LABELS_MAX_SIZE * BITS_PER_BYTE)) + return -ERANGE; + + words = BITS_TO_LONGS(n_bits); + + spin_lock(&nf_connlabels_lock); + net->ct.labels_used++; + if (words > net->ct.label_words) + net->ct.label_words = words; + spin_unlock(&nf_connlabels_lock); + + return 0; +} +EXPORT_SYMBOL_GPL(nf_connlabels_get); + +void nf_connlabels_put(struct net *net) +{ + spin_lock(&nf_connlabels_lock); + net->ct.labels_used--; + if (net->ct.labels_used == 0) + net->ct.label_words = 0; + spin_unlock(&nf_connlabels_lock); +} +EXPORT_SYMBOL_GPL(nf_connlabels_put); + static struct nf_ct_ext_type labels_extend __read_mostly = { .len = sizeof(struct nf_conn_labels), .align = __alignof__(struct nf_conn_labels), @@ -97,6 +128,7 @@ static struct nf_ct_ext_type labels_extend __read_mostly = { int nf_conntrack_labels_init(void) { + spin_lock_init(&nf_connlabels_lock); return nf_ct_extend_register(&labels_extend); } diff --git a/net/netfilter/xt_connlabel.c b/net/netfilter/xt_connlabel.c index 9f8719d..bb9cbeb 100644 --- a/net/netfilter/xt_connlabel.c +++ b/net/netfilter/xt_connlabel.c @@ -42,10 +42,6 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par) XT_CONNLABEL_OP_SET; struct xt_connlabel_mtinfo *info = par->matchinfo; int ret; - size_t words; - - if (info->bit > XT_CONNLABEL_MAXBIT) - return -ERANGE; if (info->options & ~options) { pr_err("Unknown options in mask %x\n", info->options); @@ -59,19 +55,15 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par) return ret; } - par->net->ct.labels_used++; - words = BITS_TO_LONGS(info->bit+1); - if (words > par->net->ct.label_words) - par->net->ct.label_words = words; - + ret = nf_connlabels_get(par->net, info->bit + 1); + if (ret < 0) + nf_ct_l3proto_module_put(par->family); return ret; } static void connlabel_mt_destroy(const struct xt_mtdtor_param *par) { - par->net->ct.labels_used--; - if (par->net->ct.labels_used == 0) - par->net->ct.label_words = 0; + nf_connlabels_put(par->net); nf_ct_l3proto_module_put(par->family); }