From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D9D1C43387 for ; Wed, 2 Jan 2019 20:43:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 389B220874 for ; Wed, 2 Jan 2019 20:43:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727622AbfABUm7 (ORCPT ); Wed, 2 Jan 2019 15:42:59 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:43811 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727601AbfABUm7 (ORCPT ); Wed, 2 Jan 2019 15:42:59 -0500 Received: from mail-qk1-f197.google.com ([209.85.222.197]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1genLt-0002bn-RD for stable@vger.kernel.org; Wed, 02 Jan 2019 20:42:57 +0000 Received: by mail-qk1-f197.google.com with SMTP id z68so38382766qkb.14 for ; Wed, 02 Jan 2019 12:42:57 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=cHMHvmTNqlp/UIh+cKOmQ9ElxYY2GNXRHT3+2VDoDIw=; b=ExlIlNyUuShv6jnt/FI+P9OKg72kBZaxrSGm3O6hzKf6dG2suXTrE9bTv3g/JyPWy4 o09BbEy3d6J707KV1yFNdm5erWdYhbLd3Mgk32Q8d/f267+Ic+cMg45HIHxvxEWbwZLX QLgSznLexkw/mbwznBvsL5ImK5bG9wXFsXd6Nlil30og2WpEBJoCQDK7FYrLanSet34V fSh2GDfH3hJEXAvuk7WerZHRQWeCsHGPEoh6cxm1UGFzg/PDKKgqtfqYYTn+S6NJIs6y hJ79KV0bF+cJ67Nfc+KAvAKFEWMWL8p1iWRaJ9V12fZNdzX1OxMMX1s1sCmlUv1vG2sq dGgQ== X-Gm-Message-State: AJcUukdsMo19k7ydYdZmXIBHkKgQxSbOt1q9mJWoRafj0svA5y4QJwqa 1M/bIZCC2MIkQaQwvP8+OnfR+Ko9a3NaFwnts+radzaeNaabOUpPHzSmc+R2sytOmMA0X9Z7Ju9 EKKkZyf1NtKyow7JbfiGut11UjgCuRHZBmg== X-Received: by 2002:a37:d204:: with SMTP id f4mr41556337qkj.311.1546461776842; Wed, 02 Jan 2019 12:42:56 -0800 (PST) X-Google-Smtp-Source: ALg8bN4UEviZMtAXvbDO4nCn6yAw6YppxULyyDCDsLnkoQtrGiZm4QKSz1KGUKJGWgQA8Tm6CdbKiw== X-Received: by 2002:a37:d204:: with SMTP id f4mr41556320qkj.311.1546461776635; Wed, 02 Jan 2019 12:42:56 -0800 (PST) Received: from localhost.localdomain ([179.159.56.118]) by smtp.gmail.com with ESMTPSA id e17sm26679381qte.12.2019.01.02.12.42.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 02 Jan 2019 12:42:56 -0800 (PST) From: Mauricio Faria de Oliveira To: stable@vger.kernel.org, netdev@vger.kernel.org, Florian Westphal Cc: Alakesh Haloi , nivedita.singhvi@canonical.com, Pablo Neira Ayuso , Jozsef Kadlecsik , "David S. Miller" , Yi-Hung Wei Subject: [PATCH v2 4.14 2/5] netfilter: nf_conncount: expose connection list interface Date: Wed, 2 Jan 2019 18:42:01 -0200 Message-Id: <20190102204204.12389-3-mfo@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190102204204.12389-1-mfo@canonical.com> References: <20190102204204.12389-1-mfo@canonical.com> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pablo Neira Ayuso commit 5e5cbc7b23eaf13e18652c03efbad5be6995de6a upstream. This patch provides an interface to maintain the list of connections and the lookup function to obtain the number of connections in the list. Signed-off-by: Pablo Neira Ayuso [mfo: backport: refresh context lines and use older symbol/file names: - nf_conntrack_count.h: new file, add include guards. - nf_conncount.c -> xt_connlimit.c. - nf_conncount_rb -> xt_connlimit_rb - nf_conncount_tuple -> xt_connlimit_conn - conncount_rb_cachep -> connlimit_rb_cachep - conncount_conn_cachep -> connlimit_conn_cachep] Signed-off-by: Mauricio Faria de Oliveira --- include/net/netfilter/nf_conntrack_count.h | 14 ++++++++++++ net/netfilter/xt_connlimit.c | 36 +++++++++++++++++++----------- 2 files changed, 37 insertions(+), 13 deletions(-) create mode 100644 include/net/netfilter/nf_conntrack_count.h diff --git a/include/net/netfilter/nf_conntrack_count.h b/include/net/netfilter/nf_conntrack_count.h new file mode 100644 index 0000000..54e43b8 --- /dev/null +++ b/include/net/netfilter/nf_conntrack_count.h @@ -0,0 +1,14 @@ +#ifndef _NF_CONNTRACK_COUNT_H +#define _NF_CONNTRACK_COUNT_H + +unsigned int nf_conncount_lookup(struct net *net, struct hlist_head *head, + const struct nf_conntrack_tuple *tuple, + const struct nf_conntrack_zone *zone, + bool *addit); + +bool nf_conncount_add(struct hlist_head *head, + const struct nf_conntrack_tuple *tuple); + +void nf_conncount_cache_free(struct hlist_head *hhead); + +#endif diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c index 79d4151..7af5875 100644 --- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -114,7 +114,7 @@ same_source_net(const union nf_inet_addr *addr, } } -static bool add_hlist(struct hlist_head *head, +bool nf_conncount_add(struct hlist_head *head, const struct nf_conntrack_tuple *tuple) { struct xt_connlimit_conn *conn; @@ -126,12 +126,12 @@ static bool add_hlist(struct hlist_head *head, hlist_add_head(&conn->node, head); return true; } +EXPORT_SYMBOL_GPL(nf_conncount_add); -static unsigned int check_hlist(struct net *net, - struct hlist_head *head, - const struct nf_conntrack_tuple *tuple, - const struct nf_conntrack_zone *zone, - bool *addit) +unsigned int nf_conncount_lookup(struct net *net, struct hlist_head *head, + const struct nf_conntrack_tuple *tuple, + const struct nf_conntrack_zone *zone, + bool *addit) { const struct nf_conntrack_tuple_hash *found; struct xt_connlimit_conn *conn; @@ -176,6 +176,7 @@ static unsigned int check_hlist(struct net *net, return length; } +EXPORT_SYMBOL_GPL(nf_conncount_lookup); static void tree_nodes_free(struct rb_root *root, struct xt_connlimit_rb *gc_nodes[], @@ -222,13 +223,15 @@ count_tree(struct net *net, struct rb_root *root, } else { /* same source network -> be counted! */ unsigned int count; - count = check_hlist(net, &rbconn->hhead, tuple, zone, &addit); + + count = nf_conncount_lookup(net, &rbconn->hhead, tuple, + zone, &addit); tree_nodes_free(root, gc_nodes, gc_count); if (!addit) return count; - if (!add_hlist(&rbconn->hhead, tuple)) + if (!nf_conncount_add(&rbconn->hhead, tuple)) return 0; /* hotdrop */ return count + 1; @@ -238,7 +241,7 @@ count_tree(struct net *net, struct rb_root *root, continue; /* only used for GC on hhead, retval and 'addit' ignored */ - check_hlist(net, &rbconn->hhead, tuple, zone, &addit); + nf_conncount_lookup(net, &rbconn->hhead, tuple, zone, &addit); if (hlist_empty(&rbconn->hhead)) gc_nodes[gc_count++] = rbconn; } @@ -378,11 +381,19 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par) return 0; } -static void destroy_tree(struct rb_root *r) +void nf_conncount_cache_free(struct hlist_head *hhead) { struct xt_connlimit_conn *conn; - struct xt_connlimit_rb *rbconn; struct hlist_node *n; + + hlist_for_each_entry_safe(conn, n, hhead, node) + kmem_cache_free(connlimit_conn_cachep, conn); +} +EXPORT_SYMBOL_GPL(nf_conncount_cache_free); + +static void destroy_tree(struct rb_root *r) +{ + struct xt_connlimit_rb *rbconn; struct rb_node *node; while ((node = rb_first(r)) != NULL) { @@ -390,8 +401,7 @@ static void destroy_tree(struct rb_root *r) rb_erase(node, r); - hlist_for_each_entry_safe(conn, n, &rbconn->hhead, node) - kmem_cache_free(connlimit_conn_cachep, conn); + nf_conncount_cache_free(&rbconn->hhead); kmem_cache_free(connlimit_rb_cachep, rbconn); } -- 2.7.4