Skip to contentSkip to conversation

netfilter: nf_queue: cleanup copy_range usage

PATCH Applied Florian Westphal 2 participants 4 messages Jun 5, 2013

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Florian Westphal

author maintainer
#0 lore raw

PATCH 1/2 netfilter: nf_queue: cleanup copy_range usage

For every packet queued, we check if configured copy_range is 0, and treat that as 'copy entire packet'.

We can move this check to the queue configuration, and can set copy_range appropriately.

Also, convert repetitive '0xffff - NLA_HDRLEN' to a macro.

[ queue initialization still used 0xffff, although its harmless
since the initial setting is overwritten on queue config ]

Signed-off-by Florian Westphal <[email protected]>

---
Changes since v1:
- split CAP_LEN change into separate patch
- also move comment

net/netfilter/nfnetlink_queue_core.c +12 -10
index cff4449..3c42181 100644
@@ -41,6 +41,14 @@
 
 #define NFQNL_QMAX_DEFAULT 1024
 
+/* We're using struct nlattr which has 16bit nla_len. Note that nla_len
+ * includes the header length. Thus, the maximum packet length that we
+ * support is 65531 bytes. We send truncated packets if the specified length
+ * is larger than that.  Userspace can check for presence of NFQA_CAP_LEN
+ * attribute to detect truncation.
+ */
+#define NFQNL_MAX_COPY_RANGE (0xffff - NLA_HDRLEN)
+
 struct nfqnl_instance {
 	struct hlist_node hlist;		/* global list of queues */
 	struct rcu_head rcu;

@@ -122,7 +130,7 @@ instance_create(struct nfnl_queue_net *q, u_int16_t queue_num,
 	inst->queue_num = queue_num;
 	inst->peer_portid = portid;
 	inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
-	inst->copy_range = 0xffff;
+	inst->copy_range = NFQNL_MAX_COPY_RANGE;
 	inst->copy_mode = NFQNL_COPY_NONE;
 	spin_lock_init(&inst->lock);
 	INIT_LIST_HEAD(&inst->queue_list);

@@ -333,10 +341,9 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
 			return NULL;
 
 		data_len = ACCESS_ONCE(queue->copy_range);
-		if (data_len == 0 || data_len > entskb->len)
+		if (data_len > entskb->len)
 			data_len = entskb->len;
 
-
 		if (!entskb->head_frag ||
 		    skb_headlen(entskb) < L1_CACHE_BYTES ||
 		    skb_shinfo(entskb)->nr_frags >= MAX_SKB_FRAGS)

@@ -727,13 +734,8 @@ nfqnl_set_mode(struct nfqnl_instance *queue,
 
 	case NFQNL_COPY_PACKET:
 		queue->copy_mode = mode;
-		/* We're using struct nlattr which has 16bit nla_len. Note that
-		 * nla_len includes the header length. Thus, the maximum packet
-		 * length that we support is 65531 bytes. We send truncated
-		 * packets if the specified length is larger than that.
-		 */
-		if (range > 0xffff - NLA_HDRLEN)
-			queue->copy_range = 0xffff - NLA_HDRLEN;
+		if (range == 0 || range > NFQNL_MAX_COPY_RANGE)
+			queue->copy_range = NFQNL_MAX_COPY_RANGE;
 		else
 			queue->copy_range = range;
 		break;
Signature · 1 line
1.7.8.6
author maintainer
#1 lore raw

PATCH 2/2 netfilter: nfnetlink_queue: only add CAP_LEN attr when needed

CAP_LEN contains the size of the network packet we're queueing to userspace, i.e. normally it is the same as the NFQA_PAYLOAD attribute len.

Include it only in the unlikely case when NFQA_PAYLOAD is truncated due to copy_range limitations.

Signed-off-by Florian Westphal <[email protected]>

---
Tested with examples/nf-queue.c from libnfqueue, it still prints 'truncated packet' on 1st packet sent from tracepath.

net/netfilter/nfnetlink_queue_core.c +2 -1
index 3c42181..eb2cde8 100644
@@ -472,7 +472,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
 	if (ct && nfqnl_ct_put(skb, ct, ctinfo) < 0)
 		goto nla_put_failure;
 
-	if (cap_len > 0 && nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len)))
+	if (cap_len > data_len &&
+	    nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len)))
 		goto nla_put_failure;
 
 	if (nfqnl_put_packet_info(skb, entskb))
Signature · 1 line
1.7.8.6
maintainer
#2 lore raw

Re: [PATCH -next 2/2] netfilter: nfnetlink_queue: only add CAP_LEN attr when needed

Quoted 5 lines · Florian Westphal

CAP_LEN contains the size of the network packet we're queueing to userspace, i.e. normally it is the same as the NFQA_PAYLOAD attribute len.

Include it only in the unlikely case when NFQA_PAYLOAD is truncated due to copy_range limitations.

Also applied, thanks!

maintainer Applied
#3 lore raw
In reply to Florian Westphal
Quoted 10 lines · Florian Westphal

For every packet queued, we check if configured copy_range is 0, and treat that as 'copy entire packet'.

We can move this check to the queue configuration, and can set copy_range appropriately.

Also, convert repetitive '0xffff - NLA_HDRLEN' to a macro.

[ queue initialization still used 0xffff, although its harmless
since the initial setting is overwritten on queue config ]

Applied, thanks Florian.