Skip to contentSkip to conversation

netfilter: connlimit: split xt_connlimit into front/backend

PATCH Superseded Florian Westphal 2 participants 3 messages Dec 6, 2017 – Dec 8, 2017

Subsystems (2)
Networking netfilter

v3 of 5 Superseded Latest is v5 →

lore
Share & tools
lore

Florian Westphal

author maintainer
#0 lore raw

PATCH v3 1/1 netfilter: connlimit: split xt_connlimit into front/backend

This allows to reuse xt_connlimit infrastructure from nf_tables.

The upcoming nf_tables frontend can just pass in an nftables register as input key, this allows limiting by arbitrary keys via concatenations.

For xt_connlimit, pass in the zone and the ip/ipv6 address as key to keep same behaviour.

Signed-off-by Florian Westphal <[email protected]>

---
Changes since v2:
- fix resource leak on kmalloc failure
in nf_conncount_init()
- add include guard in nf_conntrack_count.h

 include/net/netfilter/nf_conntrack_count.h  |  17 ++
 include/uapi/linux/netfilter/xt_connlimit.h |   2 +-
 net/netfilter/Kconfig                       |   3 +
 net/netfilter/Makefile                      |   2 +
 net/netfilter/nf_conncount.c                | 373 ++++++++++++++++++++++++++++
 net/netfilter/xt_connlimit.c                | 367 ++-------------------------
 6 files changed, 420 insertions(+), 344 deletions(-)
 create mode 100644 include/net/netfilter/nf_conntrack_count.h
 create mode 100644 net/netfilter/nf_conncount.c
include/net/netfilter/nf_conntrack_count.h new file +17 -0
new file mode 100644
index 0000000000000..7cb13ea909b58
@@ -0,0 +1,17 @@
+#ifndef _NF_CONNTRACK_COUNT_H
+#define _NF_CONNTRACK_COUNT_H
+
+struct nf_conncount_data;
+
+struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int family,
+					    unsigned int keylen);
+void nf_conncount_destroy(struct net *net, unsigned int family,
+			  struct nf_conncount_data *data);
+
+unsigned int nf_conncount_count(struct net *net,
+				struct nf_conncount_data *data,
+				const u32 *key,
+				unsigned int family,
+				const struct nf_conntrack_tuple *tuple,
+				const struct nf_conntrack_zone *zone);
+#endif
include/uapi/linux/netfilter/xt_connlimit.h +1 -1
index 07e5e9d47882c..d4d1943dcd111 100644
@@ -27,7 +27,7 @@ struct xt_connlimit_info {
 	__u32 flags;
 
 	/* Used internally by the kernel */
-	struct xt_connlimit_data *data __attribute__((aligned(8)));
+	struct nf_conncount_data *data __attribute__((aligned(8)));
 };
 
 #endif /* _XT_CONNLIMIT_H */
net/netfilter/Kconfig +3 -0
index e4a13cc8a2e76..8a043b85fc071 100644
@@ -62,6 +62,8 @@ config NF_LOG_NETDEV
 	select NF_LOG_COMMON
 
 if NF_CONNTRACK
+config NETFILTER_CONNCOUNT
+	tristate
 
 config NF_CONNTRACK_MARK
 	bool  'Connection mark tracking support'

@@ -1120,6 +1122,7 @@ config NETFILTER_XT_MATCH_CONNLIMIT
 	tristate '"connlimit" match support'
 	depends on NF_CONNTRACK
 	depends on NETFILTER_ADVANCED
+	select NETFILTER_CONNCOUNT
 	---help---
 	  This match allows you to match against the number of parallel
 	  connections to a server per client IP address (or address block).
net/netfilter/Makefile +2 -0
index f78ed2470831d..490a55e7166da 100644
@@ -67,6 +67,8 @@ obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o
 # SYNPROXY
 obj-$(CONFIG_NETFILTER_SYNPROXY) += nf_synproxy_core.o
 
+obj-$(CONFIG_NETFILTER_CONNCOUNT) += nf_conncount.o
+
 # generic packet duplication from netdev family
 obj-$(CONFIG_NF_DUP_NETDEV)	+= nf_dup_netdev.o
net/netfilter/nf_conncount.c new file +373 -0

373 lines not on this page · raw message

net/netfilter/xt_connlimit.c +24 -343

445 lines not on this page · raw message

Signature · 1 line
2.14.3
#1 lore raw
Quoted 15 lines · Florian Westphal
net/netfilter/nf_conncount.c new file +15 -0
+static int __init nf_conncount_modinit(void)
+{
+       int ret, i;
+
+       BUILD_BUG_ON(CONNCOUNT_LOCK_SLOTS > CONNCOUNT_SLOTS);
+       BUILD_BUG_ON((CONNCOUNT_SLOTS % CONNCOUNT_LOCK_SLOTS) != 0);
+
+       for (i = 0; i < CONNCOUNT_LOCK_SLOTS; ++i)
+               spin_lock_init(&nf_conncount_locks[i]);
+
+       conncount_conn_cachep = kmem_cache_create("nf_conncount_tuple",
+                                          sizeof(struct nf_conncount_tuple),
+                                          0, 0, NULL);
+       if (!conncount_conn_cachep)
+               return -ENOMEM;

net/netfilter/nf_conncount.c line 359

Quoted 10 lines
net/netfilter/nf_conncount.c new file +10 -0
+
+       conncount_rb_cachep = kmem_cache_create("nf_conncount_rb",
+                                          sizeof(struct nf_conncount_rb),
+                                          0, 0, NULL);
+       if (!conncount_rb_cachep) {
+               kmem_cache_destroy(conncount_conn_cachep);
+               return -ENOMEM;
+       }
+
+       return ret;

I test it with iptables -m connlimit, and nf_conncount may fail to load sometimes.

It turns out that it is because ret is not used in this function. Shall we get rid of ret, and return 0 here?

Thanks,

-Yi-Hung

author maintainer
#2 lore raw
Quoted 12 lines · Yi-Hung Wei

net/netfilter/nf_conncount.c line 359

Quoted 8 lines · Florian Westphal
net/netfilter/nf_conncount.c new file +8 -0
+static int __init nf_conncount_modinit(void)
+{
+       int ret, i;
+
+       BUILD_BUG_ON(CONNCOUNT_LOCK_SLOTS > CONNCOUNT_SLOTS);
+       BUILD_BUG_ON((CONNCOUNT_SLOTS % CONNCOUNT_LOCK_SLOTS) != 0);
+
+       return ret;

I test it with iptables -m connlimit, and nf_conncount may fail to load sometimes.

Quoted 2 lines

It turns out that it is because ret is not used in this function. Shall we get rid of ret, and return 0 here?

Yes.