Skip to contentSkip to conversation

netfilter: connlimit: split xt_connlimit into front and backend

PATCH Superseded Florian Westphal 2 participants 2 messages Dec 8, 2017 – Dec 9, 2017

Subsystems (2)
Networking netfilter

v4 of 5 Superseded Latest is v5 →

lore
Share & tools
lore

Florian Westphal

author maintainer
#0 lore raw

PATCH v4 1/1 netfilter: connlimit: split xt_connlimit into front and backend

This allows to reuse xt_connlimit infrastructure from nf_tables. The upcoming nf_tables frontend can just pass in an nftables register as input key, this allows limiting by any nft-supported key, including concatenations.

For xt_connlimit, pass in the zone and the ip/ipv6 address.

Signed-off-by Florian Westphal <[email protected]>

---
Changes since v3:
- fix nf_conncount_modinit return value
Changes since v2:
- fix resource leak on kmalloc failure
in nf_conncount_init()
- add include guard in nf_conntrack_count.h

 include/net/netfilter/nf_conntrack_count.h  |  17 ++
 include/uapi/linux/netfilter/xt_connlimit.h |   2 +-
 net/netfilter/Kconfig                       |   3 +
 net/netfilter/Makefile                      |   2 +
 net/netfilter/nf_conncount.c                | 373 ++++++++++++++++++++++++++++
 net/netfilter/xt_connlimit.c                | 367 ++-------------------------
 6 files changed, 420 insertions(+), 344 deletions(-)
 create mode 100644 include/net/netfilter/nf_conntrack_count.h
 create mode 100644 net/netfilter/nf_conncount.c
include/net/netfilter/nf_conntrack_count.h new file +17 -0
new file mode 100644
index 000000000000..7cb13ea909b5
@@ -0,0 +1,17 @@
+#ifdef _NF_CONNTRACK_COUNT_H
+#define _NF_CONNTRACK_COUNT_H
+
+struct nf_conncount_data;
+
+struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int family,
+					    unsigned int keylen);
+void nf_conncount_destroy(struct net *net, unsigned int family,
+			  struct nf_conncount_data *data);
+
+unsigned int nf_conncount_count(struct net *net,
+				struct nf_conncount_data *data,
+				const u32 *key,
+				unsigned int family,
+				const struct nf_conntrack_tuple *tuple,
+				const struct nf_conntrack_zone *zone);
+#endif
include/uapi/linux/netfilter/xt_connlimit.h +1 -1
index 07e5e9d47882..d4d1943dcd11 100644
@@ -27,7 +27,7 @@ struct xt_connlimit_info {
 	__u32 flags;
 
 	/* Used internally by the kernel */
-	struct xt_connlimit_data *data __attribute__((aligned(8)));
+	struct nf_conncount_data *data __attribute__((aligned(8)));
 };
 
 #endif /* _XT_CONNLIMIT_H */
net/netfilter/Kconfig +3 -0
index e4a13cc8a2e7..8a043b85fc07 100644
@@ -62,6 +62,8 @@ config NF_LOG_NETDEV
 	select NF_LOG_COMMON
 
 if NF_CONNTRACK
+config NETFILTER_CONNCOUNT
+	tristate
 
 config NF_CONNTRACK_MARK
 	bool  'Connection mark tracking support'

@@ -1120,6 +1122,7 @@ config NETFILTER_XT_MATCH_CONNLIMIT
 	tristate '"connlimit" match support'
 	depends on NF_CONNTRACK
 	depends on NETFILTER_ADVANCED
+	select NETFILTER_CONNCOUNT
 	---help---
 	  This match allows you to match against the number of parallel
 	  connections to a server per client IP address (or address block).
net/netfilter/Makefile +2 -0
index f78ed2470831..490a55e7166d 100644
@@ -67,6 +67,8 @@ obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o
 # SYNPROXY
 obj-$(CONFIG_NETFILTER_SYNPROXY) += nf_synproxy_core.o
 
+obj-$(CONFIG_NETFILTER_CONNCOUNT) += nf_conncount.o
+
 # generic packet duplication from netdev family
 obj-$(CONFIG_NF_DUP_NETDEV)	+= nf_dup_netdev.o
net/netfilter/nf_conncount.c new file +373 -0

373 lines not on this page · raw message

net/netfilter/xt_connlimit.c +24 -343

445 lines not on this page · raw message

Signature · 1 line
2.13.6
#1 lore raw

include/net/netfilter/nf_conntrack_count.h line 1

Quoted 4 lines · Florian Westphal
include/net/netfilter/nf_conntrack_count.h new file +1 -0
@@ -0,0 +1,17 @@
+#ifdef _NF_CONNTRACK_COUNT_H

^^^^^^^^
#ifndef? Looks like a typo in v4.

net/netfilter/xt_connlimit.c connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) · line 106

Quoted 10 lines
net/netfilter/xt_connlimit.c +0 -1
index a6214f235333..d69e2f41aaa6 100644
 static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
 {
        const struct xt_connlimit_info *info = par->matchinfo;
-       unsigned int i;
 
        nf_ct_netns_put(par->net, par->family);

I run into some issues when load and unload xt_connlimit a couple of times. It turns out that we do nf_ct_netns_put() twice, where the other one is in nf_conncount_destroy(). Maybe get rid of this line?

Thanks,

-Yi-Hung