netfilter: nf_tables: variable sized set element keys / data

This patch changes sets to support variable sized set element keys / data up to 64 bytes each by using variable sized set extensions. This allows to use concatenations with bigger data items suchs as IPv6 addresses. As a side effect, small keys/data now don't require the full 16 bytes of struct nft_data anymore but just the space they need.

Patrick McHardy committed 11 years ago

Commit 7d740261 parent d0a11fc5 files · +23 −19Browse files

Unified · Split

5 files

include/net/netfilter/nf_tables.h +4 −1
include/uapi/linux/netfilter/nf_tables.h +3 −0
net/netfilter/nf_tables_api.c +12 −15
net/netfilter/nft_hash.c +2 −2
net/netfilter/nft_rbtree.c +2 −1

include/net/netfilter/nf_tables.h+4−1

  *	@priv: element private data and extensions
  */
 struct nft_set_elem {
-	struct nft_data		key;
+	union {
+		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
+		struct nft_data	val;
+	} key;
 	void			*priv;
 };

include/uapi/linux/netfilter/nf_tables.h+3−0

@@ -388,6 +388,9 @@ enum nft_data_attributes { · 387 unmodified lines
388	};	388	};
389	#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)	389	#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
390		390
		391	/* Maximum length of a value */
		392	#define NFT_DATA_VALUE_MAXLEN 64
		393
391	/**	394	/**
392	* enum nft_verdict_attributes - nf_tables verdict netlink attributes	395	* enum nft_verdict_attributes - nf_tables verdict netlink attributes
393	*	396	*

net/netfilter/nf_tables_api.c+12−15

 	}
 	desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
-	if (desc.klen == 0 || desc.klen > FIELD_SIZEOF(struct nft_data, data))
+	if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
 		return -EINVAL;
 	flags = 0;
 			if (nla[NFTA_SET_DATA_LEN] == NULL)
 				return -EINVAL;
 			desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
-			if (desc.dlen == 0 ||
+			if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
-			    desc.dlen > FIELD_SIZEOF(struct nft_data, data))
 				return -EINVAL;
 		} else
-			desc.dlen = sizeof(struct nft_data);
+			desc.dlen = sizeof(struct nft_verdict);
 	} else if (flags & NFT_SET_MAP)
 		return -EINVAL;
 const struct nft_set_ext_type nft_set_ext_types[] = {
 	[NFT_SET_EXT_KEY]		= {
-		.len	= sizeof(struct nft_data),
+		.align	= __alignof__(u32),
-		.align	= __alignof__(struct nft_data),
 	},
 	[NFT_SET_EXT_DATA]		= {
-		.len	= sizeof(struct nft_data),
+		.align	= __alignof__(u32),
-		.align	= __alignof__(struct nft_data),
 	},
 	[NFT_SET_EXT_FLAGS]		= {
 		.len	= sizeof(u8),
 		timeout = set->timeout;
 	}
-	err = nft_data_init(ctx, &elem.key, sizeof(elem.key), &d1,
+	err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
 			    nla[NFTA_SET_ELEM_KEY]);
 	if (err < 0)
 		goto err1;
 	if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
 		goto err2;
-	nft_set_ext_add(&tmpl, NFT_SET_EXT_KEY);
+	nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
 	if (timeout > 0) {
 		nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
 		if (timeout != set->timeout)
 				goto err3;
 		}
-		nft_set_ext_add(&tmpl, NFT_SET_EXT_DATA);
+		nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
 	}
 	/* The full maximum length of userdata can exceed the maximum
 	}
 	err = -ENOMEM;
-	elem.priv = nft_set_elem_init(set, &tmpl, elem.key.data, data.data,
+	elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
 				      timeout, GFP_KERNEL);
 	if (elem.priv == NULL)
 		goto err3;
 	if (nla[NFTA_SET_ELEM_DATA] != NULL)
 		nft_data_uninit(&data, d2.type);
 err2:
-	nft_data_uninit(&elem.key, d1.type);
+	nft_data_uninit(&elem.key.val, d1.type);
 err1:
 	return err;
 }
 	if (nla[NFTA_SET_ELEM_KEY] == NULL)
 		goto err1;
-	err = nft_data_init(ctx, &elem.key, sizeof(elem.key), &desc,
+	err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
 			    nla[NFTA_SET_ELEM_KEY]);
 	if (err < 0)
 		goto err1;
 err3:
 	kfree(trans);
 err2:
-	nft_data_uninit(&elem.key, desc.type);
+	nft_data_uninit(&elem.key.val, desc.type);
 err1:
 	return err;
 }

net/netfilter/nft_hash.c+2−2

@@ -133,7 +133,7 @@ static int nft_hash_insert(const struct nft_set *set, · 132 unmodified lines
133	struct nft_hash_cmp_arg arg = {	133	struct nft_hash_cmp_arg arg = {
134	.genmask = nft_genmask_next(read_pnet(&set->pnet)),	134	.genmask = nft_genmask_next(read_pnet(&set->pnet)),
135	.set = set,	135	.set = set,
136	.key = elem->key.data,	136	.key = elem->key.val.data,
137	};	137	};
138		138
139	return rhashtable_lookup_insert_key(&priv->ht, &arg, &he->node,	139	return rhashtable_lookup_insert_key(&priv->ht, &arg, &he->node,
@@ -157,7 +157,7 @@ static void nft_hash_deactivate(const struct nft_set set, · 17 unmodified lines
157	struct nft_hash_cmp_arg arg = {	157	struct nft_hash_cmp_arg arg = {
158	.genmask = nft_genmask_next(read_pnet(&set->pnet)),	158	.genmask = nft_genmask_next(read_pnet(&set->pnet)),
159	.set = set,	159	.set = set,
160	.key = elem->key.data,	160	.key = elem->key.val.data,
161	};	161	};
162		162
163	rcu_read_lock();	163	rcu_read_lock();

net/netfilter/nft_rbtree.c+2−1

@@ -152,7 +152,8 @@ static void nft_rbtree_deactivate(const struct nft_set set, · 151 unmodified lines
152	while (parent != NULL) {	152	while (parent != NULL) {
153	rbe = rb_entry(parent, struct nft_rbtree_elem, node);	153	rbe = rb_entry(parent, struct nft_rbtree_elem, node);
154		154
155	d = memcmp(nft_set_ext_key(&rbe->ext), &elem->key, set->klen);	155	d = memcmp(nft_set_ext_key(&rbe->ext), &elem->key.val,
		156	set->klen);
156	if (d < 0)	157	if (d < 0)
157	parent = parent->rb_left;	158	parent = parent->rb_left;
158	else if (d > 0)	159	else if (d > 0)

netfilter: nf_tables: variable sized set element keys / data

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code