Commit 37f319f3 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_connlimit: move stateful fields out of expression data 



In preparation for the rule blob representation.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6316136e

net/netfilter/nft_connlimit.c

+18 −8
Original line number Original line Diff line number Diff line
@@ -14,7 +14,7 @@ 
#include <net/netfilter/nf_conntrack_zones.h>

#include <net/netfilter/nf_conntrack_zones.h>





struct nft_connlimit {

struct nft_connlimit {

	struct nf_conncount_list	list;

	struct nf_conncount_list	*list;

	u32				limit;

	u32				limit;

	bool				invert;

	bool				invert;

};

};
@@ -43,12 +43,12 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv, 
		return;

		return;

	}

	}





	if (nf_conncount_add(nft_net(pkt), &priv->list, tuple_ptr, zone)) {

	if (nf_conncount_add(nft_net(pkt), priv->list, tuple_ptr, zone)) {

		regs->verdict.code = NF_DROP;

		regs->verdict.code = NF_DROP;

		return;

		return;

	}

	}





	count = priv->list.count;

	count = priv->list->count;





	if ((count > priv->limit) ^ priv->invert) {

	if ((count > priv->limit) ^ priv->invert) {

		regs->verdict.code = NFT_BREAK;

		regs->verdict.code = NFT_BREAK;
@@ -76,7 +76,11 @@ static int nft_connlimit_do_init(const struct nft_ctx *ctx, 
			invert = true;

			invert = true;

	}

	}





	nf_conncount_list_init(&priv->list);

	priv->list = kmalloc(sizeof(*priv->list), GFP_KERNEL);

	if (!priv->list)

		return -ENOMEM;



	nf_conncount_list_init(priv->list);

	priv->limit	= limit;

	priv->limit	= limit;

	priv->invert	= invert;

	priv->invert	= invert;
@@ -87,7 +91,8 @@ static void nft_connlimit_do_destroy(const struct nft_ctx *ctx, 
				     struct nft_connlimit *priv)

				     struct nft_connlimit *priv)

{

{

	nf_ct_netns_put(ctx->net, ctx->family);

	nf_ct_netns_put(ctx->net, ctx->family);

	nf_conncount_cache_free(&priv->list);

	nf_conncount_cache_free(priv->list);

	kfree(priv->list);

}

}





static int nft_connlimit_do_dump(struct sk_buff *skb,

static int nft_connlimit_do_dump(struct sk_buff *skb,
@@ -200,7 +205,11 @@ static int nft_connlimit_clone(struct nft_expr *dst, const struct nft_expr *src) 
	struct nft_connlimit *priv_dst = nft_expr_priv(dst);

	struct nft_connlimit *priv_dst = nft_expr_priv(dst);

	struct nft_connlimit *priv_src = nft_expr_priv(src);

	struct nft_connlimit *priv_src = nft_expr_priv(src);





	nf_conncount_list_init(&priv_dst->list);

	priv_dst->list = kmalloc(sizeof(*priv_dst->list), GFP_ATOMIC);

	if (priv_dst->list)

		return -ENOMEM;



	nf_conncount_list_init(priv_dst->list);

	priv_dst->limit	 = priv_src->limit;

	priv_dst->limit	 = priv_src->limit;

	priv_dst->invert = priv_src->invert;

	priv_dst->invert = priv_src->invert;
@@ -212,7 +221,8 @@ static void nft_connlimit_destroy_clone(const struct nft_ctx *ctx, 
{

{

	struct nft_connlimit *priv = nft_expr_priv(expr);

	struct nft_connlimit *priv = nft_expr_priv(expr);





	nf_conncount_cache_free(&priv->list);

	nf_conncount_cache_free(priv->list);

	kfree(priv->list);

}

}





static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)

static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)
@@ -221,7 +231,7 @@ static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr) 
	bool ret;

	bool ret;





	local_bh_disable();

	local_bh_disable();

	ret = nf_conncount_gc_list(net, &priv->list);

	ret = nf_conncount_gc_list(net, priv->list);

	local_bh_enable();

	local_bh_enable();





	return ret;

	return ret;