Upstream commit:
commit adff6c65600000ec2bb71840c943ee12668080f5
Author: Florian Westphal <f...@strlen.de>
Date: Tue Apr 12 18:14:25 2016 +0200
netfilter: connlabels: change nf_connlabels_get bit arg to 'highest used'
nf_connlabel_set() takes the bit number that we would like to set.
nf_connlabels_get() however took the number of bits that we want to
support.
So e.g. nf_connlabels_get(32) support bits 0 to 31, but not 32.
This changes nf_connlabels_get() to take the highest bit that we want
to set.
Callers then don't have to cope with a potential integer wrap
when using nf_connlabels_get(bit + 1) anymore.
Current callers are fine, this change is only to make folloup
nft ct label set support simpler.
Signed-off-by: Florian Westphal <f...@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Jarno Rajahalme <ja...@ovn.org>
OVS compat code defined nf_connlabels_get() if it was missing. Now we
redefine it if it is missing, or if it has the old signature.
Signed-off-by: Jarno Rajahalme <ja...@ovn.org>
---
acinclude.m4 | 3 +++
datapath/conntrack.c | 2 +-
.../include/net/netfilter/nf_conntrack_labels.h | 25 +++++++++++++++-------
3 files changed, 21 insertions(+), 9 deletions(-)
diff --git a/acinclude.m4 b/acinclude.m4
index 3fd2e93..93ee458 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -468,6 +468,9 @@ AC_DEFUN([OVS_CHECK_LINUX_COMPAT], [
[nf_ct_zone_init])
OVS_GREP_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_labels.h],
[nf_connlabels_get])
+ OVS_FIND_PARAM_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_labels.h],
+ [nf_connlabels_get], [int bit],
+ [OVS_DEFINE([HAVE_NF_CONNLABELS_GET_TAKES_BIT])])
OVS_GREP_IFELSE([$KSRC/include/net/netfilter/ipv6/nf_defrag_ipv6.h],
[nf_ct_frag6_consume_orig])
OVS_GREP_IFELSE([$KSRC/include/net/netfilter/ipv6/nf_defrag_ipv6.h],
diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index 7d73f19..236e203 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -1356,7 +1356,7 @@ void ovs_ct_init(struct net *net)
unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
- if (nf_connlabels_get(net, n_bits)) {
+ if (nf_connlabels_get(net, n_bits - 1)) {
ovs_net->xt_label = false;
OVS_NLERR(true, "Failed to set connlabel length");
} else {
diff --git a/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h
b/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h
index a594a0f..31507c4 100644
--- a/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h
+++ b/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h
@@ -5,7 +5,7 @@
#include <linux/version.h>
#include_next <net/netfilter/nf_conntrack_labels.h>
-#ifndef HAVE_NF_CONNLABELS_GET
+#ifndef HAVE_NF_CONNLABELS_GET_TAKES_BIT
#if IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS)
#ifndef NF_CT_LABELS_MAX_SIZE
@@ -14,36 +14,45 @@
/* XXX: This doesn't lock others out from doing the same configuration
* simultaneously. */
-static inline int nf_connlabels_get(struct net *net, unsigned int n_bits)
+static inline int rpl_nf_connlabels_get(struct net *net, unsigned int bits)
{
+#ifndef HAVE_NF_CONNLABELS_GET
size_t words;
- if (n_bits > (NF_CT_LABELS_MAX_SIZE * BITS_PER_BYTE))
+ words = BIT_WORD(bits) + 1;
+ if (words > NF_CT_LABELS_MAX_SIZE / sizeof(long))
return -ERANGE;
- words = BITS_TO_LONGS(n_bits);
-
net->ct.labels_used++;
if (words > net->ct.label_words)
net->ct.label_words = words;
return 0;
+#else
+ return nf_connlabels_get(net, bits + 1);
+#endif /* HAVE_NF_CONNLABELS_GET */
}
+#define nf_connlabels_get rpl_nf_connlabels_get
-static inline void nf_connlabels_put(struct net *net)
+static inline void rpl_nf_connlabels_put(struct net *net)
{
+#ifndef HAVE_NF_CONNLABELS_GET
net->ct.labels_used--;
if (net->ct.labels_used == 0)
net->ct.label_words = 0;
+#else
+ nf_connlabels_put(net);
+#endif /* HAVE_NF_CONNLABELS_GET */
}
+#define nf_connlabels_put rpl_nf_connlabels_put
#else /* CONFIG_NF_CONNTRACK_LABELS */
-static inline int nf_connlabels_get(struct net *net, unsigned int n_bits)
+static inline int nf_connlabels_get(struct net *net, unsigned int bits)
{
return -ERANGE;
}
static inline void nf_connlabels_put(struct net *net) { }
#endif /* CONFIG_NF_CONNTRACK_LABELS */
-#endif /* HAVE_NF_CONNLABELS_GET */
+#endif /* HAVE_NF_CONNLABELS_GET_TAKES_BIT */
#endif /* _NF_CONNTRACK_LABELS_WRAPPER_H */
--
2.1.4
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
