github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration

Browse Source 
On helper registration, the maximum number of expectations cannot go over
NF_CT_EXPECT_MAX_CNT (255), but zero can be specified then
nf_conntrack_expect_max applies. Turn zero into NF_CT_EXPECT_MAX_CNT
otherwise, expectation LRU eviction on insertion is disabled.

Moreover, expand this sanity check all expectation classes.

This max_expecy policy is only tunable since userspace helpers are
available, set Fixes: tag to the commit that adds such infrastructure.

Remove the check for p->max_expected given this field must always
be non-zero after this patch.

Fixes: 12f7a50533 ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2026-06-23 12:56:55 +02:00
parent 6fb421bd07
commit 397c830097
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/netfilter/nf_conntrack_expect.c
View File

@ -496,8 +496,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
lockdep_is_held(&nf_conntrack_expect_lock)); lockdep_is_held(&nf_conntrack_expect_lock));
if (helper) { if (helper) {
p = &helper->expect_policy[expect->class]; p = &helper->expect_policy[expect->class];
if (p->max_expected && if (master_help->expecting[expect->class] >= p->max_expected)
master_help->expecting[expect->class] >= p->max_expected)
evict_oldest_expect(master_help, expect, p); evict_oldest_expect(master_help, expect, p);
} else { } else {
const struct nf_conntrack_expect_policy default_exp_policy = { const struct nf_conntrack_expect_policy default_exp_policy = {

7
net/netfilter/nf_conntrack_helper.c
View File

@ -374,8 +374,13 @@ int __nf_conntrack_helper_register(struct nf_conntrack_helper *me)
if (!nf_ct_helper_hash) if (!nf_ct_helper_hash)
return -ENOENT; return -ENOENT;
if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) for (i = 0; i <= me->expect_class_max; i++) {
if (!me->expect_policy[i].max_expected)
me->expect_policy[i].max_expected = NF_CT_EXPECT_MAX_CNT;
if (me->expect_policy[i].max_expected > NF_CT_EXPECT_MAX_CNT)
return -EINVAL; return -EINVAL;
}
mutex_lock(&nf_ct_helper_mutex); mutex_lock(&nf_ct_helper_mutex);
for (i = 0; i < nf_ct_helper_hsize; i++) { for (i = 0; i < nf_ct_helper_hsize; i++) {