netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration

On helper registration, the maximum number of expectations cannot go over
NF_CT_EXPECT_MAX_CNT (255), but zero can be specified then
nf_conntrack_expect_max applies. Turn zero into NF_CT_EXPECT_MAX_CNT
otherwise, expectation LRU eviction on insertion is disabled.

Moreover, expand this sanity check all expectation classes.

This max_expecy policy is only tunable since userspace helpers are
available, set Fixes: tag to the commit that adds such infrastructure.

Remove the check for p->max_expected given this field must always
be non-zero after this patch.

Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 113bb1cb1683fdbd7bbefb996828e9894272e163..38630c5e006f0814dc775ea7d92d244f9dc90d66 100644 (file)
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -496,8 +496,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
                                           lockdep_is_held(&nf_conntrack_expect_lock));
        if (helper) {
                p = &helper->expect_policy[expect->class];
-               if (p->max_expected &&
-                   master_help->expecting[expect->class] >= p->max_expected)
+               if (master_help->expecting[expect->class] >= p->max_expected)
                        evict_oldest_expect(master_help, expect, p);
        } else {
                const struct nf_conntrack_expect_policy default_exp_policy = {

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 8b94001c24306631212c8f6266aaba12370d8210..500509b17663ed9b8319e2bd778eda9efeecaffc 100644 (file)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -374,8 +374,13 @@ int __nf_conntrack_helper_register(struct nf_conntrack_helper *me)
        if (!nf_ct_helper_hash)
                return -ENOENT;
 
-       if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
-               return -EINVAL;
+       for (i = 0; i <= me->expect_class_max; i++) {
+               if (!me->expect_policy[i].max_expected)
+                       me->expect_policy[i].max_expected = NF_CT_EXPECT_MAX_CNT;
+
+               if (me->expect_policy[i].max_expected > NF_CT_EXPECT_MAX_CNT)
+                       return -EINVAL;
+       }
 
        mutex_lock(&nf_ct_helper_mutex);
        for (i = 0; i < nf_ct_helper_hsize; i++) {