netfilter: conntrack: make netns address part of expect hash

[mirror_ubuntu-zesty-kernel.git] / net / netfilter / nf_conntrack_expect.c

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 278927ab09483adbd84611e1d5b7b21fbd3cb048..130f1be8db264ecb55d9386e1aa73bfeabf64902 100644 (file)
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -24,6 +24,7 @@
 #include <linux/moduleparam.h>
 #include <linux/export.h>
 #include <net/net_namespace.h>
+#include <net/netns/hash.h>
 
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
@@ -38,6 +39,7 @@ EXPORT_SYMBOL_GPL(nf_ct_expect_hsize);
 unsigned int nf_ct_expect_max __read_mostly;
 
 static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
+static unsigned int nf_ct_expect_hashrnd __read_mostly;
 
 /* nf_conntrack_expect helper functions */
 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
@@ -72,21 +74,32 @@ static void nf_ct_expectation_timed_out(unsigned long ul_expect)
        nf_ct_expect_put(exp);
 }
 
-static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple)
+static unsigned int nf_ct_expect_dst_hash(const struct net *n, const struct nf_conntrack_tuple *tuple)
 {
-       unsigned int hash;
+       unsigned int hash, seed;
 
-       if (unlikely(!nf_conntrack_hash_rnd)) {
-               init_nf_conntrack_hash_rnd();
-       }
+       get_random_once(&nf_ct_expect_hashrnd, sizeof(nf_ct_expect_hashrnd));
+
+       seed = nf_ct_expect_hashrnd ^ net_hash_mix(n);
 
        hash = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
                      (((tuple->dst.protonum ^ tuple->src.l3num) << 16) |
-                      (__force __u16)tuple->dst.u.all) ^ nf_conntrack_hash_rnd);
+                      (__force __u16)tuple->dst.u.all) ^ seed);
 
        return reciprocal_scale(hash, nf_ct_expect_hsize);
 }
 
+static bool
+nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple,
+               const struct nf_conntrack_expect *i,
+               const struct nf_conntrack_zone *zone,
+               const struct net *net)
+{
+       return nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
+              net_eq(net, nf_ct_net(i->master)) &&
+              nf_ct_zone_equal_any(i->master, zone);
+}
+
 struct nf_conntrack_expect *
 __nf_ct_expect_find(struct net *net,
                    const struct nf_conntrack_zone *zone,
@@ -98,10 +111,9 @@ __nf_ct_expect_find(struct net *net,
        if (!net->ct.expect_count)
                return NULL;
 
-       h = nf_ct_expect_dst_hash(tuple);
+       h = nf_ct_expect_dst_hash(net, tuple);
        hlist_for_each_entry_rcu(i, &net->ct.expect_hash[h], hnode) {
-               if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
-                   nf_ct_zone_equal_any(i->master, zone))
+               if (nf_ct_exp_equal(tuple, i, zone, net))
                        return i;
        }
        return NULL;
@@ -139,11 +151,10 @@ nf_ct_find_expectation(struct net *net,
        if (!net->ct.expect_count)
                return NULL;
 
-       h = nf_ct_expect_dst_hash(tuple);
+       h = nf_ct_expect_dst_hash(net, tuple);
        hlist_for_each_entry(i, &net->ct.expect_hash[h], hnode) {
                if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
-                   nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
-                   nf_ct_zone_equal_any(i->master, zone)) {
+                   nf_ct_exp_equal(tuple, i, zone, net)) {
                        exp = i;
                        break;
                }
@@ -223,6 +234,7 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
        }
 
        return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+              net_eq(nf_ct_net(a->master), nf_ct_net(b->master)) &&
               nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master));
 }
 
@@ -232,6 +244,7 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
        return a->master == b->master && a->class == b->class &&
               nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
               nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
+              net_eq(nf_ct_net(a->master), nf_ct_net(b->master)) &&
               nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master));
 }
 
@@ -342,7 +355,7 @@ static int nf_ct_expect_insert(struct nf_conntrack_expect *exp)
        struct nf_conn_help *master_help = nfct_help(exp->master);
        struct nf_conntrack_helper *helper;
        struct net *net = nf_ct_exp_net(exp);
-       unsigned int h = nf_ct_expect_dst_hash(&exp->tuple);
+       unsigned int h = nf_ct_expect_dst_hash(net, &exp->tuple);
 
        /* two references : one for hash insert, one for the timer */
        atomic_add(2, &exp->use);
@@ -401,7 +414,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
                ret = -ESHUTDOWN;
                goto out;
        }
-       h = nf_ct_expect_dst_hash(&expect->tuple);
+       h = nf_ct_expect_dst_hash(net, &expect->tuple);
        hlist_for_each_entry_safe(i, next, &net->ct.expect_hash[h], hnode) {
                if (expect_matches(i, expect)) {
                        if (del_timer(&i->timeout)) {