datapath: change nf_connlabels_get bit arg to 'highest used'

Upstream commit:
    commit adff6c65600000ec2bb71840c943ee12668080f5
    Author: Florian Westphal <fw@strlen.de>
    Date:   Tue Apr 12 18:14:25 2016 +0200

    netfilter: connlabels: change nf_connlabels_get bit arg to 'highest used'

    nf_connlabel_set() takes the bit number that we would like to set.
    nf_connlabels_get() however took the number of bits that we want to
    support.

    So e.g. nf_connlabels_get(32) support bits 0 to 31, but not 32.
    This changes nf_connlabels_get() to take the highest bit that we want
    to set.

    Callers then don't have to cope with a potential integer wrap
    when using nf_connlabels_get(bit + 1) anymore.

    Current callers are fine, this change is only to make folloup
    nft ct label set support simpler.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Jarno Rajahalme <jarno@ovn.org>

OVS compat code defined nf_connlabels_get() if it was missing.  Now we
redefine it if it is missing, or if it has the old signature.

Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
Acked-by: Jesse Gross <jesse@kernel.org>

2 files changed, 18 insertions, 9 deletions

diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index c24aa8c16..f30a3b736 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -1403,7 +1403,7 @@ void ovs_ct_init(struct net *net)
 	unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
 	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
 
-	if (nf_connlabels_get(net, n_bits)) {
+	if (nf_connlabels_get(net, n_bits - 1)) {
 		ovs_net->xt_label = false;
 		OVS_NLERR(true, "Failed to set connlabel length");
 	} else {
diff --git a/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h b/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h
index a594a0fee..31507c45f 100644
--- a/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h
+++ b/datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h
@@ -5,7 +5,7 @@
 #include <linux/version.h>
 #include_next <net/netfilter/nf_conntrack_labels.h>
 
-#ifndef HAVE_NF_CONNLABELS_GET
+#ifndef HAVE_NF_CONNLABELS_GET_TAKES_BIT
 #if IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS)
 
 #ifndef NF_CT_LABELS_MAX_SIZE
@@ -14,36 +14,45 @@
 
 /* XXX: This doesn't lock others out from doing the same configuration
  *	simultaneously. */
-static inline int nf_connlabels_get(struct net *net, unsigned int n_bits)
+static inline int rpl_nf_connlabels_get(struct net *net, unsigned int bits)
 {
+#ifndef HAVE_NF_CONNLABELS_GET
 	size_t words;
 
-	if (n_bits > (NF_CT_LABELS_MAX_SIZE * BITS_PER_BYTE))
+	words = BIT_WORD(bits) + 1;
+	if (words > NF_CT_LABELS_MAX_SIZE / sizeof(long))
 		return -ERANGE;
 
-	words = BITS_TO_LONGS(n_bits);
-
 	net->ct.labels_used++;
 	if (words > net->ct.label_words)
 		net->ct.label_words = words;
 
 	return 0;
+#else
+	return nf_connlabels_get(net, bits + 1);
+#endif /* HAVE_NF_CONNLABELS_GET */
 }
+#define nf_connlabels_get rpl_nf_connlabels_get
 
-static inline void nf_connlabels_put(struct net *net)
+static inline void rpl_nf_connlabels_put(struct net *net)
 {
+#ifndef HAVE_NF_CONNLABELS_GET
 	net->ct.labels_used--;
 	if (net->ct.labels_used == 0)
 		net->ct.label_words = 0;
+#else
+	nf_connlabels_put(net);
+#endif /* HAVE_NF_CONNLABELS_GET */
 }
+#define nf_connlabels_put rpl_nf_connlabels_put
 
 #else /* CONFIG_NF_CONNTRACK_LABELS */
-static inline int nf_connlabels_get(struct net *net, unsigned int n_bits)
+static inline int nf_connlabels_get(struct net *net, unsigned int bits)
 {
 	return -ERANGE;
 }
 
 static inline void nf_connlabels_put(struct net *net) { }
 #endif /* CONFIG_NF_CONNTRACK_LABELS */
-#endif /* HAVE_NF_CONNLABELS_GET */
+#endif /* HAVE_NF_CONNLABELS_GET_TAKES_BIT */
 #endif /* _NF_CONNTRACK_LABELS_WRAPPER_H */