netfilter: x_tables: speed up jump target validation

[cascardo/linux.git] / net / netfilter / x_tables.c

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index fe0e2db..e0aa7c1 100644 (file)
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -702,6 +702,56 @@ int xt_check_entry_offsets(const void *base,
 }
 EXPORT_SYMBOL(xt_check_entry_offsets);
 
+/**
+ * xt_alloc_entry_offsets - allocate array to store rule head offsets
+ *
+ * @size: number of entries
+ *
+ * Return: NULL or kmalloc'd or vmalloc'd array
+ */
+unsigned int *xt_alloc_entry_offsets(unsigned int size)
+{
+       unsigned int *off;
+
+       off = kcalloc(size, sizeof(unsigned int), GFP_KERNEL | __GFP_NOWARN);
+
+       if (off)
+               return off;
+
+       if (size < (SIZE_MAX / sizeof(unsigned int)))
+               off = vmalloc(size * sizeof(unsigned int));
+
+       return off;
+}
+EXPORT_SYMBOL(xt_alloc_entry_offsets);
+
+/**
+ * xt_find_jump_offset - check if target is a valid jump offset
+ *
+ * @offsets: array containing all valid rule start offsets of a rule blob
+ * @target: the jump target to search for
+ * @size: entries in @offset
+ */
+bool xt_find_jump_offset(const unsigned int *offsets,
+                        unsigned int target, unsigned int size)
+{
+       int m, low = 0, hi = size;
+
+       while (hi > low) {
+               m = (low + hi) / 2u;
+
+               if (offsets[m] > target)
+                       hi = m;
+               else if (offsets[m] < target)
+                       low = m + 1;
+               else
+                       return true;
+       }
+
+       return false;
+}
+EXPORT_SYMBOL(xt_find_jump_offset);
+
 int xt_check_target(struct xt_tgchk_param *par,
                    unsigned int size, u_int8_t proto, bool inv_proto)
 {