Commit 03858af0 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_ct: track register operations 



Check if the destination register already contains the data that this ct
expression performs. This allows to skip this redundant operation. If
the destination contains a different selector, update the register
tracking information.

Export nft_expr_reduce_bitwise as a symbol since nft_ct might be
compiled as a module.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 34cc9e52

net/netfilter/nft_bitwise.c

+1 −0
Original line number Diff line number Diff line
@@ -529,3 +529,4 @@ bool nft_expr_reduce_bitwise(struct nft_regs_track *track, 


	return false;

}

EXPORT_SYMBOL_GPL(nft_expr_reduce_bitwise);

net/netfilter/nft_ct.c

+47 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
struct nft_ct {

	enum nft_ct_keys	key:8;

	enum ip_conntrack_dir	dir:8;

	u8			len;

	union {

		u8		dreg;

		u8		sreg;
@@ -500,6 +501,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx, 
		}

	}



	priv->len = len;

	err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,

				       NFT_DATA_VALUE, len);

	if (err < 0)
@@ -608,6 +610,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx, 
		}

	}



	priv->len = len;

	err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);

	if (err < 0)

		goto err1;
@@ -677,6 +680,29 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr) 
	return -1;

}



static bool nft_ct_get_reduce(struct nft_regs_track *track,

			      const struct nft_expr *expr)

{

	const struct nft_ct *priv = nft_expr_priv(expr);

	const struct nft_ct *ct;



	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {

		nft_reg_track_update(track, expr, priv->dreg, priv->len);

		return false;

	}



	ct = nft_expr_priv(track->regs[priv->dreg].selector);

	if (priv->key != ct->key) {

		nft_reg_track_update(track, expr, priv->dreg, priv->len);

		return false;

	}



	if (!track->regs[priv->dreg].bitwise)

		return true;



	return nft_expr_reduce_bitwise(track, expr);

}



static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)

{

	const struct nft_ct *priv = nft_expr_priv(expr);
@@ -710,8 +736,27 @@ static const struct nft_expr_ops nft_ct_get_ops = { 
	.init		= nft_ct_get_init,

	.destroy	= nft_ct_get_destroy,

	.dump		= nft_ct_get_dump,

	.reduce		= nft_ct_get_reduce,

};



static bool nft_ct_set_reduce(struct nft_regs_track *track,

			      const struct nft_expr *expr)

{

	int i;



	for (i = 0; i < NFT_REG32_NUM; i++) {

		if (!track->regs[i].selector)

			continue;



		if (track->regs[i].selector->ops != &nft_ct_get_ops)

			continue;



		__nft_reg_track_cancel(track, i);

	}



	return false;

}



static const struct nft_expr_ops nft_ct_set_ops = {

	.type		= &nft_ct_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
@@ -719,6 +764,7 @@ static const struct nft_expr_ops nft_ct_set_ops = { 
	.init		= nft_ct_set_init,

	.destroy	= nft_ct_set_destroy,

	.dump		= nft_ct_set_dump,

	.reduce		= nft_ct_set_reduce,

};



#ifdef CONFIG_NF_CONNTRACK_ZONES
@@ -729,6 +775,7 @@ static const struct nft_expr_ops nft_ct_set_zone_ops = { 
	.init		= nft_ct_set_init,

	.destroy	= nft_ct_set_destroy,

	.dump		= nft_ct_set_dump,

	.reduce		= nft_ct_set_reduce,

};

#endif