Commit 0a202145 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: do not store verdict in traceinfo structure 



Just pass it as argument to nft_trace_notify. Stack is reduced by 8 bytes:

nf_tables_core.c:256 nft_do_chain    312     static

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 698bb828

include/net/netfilter/nf_tables.h

+1 −3
Original line number Diff line number Diff line
@@ -1410,7 +1410,6 @@ void nft_unregister_flowtable_type(struct nf_flowtable_type *type); 
 *	@packet_dumped: packet headers sent in a previous traceinfo message

 *	@basechain: base chain currently processed

 *	@rule:  rule that was evaluated

 *	@verdict: verdict given by rule

 */

struct nft_traceinfo {

	bool				trace;
@@ -1420,14 +1419,13 @@ struct nft_traceinfo { 
	u32				skbid;

	const struct nft_base_chain	*basechain;

	const struct nft_rule_dp	*rule;

	const struct nft_verdict	*verdict;

};



void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,

		    const struct nft_verdict *verdict,

		    const struct nft_chain *basechain);



void nft_trace_notify(const struct nft_pktinfo *pkt,

		      const struct nft_verdict *verdict,

		      struct nft_traceinfo *info);



#define MODULE_ALIAS_NFT_CHAIN(family, name) \

net/netfilter/nf_tables_core.c

+8 −6
Original line number Diff line number Diff line
@@ -42,6 +42,7 @@ static inline void nf_skip_indirect_calls_enable(void) { } 
#endif



static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt,

					const struct nft_verdict *verdict,

					struct nft_traceinfo *info,

					enum nft_trace_types type)

{
@@ -50,10 +51,11 @@ static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, 


	info->type = type;



	nft_trace_notify(pkt, info);

	nft_trace_notify(pkt, verdict, info);

}



static inline void nft_trace_packet(const struct nft_pktinfo *pkt,

				    struct nft_verdict *verdict,

				    struct nft_traceinfo *info,

				    const struct nft_rule_dp *rule,

				    enum nft_trace_types type)
@@ -61,7 +63,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt, 
	if (static_branch_unlikely(&nft_trace_enabled)) {

		info->nf_trace = pkt->skb->nf_trace;

		info->rule = rule;

		__nft_trace_packet(pkt, info, type);

		__nft_trace_packet(pkt, verdict, info, type);

	}

}
@@ -129,7 +131,7 @@ static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, 
		break;

	}



	__nft_trace_packet(pkt, info, type);

	__nft_trace_packet(pkt, &regs->verdict, info, type);

}



static inline void nft_trace_verdict(const struct nft_pktinfo *pkt,
@@ -264,7 +266,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 


	info.trace = false;

	if (static_branch_unlikely(&nft_trace_enabled))

		nft_trace_init(&info, pkt, &regs.verdict, basechain);

		nft_trace_init(&info, pkt, basechain);

do_chain:

	if (genbit)

		blob = rcu_dereference(chain->blob_gen_1);
@@ -296,7 +298,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 
			nft_trace_copy_nftrace(pkt, &info);

			continue;

		case NFT_CONTINUE:

			nft_trace_packet(pkt, &info, rule,

			nft_trace_packet(pkt, &regs.verdict,  &info, rule,

					 NFT_TRACETYPE_RULE);

			continue;

		}
@@ -336,7 +338,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 
		goto next_rule;

	}



	nft_trace_packet(pkt, &info, NULL, NFT_TRACETYPE_POLICY);

	nft_trace_packet(pkt, &regs.verdict, &info, NULL, NFT_TRACETYPE_POLICY);



	if (static_branch_unlikely(&nft_counters_enabled))

		nft_update_chain_stats(basechain, pkt);

net/netfilter/nf_tables_trace.c

+11 −10
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ static int nf_trace_fill_pkt_info(struct sk_buff *nlskb, 
}



static int nf_trace_fill_rule_info(struct sk_buff *nlskb,

				   const struct nft_verdict *verdict,

				   const struct nft_traceinfo *info)

{

	if (!info->rule || info->rule->is_last)
@@ -135,7 +136,7 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb, 
	 * Since no rule matched, the ->rule pointer is invalid.

	 */

	if (info->type == NFT_TRACETYPE_RETURN &&

	    info->verdict->code == NFT_CONTINUE)

	    verdict->code == NFT_CONTINUE)

		return 0;



	return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE,
@@ -143,7 +144,8 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb, 
			    NFTA_TRACE_PAD);

}



static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info)

static bool nft_trace_have_verdict_chain(const struct nft_verdict *verdict,

					 struct nft_traceinfo *info)

{

	switch (info->type) {

	case NFT_TRACETYPE_RETURN:
@@ -153,7 +155,7 @@ static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info) 
		return false;

	}



	switch (info->verdict->code) {

	switch (verdict->code) {

	case NFT_JUMP:

	case NFT_GOTO:

		break;
@@ -184,6 +186,7 @@ static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *i 
}



void nft_trace_notify(const struct nft_pktinfo *pkt,

		      const struct nft_verdict *verdict,

		      struct nft_traceinfo *info)

{

	const struct nft_chain *chain;
@@ -217,8 +220,8 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, 
		nla_total_size(sizeof(u32)) +		/* nfproto */

		nla_total_size(sizeof(u32));		/* policy */



	if (nft_trace_have_verdict_chain(info))

		size += nla_total_size(strlen(info->verdict->chain->name)); /* jump target */

	if (nft_trace_have_verdict_chain(verdict, info))

		size += nla_total_size(strlen(verdict->chain->name)); /* jump target */



	skb = nlmsg_new(size, GFP_ATOMIC);

	if (!skb)
@@ -245,7 +248,7 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, 
	if (nla_put_string(skb, NFTA_TRACE_TABLE, chain->table->name))

		goto nla_put_failure;



	if (nf_trace_fill_rule_info(skb, info))

	if (nf_trace_fill_rule_info(skb, verdict, info))

		goto nla_put_failure;



	switch (info->type) {
@@ -254,11 +257,11 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, 
		break;

	case NFT_TRACETYPE_RETURN:

	case NFT_TRACETYPE_RULE:

		if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, info->verdict))

		if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, verdict))

			goto nla_put_failure;



		/* pkt->skb undefined iff NF_STOLEN, disable dump */

		if (info->verdict->code == NF_STOLEN)

		if (verdict->code == NF_STOLEN)

			info->packet_dumped = true;

		else

			mark = pkt->skb->mark;
@@ -295,7 +298,6 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, 
}



void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,

		    const struct nft_verdict *verdict,

		    const struct nft_chain *chain)

{

	static siphash_key_t trace_key __read_mostly;
@@ -305,7 +307,6 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, 
	info->trace = true;

	info->nf_trace = pkt->skb->nf_trace;

	info->packet_dumped = false;

	info->verdict = verdict;



	net_get_random_once(&trace_key, sizeof(trace_key));