Commit 4765473f authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: consolidate rule verdict trace call 



Add function to consolidate verdict tracing.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8801d791

net/netfilter/nf_tables_core.c

+32 −7
Original line number Diff line number Diff line
@@ -67,6 +67,36 @@ static void nft_cmp_fast_eval(const struct nft_expr *expr, 
	regs->verdict.code = NFT_BREAK;

}



static noinline void __nft_trace_verdict(struct nft_traceinfo *info,

					 const struct nft_chain *chain,

					 const struct nft_regs *regs)

{

	enum nft_trace_types type;



	switch (regs->verdict.code) {

	case NFT_CONTINUE:

	case NFT_RETURN:

		type = NFT_TRACETYPE_RETURN;

		break;

	default:

		type = NFT_TRACETYPE_RULE;

		break;

	}



	__nft_trace_packet(info, chain, type);

}



static inline void nft_trace_verdict(struct nft_traceinfo *info,

				     const struct nft_chain *chain,

				     const struct nft_rule *rule,

				     const struct nft_regs *regs)

{

	if (static_branch_unlikely(&nft_trace_enabled)) {

		info->rule = rule;

		__nft_trace_verdict(info, chain, regs);

	}

}



static bool nft_payload_fast_eval(const struct nft_expr *expr,

				  struct nft_regs *regs,

				  const struct nft_pktinfo *pkt)
@@ -205,13 +235,13 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 
		break;

	}



	nft_trace_verdict(&info, chain, rule, &regs);



	switch (regs.verdict.code & NF_VERDICT_MASK) {

	case NF_ACCEPT:

	case NF_DROP:

	case NF_QUEUE:

	case NF_STOLEN:

		nft_trace_packet(&info, chain, rule,

				 NFT_TRACETYPE_RULE);

		return regs.verdict.code;

	}
@@ -224,15 +254,10 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 
		stackptr++;

		fallthrough;

	case NFT_GOTO:

		nft_trace_packet(&info, chain, rule,

				 NFT_TRACETYPE_RULE);



		chain = regs.verdict.chain;

		goto do_chain;

	case NFT_CONTINUE:

	case NFT_RETURN:

		nft_trace_packet(&info, chain, rule,

				 NFT_TRACETYPE_RETURN);

		break;

	default:

		WARN_ON(1);