Commit fa502c86 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Florian Westphal
Browse files

netfilter: flowtable: simplify route logic 



Grab reference to dst from skbuff earlier to simplify route caching.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent d671fd82

include/net/netfilter/nf_flow_table.h

+2 −2
Original line number Diff line number Diff line
@@ -263,7 +263,7 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, 
	up_write(&flow_table->flow_block_lock);

}



int flow_offload_route_init(struct flow_offload *flow,

void flow_offload_route_init(struct flow_offload *flow,

			     const struct nf_flow_route *route);



int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);

net/netfilter/nf_flow_table_core.c

+3 −21
Original line number Diff line number Diff line
@@ -125,9 +125,6 @@ static int flow_offload_fill_route(struct flow_offload *flow, 
		break;

	case FLOW_OFFLOAD_XMIT_XFRM:

	case FLOW_OFFLOAD_XMIT_NEIGH:

		if (!dst_hold_safe(route->tuple[dir].dst))

			return -1;



		flow_tuple->dst_cache = dst;

		flow_tuple->dst_cookie = flow_offload_dst_cookie(flow_tuple);

		break;
@@ -148,27 +145,12 @@ static void nft_flow_dst_release(struct flow_offload *flow, 
		dst_release(flow->tuplehash[dir].tuple.dst_cache);

}



int flow_offload_route_init(struct flow_offload *flow,

void flow_offload_route_init(struct flow_offload *flow,

			    const struct nf_flow_route *route)

{

	int err;



	err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);

	if (err < 0)

		return err;



	err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);

	if (err < 0)

		goto err_route_reply;



	flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);

	flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);

	flow->type = NF_FLOW_OFFLOAD_ROUTE;



	return 0;



err_route_reply:

	nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL);



	return err;

}

EXPORT_SYMBOL_GPL(flow_offload_route_init);

net/netfilter/nft_flow_offload.c

+8 −4
Original line number Diff line number Diff line
@@ -250,9 +250,14 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, 
		break;

	}



	if (!dst_hold_safe(this_dst))

		return -ENOENT;



	nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt));

	if (!other_dst)

	if (!other_dst) {

		dst_release(this_dst);

		return -ENOENT;

	}



	nft_default_forward_path(route, this_dst, dir);

	nft_default_forward_path(route, other_dst, !dir);
@@ -349,8 +354,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, 
	if (!flow)

		goto err_flow_alloc;



	if (flow_offload_route_init(flow, &route) < 0)

		goto err_flow_add;

	flow_offload_route_init(flow, &route);



	if (tcph) {

		ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
@@ -361,12 +365,12 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, 
	if (ret < 0)

		goto err_flow_add;



	dst_release(route.tuple[!dir].dst);

	return;



err_flow_add:

	flow_offload_free(flow);

err_flow_alloc:

	dst_release(route.tuple[dir].dst);

	dst_release(route.tuple[!dir].dst);

err_flow_route:

	clear_bit(IPS_OFFLOAD_BIT, &ct->status);