Skip to content
Commit d64d80a2 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Pablo Neira Ayuso
Browse files

netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match



Currently in xt_socket, we take advantage of early demuxed sockets
since commit 00028aa3 ("netfilter: xt_socket: use IP early demux")
in order to avoid a second socket lookup in the fast path, but we
only make partial use of this:

We still unnecessarily parse headers, extract proto, {s,d}addr and
{s,d}ports from the skb data, accessing possible conntrack information,
etc even though we were not even calling into the socket lookup via
xt_socket_get_sock_{v4,v6}() due to skb->sk hit, meaning those cycles
can be spared.

After this patch, we only proceed the slower, manual lookup path
when we have a skb->sk miss, thus time to match verdict for early
demuxed sockets will improve further, which might be i.e. interesting
for use cases such as mentioned in 681f130f ("netfilter: xt_socket:
add XT_SOCKET_NOWILDCARD flag").

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0b67c43c
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment