Skip to content

Commit

Permalink
netfilter: move zone info into struct nf_conn
Browse files Browse the repository at this point in the history
Curently we store zone information as a conntrack extension.
This has one drawback: for every lookup we need to fetch the zone data
from the extension area.

This change place the zone data directly into the main conntrack object
structure and then removes the zone conntrack extension.

The zone data is just 4 bytes, it fits into a padding hole before
the tuplehash info, so we do not even increase the nf_conn structure size.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Florian Westphal authored and Pablo Neira Ayuso committed Jun 23, 2016
1 parent 7e53e7f commit 6c8dee9
Show file tree
Hide file tree
Showing 4 changed files with 16 additions and 57 deletions.
3 changes: 3 additions & 0 deletions include/net/netfilter/nf_conntrack.h
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,9 @@ struct nf_conn {
spinlock_t lock;
u16 cpu;

#ifdef CONFIG_NF_CONNTRACK_ZONES
struct nf_conntrack_zone zone;
#endif
/* XXX should I move this to the tail ? - Y.K */
/* These are my tuples; original and reply */
struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
Expand Down
4 changes: 0 additions & 4 deletions include/net/netfilter/nf_conntrack_extend.h
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,6 @@ enum nf_ct_ext_id {
#ifdef CONFIG_NF_CONNTRACK_EVENTS
NF_CT_EXT_ECACHE,
#endif
#ifdef CONFIG_NF_CONNTRACK_ZONES
NF_CT_EXT_ZONE,
#endif
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
NF_CT_EXT_TSTAMP,
#endif
Expand All @@ -38,7 +35,6 @@ enum nf_ct_ext_id {
#define NF_CT_EXT_SEQADJ_TYPE struct nf_conn_seqadj
#define NF_CT_EXT_ACCT_TYPE struct nf_conn_acct
#define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache
#define NF_CT_EXT_ZONE_TYPE struct nf_conntrack_zone
#define NF_CT_EXT_TSTAMP_TYPE struct nf_conn_tstamp
#define NF_CT_EXT_TIMEOUT_TYPE struct nf_conn_timeout
#define NF_CT_EXT_LABELS_TYPE struct nf_conn_labels
Expand Down
33 changes: 11 additions & 22 deletions include/net/netfilter/nf_conntrack_zones.h
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,11 @@
static inline const struct nf_conntrack_zone *
nf_ct_zone(const struct nf_conn *ct)
{
const struct nf_conntrack_zone *nf_ct_zone = NULL;

#ifdef CONFIG_NF_CONNTRACK_ZONES
nf_ct_zone = nf_ct_ext_find(ct, NF_CT_EXT_ZONE);
return &ct->zone;
#else
return &nf_ct_zone_dflt;
#endif
return nf_ct_zone ? nf_ct_zone : &nf_ct_zone_dflt;
}

static inline const struct nf_conntrack_zone *
Expand All @@ -31,32 +30,22 @@ static inline const struct nf_conntrack_zone *
nf_ct_zone_tmpl(const struct nf_conn *tmpl, const struct sk_buff *skb,
struct nf_conntrack_zone *tmp)
{
const struct nf_conntrack_zone *zone;

#ifdef CONFIG_NF_CONNTRACK_ZONES
if (!tmpl)
return &nf_ct_zone_dflt;

zone = nf_ct_zone(tmpl);
if (zone->flags & NF_CT_FLAG_MARK)
zone = nf_ct_zone_init(tmp, skb->mark, zone->dir, 0);

return zone;
if (tmpl->zone.flags & NF_CT_FLAG_MARK)
return nf_ct_zone_init(tmp, skb->mark, tmpl->zone.dir, 0);
#endif
return nf_ct_zone(tmpl);
}

static inline int nf_ct_zone_add(struct nf_conn *ct, gfp_t flags,
const struct nf_conntrack_zone *info)
static inline void nf_ct_zone_add(struct nf_conn *ct,
const struct nf_conntrack_zone *zone)
{
#ifdef CONFIG_NF_CONNTRACK_ZONES
struct nf_conntrack_zone *nf_ct_zone;

nf_ct_zone = nf_ct_ext_add(ct, NF_CT_EXT_ZONE, flags);
if (!nf_ct_zone)
return -ENOMEM;

nf_ct_zone_init(nf_ct_zone, info->id, info->dir,
info->flags);
ct->zone = *zone;
#endif
return 0;
}

static inline bool nf_ct_zone_matches_dir(const struct nf_conntrack_zone *zone,
Expand Down
33 changes: 2 additions & 31 deletions net/netfilter/nf_conntrack_core.c
Original file line number Diff line number Diff line change
Expand Up @@ -327,16 +327,10 @@ struct nf_conn *nf_ct_tmpl_alloc(struct net *net,

tmpl->status = IPS_TEMPLATE;
write_pnet(&tmpl->ct_net, net);

if (nf_ct_zone_add(tmpl, flags, zone) < 0)
goto out_free;

nf_ct_zone_add(tmpl, zone);
atomic_set(&tmpl->ct_general.use, 0);

return tmpl;
out_free:
kfree(tmpl);
return NULL;
}
EXPORT_SYMBOL_GPL(nf_ct_tmpl_alloc);

Expand Down Expand Up @@ -929,16 +923,13 @@ __nf_conntrack_alloc(struct net *net,
offsetof(struct nf_conn, proto) -
offsetof(struct nf_conn, __nfct_init_offset[0]));

if (zone && nf_ct_zone_add(ct, GFP_ATOMIC, zone) < 0)
goto out_free;
nf_ct_zone_add(ct, zone);

/* Because we use RCU lookups, we set ct_general.use to zero before
* this is inserted in any list.
*/
atomic_set(&ct->ct_general.use, 0);
return ct;
out_free:
kmem_cache_free(nf_conntrack_cachep, ct);
out:
atomic_dec(&net->ct.count);
return ERR_PTR(-ENOMEM);
Expand Down Expand Up @@ -1342,14 +1333,6 @@ bool __nf_ct_kill_acct(struct nf_conn *ct,
}
EXPORT_SYMBOL_GPL(__nf_ct_kill_acct);

#ifdef CONFIG_NF_CONNTRACK_ZONES
static struct nf_ct_ext_type nf_ct_zone_extend __read_mostly = {
.len = sizeof(struct nf_conntrack_zone),
.align = __alignof__(struct nf_conntrack_zone),
.id = NF_CT_EXT_ZONE,
};
#endif

#if IS_ENABLED(CONFIG_NF_CT_NETLINK)

#include <linux/netfilter/nfnetlink.h>
Expand Down Expand Up @@ -1532,9 +1515,6 @@ void nf_conntrack_cleanup_end(void)

nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_htable_size);

#ifdef CONFIG_NF_CONNTRACK_ZONES
nf_ct_extend_unregister(&nf_ct_zone_extend);
#endif
nf_conntrack_proto_fini();
nf_conntrack_seqadj_fini();
nf_conntrack_labels_fini();
Expand Down Expand Up @@ -1771,11 +1751,6 @@ int nf_conntrack_init_start(void)
if (ret < 0)
goto err_seqadj;

#ifdef CONFIG_NF_CONNTRACK_ZONES
ret = nf_ct_extend_register(&nf_ct_zone_extend);
if (ret < 0)
goto err_extend;
#endif
ret = nf_conntrack_proto_init();
if (ret < 0)
goto err_proto;
Expand All @@ -1791,10 +1766,6 @@ int nf_conntrack_init_start(void)
return 0;

err_proto:
#ifdef CONFIG_NF_CONNTRACK_ZONES
nf_ct_extend_unregister(&nf_ct_zone_extend);
err_extend:
#endif
nf_conntrack_seqadj_fini();
err_seqadj:
nf_conntrack_labels_fini();
Expand Down

0 comments on commit 6c8dee9

Please sign in to comment.