leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nft_socket: track register operations

Browse Source 
Check if the destination register already contains the data that this
socket expression performs. This allows to skip this redundant
operation.  If the destination contains a different selector, update the
register tracking information.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2022-03-14 18:23:09 +01:00
parent 71ef842d73
commit d77a721d21
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
net/netfilter/nft_socket.c
View File

@ -10,6 +10,7 @@
struct nft_socket { struct nft_socket {
enum nft_socket_keys key:8; enum nft_socket_keys key:8;
u8 level; u8 level;
u8 len;
union { union {
u8 dreg; u8 dreg;
}; };
@ -179,6 +180,7 @@ static int nft_socket_init(const struct nft_ctx *ctx,
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
priv->len = len;
return nft_parse_register_store(ctx, tb[NFTA_SOCKET_DREG], &priv->dreg, return nft_parse_register_store(ctx, tb[NFTA_SOCKET_DREG], &priv->dreg,
NULL, NFT_DATA_VALUE, len); NULL, NFT_DATA_VALUE, len);
} }
@ -198,6 +200,31 @@ static int nft_socket_dump(struct sk_buff *skb,
return 0; return 0;
} }
static bool nft_socket_reduce(struct nft_regs_track *track,
const struct nft_expr *expr)
{
const struct nft_socket *priv = nft_expr_priv(expr);
const struct nft_socket *socket;
if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
nft_reg_track_update(track, expr, priv->dreg, priv->len);
return false;
}
socket = nft_expr_priv(track->regs[priv->dreg].selector);
if (priv->key != socket->key ||
priv->dreg != socket->dreg ||
priv->level != socket->level) {
nft_reg_track_update(track, expr, priv->dreg, priv->len);
return false;
}
if (!track->regs[priv->dreg].bitwise)
return true;
return nft_expr_reduce_bitwise(track, expr);
}
static struct nft_expr_type nft_socket_type; static struct nft_expr_type nft_socket_type;
static const struct nft_expr_ops nft_socket_ops = { static const struct nft_expr_ops nft_socket_ops = {
.type = &nft_socket_type, .type = &nft_socket_type,
@ -205,6 +232,7 @@ static const struct nft_expr_ops nft_socket_ops = {
.eval = nft_socket_eval, .eval = nft_socket_eval,
.init = nft_socket_init, .init = nft_socket_init,
.dump = nft_socket_dump, .dump = nft_socket_dump,
.reduce = nft_socket_reduce,
}; };
static struct nft_expr_type nft_socket_type __read_mostly = { static struct nft_expr_type nft_socket_type __read_mostly = {