leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nf_tables: make sets built-in

Browse Source 
Placing nftables set support in an extra module is pointless:

1. nf_tables needs dynamic registeration interface for sake of one module
2. nft heavily relies on sets, e.g. even simple rule like
   "nft ... tcp dport { 80, 443 }" will not work with _SETS=n.

IOW, either nftables isn't used or both nf_tables and nf_tables_set
modules are needed anyway.

With extra module:
 307K net/netfilter/nf_tables.ko
  79K net/netfilter/nf_tables_set.ko

   text  data  bss     dec filename
 146416  3072  545  150033 nf_tables.ko
  35496  1817    0   37313 nf_tables_set.ko

This patch:
 373K net/netfilter/nf_tables.ko

 178563  4049  545  183157 nf_tables.ko

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2020-02-18 11:59:26 +01:00 committed by Pablo Neira Ayuso
parent 925d844696
commit e32a4dc651
5 changed files with 15 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/net/netfilter/nf_tables.h
View File

@ -397,9 +397,6 @@ struct nft_set_type {
}; };
#define to_set_type(o) container_of(o, struct nft_set_type, ops) #define to_set_type(o) container_of(o, struct nft_set_type, ops)
int nft_register_set(struct nft_set_type *type);
void nft_unregister_set(struct nft_set_type *type);
/** /**
* struct nft_set - nf_tables set instance * struct nft_set - nf_tables set instance
* *
@ -1253,9 +1250,6 @@ void nft_trace_notify(struct nft_traceinfo *info);
#define MODULE_ALIAS_NFT_EXPR(name) \ #define MODULE_ALIAS_NFT_EXPR(name) \
MODULE_ALIAS("nft-expr-" name) MODULE_ALIAS("nft-expr-" name)
#define MODULE_ALIAS_NFT_SET() \
MODULE_ALIAS("nft-set")
#define MODULE_ALIAS_NFT_OBJ(type) \ #define MODULE_ALIAS_NFT_OBJ(type) \
MODULE_ALIAS("nft-obj-" __stringify(type)) MODULE_ALIAS("nft-obj-" __stringify(type))

8
net/netfilter/Kconfig
View File

@ -455,14 +455,6 @@ config NF_TABLES
To compile it as a module, choose M here. To compile it as a module, choose M here.
if NF_TABLES if NF_TABLES
config NF_TABLES_SET
tristate "Netfilter nf_tables set infrastructure"
help
This option enables the nf_tables set infrastructure that allows to
look up for elements in a set and to build one-way mappings between
matchings and actions.
config NF_TABLES_INET config NF_TABLES_INET
depends on IPV6 depends on IPV6
select NF_TABLES_IPV4 select NF_TABLES_IPV4

9
net/netfilter/Makefile
View File

@ -78,14 +78,11 @@ nf_tables-objs := nf_tables_core.o nf_tables_api.o nft_chain_filter.o \
nf_tables_trace.o nft_immediate.o nft_cmp.o nft_range.o \ nf_tables_trace.o nft_immediate.o nft_cmp.o nft_range.o \
nft_bitwise.o nft_byteorder.o nft_payload.o nft_lookup.o \ nft_bitwise.o nft_byteorder.o nft_payload.o nft_lookup.o \
nft_dynset.o nft_meta.o nft_rt.o nft_exthdr.o \ nft_dynset.o nft_meta.o nft_rt.o nft_exthdr.o \
nft_chain_route.o nf_tables_offload.o nft_chain_route.o nf_tables_offload.o \
nft_set_hash.o nft_set_bitmap.o nft_set_rbtree.o \
nf_tables_set-objs := nf_tables_set_core.o \ nft_set_pipapo.o
nft_set_hash.o nft_set_bitmap.o nft_set_rbtree.o \
nft_set_pipapo.o
obj-$(CONFIG_NF_TABLES) += nf_tables.o obj-$(CONFIG_NF_TABLES) += nf_tables.o
obj-$(CONFIG_NF_TABLES_SET) += nf_tables_set.o
obj-$(CONFIG_NFT_COMPAT) += nft_compat.o obj-$(CONFIG_NFT_COMPAT) += nft_compat.o
obj-$(CONFIG_NFT_CONNLIMIT) += nft_connlimit.o obj-$(CONFIG_NFT_CONNLIMIT) += nft_connlimit.o
obj-$(CONFIG_NFT_NUMGEN) += nft_numgen.o obj-$(CONFIG_NFT_NUMGEN) += nft_numgen.o

41
net/netfilter/nf_tables_api.c
View File

@ -3266,25 +3266,14 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,
/* /*
* Sets * Sets
*/ */
static const struct nft_set_type *nft_set_types[] = {
static LIST_HEAD(nf_tables_set_types); &nft_set_hash_fast_type,
&nft_set_hash_type,
int nft_register_set(struct nft_set_type *type) &nft_set_rhash_type,
{ &nft_set_bitmap_type,
nfnl_lock(NFNL_SUBSYS_NFTABLES); &nft_set_rbtree_type,
list_add_tail_rcu(&type->list, &nf_tables_set_types); &nft_set_pipapo_type,
nfnl_unlock(NFNL_SUBSYS_NFTABLES); };
return 0;
}
EXPORT_SYMBOL_GPL(nft_register_set);
void nft_unregister_set(struct nft_set_type *type)
{
nfnl_lock(NFNL_SUBSYS_NFTABLES);
list_del_rcu(&type->list);
nfnl_unlock(NFNL_SUBSYS_NFTABLES);
}
EXPORT_SYMBOL_GPL(nft_unregister_set);
#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
NFT_SET_TIMEOUT | NFT_SET_OBJECT | \ NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
@ -3310,15 +3299,11 @@ nft_select_set_ops(const struct nft_ctx *ctx,
struct nft_set_estimate est, best; struct nft_set_estimate est, best;
const struct nft_set_type *type; const struct nft_set_type *type;
u32 flags = 0; u32 flags = 0;
int i;
lockdep_assert_held(&ctx->net->nft.commit_mutex); lockdep_assert_held(&ctx->net->nft.commit_mutex);
lockdep_nfnl_nft_mutex_not_held(); lockdep_nfnl_nft_mutex_not_held();
#ifdef CONFIG_MODULES
if (list_empty(&nf_tables_set_types)) {
if (nft_request_module(ctx->net, "nft-set") == -EAGAIN)
return ERR_PTR(-EAGAIN);
}
#endif
if (nla[NFTA_SET_FLAGS] != NULL) if (nla[NFTA_SET_FLAGS] != NULL)
flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
@ -3327,7 +3312,8 @@ nft_select_set_ops(const struct nft_ctx *ctx,
best.lookup = ~0; best.lookup = ~0;
best.space = ~0; best.space = ~0;
list_for_each_entry(type, &nf_tables_set_types, list) { for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) {
type = nft_set_types[i];
ops = &type->ops; ops = &type->ops;
if (!nft_set_ops_candidate(type, flags)) if (!nft_set_ops_candidate(type, flags))
@ -4312,7 +4298,6 @@ const struct nft_set_ext_type nft_set_ext_types[] = {
.align = __alignof__(u32), .align = __alignof__(u32),
}, },
}; };
EXPORT_SYMBOL_GPL(nft_set_ext_types);
/* /*
* Set elements * Set elements
@ -5365,7 +5350,6 @@ void nft_set_gc_batch_release(struct rcu_head *rcu)
nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true); nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
kfree(gcb); kfree(gcb);
} }
EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set, struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
gfp_t gfp) gfp_t gfp)
@ -5378,7 +5362,6 @@ struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
gcb->head.set = set; gcb->head.set = set;
return gcb; return gcb;
} }
EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
/* /*
* Stateful objects * Stateful objects

31
net/netfilter/nf_tables_set_core.c
View File

@ -1,31 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0 */
#include <linux/module.h>
#include <net/netfilter/nf_tables_core.h>
static int __init nf_tables_set_module_init(void)
{
nft_register_set(&nft_set_hash_fast_type);
nft_register_set(&nft_set_hash_type);
nft_register_set(&nft_set_rhash_type);
nft_register_set(&nft_set_bitmap_type);
nft_register_set(&nft_set_rbtree_type);
nft_register_set(&nft_set_pipapo_type);
return 0;
}
static void __exit nf_tables_set_module_exit(void)
{
nft_unregister_set(&nft_set_pipapo_type);
nft_unregister_set(&nft_set_rbtree_type);
nft_unregister_set(&nft_set_bitmap_type);
nft_unregister_set(&nft_set_rhash_type);
nft_unregister_set(&nft_set_hash_type);
nft_unregister_set(&nft_set_hash_fast_type);
}
module_init(nf_tables_set_module_init);
module_exit(nf_tables_set_module_exit);
MODULE_LICENSE("GPL");
MODULE_ALIAS_NFT_SET();