iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: flowtable: simplify route logic

Browse Source 
[ Upstream commit fa502c86566680ac62bc28ec883a069bf7a2aa5e ]

Grab reference to dst from skbuff earlier to simplify route caching.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 9e0f0430389b ("netfilter: nft_flow_offload: reset dst in route object after setting up flow")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso 2023-05-11 07:35:33 +02:00 committed by Greg Kroah-Hartman
parent 664264a5c5
commit 7c71b83122
3 changed files with 14 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/net/netfilter/nf_flow_table.h
View File

@ -257,8 +257,8 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table,
up_write(&flow_table->flow_block_lock); up_write(&flow_table->flow_block_lock);
} }
int flow_offload_route_init(struct flow_offload *flow, void flow_offload_route_init(struct flow_offload *flow,
const struct nf_flow_route *route); const struct nf_flow_route *route);
int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
void flow_offload_refresh(struct nf_flowtable *flow_table, void flow_offload_refresh(struct nf_flowtable *flow_table,

24
net/netfilter/nf_flow_table_core.c
View File

@ -124,9 +124,6 @@ static int flow_offload_fill_route(struct flow_offload *flow,
break; break;
case FLOW_OFFLOAD_XMIT_XFRM: case FLOW_OFFLOAD_XMIT_XFRM:
case FLOW_OFFLOAD_XMIT_NEIGH: case FLOW_OFFLOAD_XMIT_NEIGH:
if (!dst_hold_safe(route->tuple[dir].dst))
return -1;
flow_tuple->dst_cache = dst; flow_tuple->dst_cache = dst;
flow_tuple->dst_cookie = flow_offload_dst_cookie(flow_tuple); flow_tuple->dst_cookie = flow_offload_dst_cookie(flow_tuple);
break; break;
@ -147,27 +144,12 @@ static void nft_flow_dst_release(struct flow_offload *flow,
dst_release(flow->tuplehash[dir].tuple.dst_cache); dst_release(flow->tuplehash[dir].tuple.dst_cache);
} }
int flow_offload_route_init(struct flow_offload *flow, void flow_offload_route_init(struct flow_offload *flow,
const struct nf_flow_route *route) const struct nf_flow_route *route)
{ {
int err; flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);
flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);
err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);
if (err < 0)
return err;
err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);
if (err < 0)
goto err_route_reply;
flow->type = NF_FLOW_OFFLOAD_ROUTE; flow->type = NF_FLOW_OFFLOAD_ROUTE;
return 0;
err_route_reply:
nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
return err;
} }
EXPORT_SYMBOL_GPL(flow_offload_route_init); EXPORT_SYMBOL_GPL(flow_offload_route_init);

14
net/netfilter/nft_flow_offload.c
View File

@ -240,10 +240,15 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
break; break;
} }
nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt)); if (!dst_hold_safe(this_dst))
if (!other_dst)
return -ENOENT; return -ENOENT;
nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt));
if (!other_dst) {
dst_release(this_dst);
return -ENOENT;
}
nft_default_forward_path(route, this_dst, dir); nft_default_forward_path(route, this_dst, dir);
nft_default_forward_path(route, other_dst, !dir); nft_default_forward_path(route, other_dst, !dir);
@ -326,8 +331,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
if (!flow) if (!flow)
goto err_flow_alloc; goto err_flow_alloc;
if (flow_offload_route_init(flow, &route) < 0) flow_offload_route_init(flow, &route);
goto err_flow_add;
if (tcph) { if (tcph) {
ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
@ -338,12 +342,12 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
if (ret < 0) if (ret < 0)
goto err_flow_add; goto err_flow_add;
dst_release(route.tuple[!dir].dst);
return; return;
err_flow_add: err_flow_add:
flow_offload_free(flow); flow_offload_free(flow);
err_flow_alloc: err_flow_alloc:
dst_release(route.tuple[dir].dst);
dst_release(route.tuple[!dir].dst); dst_release(route.tuple[!dir].dst);
err_flow_route: err_flow_route:
clear_bit(IPS_OFFLOAD_BIT, &ct->status); clear_bit(IPS_OFFLOAD_BIT, &ct->status);