Commit 971502d7 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

bridge: netfilter: unroll NF_HOOK helper in bridge input path 



Replace NF_HOOK() based invocation of the netfilter hooks with a private
copy of nf_hook_slow().

This copy has one difference: it can return the rx handler value expected
by the stack, i.e. RX_HANDLER_CONSUMED or RX_HANDLER_PASS.

This is needed by the next patch to invoke the ebtables
"broute" table via the standard netfilter hooks rather than the custom
"br_should_route_hook" indirection that is used now.

When the skb is to be "brouted", we must return RX_HANDLER_PASS from the
bridge rx input handler, but there is no way to indicate this via
NF_HOOK(), unless perhaps by some hack such as exposing bridge_cb in the
netfilter core or a percpu flag.

  text    data     bss     dec   filename
  3369      56       0    3425   net/bridge/br_input.o.before
  3458      40       0    3498   net/bridge/br_input.o.after

This allows removal of the "br_should_route_hook" in the next patch.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f12064d1

include/net/netfilter/nf_queue.h

+3 −0
Original line number Diff line number Diff line
@@ -119,4 +119,7 @@ nfqueue_hash(const struct sk_buff *skb, u16 queue, u16 queues_total, u8 family, 
	return queue;

}



int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,

	     const struct nf_hook_entries *entries, unsigned int index,

	     unsigned int verdict);

#endif /* _NF_QUEUE_H */

net/bridge/br_input.c

+51 −4
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 
#include <linux/netdevice.h>

#include <linux/etherdevice.h>

#include <linux/netfilter_bridge.h>

#include <net/netfilter/nf_queue.h>

#include <linux/neighbour.h>

#include <net/arp.h>

#include <linux/export.h>
@@ -206,6 +207,55 @@ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_bu 
	return 0;

}



static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)

{

#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE

	struct nf_hook_entries *e = NULL;

	struct nf_hook_state state;

	unsigned int verdict, i;

	struct net *net;

	int ret;



	net = dev_net(skb->dev);

#ifdef HAVE_JUMP_LABEL

	if (!static_key_false(&nf_hooks_needed[NFPROTO_BRIDGE][NF_BR_PRE_ROUTING]))

		goto frame_finish;

#endif



	e = rcu_dereference(net->nf.hooks_bridge[NF_BR_PRE_ROUTING]);

	if (!e)

		goto frame_finish;



	nf_hook_state_init(&state, NF_BR_PRE_ROUTING,

			   NFPROTO_BRIDGE, skb->dev, NULL, NULL,

			   net, br_handle_frame_finish);



	for (i = 0; i < e->num_hook_entries; i++) {

		verdict = nf_hook_entry_hookfn(&e->hooks[i], skb, &state);

		switch (verdict & NF_VERDICT_MASK) {

		case NF_ACCEPT:

			break;

		case NF_DROP:

			kfree_skb(skb);

			return RX_HANDLER_CONSUMED;

		case NF_QUEUE:

			ret = nf_queue(skb, &state, e, i, verdict);

			if (ret == 1)

				continue;

			return RX_HANDLER_CONSUMED;

		default: /* STOLEN */

			return RX_HANDLER_CONSUMED;

		}

	}

frame_finish:

	net = dev_net(skb->dev);

	br_handle_frame_finish(net, NULL, skb);

#else

	br_handle_frame_finish(dev_net(skb->dev), NULL, skb);

#endif

	return RX_HANDLER_CONSUMED;

}



/*

 * Return NULL if skb is handled

 * note: already called with rcu_read_lock
@@ -304,10 +354,7 @@ forward: 
		if (ether_addr_equal(p->br->dev->dev_addr, dest))

			skb->pkt_type = PACKET_HOST;



		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,

			dev_net(skb->dev), NULL, skb, skb->dev, NULL,

			br_handle_frame_finish);

		break;

		return nf_hook_bridge_pre(skb, pskb);

	default:

drop:

		kfree_skb(skb);

net/netfilter/core.c

+1 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
#include <linux/mm.h>

#include <linux/rcupdate.h>

#include <net/net_namespace.h>

#include <net/netfilter/nf_queue.h>

#include <net/sock.h>



#include "nf_internals.h"

net/netfilter/nf_internals.h

+0 −3
Original line number Diff line number Diff line
@@ -7,9 +7,6 @@ 
#include <linux/netdevice.h>



/* nf_queue.c */

int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,

	     const struct nf_hook_entries *entries, unsigned int index,

	     unsigned int verdict);

void nf_queue_nf_hook_drop(struct net *net);



/* nf_log.c */

net/netfilter/nf_queue.c

+1 −0
Original line number Diff line number Diff line
@@ -240,6 +240,7 @@ int nf_queue(struct sk_buff *skb, struct nf_hook_state *state, 


	return 0;

}

EXPORT_SYMBOL_GPL(nf_queue);



static unsigned int nf_iterate(struct sk_buff *skb,

			       struct nf_hook_state *state,

CRA Git | Maintained and supported by SUSTech CRA and CCSE