Commit ca58fbe0 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: add and use nf_hook_slow_list() 



At this time, NF_HOOK_LIST() macro will iterate the list and then calls
nf_hook() for each individual skb.

This makes it so the entire list is passed into the netfilter core.
The advantage is that we only need to fetch the rule blob once per list
instead of per-skb.

NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only
callers.

v2: use skb_list_del_init() instead of list_del (Edward Cree)

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Acked-by: default avatarEdward Cree <ecree@solarflare.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2ad9d774

include/linux/netfilter.h

+31 −10
Original line number Diff line number Diff line
@@ -199,6 +199,8 @@ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 
int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,

		 const struct nf_hook_entries *e, unsigned int i);



void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,

		       const struct nf_hook_entries *e);

/**

 *	nf_hook - call a netfilter hook

 *
@@ -311,17 +313,36 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, 
	     struct list_head *head, struct net_device *in, struct net_device *out,

	     int (*okfn)(struct net *, struct sock *, struct sk_buff *))

{

	struct sk_buff *skb, *next;

	struct list_head sublist;



	INIT_LIST_HEAD(&sublist);

	list_for_each_entry_safe(skb, next, head, list) {

		list_del(&skb->list);

		if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)

			list_add_tail(&skb->list, &sublist);

	struct nf_hook_entries *hook_head = NULL;



#ifdef CONFIG_JUMP_LABEL

	if (__builtin_constant_p(pf) &&

	    __builtin_constant_p(hook) &&

	    !static_key_false(&nf_hooks_needed[pf][hook]))

		return;

#endif



	rcu_read_lock();

	switch (pf) {

	case NFPROTO_IPV4:

		hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);

		break;

	case NFPROTO_IPV6:

		hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);

		break;

	default:

		WARN_ON_ONCE(1);

		break;

	}

	/* Put passed packets back on main list */

	list_splice(&sublist, head);



	if (hook_head) {

		struct nf_hook_state state;



		nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn);



		nf_hook_slow_list(head, &state, hook_head);

	}

	rcu_read_unlock();

}



/* Call setsockopt() */

net/netfilter/core.c

+20 −0
Original line number Diff line number Diff line
@@ -536,6 +536,26 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, 
}

EXPORT_SYMBOL(nf_hook_slow);



void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,

		       const struct nf_hook_entries *e)

{

	struct sk_buff *skb, *next;

	struct list_head sublist;

	int ret;



	INIT_LIST_HEAD(&sublist);



	list_for_each_entry_safe(skb, next, head, list) {

		skb_list_del_init(skb);

		ret = nf_hook_slow(skb, state, e, 0);

		if (ret == 1)

			list_add_tail(&skb->list, &sublist);

	}

	/* Put passed packets back on main list */

	list_splice(&sublist, head);

}

EXPORT_SYMBOL(nf_hook_slow_list);



/* This needs to be compiled in any case to avoid dependencies between the

 * nfnetlink_queue code and nf_conntrack.

 */

CRA Git | Maintained and supported by SUSTech CRA and CCSE