You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
201 lines
6.0 KiB
Diff
201 lines
6.0 KiB
Diff
From b0f38338aef2dae5ade3c16acf713737e3b15a73 Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fw@strlen.de>
|
|
Date: Sun, 3 Dec 2017 00:58:47 +0100
|
|
Subject: [PATCH 05/11] netfilter: reduce size of hook entry point locations
|
|
|
|
struct net contains:
|
|
|
|
struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
|
|
|
|
which store the hook entry point locations for the various protocol
|
|
families and the hooks.
|
|
|
|
Using array results in compact c code when doing accesses, i.e.
|
|
x = rcu_dereference(net->nf.hooks[pf][hook]);
|
|
|
|
but its also wasting a lot of memory, as most families are
|
|
not used.
|
|
|
|
So split the array into those families that are used, which
|
|
are only 5 (instead of 13). In most cases, the 'pf' argument is
|
|
constant, i.e. gcc removes switch statement.
|
|
|
|
struct net before:
|
|
/* size: 5184, cachelines: 81, members: 46 */
|
|
after:
|
|
/* size: 4672, cachelines: 73, members: 46 */
|
|
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
---
|
|
include/linux/netfilter.h | 24 ++++++++++++++++++++++--
|
|
include/net/netns/netfilter.h | 6 +++++-
|
|
net/bridge/br_netfilter_hooks.c | 2 +-
|
|
net/netfilter/core.c | 38 ++++++++++++++++++++++++++++++--------
|
|
net/netfilter/nf_queue.c | 21 +++++++++++++++++++--
|
|
5 files changed, 77 insertions(+), 14 deletions(-)
|
|
|
|
--- a/include/linux/netfilter.h
|
|
+++ b/include/linux/netfilter.h
|
|
@@ -195,7 +195,7 @@ static inline int nf_hook(u_int8_t pf, u
|
|
struct net_device *indev, struct net_device *outdev,
|
|
int (*okfn)(struct net *, struct sock *, struct sk_buff *))
|
|
{
|
|
- struct nf_hook_entries *hook_head;
|
|
+ struct nf_hook_entries *hook_head = NULL;
|
|
int ret = 1;
|
|
|
|
#ifdef HAVE_JUMP_LABEL
|
|
@@ -206,7 +206,27 @@ static inline int nf_hook(u_int8_t pf, u
|
|
#endif
|
|
|
|
rcu_read_lock();
|
|
- hook_head = rcu_dereference(net->nf.hooks[pf][hook]);
|
|
+ switch (pf) {
|
|
+ case NFPROTO_IPV4:
|
|
+ hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
|
|
+ break;
|
|
+ case NFPROTO_IPV6:
|
|
+ hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
|
|
+ break;
|
|
+ case NFPROTO_ARP:
|
|
+ hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
|
|
+ break;
|
|
+ case NFPROTO_BRIDGE:
|
|
+ hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
|
|
+ break;
|
|
+ case NFPROTO_DECNET:
|
|
+ hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
|
|
+ break;
|
|
+ default:
|
|
+ WARN_ON_ONCE(1);
|
|
+ break;
|
|
+ }
|
|
+
|
|
if (hook_head) {
|
|
struct nf_hook_state state;
|
|
|
|
--- a/include/net/netns/netfilter.h
|
|
+++ b/include/net/netns/netfilter.h
|
|
@@ -17,7 +17,11 @@ struct netns_nf {
|
|
#ifdef CONFIG_SYSCTL
|
|
struct ctl_table_header *nf_log_dir_header;
|
|
#endif
|
|
- struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
|
|
+ struct nf_hook_entries __rcu *hooks_ipv4[NF_MAX_HOOKS];
|
|
+ struct nf_hook_entries __rcu *hooks_ipv6[NF_MAX_HOOKS];
|
|
+ struct nf_hook_entries __rcu *hooks_arp[NF_MAX_HOOKS];
|
|
+ struct nf_hook_entries __rcu *hooks_bridge[NF_MAX_HOOKS];
|
|
+ struct nf_hook_entries __rcu *hooks_decnet[NF_MAX_HOOKS];
|
|
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
|
|
bool defrag_ipv4;
|
|
#endif
|
|
--- a/net/bridge/br_netfilter_hooks.c
|
|
+++ b/net/bridge/br_netfilter_hooks.c
|
|
@@ -992,7 +992,7 @@ int br_nf_hook_thresh(unsigned int hook,
|
|
unsigned int i;
|
|
int ret;
|
|
|
|
- e = rcu_dereference(net->nf.hooks[NFPROTO_BRIDGE][hook]);
|
|
+ e = rcu_dereference(net->nf.hooks_bridge[hook]);
|
|
if (!e)
|
|
return okfn(net, sk, skb);
|
|
|
|
--- a/net/netfilter/core.c
|
|
+++ b/net/netfilter/core.c
|
|
@@ -264,8 +264,23 @@ out_assign:
|
|
|
|
static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg)
|
|
{
|
|
- if (reg->pf != NFPROTO_NETDEV)
|
|
- return net->nf.hooks[reg->pf]+reg->hooknum;
|
|
+ switch (reg->pf) {
|
|
+ case NFPROTO_NETDEV:
|
|
+ break;
|
|
+ case NFPROTO_ARP:
|
|
+ return net->nf.hooks_arp + reg->hooknum;
|
|
+ case NFPROTO_BRIDGE:
|
|
+ return net->nf.hooks_bridge + reg->hooknum;
|
|
+ case NFPROTO_IPV4:
|
|
+ return net->nf.hooks_ipv4 + reg->hooknum;
|
|
+ case NFPROTO_IPV6:
|
|
+ return net->nf.hooks_ipv6 + reg->hooknum;
|
|
+ case NFPROTO_DECNET:
|
|
+ return net->nf.hooks_decnet + reg->hooknum;
|
|
+ default:
|
|
+ WARN_ON_ONCE(1);
|
|
+ return NULL;
|
|
+ }
|
|
|
|
#ifdef CONFIG_NETFILTER_INGRESS
|
|
if (reg->hooknum == NF_NETDEV_INGRESS) {
|
|
@@ -534,14 +549,21 @@ void (*nf_nat_decode_session_hook)(struc
|
|
EXPORT_SYMBOL(nf_nat_decode_session_hook);
|
|
#endif
|
|
|
|
-static int __net_init netfilter_net_init(struct net *net)
|
|
+static void __net_init __netfilter_net_init(struct nf_hook_entries *e[NF_MAX_HOOKS])
|
|
{
|
|
- int i, h;
|
|
+ int h;
|
|
|
|
- for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
|
|
- for (h = 0; h < NF_MAX_HOOKS; h++)
|
|
- RCU_INIT_POINTER(net->nf.hooks[i][h], NULL);
|
|
- }
|
|
+ for (h = 0; h < NF_MAX_HOOKS; h++)
|
|
+ RCU_INIT_POINTER(e[h], NULL);
|
|
+}
|
|
+
|
|
+static int __net_init netfilter_net_init(struct net *net)
|
|
+{
|
|
+ __netfilter_net_init(net->nf.hooks_ipv4);
|
|
+ __netfilter_net_init(net->nf.hooks_ipv6);
|
|
+ __netfilter_net_init(net->nf.hooks_arp);
|
|
+ __netfilter_net_init(net->nf.hooks_bridge);
|
|
+ __netfilter_net_init(net->nf.hooks_decnet);
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
|
|
--- a/net/netfilter/nf_queue.c
|
|
+++ b/net/netfilter/nf_queue.c
|
|
@@ -201,6 +201,23 @@ repeat:
|
|
return NF_ACCEPT;
|
|
}
|
|
|
|
+static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
|
|
+{
|
|
+ switch (pf) {
|
|
+ case NFPROTO_BRIDGE:
|
|
+ return rcu_dereference(net->nf.hooks_bridge[hooknum]);
|
|
+ case NFPROTO_IPV4:
|
|
+ return rcu_dereference(net->nf.hooks_ipv4[hooknum]);
|
|
+ case NFPROTO_IPV6:
|
|
+ return rcu_dereference(net->nf.hooks_ipv6[hooknum]);
|
|
+ default:
|
|
+ WARN_ON_ONCE(1);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
/* Caller must hold rcu read-side lock */
|
|
void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
|
|
{
|
|
@@ -216,12 +233,12 @@ void nf_reinject(struct nf_queue_entry *
|
|
net = entry->state.net;
|
|
pf = entry->state.pf;
|
|
|
|
- hooks = rcu_dereference(net->nf.hooks[pf][entry->state.hook]);
|
|
+ hooks = nf_hook_entries_head(net, pf, entry->state.hook);
|
|
|
|
nf_queue_entry_release_refs(entry);
|
|
|
|
i = entry->hook_index;
|
|
- if (WARN_ON_ONCE(i >= hooks->num_hook_entries)) {
|
|
+ if (WARN_ON_ONCE(!hooks || i >= hooks->num_hook_entries)) {
|
|
kfree_skb(skb);
|
|
kfree(entry);
|
|
return;
|