* [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list()
@ 2019-10-10 22:30 Florian Westphal
2019-10-10 22:41 ` Edward Cree
2019-10-17 10:20 ` Pablo Neira Ayuso
0 siblings, 2 replies; 6+ messages in thread
From: Florian Westphal @ 2019-10-10 22:30 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal, Edward Cree
At this time, NF_HOOK_LIST() macro will iterate the list and then calls
nf_hook() for each individual skb.
This makes it so the entire list is passed into the netfilter core.
The advantage is that we only need to fetch the rule blob once per list
instead of per-skb.
NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only
callers.
v2: use skb_list_del_init() instead of list_del (Edward Cree)
Cc: Edward Cree <ecree@solarflare.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
include/linux/netfilter.h | 41 +++++++++++++++++++++++++++++----------
net/netfilter/core.c | 20 +++++++++++++++++++
2 files changed, 51 insertions(+), 10 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 77ebb61faf48..eb312e7ca36e 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -199,6 +199,8 @@ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
const struct nf_hook_entries *e, unsigned int i);
+void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,
+ const struct nf_hook_entries *e);
/**
* nf_hook - call a netfilter hook
*
@@ -311,17 +313,36 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
struct list_head *head, struct net_device *in, struct net_device *out,
int (*okfn)(struct net *, struct sock *, struct sk_buff *))
{
- struct sk_buff *skb, *next;
- struct list_head sublist;
-
- INIT_LIST_HEAD(&sublist);
- list_for_each_entry_safe(skb, next, head, list) {
- list_del(&skb->list);
- if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)
- list_add_tail(&skb->list, &sublist);
+ struct nf_hook_entries *hook_head = NULL;
+
+#ifdef CONFIG_JUMP_LABEL
+ if (__builtin_constant_p(pf) &&
+ __builtin_constant_p(hook) &&
+ !static_key_false(&nf_hooks_needed[pf][hook]))
+ return;
+#endif
+
+ rcu_read_lock();
+ switch (pf) {
+ case NFPROTO_IPV4:
+ hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
+ break;
+ case NFPROTO_IPV6:
+ hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
+ break;
+ default:
+ WARN_ON_ONCE(1);
+ break;
}
- /* Put passed packets back on main list */
- list_splice(&sublist, head);
+
+ if (hook_head) {
+ struct nf_hook_state state;
+
+ nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn);
+
+ nf_hook_slow_list(head, &state, hook_head);
+ }
+ rcu_read_unlock();
}
/* Call setsockopt() */
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 5d5bdf450091..78f046ec506f 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -536,6 +536,26 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
}
EXPORT_SYMBOL(nf_hook_slow);
+void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,
+ const struct nf_hook_entries *e)
+{
+ struct sk_buff *skb, *next;
+ struct list_head sublist;
+ int ret;
+
+ INIT_LIST_HEAD(&sublist);
+
+ list_for_each_entry_safe(skb, next, head, list) {
+ skb_list_del_init(skb);
+ ret = nf_hook_slow(skb, state, e, 0);
+ if (ret == 1)
+ list_add_tail(&skb->list, &sublist);
+ }
+ /* Put passed packets back on main list */
+ list_splice(&sublist, head);
+}
+EXPORT_SYMBOL(nf_hook_slow_list);
+
/* This needs to be compiled in any case to avoid dependencies between the
* nfnetlink_queue code and nf_conntrack.
*/
--
2.21.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list()
2019-10-10 22:30 [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list() Florian Westphal
@ 2019-10-10 22:41 ` Edward Cree
2019-10-10 22:54 ` Florian Westphal
2019-10-17 10:20 ` Pablo Neira Ayuso
1 sibling, 1 reply; 6+ messages in thread
From: Edward Cree @ 2019-10-10 22:41 UTC (permalink / raw)
To: Florian Westphal, netfilter-devel
On 10/10/2019 23:30, Florian Westphal wrote:
> NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only
> callers.
...
> +
> + rcu_read_lock();
> + switch (pf) {
> + case NFPROTO_IPV4:
> + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
> + break;
> + case NFPROTO_IPV6:
> + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
> + break;
> + default:
> + WARN_ON_ONCE(1);
> + break;
> }
Would it not make sense instead to abstract out the switch in nf_hook()
into, say, an inline function that could be called from here? That
would satisfy SPOT and also save updating this code if new callers of
NF_HOOK_LIST are added in the future.
(Sorry I didn't spot this the first time around; I don't know the NF
code all that well.)
-Ed
The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error, please notify the sender immediately and delete the message. Unless you are an addressee (or authorized to receive for an addressee), you may not use, copy or disclose to anyone this message or any information contained in this message. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list()
2019-10-10 22:41 ` Edward Cree
@ 2019-10-10 22:54 ` Florian Westphal
2019-10-14 11:02 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Florian Westphal @ 2019-10-10 22:54 UTC (permalink / raw)
To: Edward Cree; +Cc: Florian Westphal, netfilter-devel
Edward Cree <ecree@solarflare.com> wrote:
> On 10/10/2019 23:30, Florian Westphal wrote:
> > NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only
> > callers.
> ...
> > +
> > + rcu_read_lock();
> > + switch (pf) {
> > + case NFPROTO_IPV4:
> > + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
> > + break;
> > + case NFPROTO_IPV6:
> > + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
> > + break;
> > + default:
> > + WARN_ON_ONCE(1);
> > + break;
> > }
> Would it not make sense instead to abstract out the switch in nf_hook()
> into, say, an inline function that could be called from here? That
> would satisfy SPOT and also save updating this code if new callers of
> NF_HOOK_LIST are added in the future.
Its a matter of taste I guess. I don't really like having all these
inline wrappers for wrappers wrapped in wrappers.
Pablo, its up to you. I could add __nf_hook_get_hook_head() or similar
and use that instead of open-coding.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list()
2019-10-10 22:54 ` Florian Westphal
@ 2019-10-14 11:02 ` Pablo Neira Ayuso
2019-10-14 13:56 ` Edward Cree
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-10-14 11:02 UTC (permalink / raw)
To: Florian Westphal; +Cc: Edward Cree, netfilter-devel
On Fri, Oct 11, 2019 at 12:54:33AM +0200, Florian Westphal wrote:
> Edward Cree <ecree@solarflare.com> wrote:
> > On 10/10/2019 23:30, Florian Westphal wrote:
> > > NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only
> > > callers.
> > ...
> > > +
> > > + rcu_read_lock();
> > > + switch (pf) {
> > > + case NFPROTO_IPV4:
> > > + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
> > > + break;
> > > + case NFPROTO_IPV6:
> > > + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
> > > + break;
> > > + default:
> > > + WARN_ON_ONCE(1);
> > > + break;
> > > }
> > Would it not make sense instead to abstract out the switch in nf_hook()
> > into, say, an inline function that could be called from here? That
> > would satisfy SPOT and also save updating this code if new callers of
> > NF_HOOK_LIST are added in the future.
>
> Its a matter of taste I guess. I don't really like having all these
> inline wrappers for wrappers wrapped in wrappers.
>
> Pablo, its up to you. I could add __nf_hook_get_hook_head() or similar
> and use that instead of open-coding.
I'm fine with your approach, Florian. If new callers are added, this
can be done later on.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list()
2019-10-14 11:02 ` Pablo Neira Ayuso
@ 2019-10-14 13:56 ` Edward Cree
0 siblings, 0 replies; 6+ messages in thread
From: Edward Cree @ 2019-10-14 13:56 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal; +Cc: netfilter-devel
On 14/10/2019 12:02, Pablo Neira Ayuso wrote:
> On Fri, Oct 11, 2019 at 12:54:33AM +0200, Florian Westphal wrote:
>> Edward Cree <ecree@solarflare.com> wrote:
>>> On 10/10/2019 23:30, Florian Westphal wrote:
>>>> NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only
>>>> callers.
>>> ...
>>>> +
>>>> + rcu_read_lock();
>>>> + switch (pf) {
>>>> + case NFPROTO_IPV4:
>>>> + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
>>>> + break;
>>>> + case NFPROTO_IPV6:
>>>> + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
>>>> + break;
>>>> + default:
>>>> + WARN_ON_ONCE(1);
>>>> + break;
>>>> }
>>> Would it not make sense instead to abstract out the switch in nf_hook()
>>> into, say, an inline function that could be called from here? That
>>> would satisfy SPOT and also save updating this code if new callers of
>>> NF_HOOK_LIST are added in the future.
>> Its a matter of taste I guess. I don't really like having all these
>> inline wrappers for wrappers wrapped in wrappers.
>>
>> Pablo, its up to you. I could add __nf_hook_get_hook_head() or similar
>> and use that instead of open-coding.
> I'm fine with your approach, Florian. If new callers are added, this
> can be done later on.
Fine, in that case feel free to add my
Acked-by: Edward Cree <ecree@solarflare.com>
The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error, please notify the sender immediately and delete the message. Unless you are an addressee (or authorized to receive for an addressee), you may not use, copy or disclose to anyone this message or any information contained in this message. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list()
2019-10-10 22:30 [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list() Florian Westphal
2019-10-10 22:41 ` Edward Cree
@ 2019-10-17 10:20 ` Pablo Neira Ayuso
1 sibling, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-10-17 10:20 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel, Edward Cree
On Fri, Oct 11, 2019 at 12:30:37AM +0200, Florian Westphal wrote:
> At this time, NF_HOOK_LIST() macro will iterate the list and then calls
> nf_hook() for each individual skb.
>
> This makes it so the entire list is passed into the netfilter core.
> The advantage is that we only need to fetch the rule blob once per list
> instead of per-skb.
>
> NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only
> callers.
>
> v2: use skb_list_del_init() instead of list_del (Edward Cree)
>
> Cc: Edward Cree <ecree@solarflare.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-10-17 10:20 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-10 22:30 [PATCH v2 nf-next] netfilter: add and use nf_hook_slow_list() Florian Westphal
2019-10-10 22:41 ` Edward Cree
2019-10-10 22:54 ` Florian Westphal
2019-10-14 11:02 ` Pablo Neira Ayuso
2019-10-14 13:56 ` Edward Cree
2019-10-17 10:20 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).