netfilter: nft_ct: track register operations

Check if the destination register already contains the data that this ct
expression performs. This allows to skip this redundant operation. If
the destination contains a different selector, update the register
tracking information.

Export nft_expr_reduce_bitwise as a symbol since nft_ct might be
compiled as a module.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index dffda6612369d35f17513c11f4c4a4d73f44db48..38caa66632b4e4cc331392f20d0ece18bb16e627 100644 (file)
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -529,3 +529,4 @@ bool nft_expr_reduce_bitwise(struct nft_regs_track *track,
 
        return false;
 }
+EXPORT_SYMBOL_GPL(nft_expr_reduce_bitwise);

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 1ec9a7e96e59fcf062219d4eccd7942ba474bdc4..d8e1614918a13cfb2683b86c6c90622b641d4c69 100644 (file)
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -26,6 +26,7 @@
 struct nft_ct {
        enum nft_ct_keys        key:8;
        enum ip_conntrack_dir   dir:8;
+       u8                      len;
        union {
                u8              dreg;
                u8              sreg;
@@ -500,6 +501,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
                }
        }
 
+       priv->len = len;
        err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
                                       NFT_DATA_VALUE, len);
        if (err < 0)
@@ -608,6 +610,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
                }
        }
 
+       priv->len = len;
        err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
        if (err < 0)
                goto err1;
@@ -677,6 +680,29 @@ nla_put_failure:
        return -1;
 }
 
+static bool nft_ct_get_reduce(struct nft_regs_track *track,
+                             const struct nft_expr *expr)
+{
+       const struct nft_ct *priv = nft_expr_priv(expr);
+       const struct nft_ct *ct;
+
+       if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       ct = nft_expr_priv(track->regs[priv->dreg].selector);
+       if (priv->key != ct->key) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       if (!track->regs[priv->dreg].bitwise)
+               return true;
+
+       return nft_expr_reduce_bitwise(track, expr);
+}
+
 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
        const struct nft_ct *priv = nft_expr_priv(expr);
@@ -710,8 +736,27 @@ static const struct nft_expr_ops nft_ct_get_ops = {
        .init           = nft_ct_get_init,
        .destroy        = nft_ct_get_destroy,
        .dump           = nft_ct_get_dump,
+       .reduce         = nft_ct_get_reduce,
 };
 
+static bool nft_ct_set_reduce(struct nft_regs_track *track,
+                             const struct nft_expr *expr)
+{
+       int i;
+
+       for (i = 0; i < NFT_REG32_NUM; i++) {
+               if (!track->regs[i].selector)
+                       continue;
+
+               if (track->regs[i].selector->ops != &nft_ct_get_ops)
+                       continue;
+
+               __nft_reg_track_cancel(track, i);
+       }
+
+       return false;
+}
+
 static const struct nft_expr_ops nft_ct_set_ops = {
        .type           = &nft_ct_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
@@ -719,6 +764,7 @@ static const struct nft_expr_ops nft_ct_set_ops = {
        .init           = nft_ct_set_init,
        .destroy        = nft_ct_set_destroy,
        .dump           = nft_ct_set_dump,
+       .reduce         = nft_ct_set_reduce,
 };
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
@@ -729,6 +775,7 @@ static const struct nft_expr_ops nft_ct_set_zone_ops = {
        .init           = nft_ct_set_init,
        .destroy        = nft_ct_set_destroy,
        .dump           = nft_ct_set_dump,
+       .reduce         = nft_ct_set_reduce,
 };
 #endif