netfilter: nft_tunnel: track register operations

Check if the destination register already contains the data that this
tunnel expression performs. This allows to skip this redundant operation.
If the destination contains a different selector, update the register
tracking information. This patch does not perform bitwise tracking.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
index 3b27926..d0f9b1d 100644 (file)
--- a/net/netfilter/nft_tunnel.c
+++ b/net/netfilter/nft_tunnel.c
@@ -17,6 +17,7 @@ struct nft_tunnel {
        enum nft_tunnel_keys    key:8;
        u8                      dreg;
        enum nft_tunnel_mode    mode:8;
+       u8                      len;
 };
 
 static void nft_tunnel_get_eval(const struct nft_expr *expr,
@@ -101,6 +102,7 @@ static int nft_tunnel_get_init(const struct nft_ctx *ctx,
                priv->mode = NFT_TUNNEL_MODE_NONE;
        }
 
+       priv->len = len;
        return nft_parse_register_store(ctx, tb[NFTA_TUNNEL_DREG], &priv->dreg,
                                        NULL, NFT_DATA_VALUE, len);
 }
@@ -122,6 +124,31 @@ nla_put_failure:
        return -1;
 }
 
+static bool nft_tunnel_get_reduce(struct nft_regs_track *track,
+                                 const struct nft_expr *expr)
+{
+       const struct nft_tunnel *priv = nft_expr_priv(expr);
+       const struct nft_tunnel *tunnel;
+
+       if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       tunnel = nft_expr_priv(track->regs[priv->dreg].selector);
+       if (priv->key != tunnel->key ||
+           priv->dreg != tunnel->dreg ||
+           priv->mode != tunnel->mode) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       if (!track->regs[priv->dreg].bitwise)
+               return true;
+
+       return false;
+}
+
 static struct nft_expr_type nft_tunnel_type;
 static const struct nft_expr_ops nft_tunnel_get_ops = {
        .type           = &nft_tunnel_type,
@@ -129,6 +156,7 @@ static const struct nft_expr_ops nft_tunnel_get_ops = {
        .eval           = nft_tunnel_get_eval,
        .init           = nft_tunnel_get_init,
        .dump           = nft_tunnel_get_dump,
+       .reduce         = nft_tunnel_get_reduce,
 };
 
 static struct nft_expr_type nft_tunnel_type __read_mostly = {