netfilter: flowtable: simplify route logic

Grab reference to dst from skbuff earlier to simplify route caching.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index ebb28ec..546fc4a 100644 (file)
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -263,8 +263,8 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table,
        up_write(&flow_table->flow_block_lock);
 }
 
-int flow_offload_route_init(struct flow_offload *flow,
-                           const struct nf_flow_route *route);
+void flow_offload_route_init(struct flow_offload *flow,
+                            const struct nf_flow_route *route);
 
 int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
 void flow_offload_refresh(struct nf_flowtable *flow_table,

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 04bd0ed..b46dd89 100644 (file)
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -125,9 +125,6 @@ static int flow_offload_fill_route(struct flow_offload *flow,
                break;
        case FLOW_OFFLOAD_XMIT_XFRM:
        case FLOW_OFFLOAD_XMIT_NEIGH:
-               if (!dst_hold_safe(route->tuple[dir].dst))
-                       return -1;
-
                flow_tuple->dst_cache = dst;
                flow_tuple->dst_cookie = flow_offload_dst_cookie(flow_tuple);
                break;
@@ -148,27 +145,12 @@ static void nft_flow_dst_release(struct flow_offload *flow,
                dst_release(flow->tuplehash[dir].tuple.dst_cache);
 }
 
-int flow_offload_route_init(struct flow_offload *flow,
+void flow_offload_route_init(struct flow_offload *flow,
                            const struct nf_flow_route *route)
 {
-       int err;
-
-       err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);
-       if (err < 0)
-               return err;
-
-       err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);
-       if (err < 0)
-               goto err_route_reply;
-
+       flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);
+       flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);
        flow->type = NF_FLOW_OFFLOAD_ROUTE;
-
-       return 0;
-
-err_route_reply:
-       nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
-
-       return err;
 }
 EXPORT_SYMBOL_GPL(flow_offload_route_init);
 

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index e860d8f..5ef9146 100644 (file)
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -250,9 +250,14 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
                break;
        }
 
+       if (!dst_hold_safe(this_dst))
+               return -ENOENT;
+
        nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt));
-       if (!other_dst)
+       if (!other_dst) {
+               dst_release(this_dst);
                return -ENOENT;
+       }
 
        nft_default_forward_path(route, this_dst, dir);
        nft_default_forward_path(route, other_dst, !dir);
@@ -349,8 +354,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        if (!flow)
                goto err_flow_alloc;
 
-       if (flow_offload_route_init(flow, &route) < 0)
-               goto err_flow_add;
+       flow_offload_route_init(flow, &route);
 
        if (tcph) {
                ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
@@ -361,12 +365,12 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        if (ret < 0)
                goto err_flow_add;
 
-       dst_release(route.tuple[!dir].dst);
        return;
 
 err_flow_add:
        flow_offload_free(flow);
 err_flow_alloc:
+       dst_release(route.tuple[dir].dst);
        dst_release(route.tuple[!dir].dst);
 err_flow_route:
        clear_bit(IPS_OFFLOAD_BIT, &ct->status);