netfilter: nft_osf: track register operations

Allow to recycle the previous output of the OS fingerprint expression
if flags and ttl are the same.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index d82677e..5eed18f 100644 (file)
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -120,6 +120,30 @@ static int nft_osf_validate(const struct nft_ctx *ctx,
                                                    (1 << NF_INET_FORWARD));
 }
 
+static bool nft_osf_reduce(struct nft_regs_track *track,
+                          const struct nft_expr *expr)
+{
+       struct nft_osf *priv = nft_expr_priv(expr);
+       struct nft_osf *osf;
+
+       if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
+               nft_reg_track_update(track, expr, priv->dreg, NFT_OSF_MAXGENRELEN);
+               return false;
+       }
+
+       osf = nft_expr_priv(track->regs[priv->dreg].selector);
+       if (priv->flags != osf->flags ||
+           priv->ttl != osf->ttl) {
+               nft_reg_track_update(track, expr, priv->dreg, NFT_OSF_MAXGENRELEN);
+               return false;
+       }
+
+       if (!track->regs[priv->dreg].bitwise)
+               return true;
+
+       return false;
+}
+
 static struct nft_expr_type nft_osf_type;
 static const struct nft_expr_ops nft_osf_op = {
        .eval           = nft_osf_eval,
@@ -128,6 +152,7 @@ static const struct nft_expr_ops nft_osf_op = {
        .dump           = nft_osf_dump,
        .type           = &nft_osf_type,
        .validate       = nft_osf_validate,
+       .reduce         = nft_osf_reduce,
 };
 
 static struct nft_expr_type nft_osf_type __read_mostly = {