Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5769be34 authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan
Browse files

net: ipv6: Optimize ipv6 packet matching 



iptables matching for ipv6 always has a mask if an address is
specified for match. Adding a check for mask prior to that
helps to improve performance as it avoids the masked comparison.
This is achieved by defining a new feature IP6_NF_IPTABLES_128
which allows to perform 128 bit arithmetic while matching.

CRs-Fixed: 2122802
Change-Id: I9ffd34e29d1b06ad74545d4751aa0e1ea06ded49
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent 6767cbd7

net/ipv6/netfilter/Kconfig

+12 −0
Original line number Diff line number Diff line
@@ -135,6 +135,18 @@ config IP6_NF_IPTABLES 


if IP6_NF_IPTABLES



config IP6_NF_IPTABLES_128

	tristate "128 bit arithmetic for iptables matching"

	depends on IP6_NF_IPTABLES

	help

	  This enables 128 bit matching in ip6tables to help optimize cases

          where there is no match required. ip6tables matching for ipv6 always

	  has a mask if an address is specified for match. Adding a check for

	  mask prior to that helps to improve performance as it avoids the

	  masked comparison.



	  Note that this feature depends on the architecture. If unsure, say N.



# The simple matches.

config IP6_NF_MATCH_AH

	tristate '"ah" match support'

net/ipv6/netfilter/ip6_tables.c

+16 −7
Original line number Diff line number Diff line
@@ -72,7 +72,15 @@ ip6_packet_match(const struct sk_buff *skb, 
{

	unsigned long ret;

	const struct ipv6hdr *ipv6 = ipv6_hdr(skb);

#if IS_ENABLED(IP6_NF_IPTABLES_128)

	const __uint128_t *ulm1 = (const __uint128_t *)&ip6info->smsk;

	const __uint128_t *ulm2 = (const __uint128_t *)&ip6info->dmsk;

#endif



#if IS_ENABLED(IP6_NF_IPTABLES_128)

	if (*ulm1 || *ulm2)

#endif

	{

		if (NF_INVF(ip6info, IP6T_INV_SRCIP,

			    ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,

						 &ip6info->src)) ||
@@ -80,6 +88,7 @@ ip6_packet_match(const struct sk_buff *skb, 
			    ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,

						 &ip6info->dst)))

			return false;

	}



	ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);