Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 827318fe authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: remove helper hook again 



place them into the confirm one.

Old:
 hook (300): ipv4/6_help() first call helper, then seqadj.
 hook (INT_MAX): confirm

Now:
 hook (INT_MAX): confirm, first call helper, then seqadj, then confirm

Not having the extra call is noticeable in bechmarks.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 10870dd8

net/netfilter/nf_conntrack_proto.c

+36 −106
Original line number Diff line number Diff line
@@ -364,55 +364,55 @@ void nf_ct_l4proto_pernet_unregister(struct net *net, 
}

EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_unregister);



static unsigned int ipv4_helper(void *priv,

				struct sk_buff *skb,

				const struct nf_hook_state *state)

static unsigned int nf_confirm(struct sk_buff *skb,

			       unsigned int protoff,

			       struct nf_conn *ct,

			       enum ip_conntrack_info ctinfo)

{

	struct nf_conn *ct;

	enum ip_conntrack_info ctinfo;

	const struct nf_conn_help *help;

	const struct nf_conntrack_helper *helper;



	/* This is where we call the helper: as the packet goes out. */

	ct = nf_ct_get(skb, &ctinfo);

	if (!ct || ctinfo == IP_CT_RELATED_REPLY)

		return NF_ACCEPT;



	help = nfct_help(ct);

	if (!help)

		return NF_ACCEPT;

	if (help) {

		const struct nf_conntrack_helper *helper;

		int ret;



		/* rcu_read_lock()ed by nf_hook_thresh */

		helper = rcu_dereference(help->helper);

	if (!helper)

		return NF_ACCEPT;



	return helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),

		if (helper) {

			ret = helper->help(skb,

					   protoff,

					   ct, ctinfo);

			if (ret != NF_ACCEPT)

				return ret;

		}

	}



	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&

	    !nf_is_loopback_packet(skb)) {

		if (!nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {

			NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);

			return NF_DROP;

		}

	}



	/* We've seen it coming out the other side: confirm it */

	return nf_conntrack_confirm(skb);

}



static unsigned int ipv4_confirm(void *priv,

				 struct sk_buff *skb,

				 const struct nf_hook_state *state)

{

	struct nf_conn *ct;

	enum ip_conntrack_info ctinfo;

	struct nf_conn *ct;



	ct = nf_ct_get(skb, &ctinfo);

	if (!ct || ctinfo == IP_CT_RELATED_REPLY)

		goto out;



	/* adjust seqs for loopback traffic only in outgoing direction */

	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&

	    !nf_is_loopback_packet(skb)) {

		if (!nf_ct_seq_adjust(skb, ct, ctinfo, ip_hdrlen(skb))) {

			NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);

			return NF_DROP;

		}

	}

out:

	/* We've seen it coming out the other side: confirm it */

		return nf_conntrack_confirm(skb);



	return nf_confirm(skb,

			  skb_network_offset(skb) + ip_hdrlen(skb),

			  ct, ctinfo);

}



static unsigned int ipv4_conntrack_in(void *priv,
@@ -460,24 +460,12 @@ static const struct nf_hook_ops ipv4_conntrack_ops[] = { 
		.hooknum	= NF_INET_LOCAL_OUT,

		.priority	= NF_IP_PRI_CONNTRACK,

	},

	{

		.hook		= ipv4_helper,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_POST_ROUTING,

		.priority	= NF_IP_PRI_CONNTRACK_HELPER,

	},

	{

		.hook		= ipv4_confirm,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_POST_ROUTING,

		.priority	= NF_IP_PRI_CONNTRACK_CONFIRM,

	},

	{

		.hook		= ipv4_helper,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP_PRI_CONNTRACK_HELPER,

	},

	{

		.hook		= ipv4_confirm,

		.pf		= NFPROTO_IPV4,
@@ -623,31 +611,21 @@ static unsigned int ipv6_confirm(void *priv, 
	struct nf_conn *ct;

	enum ip_conntrack_info ctinfo;

	unsigned char pnum = ipv6_hdr(skb)->nexthdr;

	int protoff;

	__be16 frag_off;

	int protoff;



	ct = nf_ct_get(skb, &ctinfo);

	if (!ct || ctinfo == IP_CT_RELATED_REPLY)

		goto out;

		return nf_conntrack_confirm(skb);



	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,

				   &frag_off);

	if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {

		pr_debug("proto header not found\n");

		goto out;

		return nf_conntrack_confirm(skb);

	}



	/* adjust seqs for loopback traffic only in outgoing direction */

	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&

	    !nf_is_loopback_packet(skb)) {

		if (!nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {

			NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);

			return NF_DROP;

		}

	}

out:

	/* We've seen it coming out the other side: confirm it */

	return nf_conntrack_confirm(skb);

	return nf_confirm(skb, protoff, ct, ctinfo);

}



static unsigned int ipv6_conntrack_in(void *priv,
@@ -664,42 +642,6 @@ static unsigned int ipv6_conntrack_local(void *priv, 
	return nf_conntrack_in(skb, state);

}



static unsigned int ipv6_helper(void *priv,

				struct sk_buff *skb,

				const struct nf_hook_state *state)

{

	struct nf_conn *ct;

	const struct nf_conn_help *help;

	const struct nf_conntrack_helper *helper;

	enum ip_conntrack_info ctinfo;

	__be16 frag_off;

	int protoff;

	u8 nexthdr;



	/* This is where we call the helper: as the packet goes out. */

	ct = nf_ct_get(skb, &ctinfo);

	if (!ct || ctinfo == IP_CT_RELATED_REPLY)

		return NF_ACCEPT;



	help = nfct_help(ct);

	if (!help)

		return NF_ACCEPT;

	/* rcu_read_lock()ed by nf_hook_thresh */

	helper = rcu_dereference(help->helper);

	if (!helper)

		return NF_ACCEPT;



	nexthdr = ipv6_hdr(skb)->nexthdr;

	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,

				   &frag_off);

	if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {

		pr_debug("proto header not found\n");

		return NF_ACCEPT;

	}



	return helper->help(skb, protoff, ct, ctinfo);

}



static const struct nf_hook_ops ipv6_conntrack_ops[] = {

	{

		.hook		= ipv6_conntrack_in,
@@ -713,24 +655,12 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = { 
		.hooknum	= NF_INET_LOCAL_OUT,

		.priority	= NF_IP6_PRI_CONNTRACK,

	},

	{

		.hook		= ipv6_helper,

		.pf		= NFPROTO_IPV6,

		.hooknum	= NF_INET_POST_ROUTING,

		.priority	= NF_IP6_PRI_CONNTRACK_HELPER,

	},

	{

		.hook		= ipv6_confirm,

		.pf		= NFPROTO_IPV6,

		.hooknum	= NF_INET_POST_ROUTING,

		.priority	= NF_IP6_PRI_LAST,

	},

	{

		.hook		= ipv6_helper,

		.pf		= NFPROTO_IPV6,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP6_PRI_CONNTRACK_HELPER,

	},

	{

		.hook		= ipv6_confirm,

		.pf		= NFPROTO_IPV6,