Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4156e8c authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETFILTER]: nf_conntrack: reduce masks to a subset of tuples 



Since conntrack currently allows to use masks for every bit of both
helper and expectation tuples, we can't hash them and have to keep
them on two global lists that are searched for every new connection.

This patch removes the never used ability to use masks for the
destination part of the expectation tuple and completely removes
masks from helpers since the only reasonable choice is a full
match on l3num, protonum and src.u.all.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent df43b4e7

include/net/netfilter/nf_conntrack_expect.h

+2 −1
Original line number Original line Diff line number Diff line
@@ -16,7 +16,8 @@ struct nf_conntrack_expect 
	struct list_head list;

	struct list_head list;





	/* We expect this tuple, with the following mask */

	/* We expect this tuple, with the following mask */

	struct nf_conntrack_tuple tuple, mask;

	struct nf_conntrack_tuple tuple;

	struct nf_conntrack_tuple_mask mask;





	/* Function to call after setup and insertion */

	/* Function to call after setup and insertion */

	void (*expectfn)(struct nf_conn *new,

	void (*expectfn)(struct nf_conn *new,

include/net/netfilter/nf_conntrack_helper.h

+2 −3
Original line number Original line Diff line number Diff line
@@ -24,9 +24,8 @@ struct nf_conntrack_helper 
					 * expected connections */

					 * expected connections */

	unsigned int timeout;		/* timeout for expecteds */

	unsigned int timeout;		/* timeout for expecteds */





	/* Mask of things we will help (compared against server response) */

	/* Tuple of things we will help (compared against server response) */

	struct nf_conntrack_tuple tuple;

	struct nf_conntrack_tuple tuple;

	struct nf_conntrack_tuple mask;





	/* Function to call when data passes; return verdict, or -1 to

	/* Function to call when data passes; return verdict, or -1 to

           invalidate. */

           invalidate. */

include/net/netfilter/nf_conntrack_tuple.h

+43 −22
Original line number Original line Diff line number Diff line
@@ -100,6 +100,14 @@ struct nf_conntrack_tuple 
	} dst;

	} dst;

};

};





struct nf_conntrack_tuple_mask

{

	struct {

		union nf_conntrack_address u3;

		union nf_conntrack_man_proto u;

	} src;

};



/* This is optimized opposed to a memset of the whole structure.  Everything we

/* This is optimized opposed to a memset of the whole structure.  Everything we

 * really care about is the  source/destination unions */

 * really care about is the  source/destination unions */

#define NF_CT_TUPLE_U_BLANK(tuple)                              	\

#define NF_CT_TUPLE_U_BLANK(tuple)                              	\
@@ -161,31 +169,44 @@ static inline int nf_ct_tuple_equal(const struct nf_conntrack_tuple *t1, 
	return nf_ct_tuple_src_equal(t1, t2) && nf_ct_tuple_dst_equal(t1, t2);

	return nf_ct_tuple_src_equal(t1, t2) && nf_ct_tuple_dst_equal(t1, t2);

}

}





static inline int nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,

static inline int nf_ct_tuple_mask_equal(const struct nf_conntrack_tuple_mask *m1,

				       const struct nf_conntrack_tuple *tuple,

					 const struct nf_conntrack_tuple_mask *m2)

				       const struct nf_conntrack_tuple *mask)

{

	return (m1->src.u3.all[0] == m2->src.u3.all[0] &&

		m1->src.u3.all[1] == m2->src.u3.all[1] &&

		m1->src.u3.all[2] == m2->src.u3.all[2] &&

		m1->src.u3.all[3] == m2->src.u3.all[3] &&

		m1->src.u.all == m2->src.u.all);

}



static inline int nf_ct_tuple_src_mask_cmp(const struct nf_conntrack_tuple *t1,

					   const struct nf_conntrack_tuple *t2,

					   const struct nf_conntrack_tuple_mask *mask)

{

{

	int count = 0;

	int count;





	for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++) {

	for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++) {

                if ((t->src.u3.all[count] ^ tuple->src.u3.all[count]) &

		if ((t1->src.u3.all[count] ^ t2->src.u3.all[count]) &

		    mask->src.u3.all[count])

		    mask->src.u3.all[count])

			return 0;

			return 0;

	}

	}





        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){

	if ((t1->src.u.all ^ t2->src.u.all) & mask->src.u.all)

                if ((t->dst.u3.all[count] ^ tuple->dst.u3.all[count]) &

                    mask->dst.u3.all[count])

		return 0;

		return 0;

        }





        if ((t->src.u.all ^ tuple->src.u.all) & mask->src.u.all ||

	if (t1->src.l3num != t2->src.l3num ||

            (t->dst.u.all ^ tuple->dst.u.all) & mask->dst.u.all ||

	    t1->dst.protonum != t2->dst.protonum)

            (t->src.l3num ^ tuple->src.l3num) & mask->src.l3num ||

            (t->dst.protonum ^ tuple->dst.protonum) & mask->dst.protonum)

		return 0;

		return 0;





	return 1;

	return 1;

}

}





static inline int nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,

				       const struct nf_conntrack_tuple *tuple,

				       const struct nf_conntrack_tuple_mask *mask)

{

	return nf_ct_tuple_src_mask_cmp(t, tuple, mask) &&

	       nf_ct_tuple_dst_equal(t, tuple);

}



#endif /* _NF_CONNTRACK_TUPLE_H */
 
#endif /* _NF_CONNTRACK_TUPLE_H */

net/ipv4/netfilter/nf_nat_snmp_basic.c

+0 −6
Original line number Original line Diff line number Diff line
@@ -1276,9 +1276,6 @@ static struct nf_conntrack_helper snmp_helper __read_mostly = { 
	.tuple.src.l3num	= AF_INET,

	.tuple.src.l3num	= AF_INET,

	.tuple.src.u.udp.port	= __constant_htons(SNMP_PORT),

	.tuple.src.u.udp.port	= __constant_htons(SNMP_PORT),

	.tuple.dst.protonum	= IPPROTO_UDP,

	.tuple.dst.protonum	= IPPROTO_UDP,

	.mask.src.l3num		= 0xFFFF,

	.mask.src.u.udp.port	= __constant_htons(0xFFFF),

	.mask.dst.protonum	= 0xFF,

};

};





static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {

static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
@@ -1290,9 +1287,6 @@ static struct nf_conntrack_helper snmp_trap_helper __read_mostly = { 
	.tuple.src.l3num	= AF_INET,

	.tuple.src.l3num	= AF_INET,

	.tuple.src.u.udp.port	= __constant_htons(SNMP_TRAP_PORT),

	.tuple.src.u.udp.port	= __constant_htons(SNMP_TRAP_PORT),

	.tuple.dst.protonum	= IPPROTO_UDP,

	.tuple.dst.protonum	= IPPROTO_UDP,

	.mask.src.l3num		= 0xFFFF,

	.mask.src.u.udp.port	= __constant_htons(0xFFFF),

	.mask.dst.protonum	= 0xFF,

};

};





/*****************************************************************************

/*****************************************************************************

net/netfilter/nf_conntrack_amanda.c

+0 −6
Original line number Original line Diff line number Diff line
@@ -174,9 +174,6 @@ static struct nf_conntrack_helper amanda_helper[2] __read_mostly = { 
		.tuple.src.l3num	= AF_INET,

		.tuple.src.l3num	= AF_INET,

		.tuple.src.u.udp.port	= __constant_htons(10080),

		.tuple.src.u.udp.port	= __constant_htons(10080),

		.tuple.dst.protonum	= IPPROTO_UDP,

		.tuple.dst.protonum	= IPPROTO_UDP,

		.mask.src.l3num		= 0xFFFF,

		.mask.src.u.udp.port	= __constant_htons(0xFFFF),

		.mask.dst.protonum	= 0xFF,

	},

	},

	{

	{

		.name			= "amanda",

		.name			= "amanda",
@@ -187,9 +184,6 @@ static struct nf_conntrack_helper amanda_helper[2] __read_mostly = { 
		.tuple.src.l3num	= AF_INET6,

		.tuple.src.l3num	= AF_INET6,

		.tuple.src.u.udp.port	= __constant_htons(10080),

		.tuple.src.u.udp.port	= __constant_htons(10080),

		.tuple.dst.protonum	= IPPROTO_UDP,

		.tuple.dst.protonum	= IPPROTO_UDP,

		.mask.src.l3num		= 0xFFFF,

		.mask.src.u.udp.port	= __constant_htons(0xFFFF),

		.mask.dst.protonum	= 0xFF,

	},

	},

};

};