Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00028aa3 authored by Eric Dumazet's avatar Eric Dumazet Committed by Pablo Neira Ayuso
Browse files

netfilter: xt_socket: use IP early demux 



With IP early demux added in linux-3.6, we perform TCP lookup in IP
layer before iptables hooks.

We can avoid doing a second lookup in xt_socket.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 27e7190e

net/netfilter/xt_socket.c

+16 −10
Original line number Diff line number Diff line
@@ -107,7 +107,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, 
{

	const struct iphdr *iph = ip_hdr(skb);

	struct udphdr _hdr, *hp = NULL;

	struct sock *sk;

	struct sock *sk = skb->sk;

	__be32 uninitialized_var(daddr), uninitialized_var(saddr);

	__be16 uninitialized_var(dport), uninitialized_var(sport);

	u8 uninitialized_var(protocol);
@@ -155,9 +155,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, 
	}

#endif



	if (!sk)

		sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,

				   saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY);

	if (sk != NULL) {

					   saddr, daddr, sport, dport,

					   par->in, NFT_LOOKUP_ANY);

	if (sk) {

		bool wildcard;

		bool transparent = true;
@@ -173,6 +175,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, 
				       (sk->sk_state == TCP_TIME_WAIT &&

					inet_twsk(sk)->tw_transparent));



		if (sk != skb->sk)

			xt_socket_put_sk(sk);



		if (wildcard || !transparent)
@@ -260,7 +263,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) 
{

	struct ipv6hdr *iph = ipv6_hdr(skb);

	struct udphdr _hdr, *hp = NULL;

	struct sock *sk;

	struct sock *sk = skb->sk;

	struct in6_addr *daddr = NULL, *saddr = NULL;

	__be16 uninitialized_var(dport), uninitialized_var(sport);

	int thoff = 0, uninitialized_var(tproto);
@@ -291,9 +294,11 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) 
		return false;

	}



	if (!sk)

		sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,

				   saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY);

	if (sk != NULL) {

					   saddr, daddr, sport, dport,

					   par->in, NFT_LOOKUP_ANY);

	if (sk) {

		bool wildcard;

		bool transparent = true;
@@ -309,6 +314,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) 
				       (sk->sk_state == TCP_TIME_WAIT &&

					inet_twsk(sk)->tw_transparent));



		if (sk != skb->sk)

			xt_socket_put_sk(sk);



		if (wildcard || !transparent)