Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af4610c3 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: don't call hooks unless needed 



With the previous patches in place, a netns nf_hook_list might be empty,
even if e.g. init_net performs filtering.

Thus change nf_hook_thresh to check the hook_list as well before
initializing hook_state and calling nf_hook_slow().

We still make use of static keys; if no netfilter modules are loaded
list is guaranteed to be empty.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5f6c253e

include/linux/netfilter.h

+11 −18
Original line number Original line Diff line number Diff line
@@ -141,22 +141,6 @@ void nf_unregister_sockopt(struct nf_sockopt_ops *reg); 




#ifdef HAVE_JUMP_LABEL

#ifdef HAVE_JUMP_LABEL

extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];

extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];



static inline bool nf_hook_list_active(struct list_head *hook_list,

				       u_int8_t pf, unsigned int hook)

{

	if (__builtin_constant_p(pf) &&

	    __builtin_constant_p(hook))

		return static_key_false(&nf_hooks_needed[pf][hook]);



	return !list_empty(hook_list);

}

#else

static inline bool nf_hook_list_active(struct list_head *hook_list,

				       u_int8_t pf, unsigned int hook)

{

	return !list_empty(hook_list);

}

#endif

#endif





int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state);

int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state);
@@ -177,9 +161,18 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 
				 int (*okfn)(struct net *, struct sock *, struct sk_buff *),

				 int (*okfn)(struct net *, struct sock *, struct sk_buff *),

				 int thresh)

				 int thresh)

{

{

	struct list_head *hook_list = &net->nf.hooks[pf][hook];

	struct list_head *hook_list;



#ifdef HAVE_JUMP_LABEL

	if (__builtin_constant_p(pf) &&

	    __builtin_constant_p(hook) &&

	    !static_key_false(&nf_hooks_needed[pf][hook]))

		return 1;

#endif



	hook_list = &net->nf.hooks[pf][hook];





	if (nf_hook_list_active(hook_list, pf, hook)) {

	if (!list_empty(hook_list)) {

		struct nf_hook_state state;

		struct nf_hook_state state;





		nf_hook_state_init(&state, hook_list, hook, thresh,

		nf_hook_state_init(&state, hook_list, hook, thresh,