Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 97a6ad13 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: reduce direct skb->nfct usage 



Next patch makes direct skb->nfct access illegal, reduce noise
in next patch by using accessors we already have.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6e10148c

include/net/ip_vs.h

+6 −3
Original line number Original line Diff line number Diff line
@@ -1554,10 +1554,13 @@ static inline void ip_vs_notrack(struct sk_buff *skb) 
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);

	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);





	if (!ct || !nf_ct_is_untracked(ct)) {

	if (!ct || !nf_ct_is_untracked(ct)) {

		nf_conntrack_put(skb->nfct);

		struct nf_conn *untracked;

		skb->nfct = &nf_ct_untracked_get()->ct_general;



		nf_conntrack_put(&ct->ct_general);

		untracked = nf_ct_untracked_get();

		nf_conntrack_get(&untracked->ct_general);

		skb->nfct = &untracked->ct_general;

		skb->nfctinfo = IP_CT_NEW;

		skb->nfctinfo = IP_CT_NEW;

		nf_conntrack_get(skb->nfct);

	}

	}

#endif

#endif

}

}

net/netfilter/nf_conntrack_core.c

+9 −6
Original line number Original line Diff line number Diff line
@@ -686,8 +686,11 @@ static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb, 
	    !nfct_nat(ct) &&

	    !nfct_nat(ct) &&

	    !nf_ct_is_dying(ct) &&

	    !nf_ct_is_dying(ct) &&

	    atomic_inc_not_zero(&ct->ct_general.use)) {

	    atomic_inc_not_zero(&ct->ct_general.use)) {

		nf_ct_acct_merge(ct, ctinfo, (struct nf_conn *)skb->nfct);

		enum ip_conntrack_info oldinfo;

		nf_conntrack_put(skb->nfct);

		struct nf_conn *loser_ct = nf_ct_get(skb, &oldinfo);



		nf_ct_acct_merge(ct, ctinfo, loser_ct);

		nf_conntrack_put(&loser_ct->ct_general);

		/* Assign conntrack already in hashes to this skbuff. Don't

		/* Assign conntrack already in hashes to this skbuff. Don't

		 * modify skb->nfctinfo to ensure consistent stateful filtering.

		 * modify skb->nfctinfo to ensure consistent stateful filtering.

		 */

		 */
@@ -1288,7 +1291,7 @@ unsigned int 
nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,

nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,

		struct sk_buff *skb)

		struct sk_buff *skb)

{

{

	struct nf_conn *ct, *tmpl = NULL;

	struct nf_conn *ct, *tmpl;

	enum ip_conntrack_info ctinfo;

	enum ip_conntrack_info ctinfo;

	struct nf_conntrack_l3proto *l3proto;

	struct nf_conntrack_l3proto *l3proto;

	struct nf_conntrack_l4proto *l4proto;

	struct nf_conntrack_l4proto *l4proto;
@@ -1298,9 +1301,9 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, 
	int set_reply = 0;

	int set_reply = 0;

	int ret;

	int ret;





	if (skb->nfct) {

	tmpl = nf_ct_get(skb, &ctinfo);

	if (tmpl) {

		/* Previously seen (loopback or untracked)?  Ignore. */

		/* Previously seen (loopback or untracked)?  Ignore. */

		tmpl = (struct nf_conn *)skb->nfct;

		if (!nf_ct_is_template(tmpl)) {

		if (!nf_ct_is_template(tmpl)) {

			NF_CT_STAT_INC_ATOMIC(net, ignore);

			NF_CT_STAT_INC_ATOMIC(net, ignore);

			return NF_ACCEPT;

			return NF_ACCEPT;
@@ -1364,7 +1367,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, 
		/* Invalid: inverse of the return code tells

		/* Invalid: inverse of the return code tells

		 * the netfilter core what to do */

		 * the netfilter core what to do */

		pr_debug("nf_conntrack_in: Can't track with proto module\n");

		pr_debug("nf_conntrack_in: Can't track with proto module\n");

		nf_conntrack_put(skb->nfct);

		nf_conntrack_put(&ct->ct_general);

		skb->nfct = NULL;

		skb->nfct = NULL;

		NF_CT_STAT_INC_ATOMIC(net, invalid);

		NF_CT_STAT_INC_ATOMIC(net, invalid);

		if (ret == -NF_DROP)

		if (ret == -NF_DROP)