Skip to content

L
linux
Commit 06fcaca2 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files
Options

netfilter: nf_tables: reduce trans->ctx.table references 

nft_ctx is huge, it should not be stored in nft_trans at all,
most information is not needed.

Preparation patch to remove trans->ctx, no change in behaviour intended.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b3f4c216
Hide whitespace changes
Inline Side-by-side
Showing with 41 additions and 38 deletions
net/netfilter/nf_tables_api.c
View file @ 06fcaca2
...@@ -9472,14 +9472,15 @@ static void nft_chain_commit_drop_policy(struct nft_trans *trans) ...@@ -9472,14 +9472,15 @@ static void nft_chain_commit_drop_policy(struct nft_trans *trans)
static void nft_chain_commit_update(struct nft_trans *trans) static void nft_chain_commit_update(struct nft_trans *trans)
{ {
struct nft_table *table = trans->ctx.table;
struct nft_base_chain *basechain; struct nft_base_chain *basechain;
if (nft_trans_chain_name(trans)) { if (nft_trans_chain_name(trans)) {
rhltable_remove(&trans->ctx.table->chains_ht, rhltable_remove(&table->chains_ht,
&trans->ctx.chain->rhlhead, &trans->ctx.chain->rhlhead,
nft_chain_ht_params); nft_chain_ht_params);
swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
rhltable_insert_key(&trans->ctx.table->chains_ht, rhltable_insert_key(&table->chains_ht,
trans->ctx.chain->name, trans->ctx.chain->name,
&trans->ctx.chain->rhlhead, &trans->ctx.chain->rhlhead,
nft_chain_ht_params); nft_chain_ht_params);
...@@ -10237,9 +10238,10 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) ...@@ -10237,9 +10238,10 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
/* 1. Allocate space for next generation rules_gen_X[] */ /* 1. Allocate space for next generation rules_gen_X[] */
list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
struct nft_table *table = trans->ctx.table;
int ret; int ret;
ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); ret = nf_tables_commit_audit_alloc(&adl, table);
if (ret) { if (ret) {
nf_tables_commit_chain_prepare_cancel(net); nf_tables_commit_chain_prepare_cancel(net);
nf_tables_commit_audit_free(&adl); nf_tables_commit_audit_free(&adl);
...@@ -10280,28 +10282,29 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) ...@@ -10280,28 +10282,29 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
net->nft.gencursor = nft_gencursor_next(net); net->nft.gencursor = nft_gencursor_next(net);
list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
nf_tables_commit_audit_collect(&adl, trans->ctx.table, struct nft_table *table = trans->ctx.table;
trans->msg_type);
nf_tables_commit_audit_collect(&adl, table, trans->msg_type);
switch (trans->msg_type) { switch (trans->msg_type) {
case NFT_MSG_NEWTABLE: case NFT_MSG_NEWTABLE:
if (nft_trans_table_update(trans)) { if (nft_trans_table_update(trans)) {
if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { if (!(table->flags & __NFT_TABLE_F_UPDATE)) {
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
} }
if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT) if (table->flags & NFT_TABLE_F_DORMANT)
nf_tables_table_disable(net, trans->ctx.table); nf_tables_table_disable(net, table);
trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; table->flags &= ~__NFT_TABLE_F_UPDATE;
} else { } else {
nft_clear(net, trans->ctx.table); nft_clear(net, table);
} }
nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE); nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
case NFT_MSG_DELTABLE: case NFT_MSG_DELTABLE:
case NFT_MSG_DESTROYTABLE: case NFT_MSG_DESTROYTABLE:
list_del_rcu(&trans->ctx.table->list); list_del_rcu(&table->list);
nf_tables_table_notify(&trans->ctx, trans->msg_type); nf_tables_table_notify(&trans->ctx, trans->msg_type);
break; break;
case NFT_MSG_NEWCHAIN: case NFT_MSG_NEWCHAIN:
...@@ -10324,7 +10327,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) ...@@ -10324,7 +10327,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
if (nft_trans_chain_update(trans)) { if (nft_trans_chain_update(trans)) {
nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
&nft_trans_chain_hooks(trans)); &nft_trans_chain_hooks(trans));
if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) { if (!(table->flags & NFT_TABLE_F_DORMANT)) {
nft_netdev_unregister_hooks(net, nft_netdev_unregister_hooks(net,
&nft_trans_chain_hooks(trans), &nft_trans_chain_hooks(trans),
true); true);
...@@ -10333,8 +10336,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) ...@@ -10333,8 +10336,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
nft_chain_del(trans->ctx.chain); nft_chain_del(trans->ctx.chain);
nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
NULL); NULL);
nf_tables_unregister_hook(trans->ctx.net, nf_tables_unregister_hook(trans->ctx.net, table,
trans->ctx.table,
trans->ctx.chain); trans->ctx.chain);
} }
break; break;
...@@ -10377,7 +10379,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) ...@@ -10377,7 +10379,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
*/ */
if (nft_set_is_anonymous(nft_trans_set(trans)) && if (nft_set_is_anonymous(nft_trans_set(trans)) &&
!list_empty(&nft_trans_set(trans)->bindings)) !list_empty(&nft_trans_set(trans)->bindings))
nft_use_dec(&trans->ctx.table->use); nft_use_dec(&table->use);
} }
nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
NFT_MSG_NEWSET, GFP_KERNEL); NFT_MSG_NEWSET, GFP_KERNEL);
...@@ -10575,37 +10577,39 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10575,37 +10577,39 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list,
list) { list) {
struct nft_table *table = trans->ctx.table;
switch (trans->msg_type) { switch (trans->msg_type) {
case NFT_MSG_NEWTABLE: case NFT_MSG_NEWTABLE:
if (nft_trans_table_update(trans)) { if (nft_trans_table_update(trans)) {
if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { if (!(table->flags & __NFT_TABLE_F_UPDATE)) {
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
} }
if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) { if (table->flags & __NFT_TABLE_F_WAS_DORMANT) {
nf_tables_table_disable(net, trans->ctx.table); nf_tables_table_disable(net, table);
trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; table->flags |= NFT_TABLE_F_DORMANT;
} else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) { } else if (table->flags & __NFT_TABLE_F_WAS_AWAKEN) {
trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT; table->flags &= ~NFT_TABLE_F_DORMANT;
} }
if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_ORPHAN) { if (table->flags & __NFT_TABLE_F_WAS_ORPHAN) {
trans->ctx.table->flags &= ~NFT_TABLE_F_OWNER; table->flags &= ~NFT_TABLE_F_OWNER;
trans->ctx.table->nlpid = 0; table->nlpid = 0;
} }
trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; table->flags &= ~__NFT_TABLE_F_UPDATE;
nft_trans_destroy(trans); nft_trans_destroy(trans);
} else { } else {
list_del_rcu(&trans->ctx.table->list); list_del_rcu(&table->list);
} }
break; break;
case NFT_MSG_DELTABLE: case NFT_MSG_DELTABLE:
case NFT_MSG_DESTROYTABLE: case NFT_MSG_DESTROYTABLE:
nft_clear(trans->ctx.net, trans->ctx.table); nft_clear(trans->ctx.net, table);
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
case NFT_MSG_NEWCHAIN: case NFT_MSG_NEWCHAIN:
if (nft_trans_chain_update(trans)) { if (nft_trans_chain_update(trans)) {
if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) { if (!(table->flags & NFT_TABLE_F_DORMANT)) {
nft_netdev_unregister_hooks(net, nft_netdev_unregister_hooks(net,
&nft_trans_chain_hooks(trans), &nft_trans_chain_hooks(trans),
true); true);
...@@ -10618,10 +10622,9 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10618,10 +10622,9 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
} }
nft_use_dec_restore(&trans->ctx.table->use); nft_use_dec_restore(&table->use);
nft_chain_del(trans->ctx.chain); nft_chain_del(trans->ctx.chain);
nf_tables_unregister_hook(trans->ctx.net, nf_tables_unregister_hook(trans->ctx.net, table,
trans->ctx.table,
trans->ctx.chain); trans->ctx.chain);
} }
break; break;
...@@ -10631,7 +10634,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10631,7 +10634,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
list_splice(&nft_trans_chain_hooks(trans), list_splice(&nft_trans_chain_hooks(trans),
&nft_trans_basechain(trans)->hook_list); &nft_trans_basechain(trans)->hook_list);
} else { } else {
nft_use_inc_restore(&trans->ctx.table->use); nft_use_inc_restore(&table->use);
nft_clear(trans->ctx.net, trans->ctx.chain); nft_clear(trans->ctx.net, trans->ctx.chain);
} }
nft_trans_destroy(trans); nft_trans_destroy(trans);
...@@ -10664,7 +10667,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10664,7 +10667,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
} }
nft_use_dec_restore(&trans->ctx.table->use); nft_use_dec_restore(&table->use);
if (nft_trans_set_bound(trans)) { if (nft_trans_set_bound(trans)) {
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
...@@ -10674,7 +10677,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10674,7 +10677,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
break; break;
case NFT_MSG_DELSET: case NFT_MSG_DELSET:
case NFT_MSG_DESTROYSET: case NFT_MSG_DESTROYSET:
nft_use_inc_restore(&trans->ctx.table->use); nft_use_inc_restore(&table->use);
nft_clear(trans->ctx.net, nft_trans_set(trans)); nft_clear(trans->ctx.net, nft_trans_set(trans));
if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
nft_map_activate(&trans->ctx, nft_trans_set(trans)); nft_map_activate(&trans->ctx, nft_trans_set(trans));
...@@ -10720,13 +10723,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10720,13 +10723,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans));
nft_trans_destroy(trans); nft_trans_destroy(trans);
} else { } else {
nft_use_dec_restore(&trans->ctx.table->use); nft_use_dec_restore(&table->use);
nft_obj_del(nft_trans_obj(trans)); nft_obj_del(nft_trans_obj(trans));
} }
break; break;
case NFT_MSG_DELOBJ: case NFT_MSG_DELOBJ:
case NFT_MSG_DESTROYOBJ: case NFT_MSG_DESTROYOBJ:
nft_use_inc_restore(&trans->ctx.table->use); nft_use_inc_restore(&table->use);
nft_clear(trans->ctx.net, nft_trans_obj(trans)); nft_clear(trans->ctx.net, nft_trans_obj(trans));
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
...@@ -10735,7 +10738,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10735,7 +10738,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
nft_unregister_flowtable_net_hooks(net, nft_unregister_flowtable_net_hooks(net,
&nft_trans_flowtable_hooks(trans)); &nft_trans_flowtable_hooks(trans));
} else { } else {
nft_use_dec_restore(&trans->ctx.table->use); nft_use_dec_restore(&table->use);
list_del_rcu(&nft_trans_flowtable(trans)->list); list_del_rcu(&nft_trans_flowtable(trans)->list);
nft_unregister_flowtable_net_hooks(net, nft_unregister_flowtable_net_hooks(net,
&nft_trans_flowtable(trans)->hook_list); &nft_trans_flowtable(trans)->hook_list);
...@@ -10747,7 +10750,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) ...@@ -10747,7 +10750,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
list_splice(&nft_trans_flowtable_hooks(trans), list_splice(&nft_trans_flowtable_hooks(trans),
&nft_trans_flowtable(trans)->hook_list); &nft_trans_flowtable(trans)->hook_list);
} else { } else {
nft_use_inc_restore(&trans->ctx.table->use); nft_use_inc_restore(&table->use);
nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
} }
nft_trans_destroy(trans); nft_trans_destroy(trans);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7