Commit 06fcaca2 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: reduce trans->ctx.table references 



nft_ctx is huge, it should not be stored in nft_trans at all,
most information is not needed.

Preparation patch to remove trans->ctx, no change in behaviour intended.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b3f4c216

net/netfilter/nf_tables_api.c

+41 −38
Original line number Diff line number Diff line
@@ -9472,14 +9472,15 @@ static void nft_chain_commit_drop_policy(struct nft_trans *trans) 


static void nft_chain_commit_update(struct nft_trans *trans)

{

	struct nft_table *table = trans->ctx.table;

	struct nft_base_chain *basechain;



	if (nft_trans_chain_name(trans)) {

		rhltable_remove(&trans->ctx.table->chains_ht,

		rhltable_remove(&table->chains_ht,

				&trans->ctx.chain->rhlhead,

				nft_chain_ht_params);

		swap(trans->ctx.chain->name, nft_trans_chain_name(trans));

		rhltable_insert_key(&trans->ctx.table->chains_ht,

		rhltable_insert_key(&table->chains_ht,

				    trans->ctx.chain->name,

				    &trans->ctx.chain->rhlhead,

				    nft_chain_ht_params);
@@ -10237,9 +10238,10 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 


	/* 1.  Allocate space for next generation rules_gen_X[] */

	list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {

		struct nft_table *table = trans->ctx.table;

		int ret;



		ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table);

		ret = nf_tables_commit_audit_alloc(&adl, table);

		if (ret) {

			nf_tables_commit_chain_prepare_cancel(net);

			nf_tables_commit_audit_free(&adl);
@@ -10280,28 +10282,29 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
	net->nft.gencursor = nft_gencursor_next(net);



	list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {

		nf_tables_commit_audit_collect(&adl, trans->ctx.table,

					       trans->msg_type);

		struct nft_table *table = trans->ctx.table;



		nf_tables_commit_audit_collect(&adl, table, trans->msg_type);

		switch (trans->msg_type) {

		case NFT_MSG_NEWTABLE:

			if (nft_trans_table_update(trans)) {

				if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {

				if (!(table->flags & __NFT_TABLE_F_UPDATE)) {

					nft_trans_destroy(trans);

					break;

				}

				if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT)

					nf_tables_table_disable(net, trans->ctx.table);

				if (table->flags & NFT_TABLE_F_DORMANT)

					nf_tables_table_disable(net, table);



				trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;

				table->flags &= ~__NFT_TABLE_F_UPDATE;

			} else {

				nft_clear(net, trans->ctx.table);

				nft_clear(net, table);

			}

			nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);

			nft_trans_destroy(trans);

			break;

		case NFT_MSG_DELTABLE:

		case NFT_MSG_DESTROYTABLE:

			list_del_rcu(&trans->ctx.table->list);

			list_del_rcu(&table->list);

			nf_tables_table_notify(&trans->ctx, trans->msg_type);

			break;

		case NFT_MSG_NEWCHAIN:
@@ -10324,7 +10327,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
			if (nft_trans_chain_update(trans)) {

				nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,

						       &nft_trans_chain_hooks(trans));

				if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {

				if (!(table->flags & NFT_TABLE_F_DORMANT)) {

					nft_netdev_unregister_hooks(net,

								    &nft_trans_chain_hooks(trans),

								    true);
@@ -10333,8 +10336,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
				nft_chain_del(trans->ctx.chain);

				nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,

						       NULL);

				nf_tables_unregister_hook(trans->ctx.net,

							  trans->ctx.table,

				nf_tables_unregister_hook(trans->ctx.net, table,

							  trans->ctx.chain);

			}

			break;
@@ -10377,7 +10379,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
				 */

				if (nft_set_is_anonymous(nft_trans_set(trans)) &&

				    !list_empty(&nft_trans_set(trans)->bindings))

					nft_use_dec(&trans->ctx.table->use);

					nft_use_dec(&table->use);

			}

			nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),

					     NFT_MSG_NEWSET, GFP_KERNEL);
@@ -10575,37 +10577,39 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 


	list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list,

					 list) {

		struct nft_table *table = trans->ctx.table;



		switch (trans->msg_type) {

		case NFT_MSG_NEWTABLE:

			if (nft_trans_table_update(trans)) {

				if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {

				if (!(table->flags & __NFT_TABLE_F_UPDATE)) {

					nft_trans_destroy(trans);

					break;

				}

				if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) {

					nf_tables_table_disable(net, trans->ctx.table);

					trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;

				} else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) {

					trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT;

				if (table->flags & __NFT_TABLE_F_WAS_DORMANT) {

					nf_tables_table_disable(net, table);

					table->flags |= NFT_TABLE_F_DORMANT;

				} else if (table->flags & __NFT_TABLE_F_WAS_AWAKEN) {

					table->flags &= ~NFT_TABLE_F_DORMANT;

				}

				if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_ORPHAN) {

					trans->ctx.table->flags &= ~NFT_TABLE_F_OWNER;

					trans->ctx.table->nlpid = 0;

				if (table->flags & __NFT_TABLE_F_WAS_ORPHAN) {

					table->flags &= ~NFT_TABLE_F_OWNER;

					table->nlpid = 0;

				}

				trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;

				table->flags &= ~__NFT_TABLE_F_UPDATE;

				nft_trans_destroy(trans);

			} else {

				list_del_rcu(&trans->ctx.table->list);

				list_del_rcu(&table->list);

			}

			break;

		case NFT_MSG_DELTABLE:

		case NFT_MSG_DESTROYTABLE:

			nft_clear(trans->ctx.net, trans->ctx.table);

			nft_clear(trans->ctx.net, table);

			nft_trans_destroy(trans);

			break;

		case NFT_MSG_NEWCHAIN:

			if (nft_trans_chain_update(trans)) {

				if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {

				if (!(table->flags & NFT_TABLE_F_DORMANT)) {

					nft_netdev_unregister_hooks(net,

								    &nft_trans_chain_hooks(trans),

								    true);
@@ -10618,10 +10622,9 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
					nft_trans_destroy(trans);

					break;

				}

				nft_use_dec_restore(&trans->ctx.table->use);

				nft_use_dec_restore(&table->use);

				nft_chain_del(trans->ctx.chain);

				nf_tables_unregister_hook(trans->ctx.net,

							  trans->ctx.table,

				nf_tables_unregister_hook(trans->ctx.net, table,

							  trans->ctx.chain);

			}

			break;
@@ -10631,7 +10634,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
				list_splice(&nft_trans_chain_hooks(trans),

					    &nft_trans_basechain(trans)->hook_list);

			} else {

				nft_use_inc_restore(&trans->ctx.table->use);

				nft_use_inc_restore(&table->use);

				nft_clear(trans->ctx.net, trans->ctx.chain);

			}

			nft_trans_destroy(trans);
@@ -10664,7 +10667,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
				nft_trans_destroy(trans);

				break;

			}

			nft_use_dec_restore(&trans->ctx.table->use);

			nft_use_dec_restore(&table->use);

			if (nft_trans_set_bound(trans)) {

				nft_trans_destroy(trans);

				break;
@@ -10674,7 +10677,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
			break;

		case NFT_MSG_DELSET:

		case NFT_MSG_DESTROYSET:

			nft_use_inc_restore(&trans->ctx.table->use);

			nft_use_inc_restore(&table->use);

			nft_clear(trans->ctx.net, nft_trans_set(trans));

			if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT))

				nft_map_activate(&trans->ctx, nft_trans_set(trans));
@@ -10720,13 +10723,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
				nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans));

				nft_trans_destroy(trans);

			} else {

				nft_use_dec_restore(&trans->ctx.table->use);

				nft_use_dec_restore(&table->use);

				nft_obj_del(nft_trans_obj(trans));

			}

			break;

		case NFT_MSG_DELOBJ:

		case NFT_MSG_DESTROYOBJ:

			nft_use_inc_restore(&trans->ctx.table->use);

			nft_use_inc_restore(&table->use);

			nft_clear(trans->ctx.net, nft_trans_obj(trans));

			nft_trans_destroy(trans);

			break;
@@ -10735,7 +10738,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
				nft_unregister_flowtable_net_hooks(net,

						&nft_trans_flowtable_hooks(trans));

			} else {

				nft_use_dec_restore(&trans->ctx.table->use);

				nft_use_dec_restore(&table->use);

				list_del_rcu(&nft_trans_flowtable(trans)->list);

				nft_unregister_flowtable_net_hooks(net,

						&nft_trans_flowtable(trans)->hook_list);
@@ -10747,7 +10750,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
				list_splice(&nft_trans_flowtable_hooks(trans),

					    &nft_trans_flowtable(trans)->hook_list);

			} else {

				nft_use_inc_restore(&trans->ctx.table->use);

				nft_use_inc_restore(&table->use);

				nft_clear(trans->ctx.net, nft_trans_flowtable(trans));

			}

			nft_trans_destroy(trans);