projects / openwrt / staging / yousong.git / blob
? search:


5e339865d38bfdb541ca50284350ee27d4284954
[openwrt/staging/yousong.git] /
1 From b0f38338aef2dae5ade3c16acf713737e3b15a73 Mon Sep 17 00:00:00 2001
2 From: Florian Westphal <fw@strlen.de>
3 Date: Sun, 3 Dec 2017 00:58:47 +0100
4 Subject: [PATCH 05/11] netfilter: reduce size of hook entry point locations
5
6 struct net contains:
7
8 struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
9
10 which store the hook entry point locations for the various protocol
11 families and the hooks.
12
13 Using array results in compact c code when doing accesses, i.e.
14 x = rcu_dereference(net->nf.hooks[pf][hook]);
15
16 but its also wasting a lot of memory, as most families are
17 not used.
18
19 So split the array into those families that are used, which
20 are only 5 (instead of 13). In most cases, the 'pf' argument is
21 constant, i.e. gcc removes switch statement.
22
23 struct net before:
24 /* size: 5184, cachelines: 81, members: 46 */
25 after:
26 /* size: 4672, cachelines: 73, members: 46 */
27
28 Signed-off-by: Florian Westphal <fw@strlen.de>
29 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
30 ---
31 include/linux/netfilter.h | 24 ++++++++++++++++++++++--
32 include/net/netns/netfilter.h | 6 +++++-
33 net/bridge/br_netfilter_hooks.c | 2 +-
34 net/netfilter/core.c | 38 ++++++++++++++++++++++++++++++--------
35 net/netfilter/nf_queue.c | 21 +++++++++++++++++++--
36 5 files changed, 77 insertions(+), 14 deletions(-)
37
38 --- a/include/linux/netfilter.h
39 +++ b/include/linux/netfilter.h
40 @@ -195,7 +195,7 @@ static inline int nf_hook(u_int8_t pf, u
41 struct net_device *indev, struct net_device *outdev,
42 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
43 {
44 - struct nf_hook_entries *hook_head;
45 + struct nf_hook_entries *hook_head = NULL;
46 int ret = 1;
47
48 #ifdef HAVE_JUMP_LABEL
49 @@ -206,7 +206,27 @@ static inline int nf_hook(u_int8_t pf, u
50 #endif
51
52 rcu_read_lock();
53 - hook_head = rcu_dereference(net->nf.hooks[pf][hook]);
54 + switch (pf) {
55 + case NFPROTO_IPV4:
56 + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
57 + break;
58 + case NFPROTO_IPV6:
59 + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
60 + break;
61 + case NFPROTO_ARP:
62 + hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
63 + break;
64 + case NFPROTO_BRIDGE:
65 + hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
66 + break;
67 + case NFPROTO_DECNET:
68 + hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
69 + break;
70 + default:
71 + WARN_ON_ONCE(1);
72 + break;
73 + }
74 +
75 if (hook_head) {
76 struct nf_hook_state state;
77
78 --- a/include/net/netns/netfilter.h
79 +++ b/include/net/netns/netfilter.h
80 @@ -17,7 +17,11 @@ struct netns_nf {
81 #ifdef CONFIG_SYSCTL
82 struct ctl_table_header *nf_log_dir_header;
83 #endif
84 - struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
85 + struct nf_hook_entries __rcu *hooks_ipv4[NF_MAX_HOOKS];
86 + struct nf_hook_entries __rcu *hooks_ipv6[NF_MAX_HOOKS];
87 + struct nf_hook_entries __rcu *hooks_arp[NF_MAX_HOOKS];
88 + struct nf_hook_entries __rcu *hooks_bridge[NF_MAX_HOOKS];
89 + struct nf_hook_entries __rcu *hooks_decnet[NF_MAX_HOOKS];
90 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
91 bool defrag_ipv4;
92 #endif
93 --- a/net/bridge/br_netfilter_hooks.c
94 +++ b/net/bridge/br_netfilter_hooks.c
95 @@ -988,7 +988,7 @@ int br_nf_hook_thresh(unsigned int hook,
96 unsigned int i;
97 int ret;
98
99 - e = rcu_dereference(net->nf.hooks[NFPROTO_BRIDGE][hook]);
100 + e = rcu_dereference(net->nf.hooks_bridge[hook]);
101 if (!e)
102 return okfn(net, sk, skb);
103
104 --- a/net/netfilter/core.c
105 +++ b/net/netfilter/core.c
106 @@ -264,8 +264,23 @@ out_assign:
107
108 static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg)
109 {
110 - if (reg->pf != NFPROTO_NETDEV)
111 - return net->nf.hooks[reg->pf]+reg->hooknum;
112 + switch (reg->pf) {
113 + case NFPROTO_NETDEV:
114 + break;
115 + case NFPROTO_ARP:
116 + return net->nf.hooks_arp + reg->hooknum;
117 + case NFPROTO_BRIDGE:
118 + return net->nf.hooks_bridge + reg->hooknum;
119 + case NFPROTO_IPV4:
120 + return net->nf.hooks_ipv4 + reg->hooknum;
121 + case NFPROTO_IPV6:
122 + return net->nf.hooks_ipv6 + reg->hooknum;
123 + case NFPROTO_DECNET:
124 + return net->nf.hooks_decnet + reg->hooknum;
125 + default:
126 + WARN_ON_ONCE(1);
127 + return NULL;
128 + }
129
130 #ifdef CONFIG_NETFILTER_INGRESS
131 if (reg->hooknum == NF_NETDEV_INGRESS) {
132 @@ -534,14 +549,21 @@ void (*nf_nat_decode_session_hook)(struc
133 EXPORT_SYMBOL(nf_nat_decode_session_hook);
134 #endif
135
136 -static int __net_init netfilter_net_init(struct net *net)
137 +static void __net_init __netfilter_net_init(struct nf_hook_entries *e[NF_MAX_HOOKS])
138 {
139 - int i, h;
140 + int h;
141
142 - for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
143 - for (h = 0; h < NF_MAX_HOOKS; h++)
144 - RCU_INIT_POINTER(net->nf.hooks[i][h], NULL);
145 - }
146 + for (h = 0; h < NF_MAX_HOOKS; h++)
147 + RCU_INIT_POINTER(e[h], NULL);
148 +}
149 +
150 +static int __net_init netfilter_net_init(struct net *net)
151 +{
152 + __netfilter_net_init(net->nf.hooks_ipv4);
153 + __netfilter_net_init(net->nf.hooks_ipv6);
154 + __netfilter_net_init(net->nf.hooks_arp);
155 + __netfilter_net_init(net->nf.hooks_bridge);
156 + __netfilter_net_init(net->nf.hooks_decnet);
157
158 #ifdef CONFIG_PROC_FS
159 net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
160 --- a/net/netfilter/nf_queue.c
161 +++ b/net/netfilter/nf_queue.c
162 @@ -202,6 +202,23 @@ repeat:
163 return NF_ACCEPT;
164 }
165
166 +static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
167 +{
168 + switch (pf) {
169 + case NFPROTO_BRIDGE:
170 + return rcu_dereference(net->nf.hooks_bridge[hooknum]);
171 + case NFPROTO_IPV4:
172 + return rcu_dereference(net->nf.hooks_ipv4[hooknum]);
173 + case NFPROTO_IPV6:
174 + return rcu_dereference(net->nf.hooks_ipv6[hooknum]);
175 + default:
176 + WARN_ON_ONCE(1);
177 + return NULL;
178 + }
179 +
180 + return NULL;
181 +}
182 +
183 /* Caller must hold rcu read-side lock */
184 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
185 {
186 @@ -217,12 +234,12 @@ void nf_reinject(struct nf_queue_entry *
187 net = entry->state.net;
188 pf = entry->state.pf;
189
190 - hooks = rcu_dereference(net->nf.hooks[pf][entry->state.hook]);
191 + hooks = nf_hook_entries_head(net, pf, entry->state.hook);
192
193 nf_queue_entry_release_refs(entry);
194
195 i = entry->hook_index;
196 - if (WARN_ON_ONCE(i >= hooks->num_hook_entries)) {
197 + if (WARN_ON_ONCE(!hooks || i >= hooks->num_hook_entries)) {
198 kfree_skb(skb);
199 kfree(entry);
200 return;
Yousong Zhou staging tree