Commit cc4bc062 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Luis Henriques

netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC

commit ba378ca9 upstream.

Fix lookup of existing match/target structures in the corresponding list
by skipping the family check if NFPROTO_UNSPEC is used.

This is resulting in the allocation and insertion of one match/target
structure for each use of them. So this not only bloats memory
consumption but also severely affects the time to reload the ruleset
from the iptables-compat utility.

After this patch, iptables-compat-restore and iptables-compat take
almost the same time to reload large rulesets.

Fixes: 0ca743a5 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 34ad4e3e
...@@ -612,6 +612,13 @@ struct nft_xt { ...@@ -612,6 +612,13 @@ struct nft_xt {
static struct nft_expr_type nft_match_type; static struct nft_expr_type nft_match_type;
static bool nft_match_cmp(const struct xt_match *match,
const char *name, u32 rev, u32 family)
{
return strcmp(match->name, name) == 0 && match->revision == rev &&
(match->family == NFPROTO_UNSPEC || match->family == family);
}
static const struct nft_expr_ops * static const struct nft_expr_ops *
nft_match_select_ops(const struct nft_ctx *ctx, nft_match_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[]) const struct nlattr * const tb[])
...@@ -619,7 +626,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, ...@@ -619,7 +626,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
struct nft_xt *nft_match; struct nft_xt *nft_match;
struct xt_match *match; struct xt_match *match;
char *mt_name; char *mt_name;
__u32 rev, family; u32 rev, family;
if (tb[NFTA_MATCH_NAME] == NULL || if (tb[NFTA_MATCH_NAME] == NULL ||
tb[NFTA_MATCH_REV] == NULL || tb[NFTA_MATCH_REV] == NULL ||
...@@ -634,8 +641,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, ...@@ -634,8 +641,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
list_for_each_entry(nft_match, &nft_match_list, head) { list_for_each_entry(nft_match, &nft_match_list, head) {
struct xt_match *match = nft_match->ops.data; struct xt_match *match = nft_match->ops.data;
if (strcmp(match->name, mt_name) == 0 && if (nft_match_cmp(match, mt_name, rev, family)) {
match->revision == rev && match->family == family) {
if (!try_module_get(match->me)) if (!try_module_get(match->me))
return ERR_PTR(-ENOENT); return ERR_PTR(-ENOENT);
...@@ -687,6 +693,13 @@ static LIST_HEAD(nft_target_list); ...@@ -687,6 +693,13 @@ static LIST_HEAD(nft_target_list);
static struct nft_expr_type nft_target_type; static struct nft_expr_type nft_target_type;
static bool nft_target_cmp(const struct xt_target *tg,
const char *name, u32 rev, u32 family)
{
return strcmp(tg->name, name) == 0 && tg->revision == rev &&
(tg->family == NFPROTO_UNSPEC || tg->family == family);
}
static const struct nft_expr_ops * static const struct nft_expr_ops *
nft_target_select_ops(const struct nft_ctx *ctx, nft_target_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[]) const struct nlattr * const tb[])
...@@ -694,7 +707,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, ...@@ -694,7 +707,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
struct nft_xt *nft_target; struct nft_xt *nft_target;
struct xt_target *target; struct xt_target *target;
char *tg_name; char *tg_name;
__u32 rev, family; u32 rev, family;
if (tb[NFTA_TARGET_NAME] == NULL || if (tb[NFTA_TARGET_NAME] == NULL ||
tb[NFTA_TARGET_REV] == NULL || tb[NFTA_TARGET_REV] == NULL ||
...@@ -709,8 +722,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, ...@@ -709,8 +722,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
list_for_each_entry(nft_target, &nft_target_list, head) { list_for_each_entry(nft_target, &nft_target_list, head) {
struct xt_target *target = nft_target->ops.data; struct xt_target *target = nft_target->ops.data;
if (strcmp(target->name, tg_name) == 0 && if (nft_target_cmp(target, tg_name, rev, family)) {
target->revision == rev && target->family == family) {
if (!try_module_get(target->me)) if (!try_module_get(target->me))
return ERR_PTR(-ENOENT); return ERR_PTR(-ENOENT);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment