Commit e701001e authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nft_rbtree: allow adjacent intervals with dynamic updates

This patch fixes dynamic element updates for adjacent intervals in the
rb-tree representation.

Since elements are sorted in the rb-tree, in case of adjacent nodes with
the same key, the assumption is that an interval end node must be placed
before an interval opening.

In tree lookup operations, the idea is to search for the closer element
that is smaller than the one we're searching for. Given that we'll have
two possible matchings, we have to take the opening interval in case of
adjacent nodes.

Range merges are not trivial with the current representation,
specifically we have to check if node extensions are equal and make sure
we keep the existing internal states around.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent ef1d20e0
...@@ -35,6 +35,12 @@ static bool nft_rbtree_interval_end(const struct nft_rbtree_elem *rbe) ...@@ -35,6 +35,12 @@ static bool nft_rbtree_interval_end(const struct nft_rbtree_elem *rbe)
(*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END); (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END);
} }
static bool nft_rbtree_equal(const struct nft_set *set, const void *this,
const struct nft_rbtree_elem *interval)
{
return memcmp(this, nft_set_ext_key(&interval->ext), set->klen) == 0;
}
static bool nft_rbtree_lookup(const struct nft_set *set, const u32 *key, static bool nft_rbtree_lookup(const struct nft_set *set, const u32 *key,
const struct nft_set_ext **ext) const struct nft_set_ext **ext)
{ {
...@@ -42,6 +48,7 @@ static bool nft_rbtree_lookup(const struct nft_set *set, const u32 *key, ...@@ -42,6 +48,7 @@ static bool nft_rbtree_lookup(const struct nft_set *set, const u32 *key,
const struct nft_rbtree_elem *rbe, *interval = NULL; const struct nft_rbtree_elem *rbe, *interval = NULL;
const struct rb_node *parent; const struct rb_node *parent;
u8 genmask = nft_genmask_cur(read_pnet(&set->pnet)); u8 genmask = nft_genmask_cur(read_pnet(&set->pnet));
const void *this;
int d; int d;
spin_lock_bh(&nft_rbtree_lock); spin_lock_bh(&nft_rbtree_lock);
...@@ -49,9 +56,16 @@ static bool nft_rbtree_lookup(const struct nft_set *set, const u32 *key, ...@@ -49,9 +56,16 @@ static bool nft_rbtree_lookup(const struct nft_set *set, const u32 *key,
while (parent != NULL) { while (parent != NULL) {
rbe = rb_entry(parent, struct nft_rbtree_elem, node); rbe = rb_entry(parent, struct nft_rbtree_elem, node);
d = memcmp(nft_set_ext_key(&rbe->ext), key, set->klen); this = nft_set_ext_key(&rbe->ext);
d = memcmp(this, key, set->klen);
if (d < 0) { if (d < 0) {
parent = parent->rb_left; parent = parent->rb_left;
/* In case of adjacent ranges, we always see the high
* part of the range in first place, before the low one.
* So don't update interval if the keys are equal.
*/
if (interval && nft_rbtree_equal(set, this, interval))
continue;
interval = rbe; interval = rbe;
} else if (d > 0) } else if (d > 0)
parent = parent->rb_right; parent = parent->rb_right;
...@@ -101,9 +115,16 @@ static int __nft_rbtree_insert(const struct nft_set *set, ...@@ -101,9 +115,16 @@ static int __nft_rbtree_insert(const struct nft_set *set,
else if (d > 0) else if (d > 0)
p = &parent->rb_right; p = &parent->rb_right;
else { else {
if (nft_set_elem_active(&rbe->ext, genmask)) if (nft_set_elem_active(&rbe->ext, genmask)) {
return -EEXIST; if (nft_rbtree_interval_end(rbe) &&
!nft_rbtree_interval_end(new))
p = &parent->rb_left; p = &parent->rb_left;
else if (!nft_rbtree_interval_end(rbe) &&
nft_rbtree_interval_end(new))
p = &parent->rb_right;
else
return -EEXIST;
}
} }
} }
rb_link_node(&new->node, parent, p); rb_link_node(&new->node, parent, p);
...@@ -148,7 +169,7 @@ static void *nft_rbtree_deactivate(const struct nft_set *set, ...@@ -148,7 +169,7 @@ static void *nft_rbtree_deactivate(const struct nft_set *set,
{ {
const struct nft_rbtree *priv = nft_set_priv(set); const struct nft_rbtree *priv = nft_set_priv(set);
const struct rb_node *parent = priv->root.rb_node; const struct rb_node *parent = priv->root.rb_node;
struct nft_rbtree_elem *rbe; struct nft_rbtree_elem *rbe, *this = elem->priv;
u8 genmask = nft_genmask_cur(read_pnet(&set->pnet)); u8 genmask = nft_genmask_cur(read_pnet(&set->pnet));
int d; int d;
...@@ -166,6 +187,15 @@ static void *nft_rbtree_deactivate(const struct nft_set *set, ...@@ -166,6 +187,15 @@ static void *nft_rbtree_deactivate(const struct nft_set *set,
parent = parent->rb_left; parent = parent->rb_left;
continue; continue;
} }
if (nft_rbtree_interval_end(rbe) &&
!nft_rbtree_interval_end(this)) {
parent = parent->rb_left;
continue;
} else if (!nft_rbtree_interval_end(rbe) &&
nft_rbtree_interval_end(this)) {
parent = parent->rb_right;
continue;
}
nft_set_elem_change_active(set, &rbe->ext); nft_set_elem_change_active(set, &rbe->ext);
return rbe; return rbe;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment