2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-17 01:34:00 +08:00

netfilter: conntrack: add nf_conntrack_events autodetect mode

This adds the new nf_conntrack_events=2 mode and makes it the
default.

This leverages the earlier flag in struct net to allow to avoid
the event extension as long as no event listener is active in
the namespace.

This avoids, for most cases, allocation of ct->ext area.
A followup patch will take further advantage of this by avoiding
calls down into the event framework if the extension isn't present.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2022-04-25 15:15:43 +02:00 committed by Pablo Neira Ayuso
parent b0a7ab4a77
commit 90d1daa458
4 changed files with 28 additions and 9 deletions

View File

@ -34,10 +34,13 @@ nf_conntrack_count - INTEGER (read-only)
nf_conntrack_events - BOOLEAN nf_conntrack_events - BOOLEAN
- 0 - disabled - 0 - disabled
- not 0 - enabled (default) - 1 - enabled
- 2 - auto (default)
If this option is enabled, the connection tracking code will If this option is enabled, the connection tracking code will
provide userspace with connection tracking events via ctnetlink. provide userspace with connection tracking events via ctnetlink.
The default allocates the extension if a userspace program is
listening to ctnetlink events.
nf_conntrack_expect_max - INTEGER nf_conntrack_expect_max - INTEGER
Maximum size of expectation table. Default value is Maximum size of expectation table. Default value is

View File

@ -1736,7 +1736,8 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
#ifdef CONFIG_NF_CONNTRACK_EVENTS #ifdef CONFIG_NF_CONNTRACK_EVENTS
ecache = tmpl ? nf_ct_ecache_find(tmpl) : NULL; ecache = tmpl ? nf_ct_ecache_find(tmpl) : NULL;
if (!nf_ct_ecache_ext_add(ct, ecache ? ecache->ctmask : 0, if ((ecache || net->ct.sysctl_events) &&
!nf_ct_ecache_ext_add(ct, ecache ? ecache->ctmask : 0,
ecache ? ecache->expmask : 0, ecache ? ecache->expmask : 0,
GFP_ATOMIC)) { GFP_ATOMIC)) {
nf_conntrack_free(ct); nf_conntrack_free(ct);

View File

@ -302,12 +302,27 @@ bool nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp
struct net *net = nf_ct_net(ct); struct net *net = nf_ct_net(ct);
struct nf_conntrack_ecache *e; struct nf_conntrack_ecache *e;
if (!ctmask && !expmask && net->ct.sysctl_events) { switch (net->ct.sysctl_events) {
ctmask = ~0; case 0:
expmask = ~0; /* assignment via template / ruleset? ignore sysctl. */
if (ctmask || expmask)
break;
return true;
case 2: /* autodetect: no event listener, don't allocate extension. */
if (!READ_ONCE(net->ct.ctnetlink_has_listener))
return true;
fallthrough;
case 1:
/* always allocate an extension. */
if (!ctmask && !expmask) {
ctmask = ~0;
expmask = ~0;
}
break;
default:
WARN_ON_ONCE(1);
return true;
} }
if (!ctmask && !expmask)
return false;
e = nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp); e = nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp);
if (e) { if (e) {
@ -319,7 +334,7 @@ bool nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp
} }
EXPORT_SYMBOL_GPL(nf_ct_ecache_ext_add); EXPORT_SYMBOL_GPL(nf_ct_ecache_ext_add);
#define NF_CT_EVENTS_DEFAULT 1 #define NF_CT_EVENTS_DEFAULT 2
static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT; static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
void nf_conntrack_ecache_pernet_init(struct net *net) void nf_conntrack_ecache_pernet_init(struct net *net)

View File

@ -693,7 +693,7 @@ static struct ctl_table nf_ct_sysctl_table[] = {
.mode = 0644, .mode = 0644,
.proc_handler = proc_dou8vec_minmax, .proc_handler = proc_dou8vec_minmax,
.extra1 = SYSCTL_ZERO, .extra1 = SYSCTL_ZERO,
.extra2 = SYSCTL_ONE, .extra2 = SYSCTL_TWO,
}, },
#endif #endif
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP