Netfilter: Remove ip_conntrack_tuple_hash "ctrack" pointer
Subsystems (2)
PATCH 1/3 Netfilter: Remove ip_conntrack_tuple_hash "ctrack" pointer
Oops, these three are part of the previous chain.
Name: Remove ip_conntrack_tuple_hash "ctrack" pointer
Status: Tested under nfsim
We keep a pointer from the hash table entry into the connection tracking entry it's a part of. However, there's a spare byte in the hash entry anyway, which we can use to indicate which of the two tuples it is, and the simply use container_of() to access the conntrack.
This saves two pointers per connection tracking entry.
net/ipv4/netfilter/ip_conntrack_amanda.c +2 -2
@@ -120,7 +120,7 @@ exp->mask.src.ip =0xFFFFFFFF ; exp->mask.src.u.tcp.port =0 ; exp->mask.dst.ip =0xFFFFFFFF ; - exp->mask.dst.protonum =0xFFFF ; + exp->mask.dst.protonum =0xFF ; exp->mask.dst.u.tcp.port =0xFFFF ;if (ip_nat_amanda_hook)
@@ -149,7 +149,7 @@ .dst = { .protonum = IPPROTO_UDP }, }, .mask = { .src = { .u = { 0xFFFF } }, - .dst = { .protonum = 0xFFFF }, + .dst = { .protonum = 0xFF }, }, };
net/ipv4/netfilter/ip_conntrack_standalone.c +3 -2
@@ -66,7 +66,8 @@#ifdef CONFIG_IP_NF_CT_ACCT static unsigned int -seq_print_counters (struct seq_file *s,struct ip_conntrack_counter *counter) +seq_print_counters (struct seq_file *s, +const struct ip_conntrack_counter *counter) { return seq_printf(s, "packets=%llu bytes=%llu ", (unsigned long long)counter->packets,
@@ -99,7 +100,7 @@static int ct_seq_real_show (const struct ip_conntrack_tuple_hash *hash,struct seq_file *s) { -struct ip_conntrack *conntrack = hash->ctrack; +const struct ip_conntrack *conntrack =tuplehash_to_ctrack (hash);struct ip_conntrack_protocol *proto;MUST_BE_READ_LOCKED (&ip_conntrack_lock);
include/linux/netfilter_ipv4/ip_nat.h +2 -0
@@ -66,6 +66,8 @@struct ip_nat_seq seq[IP_CT_DIR_MAX ]; }; +struct ip_conntrack ; +/* Set up the info structure to map into this range. */ extern unsigned int ip_nat_setup_info(struct ip_conntrack *conntrack, const struct ip_nat_range *range,
include/linux/netfilter_ipv4/ip_conntrack.h +7 -0
@@ -192,6 +192,13 @@struct ip_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX ]; }; +static inline struct ip_conntrack * +tuplehash_to_ctrack (const struct ip_conntrack_tuple_hash *hash) +{ + return container_of(hash, struct ip_conntrack, + tuplehash[hash->tuple.dst.dir]); +} +/* get master conntrack via master expectation */ #define master_ct (conntr) (conntr->master)
net/ipv4/netfilter/ip_conntrack_tftp.c +2 -2
@@ -73,7 +73,7 @@ exp->mask.src.ip =0xffffffff ; exp->mask.dst.ip =0xffffffff ; exp->mask.dst.u.udp.port =0xffff ; - exp->mask.dst.protonum =0xffff ; + exp->mask.dst.protonum =0xff ; exp->expectfn =NULL ; exp->master = ct;
@@ -128,7 +128,7 @@ tftp[i].tuple.dst.protonum =IPPROTO_UDP ; tftp[i].tuple.src.u.udp.port =htons (ports[i]); - tftp[i].mask.dst.protonum =0xFFFF ; + tftp[i].mask.dst.protonum =0xFF ; tftp[i].mask.src.u.udp.port =0xFFFF ; tftp[i].max_expected =1 ; tftp[i].timeout =5 *60 ;/* 5 minutes */
net/ipv4/netfilter/ip_conntrack_ftp.c +2 -2
@@ -418,7 +418,7 @@ exp->tuple.dst.protonum =IPPROTO_TCP ; exp->mask = ((struct ip_conntrack_tuple ) { {0xFFFFFFFF , {0 } }, - {0xFFFFFFFF , { .tcp = {0xFFFF } },0xFFFF }}); + {0xFFFFFFFF , { .tcp = {0xFFFF } },0xFF }}); exp->expectfn =NULL ; exp->master = ct;
@@ -473,7 +473,7 @@ ftp[i].tuple.src.u.tcp.port =htons (ports[i]); ftp[i].tuple.dst.protonum =IPPROTO_TCP ; ftp[i].mask.src.u.tcp.port =0xFFFF ; - ftp[i].mask.dst.protonum =0xFFFF ; + ftp[i].mask.dst.protonum =0xFF ; ftp[i].max_expected =1 ; ftp[i].timeout =5 *60 ;/* 5 minutes */ ftp[i].me =THIS_MODULE ;
net/ipv4/netfilter/ip_conntrack_proto_icmp.c +1 -1
@@ -196,7 +196,7 @@ }/* Update skb to refer to this connection */ - skb->nfct = &h->ctrack->ct_general; + skb->nfct = &tuplehash_to_ctrack (h)->ct_general; skb->nfctinfo = *ctinfo;return -NF_ACCEPT ; }
net/ipv4/netfilter/ip_conntrack_irc.c +2 -2
@@ -215,7 +215,7 @@ IPPROTO_TCP }}); exp->mask = ((struct ip_conntrack_tuple ) { {0 , {0 } }, - {0xFFFFFFFF , { .tcp = {0xFFFF } },0xFFFF }}); + {0xFFFFFFFF , { .tcp = {0xFFFF } },0xFF }}); exp->expectfn =NULL ; exp->master = ct;if (ip_nat_irc_hook)
@@ -265,7 +265,7 @@ hlpr->tuple.src.u.tcp.port =htons (ports[i]); hlpr->tuple.dst.protonum =IPPROTO_TCP ; hlpr->mask.src.u.tcp.port =0xFFFF ; - hlpr->mask.dst.protonum =0xFFFF ; + hlpr->mask.dst.protonum =0xFF ; hlpr->max_expected = max_dcc_channels; hlpr->timeout = dcc_timeout; hlpr->me =THIS_MODULE ;
include/linux/netfilter_ipv4/ip_conntrack_tuple.h +5 -5
@@ -64,7 +64,10 @@ } u;/* The protocol. */ -u_int16_t protonum; +u8 protonum; + +/* The direction (for tuplehash) */ +u8 dir; } dst; };
@@ -94,7 +97,7 @@#define CTINFO2DIR (ctinfo) ((ctinfo) >= IP_CT_IS_REPLY ? IP_CT_DIR_REPLY : IP_CT_DIR_ORIGINAL)/* If we're the first tuple, it's the original dir. */ -#define DIRECTION (h) ((enum ip_conntrack_dir)(&(h)->ctrack->tuplehash[1] == (h))) +#define DIRECTION (h) ((enum ip_conntrack_dir)(h)->tuple.dst.dir)/* Connections have two entries in the hash table: one for each way */ struct ip_conntrack_tuple_hash
@@ -102,9 +105,6 @@struct list_head list; struct ip_conntrack_tuple tuple; - -/* this == &ctrack->tuplehash[DIRECTION(this)]. */ - struct ip_conntrack *ctrack; };#endif /* __KERNEL__ */
net/ipv4/netfilter/ip_conntrack_core.c +35 -28
186 lines not on this page · raw message
Re: [PATCH 1/3] Netfilter: Remove ip_conntrack_tuple_hash "ctrack"
Quoted 6 lines · Rusty Russell
Index:
linux-2.6.10-bk13-Netfilter/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
===================================================================include/linux/netfilter_ipv4/ip_conntrack_tuple.h +0
-0@@ -64,7 +64,10 @@ } u;
include/linux/netfilter_ipv4/ip_conntrack_tuple.h line 73
Quoted 10 lines
include/linux/netfilter_ipv4/ip_conntrack_tuple.h +4
-1/* The protocol. */ -u_int16_t protonum; +u8 protonum; + +/* The direction (for tuplehash) */ +u8 dir; } dst; };
Doesn't this break the iptables conntrack module on big-endian systems?
Andreas.
Signature · 4 lines
Andreas Schwab, SuSE Labs, [email protected] SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5 "And now for something completely different."
Re: [PATCH 1/3] Netfilter: Remove ip_conntrack_tuple_hash "ctrack"
Quoted 9 lines · Andreas Schwab
Quoted 7 lines · Rusty Russell
Index:
linux-2.6.10-bk13-Netfilter/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
===================================================================include/linux/netfilter_ipv4/ip_conntrack_tuple.h +0
-0@@ -64,7 +64,10 @@ } u;
Quoted 11 lines
include/linux/netfilter_ipv4/ip_conntrack_tuple.h line 73
Quoted 9 lines
include/linux/netfilter_ipv4/ip_conntrack_tuple.h +4
-1/* The protocol. */ -u_int16_t protonum; +u8 protonum; + +/* The direction (for tuplehash) */ +u8 dir; } dst; };Doesn't this break the iptables conntrack module on big-endian systems?
I don't see why... we only need 8 bits for the protocol, and we used to use 16 (because we had them). I wanted to add a field, so I reduced protonum to 8 bits and added another 8 bit field.
Rusty.
Signature · 1 line
A bad analogy is like a leaky screwdriver -- Richard Braakman
Re: [PATCH 1/3] Netfilter: Remove ip_conntrack_tuple_hash "ctrack"
Quoted 22 lines · Rusty Russell
Quoted 9 lines · Andreas Schwab
Quoted 7 lines · Rusty Russell
Index:
linux-2.6.10-bk13-Netfilter/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
===================================================================include/linux/netfilter_ipv4/ip_conntrack_tuple.h +0
-0@@ -64,7 +64,10 @@ } u;Quoted 11 lines
include/linux/netfilter_ipv4/ip_conntrack_tuple.h line 73
Quoted 9 lines
include/linux/netfilter_ipv4/ip_conntrack_tuple.h +4
-1/* The protocol. */ -u_int16_t protonum; +u8 protonum; + +/* The direction (for tuplehash) */ +u8 dir; } dst; };Doesn't this break the iptables conntrack module on big-endian systems?
Quoted 3 lines
I don't see why... we only need 8 bits for the protocol, and we used to use 16 (because we had them). I wanted to add a field, so I reduced protonum to 8 bits and added another 8 bit field.
iptables uses this structure internally. If it also uses it inside a kernel interface then you have broken the kernel ABI.
Andreas.
Signature · 4 lines
Andreas Schwab, SuSE Labs, [email protected] SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5 "And now for something completely different."
Re: [PATCH 1/3] Netfilter: Remove ip_conntrack_tuple_hash "ctrack"
Quoted 11 lines · Andreas Schwab
Quoted 6 lines · Rusty Russell
Quoted 1 line · Andreas Schwab
Doesn't this break the iptables conntrack module on big-endian systems?
I don't see why... we only need 8 bits for the protocol, and we used to use 16 (because we had them). I wanted to add a field, so I reduced protonum to 8 bits and added another 8 bit field.
iptables uses this structure internally. If it also uses it inside a kernel interface then you have broken the kernel ABI.
Sorry, I misunderstood. You're right.
Name: Avoid breaking userspace due to tuple change
Status: Trivial, Compiled
Andreas Schwab <[email protected]> points out that the ipt_conntrack match exposes "struct ip_conntrack_tuple" to userspace, and we changed it recently. Make it use a "special" one, to avoid breaking compatibility.
include/linux/netfilter_ipv4/ipt_conntrack.h +22 -1
@@ -22,11 +22,32 @@#define IPT_CONNTRACK_STATUS 0x40#define IPT_CONNTRACK_EXPIRES 0x80 +/* This is exposed to userspace, so remains frozen in time. */ +struct ip_conntrack_old_tuple +{ +struct { +__u32 ip; +union { +__u16 all; + } u; + } src; + +struct { +__u32 ip; +union { +__u16 all; + } u; + +/* The protocol. */ +u16 protonum; + } dst; +}; +struct ipt_conntrack_info {unsigned int statemask, statusmask; -struct ip_conntrack_tuple tuple[IP_CT_DIR_MAX ]; +struct ip_conntrack_old_tuple tuple[IP_CT_DIR_MAX ];struct in_addr sipmsk[IP_CT_DIR_MAX ], dipmsk[IP_CT_DIR_MAX ];unsigned long expires_min, expires_max;
Signature · 1 line
A bad analogy is like a leaky screwdriver -- Richard Braakman
Re: [PATCH 1/3] Netfilter: Remove ip_conntrack_tuple_hash "ctrack"
Quoted 8 lines · On Tue, 25 Jan 2005 18:46:33 +1100 Rusty Russell <[email protected]> wrote:
Name: Avoid breaking userspace due to tuple change
Status: Trivial, CompiledSigned-off-by Rusty Russell <[email protected]>Andreas Schwab <[email protected]> points out that the
ipt_conntrackmatch exposes "structip_conntrack_tuple" to userspace, and we changed it recently. Make it use a "special" one, to avoid breaking compatibility.
Applied, thanks Rusty.