Skip to contentSkip to conversation

Patch "netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC" has been added to the 3.14-stable tree

PATCH [email protected] 1 participant 1 message Oct 17, 2015

Subsystems (3)
Networking Stable branch netfilter
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
netfilter-nft_compat-skip-family-comparison-in-case-of-nfproto_unspec.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From ba378ca9c04a5fc1b2cf0f0274a9d02eb3d1bad9 Mon Sep 17 00:00:00 2001

From: Pablo Neira Ayuso <[email protected]>
Date: Mon, 14 Sep 2015 18:04:09 +0200
Subject: netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC

From: Pablo Neira Ayuso <[email protected]>

commit ba378ca9c04a5fc1b2cf0f0274a9d02eb3d1bad9 upstream.

Fix lookup of existing match/target structures in the corresponding list by skipping the family check if NFPROTO_UNSPEC is used.

This is resulting in the allocation and insertion of one match/target structure for each use of them. So this not only bloats memory consumption but also severely affects the time to reload the ruleset from the iptables-compat utility.

After this patch, iptables-compat-restore and iptables-compat take almost the same time to reload large rulesets.

Fixes 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 net/netfilter/nft_compat.c |   24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)
net/netfilter/nft_compat.c +18 -6
@@ -594,6 +594,13 @@ struct nft_xt {
 
 static struct nft_expr_type nft_match_type;
 
+static bool nft_match_cmp(const struct xt_match *match,
+			  const char *name, u32 rev, u32 family)
+{
+	return strcmp(match->name, name) == 0 && match->revision == rev &&
+	       (match->family == NFPROTO_UNSPEC || match->family == family);
+}
+
 static const struct nft_expr_ops *
 nft_match_select_ops(const struct nft_ctx *ctx,
 		     const struct nlattr * const tb[])

@@ -601,7 +608,7 @@ nft_match_select_ops(const struct nft_ct
 	struct nft_xt *nft_match;
 	struct xt_match *match;
 	char *mt_name;
-	__u32 rev, family;
+	u32 rev, family;
 
 	if (tb[NFTA_MATCH_NAME] == NULL ||
 	    tb[NFTA_MATCH_REV] == NULL ||

@@ -616,8 +623,7 @@ nft_match_select_ops(const struct nft_ct
 	list_for_each_entry(nft_match, &nft_match_list, head) {
 		struct xt_match *match = nft_match->ops.data;
 
-		if (strcmp(match->name, mt_name) == 0 &&
-		    match->revision == rev && match->family == family) {
+		if (nft_match_cmp(match, mt_name, rev, family)) {
 			if (!try_module_get(match->me))
 				return ERR_PTR(-ENOENT);
 

@@ -669,6 +675,13 @@ static LIST_HEAD(nft_target_list);
 
 static struct nft_expr_type nft_target_type;
 
+static bool nft_target_cmp(const struct xt_target *tg,
+			   const char *name, u32 rev, u32 family)
+{
+	return strcmp(tg->name, name) == 0 && tg->revision == rev &&
+	       (tg->family == NFPROTO_UNSPEC || tg->family == family);
+}
+
 static const struct nft_expr_ops *
 nft_target_select_ops(const struct nft_ctx *ctx,
 		      const struct nlattr * const tb[])

@@ -676,7 +689,7 @@ nft_target_select_ops(const struct nft_c
 	struct nft_xt *nft_target;
 	struct xt_target *target;
 	char *tg_name;
-	__u32 rev, family;
+	u32 rev, family;
 
 	if (tb[NFTA_TARGET_NAME] == NULL ||
 	    tb[NFTA_TARGET_REV] == NULL ||

@@ -691,8 +704,7 @@ nft_target_select_ops(const struct nft_c
 	list_for_each_entry(nft_target, &nft_target_list, head) {
 		struct xt_target *target = nft_target->ops.data;
 
-		if (strcmp(target->name, tg_name) == 0 &&
-		    target->revision == rev && target->family == family) {
+		if (nft_target_cmp(target, tg_name, rev, family)) {
 			if (!try_module_get(target->me))
 				return ERR_PTR(-ENOENT);

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/netfilter-nft_compat-skip-family-comparison-in-case-of-nfproto_unspec.patch queue-3.14/netfilter-nf_conntrack-support-expectations-in-different-zones.patch queue-3.14/netfilter-ctnetlink-put-back-references-to-master-ct-and-expect-objects.patch