diff options
| author | Eric Dumazet <edumazet@google.com> | 2013-05-22 11:01:06 +0000 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 10:59:55 +0200 |
| commit | 2d023ceda68180d4df1f3da32345d7b6f3416eaf (patch) | |
| tree | 8b1230c4aeb15d98b1ac6ae83bf3320f780a3d07 | |
| parent | 38c4db1838b025d854ac7d72b58f1c910c50b0b0 (diff) | |
netfilter: xt_socket: use IP early demux
With IP early demux added in linux-3.6, we perform TCP lookup in IP
layer before iptables hooks.
We can avoid doing a second lookup in xt_socket.
Change-Id: I9a29233ab0acc40a528374910c010e383af3eaf3
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
| -rw-r--r-- | net/netfilter/xt_socket.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 030f33cd9..f4080c48e 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -107,7 +107,7 @@ xt_socket_get4_sk(const struct sk_buff *skb, struct xt_action_param *par) { const struct iphdr *iph = ip_hdr(skb); struct udphdr _hdr, *hp = NULL; - struct sock *sk; + struct sock *sk = skb->sk; __be32 uninitialized_var(daddr), uninitialized_var(saddr); __be16 uninitialized_var(dport), uninitialized_var(sport); u8 uninitialized_var(protocol); @@ -156,7 +156,8 @@ xt_socket_get4_sk(const struct sk_buff *skb, struct xt_action_param *par) #endif sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, - saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); + saddr, daddr, sport, dport, + par->in, NFT_LOOKUP_ANY); pr_debug("proto %hhu %pI4:%hu -> %pI4:%hu (orig %pI4:%hu) sock %p\n", protocol, &saddr, ntohs(sport), @@ -174,7 +175,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, struct sock *sk; sk = xt_socket_get4_sk(skb, par); - if (sk != NULL) { + if (sk) { bool wildcard; bool transparent = true; @@ -190,7 +191,8 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, (sk->sk_state == TCP_TIME_WAIT && inet_twsk(sk)->tw_transparent)); - xt_socket_put_sk(sk); + if (sk != skb->sk) + xt_socket_put_sk(sk); if (wildcard || !transparent) sk = NULL; @@ -272,7 +274,7 @@ xt_socket_get6_sk(const struct sk_buff *skb, struct xt_action_param *par) { struct ipv6hdr *iph = ipv6_hdr(skb); struct udphdr _hdr, *hp = NULL; - struct sock *sk; + struct sock *sk = skb->sk; struct in6_addr *daddr = NULL, *saddr = NULL; __be16 uninitialized_var(dport), uninitialized_var(sport); int thoff = 0, uninitialized_var(tproto); @@ -303,7 +305,9 @@ xt_socket_get6_sk(const struct sk_buff *skb, struct xt_action_param *par) } sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, - saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); + saddr, daddr, sport, dport, + par->in, NFT_LOOKUP_ANY); + pr_debug("proto %hhd %pI6:%hu -> %pI6:%hu " "(orig %pI6:%hu) sock %p\n", tproto, saddr, ntohs(sport), @@ -321,7 +325,8 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) info = (struct xt_socket_mtinfo1 *) par->matchinfo; sk = xt_socket_get6_sk(skb, par); - if (sk != NULL) { + + if (sk) { bool wildcard; bool transparent = true; @@ -337,7 +342,8 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) (sk->sk_state == TCP_TIME_WAIT && inet_twsk(sk)->tw_transparent)); - xt_socket_put_sk(sk); + if (sk != skb->sk) + xt_socket_put_sk(sk); if (wildcard || !transparent) sk = NULL; |