netfilter: nf_tables: do not store verdict in traceinfo structure

Just pass it as argument to nft_trace_notify. Stack is reduced by 8 bytes:

nf_tables_core.c:256 nft_do_chain    312     static

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index cab351928cd212e25f20ce141ca9022c8cc8d455..693469ecfa54940e41931d2fa9e47d5bb99c162f 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1410,7 +1410,6 @@ void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
  *     @packet_dumped: packet headers sent in a previous traceinfo message
  *     @basechain: base chain currently processed
  *     @rule:  rule that was evaluated
- *     @verdict: verdict given by rule
  */
 struct nft_traceinfo {
        bool                            trace;
@@ -1420,14 +1419,13 @@ struct nft_traceinfo {
        u32                             skbid;
        const struct nft_base_chain     *basechain;
        const struct nft_rule_dp        *rule;
-       const struct nft_verdict        *verdict;
 };
 
 void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
-                   const struct nft_verdict *verdict,
                    const struct nft_chain *basechain);
 
 void nft_trace_notify(const struct nft_pktinfo *pkt,
+                     const struct nft_verdict *verdict,
                      struct nft_traceinfo *info);
 
 #define MODULE_ALIAS_NFT_CHAIN(family, name) \

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 776eb2b9f63298424f35c0807fdd41a2b4d46bfc..6debe8b2623f2de03f8fe7027a660d25e33ecb2f 100644 (file)
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -42,6 +42,7 @@ static inline void nf_skip_indirect_calls_enable(void) { }
 #endif
 
 static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt,
+                                       const struct nft_verdict *verdict,
                                        struct nft_traceinfo *info,
                                        enum nft_trace_types type)
 {
@@ -50,10 +51,11 @@ static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt,
 
        info->type = type;
 
-       nft_trace_notify(pkt, info);
+       nft_trace_notify(pkt, verdict, info);
 }
 
 static inline void nft_trace_packet(const struct nft_pktinfo *pkt,
+                                   struct nft_verdict *verdict,
                                    struct nft_traceinfo *info,
                                    const struct nft_rule_dp *rule,
                                    enum nft_trace_types type)
@@ -61,7 +63,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt,
        if (static_branch_unlikely(&nft_trace_enabled)) {
                info->nf_trace = pkt->skb->nf_trace;
                info->rule = rule;
-               __nft_trace_packet(pkt, info, type);
+               __nft_trace_packet(pkt, verdict, info, type);
        }
 }
 
@@ -129,7 +131,7 @@ static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt,
                break;
        }
 
-       __nft_trace_packet(pkt, info, type);
+       __nft_trace_packet(pkt, &regs->verdict, info, type);
 }
 
 static inline void nft_trace_verdict(const struct nft_pktinfo *pkt,
@@ -264,7 +266,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv)
 
        info.trace = false;
        if (static_branch_unlikely(&nft_trace_enabled))
-               nft_trace_init(&info, pkt, &regs.verdict, basechain);
+               nft_trace_init(&info, pkt, basechain);
 do_chain:
        if (genbit)
                blob = rcu_dereference(chain->blob_gen_1);
@@ -296,7 +298,7 @@ next_rule:
                        nft_trace_copy_nftrace(pkt, &info);
                        continue;
                case NFT_CONTINUE:
-                       nft_trace_packet(pkt, &info, rule,
+                       nft_trace_packet(pkt, &regs.verdict,  &info, rule,
                                         NFT_TRACETYPE_RULE);
                        continue;
                }
@@ -336,7 +338,7 @@ next_rule:
                goto next_rule;
        }
 
-       nft_trace_packet(pkt, &info, NULL, NFT_TRACETYPE_POLICY);
+       nft_trace_packet(pkt, &regs.verdict, &info, NULL, NFT_TRACETYPE_POLICY);
 
        if (static_branch_unlikely(&nft_counters_enabled))
                nft_update_chain_stats(basechain, pkt);

diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c
index 0a0dcf2587fdc812a68fde20f1912b6ce5310eee..e635104a42be15f16e2b2d91d9edba34c5c5879f 100644 (file)
--- a/net/netfilter/nf_tables_trace.c
+++ b/net/netfilter/nf_tables_trace.c
@@ -124,6 +124,7 @@ static int nf_trace_fill_pkt_info(struct sk_buff *nlskb,
 }
 
 static int nf_trace_fill_rule_info(struct sk_buff *nlskb,
+                                  const struct nft_verdict *verdict,
                                   const struct nft_traceinfo *info)
 {
        if (!info->rule || info->rule->is_last)
@@ -135,7 +136,7 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb,
         * Since no rule matched, the ->rule pointer is invalid.
         */
        if (info->type == NFT_TRACETYPE_RETURN &&
-           info->verdict->code == NFT_CONTINUE)
+           verdict->code == NFT_CONTINUE)
                return 0;
 
        return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE,
@@ -143,7 +144,8 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb,
                            NFTA_TRACE_PAD);
 }
 
-static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info)
+static bool nft_trace_have_verdict_chain(const struct nft_verdict *verdict,
+                                        struct nft_traceinfo *info)
 {
        switch (info->type) {
        case NFT_TRACETYPE_RETURN:
@@ -153,7 +155,7 @@ static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info)
                return false;
        }
 
-       switch (info->verdict->code) {
+       switch (verdict->code) {
        case NFT_JUMP:
        case NFT_GOTO:
                break;
@@ -184,6 +186,7 @@ static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *i
 }
 
 void nft_trace_notify(const struct nft_pktinfo *pkt,
+                     const struct nft_verdict *verdict,
                      struct nft_traceinfo *info)
 {
        const struct nft_chain *chain;
@@ -217,8 +220,8 @@ void nft_trace_notify(const struct nft_pktinfo *pkt,
                nla_total_size(sizeof(u32)) +           /* nfproto */
                nla_total_size(sizeof(u32));            /* policy */
 
-       if (nft_trace_have_verdict_chain(info))
-               size += nla_total_size(strlen(info->verdict->chain->name)); /* jump target */
+       if (nft_trace_have_verdict_chain(verdict, info))
+               size += nla_total_size(strlen(verdict->chain->name)); /* jump target */
 
        skb = nlmsg_new(size, GFP_ATOMIC);
        if (!skb)
@@ -245,7 +248,7 @@ void nft_trace_notify(const struct nft_pktinfo *pkt,
        if (nla_put_string(skb, NFTA_TRACE_TABLE, chain->table->name))
                goto nla_put_failure;
 
-       if (nf_trace_fill_rule_info(skb, info))
+       if (nf_trace_fill_rule_info(skb, verdict, info))
                goto nla_put_failure;
 
        switch (info->type) {
@@ -254,11 +257,11 @@ void nft_trace_notify(const struct nft_pktinfo *pkt,
                break;
        case NFT_TRACETYPE_RETURN:
        case NFT_TRACETYPE_RULE:
-               if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, info->verdict))
+               if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, verdict))
                        goto nla_put_failure;
 
                /* pkt->skb undefined iff NF_STOLEN, disable dump */
-               if (info->verdict->code == NF_STOLEN)
+               if (verdict->code == NF_STOLEN)
                        info->packet_dumped = true;
                else
                        mark = pkt->skb->mark;
@@ -295,7 +298,6 @@ void nft_trace_notify(const struct nft_pktinfo *pkt,
 }
 
 void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
-                   const struct nft_verdict *verdict,
                    const struct nft_chain *chain)
 {
        static siphash_key_t trace_key __read_mostly;
@@ -305,7 +307,6 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
        info->trace = true;
        info->nf_trace = pkt->skb->nf_trace;
        info->packet_dumped = false;
-       info->verdict = verdict;
 
        net_get_random_once(&trace_key, sizeof(trace_key));