netfilter: nft_xfrm: track register operations

Check if the destination register already contains the data that this
xfrm expression performs. This allows to skip this redundant operation.
If the destination contains a different selector, update the register
tracking information.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c
index cbbbc4ecad3aed11b584db94f6bc6543ce09fe34..becb88fa4e9b961ee768137a97d3a46e47d5fcd4 100644 (file)
--- a/net/netfilter/nft_xfrm.c
+++ b/net/netfilter/nft_xfrm.c
@@ -27,6 +27,7 @@ struct nft_xfrm {
        u8                      dreg;
        u8                      dir;
        u8                      spnum;
+       u8                      len;
 };
 
 static int nft_xfrm_get_init(const struct nft_ctx *ctx,
@@ -86,6 +87,7 @@ static int nft_xfrm_get_init(const struct nft_ctx *ctx,
 
        priv->spnum = spnum;
 
+       priv->len = len;
        return nft_parse_register_store(ctx, tb[NFTA_XFRM_DREG], &priv->dreg,
                                        NULL, NFT_DATA_VALUE, len);
 }
@@ -252,6 +254,31 @@ static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *e
        return nft_chain_validate_hooks(ctx->chain, hooks);
 }
 
+static bool nft_xfrm_reduce(struct nft_regs_track *track,
+                           const struct nft_expr *expr)
+{
+       const struct nft_xfrm *priv = nft_expr_priv(expr);
+       const struct nft_xfrm *xfrm;
+
+       if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       xfrm = nft_expr_priv(track->regs[priv->dreg].selector);
+       if (priv->key != xfrm->key ||
+           priv->dreg != xfrm->dreg ||
+           priv->dir != xfrm->dir ||
+           priv->spnum != xfrm->spnum) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       if (!track->regs[priv->dreg].bitwise)
+               return true;
+
+       return nft_expr_reduce_bitwise(track, expr);
+}
 
 static struct nft_expr_type nft_xfrm_type;
 static const struct nft_expr_ops nft_xfrm_get_ops = {
@@ -261,6 +288,7 @@ static const struct nft_expr_ops nft_xfrm_get_ops = {
        .init           = nft_xfrm_get_init,
        .dump           = nft_xfrm_get_dump,
        .validate       = nft_xfrm_validate,
+       .reduce         = nft_xfrm_reduce,
 };
 
 static struct nft_expr_type nft_xfrm_type __read_mostly = {