netfilter: conntrack: merge ipv4+ipv6 confirm functions

No need to have distinct functions.  After merge, ipv6 can avoid
protooff computation if the connection neither needs sequence adjustment
nor helper invocation -- this is the normal case.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index b2b9de70d9f4d4ff3658205fb9c6d7c07a997004..71d1269fe4d4f0345829474d5ee555ef6f4325b5 100644 (file)
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -71,8 +71,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
        return ret;
 }
 
-unsigned int nf_confirm(struct sk_buff *skb, unsigned int protoff,
-                       struct nf_conn *ct, enum ip_conntrack_info ctinfo);
+unsigned int nf_confirm(void *priv, struct sk_buff *skb, const struct nf_hook_state *state);
 
 void print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
                 const struct nf_conntrack_l4proto *proto);

diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 73242962be5d748dcf698a74267a7a70455eda91..5c5dd437f1c25b93b5a23ae96578ee7a0bf1d991 100644 (file)
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -366,42 +366,12 @@ static int nf_ct_bridge_refrag_post(struct net *net, struct sock *sk,
        return br_dev_queue_push_xmit(net, sk, skb);
 }
 
-static unsigned int nf_ct_bridge_confirm(struct sk_buff *skb)
-{
-       enum ip_conntrack_info ctinfo;
-       struct nf_conn *ct;
-       int protoff;
-
-       ct = nf_ct_get(skb, &ctinfo);
-       if (!ct || ctinfo == IP_CT_RELATED_REPLY)
-               return nf_conntrack_confirm(skb);
-
-       switch (skb->protocol) {
-       case htons(ETH_P_IP):
-               protoff = skb_network_offset(skb) + ip_hdrlen(skb);
-               break;
-       case htons(ETH_P_IPV6): {
-               unsigned char pnum = ipv6_hdr(skb)->nexthdr;
-               __be16 frag_off;
-
-               protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
-                                          &frag_off);
-               if (protoff < 0 || (frag_off & htons(~0x7)) != 0)
-                       return nf_conntrack_confirm(skb);
-               }
-               break;
-       default:
-               return NF_ACCEPT;
-       }
-       return nf_confirm(skb, protoff, ct, ctinfo);
-}
-
 static unsigned int nf_ct_bridge_post(void *priv, struct sk_buff *skb,
                                      const struct nf_hook_state *state)
 {
        int ret;
 
-       ret = nf_ct_bridge_confirm(skb);
+       ret = nf_confirm(priv, skb, state);
        if (ret != NF_ACCEPT)
                return ret;
 

diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 895b09cbd7cfca746c771577424885298a0cb55c..99323fb12d0f5196e0f00fdecea540c53c420b1e 100644 (file)
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -121,17 +121,61 @@ const struct nf_conntrack_l4proto *nf_ct_l4proto_find(u8 l4proto)
 };
 EXPORT_SYMBOL_GPL(nf_ct_l4proto_find);
 
-unsigned int nf_confirm(struct sk_buff *skb, unsigned int protoff,
-                       struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+static bool in_vrf_postrouting(const struct nf_hook_state *state)
+{
+#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
+       if (state->hook == NF_INET_POST_ROUTING &&
+           netif_is_l3_master(state->out))
+               return true;
+#endif
+       return false;
+}
+
+unsigned int nf_confirm(void *priv,
+                       struct sk_buff *skb,
+                       const struct nf_hook_state *state)
 {
        const struct nf_conn_help *help;
+       enum ip_conntrack_info ctinfo;
+       unsigned int protoff;
+       struct nf_conn *ct;
+       bool seqadj_needed;
+       __be16 frag_off;
+       u8 pnum;
+
+       ct = nf_ct_get(skb, &ctinfo);
+       if (!ct || in_vrf_postrouting(state))
+               return NF_ACCEPT;
 
        help = nfct_help(ct);
+
+       seqadj_needed = test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && !nf_is_loopback_packet(skb);
+       if (!help && !seqadj_needed)
+               return nf_conntrack_confirm(skb);
+
+       /* helper->help() do not expect ICMP packets */
+       if (ctinfo == IP_CT_RELATED_REPLY)
+               return nf_conntrack_confirm(skb);
+
+       switch (nf_ct_l3num(ct)) {
+       case NFPROTO_IPV4:
+               protoff = skb_network_offset(skb) + ip_hdrlen(skb);
+               break;
+       case NFPROTO_IPV6:
+               pnum = ipv6_hdr(skb)->nexthdr;
+               protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum, &frag_off);
+               if (protoff < 0 || (frag_off & htons(~0x7)) != 0)
+                       return nf_conntrack_confirm(skb);
+               break;
+       default:
+               return nf_conntrack_confirm(skb);
+       }
+
        if (help) {
                const struct nf_conntrack_helper *helper;
                int ret;
 
-               /* rcu_read_lock()ed by nf_hook_thresh */
+               /* rcu_read_lock()ed by nf_hook */
                helper = rcu_dereference(help->helper);
                if (helper) {
                        ret = helper->help(skb,
@@ -142,12 +186,10 @@ unsigned int nf_confirm(struct sk_buff *skb, unsigned int protoff,
                }
        }
 
-       if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
-           !nf_is_loopback_packet(skb)) {
-               if (!nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {
-                       NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
-                       return NF_DROP;
-               }
+       if (seqadj_needed &&
+           !nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {
+               NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
+               return NF_DROP;
        }
 
        /* We've seen it coming out the other side: confirm it */
@@ -155,35 +197,6 @@ unsigned int nf_confirm(struct sk_buff *skb, unsigned int protoff,
 }
 EXPORT_SYMBOL_GPL(nf_confirm);
 
-static bool in_vrf_postrouting(const struct nf_hook_state *state)
-{
-#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
-       if (state->hook == NF_INET_POST_ROUTING &&
-           netif_is_l3_master(state->out))
-               return true;
-#endif
-       return false;
-}
-
-static unsigned int ipv4_confirm(void *priv,
-                                struct sk_buff *skb,
-                                const struct nf_hook_state *state)
-{
-       enum ip_conntrack_info ctinfo;
-       struct nf_conn *ct;
-
-       ct = nf_ct_get(skb, &ctinfo);
-       if (!ct || ctinfo == IP_CT_RELATED_REPLY)
-               return nf_conntrack_confirm(skb);
-
-       if (in_vrf_postrouting(state))
-               return NF_ACCEPT;
-
-       return nf_confirm(skb,
-                         skb_network_offset(skb) + ip_hdrlen(skb),
-                         ct, ctinfo);
-}
-
 static unsigned int ipv4_conntrack_in(void *priv,
                                      struct sk_buff *skb,
                                      const struct nf_hook_state *state)
@@ -230,13 +243,13 @@ static const struct nf_hook_ops ipv4_conntrack_ops[] = {
                .priority       = NF_IP_PRI_CONNTRACK,
        },
        {
-               .hook           = ipv4_confirm,
+               .hook           = nf_confirm,
                .pf             = NFPROTO_IPV4,
                .hooknum        = NF_INET_POST_ROUTING,
                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
        },
        {
-               .hook           = ipv4_confirm,
+               .hook           = nf_confirm,
                .pf             = NFPROTO_IPV4,
                .hooknum        = NF_INET_LOCAL_IN,
                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
@@ -373,33 +386,6 @@ static struct nf_sockopt_ops so_getorigdst6 = {
        .owner          = THIS_MODULE,
 };
 
-static unsigned int ipv6_confirm(void *priv,
-                                struct sk_buff *skb,
-                                const struct nf_hook_state *state)
-{
-       struct nf_conn *ct;
-       enum ip_conntrack_info ctinfo;
-       unsigned char pnum = ipv6_hdr(skb)->nexthdr;
-       __be16 frag_off;
-       int protoff;
-
-       ct = nf_ct_get(skb, &ctinfo);
-       if (!ct || ctinfo == IP_CT_RELATED_REPLY)
-               return nf_conntrack_confirm(skb);
-
-       if (in_vrf_postrouting(state))
-               return NF_ACCEPT;
-
-       protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
-                                  &frag_off);
-       if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
-               pr_debug("proto header not found\n");
-               return nf_conntrack_confirm(skb);
-       }
-
-       return nf_confirm(skb, protoff, ct, ctinfo);
-}
-
 static unsigned int ipv6_conntrack_in(void *priv,
                                      struct sk_buff *skb,
                                      const struct nf_hook_state *state)
@@ -428,13 +414,13 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = {
                .priority       = NF_IP6_PRI_CONNTRACK,
        },
        {
-               .hook           = ipv6_confirm,
+               .hook           = nf_confirm,
                .pf             = NFPROTO_IPV6,
                .hooknum        = NF_INET_POST_ROUTING,
                .priority       = NF_IP6_PRI_LAST,
        },
        {
-               .hook           = ipv6_confirm,
+               .hook           = nf_confirm,
                .pf             = NFPROTO_IPV6,
                .hooknum        = NF_INET_LOCAL_IN,
                .priority       = NF_IP6_PRI_LAST - 1,