netfilter: nft_socket: track register operations

Check if the destination register already contains the data that this
socket expression performs. This allows to skip this redundant
operation.  If the destination contains a different selector, update the
register tracking information.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index d601974c9d2e010542520580cd80198780d854ed..bd3792f080ed0673a6be9f29a0c51aeade966dfb 100644 (file)
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -10,6 +10,7 @@
 struct nft_socket {
        enum nft_socket_keys            key:8;
        u8                              level;
+       u8                              len;
        union {
                u8                      dreg;
        };
@@ -179,6 +180,7 @@ static int nft_socket_init(const struct nft_ctx *ctx,
                return -EOPNOTSUPP;
        }
 
+       priv->len = len;
        return nft_parse_register_store(ctx, tb[NFTA_SOCKET_DREG], &priv->dreg,
                                        NULL, NFT_DATA_VALUE, len);
 }
@@ -198,6 +200,31 @@ static int nft_socket_dump(struct sk_buff *skb,
        return 0;
 }
 
+static bool nft_socket_reduce(struct nft_regs_track *track,
+                             const struct nft_expr *expr)
+{
+       const struct nft_socket *priv = nft_expr_priv(expr);
+       const struct nft_socket *socket;
+
+       if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       socket = nft_expr_priv(track->regs[priv->dreg].selector);
+       if (priv->key != socket->key ||
+           priv->dreg != socket->dreg ||
+           priv->level != socket->level) {
+               nft_reg_track_update(track, expr, priv->dreg, priv->len);
+               return false;
+       }
+
+       if (!track->regs[priv->dreg].bitwise)
+               return true;
+
+       return nft_expr_reduce_bitwise(track, expr);
+}
+
 static struct nft_expr_type nft_socket_type;
 static const struct nft_expr_ops nft_socket_ops = {
        .type           = &nft_socket_type,
@@ -205,6 +232,7 @@ static const struct nft_expr_ops nft_socket_ops = {
        .eval           = nft_socket_eval,
        .init           = nft_socket_init,
        .dump           = nft_socket_dump,
+       .reduce         = nft_socket_reduce,
 };
 
 static struct nft_expr_type nft_socket_type __read_mostly = {