Skip to content

Commit 7a9bc9b

Browse files
davem330davem330
committed
ipv4: Elide fib_validate_source() completely when possible.
If rpfilter is off (or the SKB has an IPSEC path) and there are not tclassid users, we don't have to do anything at all when fib_validate_source() is invoked besides setting the itag to zero. We monitor tclassid uses with a counter (modified only under RTNL and marked __read_mostly) and we protect the fib_validate_source() real work with a test against this counter and whether rpfilter is to be done. Having a way to know whether we need no tclassid processing or not also opens the door for future optimized rpfilter algorithms that do not perform full FIB lookups. Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent b8c8430 commit 7a9bc9b

File tree

6 files changed

+59
-9
lines changed

6 files changed

+59
-9
lines changed

‎include/net/fib_rules.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ struct fib_rules_ops {
5252
struct sk_buff *,
5353
struct fib_rule_hdr *,
5454
struct nlattr **);
55+
void (*delete)(struct fib_rule *);
5556
int (*compare)(struct fib_rule *,
5657
struct fib_rule_hdr *,
5758
struct nlattr **);

‎include/net/ip_fib.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,11 @@ extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
235235
u8 tos, int oif, struct net_device *dev,
236236
struct in_device *idev, u32 *itag);
237237
extern void fib_select_default(struct fib_result *res);
238+
#ifdef CONFIG_IP_ROUTE_CLASSID
239+
extern int fib_num_tclassid_users;
240+
#else
241+
#define fib_num_tclassid_users 0
242+
#endif
238243

239244
/* Exported by fib_semantics.c */
240245
extern int ip_fib_check_default(__be32 gw, struct net_device *dev);

‎net/core/fib_rules.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,8 @@ static void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
151151

152152
list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) {
153153
list_del_rcu(&rule->list);
154+
if (ops->delete)
155+
ops->delete(rule);
154156
fib_rule_put(rule);
155157
}
156158
}
@@ -499,6 +501,8 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
499501

500502
notify_rule_change(RTM_DELRULE, rule, ops, nlh,
501503
NETLINK_CB(skb).pid);
504+
if (ops->delete)
505+
ops->delete(rule);
502506
fib_rule_put(rule);
503507
flush_route_cache(ops);
504508
rules_ops_put(ops);

‎net/ipv4/fib_frontend.c

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
#include <linux/if_addr.h>
3232
#include <linux/if_arp.h>
3333
#include <linux/skbuff.h>
34+
#include <linux/cache.h>
3435
#include <linux/init.h>
3536
#include <linux/list.h>
3637
#include <linux/slab.h>
@@ -217,6 +218,10 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
217218
return inet_select_addr(dev, ip_hdr(skb)->saddr, scope);
218219
}
219220

221+
#ifdef CONFIG_IP_ROUTE_CLASSID
222+
int fib_num_tclassid_users __read_mostly;
223+
#endif
224+
220225
/* Given (packet source, input interface) and optional (dst, oif, tos):
221226
* - (main) check, that source is valid i.e. not broadcast or our local
222227
* address.
@@ -225,11 +230,11 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
225230
* - check, that packet arrived from expected physical interface.
226231
* called with rcu_read_lock()
227232
*/
228-
int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos,
229-
int oif, struct net_device *dev, struct in_device *idev,
230-
u32 *itag)
233+
static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
234+
u8 tos, int oif, struct net_device *dev,
235+
int rpf, struct in_device *idev, u32 *itag)
231236
{
232-
int ret, no_addr, rpf, accept_local;
237+
int ret, no_addr, accept_local;
233238
struct fib_result res;
234239
struct flowi4 fl4;
235240
struct net *net;
@@ -242,12 +247,9 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos,
242247
fl4.flowi4_tos = tos;
243248
fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
244249

245-
no_addr = rpf = accept_local = 0;
250+
no_addr = accept_local = 0;
246251
no_addr = idev->ifa_list == NULL;
247252

248-
/* Ignore rp_filter for packets protected by IPsec. */
249-
rpf = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
250-
251253
accept_local = IN_DEV_ACCEPT_LOCAL(idev);
252254
fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
253255

@@ -303,6 +305,20 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos,
303305
return -EXDEV;
304306
}
305307

308+
/* Ignore rp_filter for packets protected by IPsec. */
309+
int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
310+
u8 tos, int oif, struct net_device *dev,
311+
struct in_device *idev, u32 *itag)
312+
{
313+
int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
314+
315+
if (!r && !fib_num_tclassid_users) {
316+
*itag = 0;
317+
return 0;
318+
}
319+
return __fib_validate_source(skb, src, dst, tos, oif, dev, r, idev, itag);
320+
}
321+
306322
static inline __be32 sk_extract_addr(struct sockaddr *addr)
307323
{
308324
return ((struct sockaddr_in *) addr)->sin_addr.s_addr;

‎net/ipv4/fib_rules.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,8 +169,11 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
169169
rule4->dst = nla_get_be32(tb[FRA_DST]);
170170

171171
#ifdef CONFIG_IP_ROUTE_CLASSID
172-
if (tb[FRA_FLOW])
172+
if (tb[FRA_FLOW]) {
173173
rule4->tclassid = nla_get_u32(tb[FRA_FLOW]);
174+
if (rule4->tclassid)
175+
fib_num_tclassid_users++;
176+
}
174177
#endif
175178

176179
rule4->src_len = frh->src_len;
@@ -184,6 +187,16 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
184187
return err;
185188
}
186189

190+
static void fib4_rule_delete(struct fib_rule *rule)
191+
{
192+
#ifdef CONFIG_IP_ROUTE_CLASSID
193+
struct fib4_rule *rule4 = (struct fib4_rule *) rule;
194+
195+
if (rule4->tclassid)
196+
fib_num_tclassid_users--;
197+
#endif
198+
}
199+
187200
static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
188201
struct nlattr **tb)
189202
{
@@ -256,6 +269,7 @@ static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = {
256269
.action = fib4_rule_action,
257270
.match = fib4_rule_match,
258271
.configure = fib4_rule_configure,
272+
.delete = fib4_rule_delete,
259273
.compare = fib4_rule_compare,
260274
.fill = fib4_rule_fill,
261275
.default_pref = fib_default_rule_pref,

‎net/ipv4/fib_semantics.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,12 @@ void free_fib_info(struct fib_info *fi)
163163
return;
164164
}
165165
fib_info_cnt--;
166+
#ifdef CONFIG_IP_ROUTE_CLASSID
167+
change_nexthops(fi) {
168+
if (nexthop_nh->nh_tclassid)
169+
fib_num_tclassid_users--;
170+
} endfor_nexthops(fi);
171+
#endif
166172
call_rcu(&fi->rcu, free_fib_info_rcu);
167173
}
168174

@@ -421,6 +427,8 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
421427
#ifdef CONFIG_IP_ROUTE_CLASSID
422428
nla = nla_find(attrs, attrlen, RTA_FLOW);
423429
nexthop_nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
430+
if (nexthop_nh->nh_tclassid)
431+
fib_num_tclassid_users++;
424432
#endif
425433
}
426434

@@ -815,6 +823,8 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
815823
nh->nh_flags = cfg->fc_flags;
816824
#ifdef CONFIG_IP_ROUTE_CLASSID
817825
nh->nh_tclassid = cfg->fc_flow;
826+
if (nh->nh_tclassid)
827+
fib_num_tclassid_users++;
818828
#endif
819829
#ifdef CONFIG_IP_ROUTE_MULTIPATH
820830
nh->nh_weight = 1;

0 commit comments

Comments
 (0)