Skip to content

Commit 90d1daa

Browse files
Florian Westphalummakynes
authored andcommitted
netfilter: conntrack: add nf_conntrack_events autodetect mode
This adds the new nf_conntrack_events=2 mode and makes it the default. This leverages the earlier flag in struct net to allow to avoid the event extension as long as no event listener is active in the namespace. This avoids, for most cases, allocation of ct->ext area. A followup patch will take further advantage of this by avoiding calls down into the event framework if the extension isn't present. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent b0a7ab4 commit 90d1daa

File tree

4 files changed

+28
-9
lines changed

4 files changed

+28
-9
lines changed

Documentation/networking/nf_conntrack-sysctl.rst

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,13 @@ nf_conntrack_count - INTEGER (read-only)
3434

3535
nf_conntrack_events - BOOLEAN
3636
- 0 - disabled
37-
- not 0 - enabled (default)
37+
- 1 - enabled
38+
- 2 - auto (default)
3839

3940
If this option is enabled, the connection tracking code will
4041
provide userspace with connection tracking events via ctnetlink.
42+
The default allocates the extension if a userspace program is
43+
listening to ctnetlink events.
4144

4245
nf_conntrack_expect_max - INTEGER
4346
Maximum size of expectation table. Default value is

net/netfilter/nf_conntrack_core.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1736,7 +1736,8 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
17361736
#ifdef CONFIG_NF_CONNTRACK_EVENTS
17371737
ecache = tmpl ? nf_ct_ecache_find(tmpl) : NULL;
17381738

1739-
if (!nf_ct_ecache_ext_add(ct, ecache ? ecache->ctmask : 0,
1739+
if ((ecache || net->ct.sysctl_events) &&
1740+
!nf_ct_ecache_ext_add(ct, ecache ? ecache->ctmask : 0,
17401741
ecache ? ecache->expmask : 0,
17411742
GFP_ATOMIC)) {
17421743
nf_conntrack_free(ct);

net/netfilter/nf_conntrack_ecache.c

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -302,12 +302,27 @@ bool nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp
302302
struct net *net = nf_ct_net(ct);
303303
struct nf_conntrack_ecache *e;
304304

305-
if (!ctmask && !expmask && net->ct.sysctl_events) {
306-
ctmask = ~0;
307-
expmask = ~0;
305+
switch (net->ct.sysctl_events) {
306+
case 0:
307+
/* assignment via template / ruleset? ignore sysctl. */
308+
if (ctmask || expmask)
309+
break;
310+
return true;
311+
case 2: /* autodetect: no event listener, don't allocate extension. */
312+
if (!READ_ONCE(net->ct.ctnetlink_has_listener))
313+
return true;
314+
fallthrough;
315+
case 1:
316+
/* always allocate an extension. */
317+
if (!ctmask && !expmask) {
318+
ctmask = ~0;
319+
expmask = ~0;
320+
}
321+
break;
322+
default:
323+
WARN_ON_ONCE(1);
324+
return true;
308325
}
309-
if (!ctmask && !expmask)
310-
return false;
311326

312327
e = nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp);
313328
if (e) {
@@ -319,7 +334,7 @@ bool nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp
319334
}
320335
EXPORT_SYMBOL_GPL(nf_ct_ecache_ext_add);
321336

322-
#define NF_CT_EVENTS_DEFAULT 1
337+
#define NF_CT_EVENTS_DEFAULT 2
323338
static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
324339

325340
void nf_conntrack_ecache_pernet_init(struct net *net)

net/netfilter/nf_conntrack_standalone.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -693,7 +693,7 @@ static struct ctl_table nf_ct_sysctl_table[] = {
693693
.mode = 0644,
694694
.proc_handler = proc_dou8vec_minmax,
695695
.extra1 = SYSCTL_ZERO,
696-
.extra2 = SYSCTL_ONE,
696+
.extra2 = SYSCTL_TWO,
697697
},
698698
#endif
699699
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP

0 commit comments

Comments
 (0)