From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 26/33] Revert "netfilter: nft_hash: add map lookups for hashing operations"
Date: Tue, 29 Jan 2019 00:57:43 +0100 [thread overview]
Message-ID: <20190128235750.18412-27-pablo@netfilter.org> (raw)
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Laura Garcia Liebana <nevola@gmail.com>
A better way to implement this from userspace has been found without
specific code in the kernel side, revert this.
Fixes: b9ccc07e3f31 ("netfilter: nft_hash: add map lookups for hashing operations")
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_tables.h | 4 +-
net/netfilter/nft_hash.c | 121 -------------------------------
2 files changed, 2 insertions(+), 123 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 0ba8f48bdf0b..030302893d96 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -877,8 +877,8 @@ enum nft_hash_attributes {
NFTA_HASH_SEED,
NFTA_HASH_OFFSET,
NFTA_HASH_TYPE,
- NFTA_HASH_SET_NAME,
- NFTA_HASH_SET_ID,
+ NFTA_HASH_SET_NAME, /* deprecated */
+ NFTA_HASH_SET_ID, /* deprecated */
__NFTA_HASH_MAX,
};
#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index c2d237144f74..ea658e6c53e3 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -25,7 +25,6 @@ struct nft_jhash {
u32 modulus;
u32 seed;
u32 offset;
- struct nft_set *map;
};
static void nft_jhash_eval(const struct nft_expr *expr,
@@ -42,33 +41,10 @@ static void nft_jhash_eval(const struct nft_expr *expr,
regs->data[priv->dreg] = h + priv->offset;
}
-static void nft_jhash_map_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
-{
- struct nft_jhash *priv = nft_expr_priv(expr);
- const void *data = ®s->data[priv->sreg];
- const struct nft_set *map = priv->map;
- const struct nft_set_ext *ext;
- u32 result;
- bool found;
-
- result = reciprocal_scale(jhash(data, priv->len, priv->seed),
- priv->modulus) + priv->offset;
-
- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
- if (!found)
- return;
-
- nft_data_copy(®s->data[priv->dreg],
- nft_set_ext_data(ext), map->dlen);
-}
-
struct nft_symhash {
enum nft_registers dreg:8;
u32 modulus;
u32 offset;
- struct nft_set *map;
};
static void nft_symhash_eval(const struct nft_expr *expr,
@@ -84,28 +60,6 @@ static void nft_symhash_eval(const struct nft_expr *expr,
regs->data[priv->dreg] = h + priv->offset;
}
-static void nft_symhash_map_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
-{
- struct nft_symhash *priv = nft_expr_priv(expr);
- struct sk_buff *skb = pkt->skb;
- const struct nft_set *map = priv->map;
- const struct nft_set_ext *ext;
- u32 result;
- bool found;
-
- result = reciprocal_scale(__skb_get_hash_symmetric(skb),
- priv->modulus) + priv->offset;
-
- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
- if (!found)
- return;
-
- nft_data_copy(®s->data[priv->dreg],
- nft_set_ext_data(ext), map->dlen);
-}
-
static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
[NFTA_HASH_SREG] = { .type = NLA_U32 },
[NFTA_HASH_DREG] = { .type = NLA_U32 },
@@ -114,9 +68,6 @@ static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
[NFTA_HASH_SEED] = { .type = NLA_U32 },
[NFTA_HASH_OFFSET] = { .type = NLA_U32 },
[NFTA_HASH_TYPE] = { .type = NLA_U32 },
- [NFTA_HASH_SET_NAME] = { .type = NLA_STRING,
- .len = NFT_SET_MAXNAMELEN - 1 },
- [NFTA_HASH_SET_ID] = { .type = NLA_U32 },
};
static int nft_jhash_init(const struct nft_ctx *ctx,
@@ -166,20 +117,6 @@ static int nft_jhash_init(const struct nft_ctx *ctx,
NFT_DATA_VALUE, sizeof(u32));
}
-static int nft_jhash_map_init(const struct nft_ctx *ctx,
- const struct nft_expr *expr,
- const struct nlattr * const tb[])
-{
- struct nft_jhash *priv = nft_expr_priv(expr);
- u8 genmask = nft_genmask_next(ctx->net);
-
- nft_jhash_init(ctx, expr, tb);
- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
- tb[NFTA_HASH_SET_NAME],
- tb[NFTA_HASH_SET_ID], genmask);
- return PTR_ERR_OR_ZERO(priv->map);
-}
-
static int nft_symhash_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
@@ -206,20 +143,6 @@ static int nft_symhash_init(const struct nft_ctx *ctx,
NFT_DATA_VALUE, sizeof(u32));
}
-static int nft_symhash_map_init(const struct nft_ctx *ctx,
- const struct nft_expr *expr,
- const struct nlattr * const tb[])
-{
- struct nft_jhash *priv = nft_expr_priv(expr);
- u8 genmask = nft_genmask_next(ctx->net);
-
- nft_symhash_init(ctx, expr, tb);
- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
- tb[NFTA_HASH_SET_NAME],
- tb[NFTA_HASH_SET_ID], genmask);
- return PTR_ERR_OR_ZERO(priv->map);
-}
-
static int nft_jhash_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
@@ -247,18 +170,6 @@ static int nft_jhash_dump(struct sk_buff *skb,
return -1;
}
-static int nft_jhash_map_dump(struct sk_buff *skb,
- const struct nft_expr *expr)
-{
- const struct nft_jhash *priv = nft_expr_priv(expr);
-
- if (nft_jhash_dump(skb, expr) ||
- nla_put_string(skb, NFTA_HASH_SET_NAME, priv->map->name))
- return -1;
-
- return 0;
-}
-
static int nft_symhash_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
@@ -279,18 +190,6 @@ static int nft_symhash_dump(struct sk_buff *skb,
return -1;
}
-static int nft_symhash_map_dump(struct sk_buff *skb,
- const struct nft_expr *expr)
-{
- const struct nft_symhash *priv = nft_expr_priv(expr);
-
- if (nft_symhash_dump(skb, expr) ||
- nla_put_string(skb, NFTA_HASH_SET_NAME, priv->map->name))
- return -1;
-
- return 0;
-}
-
static struct nft_expr_type nft_hash_type;
static const struct nft_expr_ops nft_jhash_ops = {
.type = &nft_hash_type,
@@ -300,14 +199,6 @@ static const struct nft_expr_ops nft_jhash_ops = {
.dump = nft_jhash_dump,
};
-static const struct nft_expr_ops nft_jhash_map_ops = {
- .type = &nft_hash_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_jhash)),
- .eval = nft_jhash_map_eval,
- .init = nft_jhash_map_init,
- .dump = nft_jhash_map_dump,
-};
-
static const struct nft_expr_ops nft_symhash_ops = {
.type = &nft_hash_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
@@ -316,14 +207,6 @@ static const struct nft_expr_ops nft_symhash_ops = {
.dump = nft_symhash_dump,
};
-static const struct nft_expr_ops nft_symhash_map_ops = {
- .type = &nft_hash_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
- .eval = nft_symhash_map_eval,
- .init = nft_symhash_map_init,
- .dump = nft_symhash_map_dump,
-};
-
static const struct nft_expr_ops *
nft_hash_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
@@ -336,12 +219,8 @@ nft_hash_select_ops(const struct nft_ctx *ctx,
type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE]));
switch (type) {
case NFT_HASH_SYM:
- if (tb[NFTA_HASH_SET_NAME])
- return &nft_symhash_map_ops;
return &nft_symhash_ops;
case NFT_HASH_JENKINS:
- if (tb[NFTA_HASH_SET_NAME])
- return &nft_jhash_map_ops;
return &nft_jhash_ops;
default:
break;
--
2.11.0
next prev parent reply other threads:[~2019-01-28 23:57 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-28 23:57 [PATCH 00/33] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 01/33] netfilter: nf_tables: prepare nft_object for lookups via hashtable Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 02/33] netfilter: nf_tables: handle nft_object lookups via rhltable Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 03/33] netfilter: nf_tables: add direct calls for all builtin expressions Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 04/33] netfilter: conntrack: remove helper hook again Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 05/33] netfilter: physdev: relax br_netfilter dependency Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 06/33] netfilter: nf_tables: Support RULE_ID reference in new rule Pablo Neira Ayuso
2019-01-29 5:24 ` Cong Wang
2019-01-29 8:09 ` Florian Westphal
2019-01-28 23:57 ` [PATCH 07/33] netfilter: conntrack: handle builtin l4proto packet functions via direct calls Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 08/33] netfilter: conntrack: handle icmp pkt_to_tuple helper " Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 09/33] netfilter: conntrack: gre: convert rwlock to rcu Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 10/33] netfilter: conntrack: gre: switch module to be built-in Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 11/33] netfilter: conntrack: remove net_id Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 12/33] netfilter: conntrack: remove pkt_to_tuple callback Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 13/33] netfilter: conntrack: remove invert_tuple callback Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 14/33] netfilter: conntrack: remove module owner field Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 15/33] netfilter: conntrack: remove remaining l4proto indirect packet calls Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 16/33] netfilter: conntrack: remove pernet l4 proto register interface Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 17/33] netfilter: conntrack: avoid unneeded nf_conntrack_l4proto lookups Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 18/33] netfilter: conntrack: unify sysctl handling Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 19/33] netfilter: conntrack: remove sysctl registration helpers Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 20/33] netfilter: conntrack: remove l4proto init and get_net callbacks Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 21/33] netfilter: conntrack: remove l4proto destroy hook Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 22/33] netfilter: conntrack: remove nf_ct_l4proto_find_get Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 23/33] netfilter: nf_conntrack: provide modparam to always register conntrack hooks Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 24/33] netfilter: nft_meta: Add NFT_META_I/OIFKIND meta type Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 25/33] netfilter: nat: un-export nf_nat_used_tuple Pablo Neira Ayuso
2019-01-28 23:57 ` Pablo Neira Ayuso [this message]
2019-01-28 23:57 ` [PATCH 27/33] netfilter: conntrack: fix IPV6=n builds Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 28/33] netfilter: conntrack: fix bogus port values for other l4 protocols Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 29/33] ipvs: avoid indirect calls when calculating checksums Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 30/33] ipvs: use indirect call wrappers Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 31/33] netfilter: nft_counter: remove wrong __percpu of nft_counter_resest()'s arg Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 32/33] netfilter: conntrack: fix error path in nf_conntrack_pernet_init() Pablo Neira Ayuso
2019-01-28 23:57 ` [PATCH 33/33] netfilter: ipv4: remove useless export_symbol Pablo Neira Ayuso
2019-01-29 1:38 ` [PATCH 00/33] Netfilter/IPVS updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190128235750.18412-27-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).