From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 08/12] openvswitch: load and reference the NAT helper.
Date: Mon, 6 May 2019 01:33:01 +0200 [thread overview]
Message-ID: <20190505233305.13650-9-pablo@netfilter.org> (raw)
In-Reply-To: <20190505233305.13650-1-pablo@netfilter.org>
From: Flavio Leitner <fbl@redhat.com>
This improves the original commit 17c357efe5ec ("openvswitch: load
NAT helper") where it unconditionally tries to load the module for
every flow using NAT, so not efficient when loading multiple flows.
It also doesn't hold any references to the NAT module while the
flow is active.
This change fixes those problems. It will try to load the module
only if it's not present. It grabs a reference to the NAT module
and holds it while the flow is active. Finally, an error message
shows up if either actions above fails.
Fixes: 17c357efe5ec ("openvswitch: load NAT helper")
Signed-off-by: Flavio Leitner <fbl@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/openvswitch/conntrack.c | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index bded32144619..c4128082f88b 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1307,6 +1307,7 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
{
struct nf_conntrack_helper *helper;
struct nf_conn_help *help;
+ int ret = 0;
helper = nf_conntrack_helper_try_module_get(name, info->family,
key->ip.proto);
@@ -1321,13 +1322,21 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
return -ENOMEM;
}
+#ifdef CONFIG_NF_NAT_NEEDED
+ if (info->nat) {
+ ret = nf_nat_helper_try_module_get(name, info->family,
+ key->ip.proto);
+ if (ret) {
+ nf_conntrack_helper_put(helper);
+ OVS_NLERR(log, "Failed to load \"%s\" NAT helper, error: %d",
+ name, ret);
+ return ret;
+ }
+ }
+#endif
rcu_assign_pointer(help->helper, helper);
info->helper = helper;
-
- if (info->nat)
- request_module("ip_nat_%s", name);
-
- return 0;
+ return ret;
}
#if IS_ENABLED(CONFIG_NF_NAT)
@@ -1801,8 +1810,13 @@ void ovs_ct_free_action(const struct nlattr *a)
static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
{
- if (ct_info->helper)
+ if (ct_info->helper) {
+#ifdef CONFIG_NF_NAT_NEEDED
+ if (ct_info->nat)
+ nf_nat_helper_put(ct_info->helper);
+#endif
nf_conntrack_helper_put(ct_info->helper);
+ }
if (ct_info->ct) {
if (ct_info->timeout[0])
nf_ct_destroy_timeout(ct_info->ct);
--
2.11.0
next prev parent reply other threads:[~2019-05-05 23:33 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-05 23:32 [PATCH 00/12] Netfilter updates for net-next Pablo Neira Ayuso
2019-05-05 23:32 ` [PATCH 01/12] netfilter: nf_tables: relocate header content to consumer Pablo Neira Ayuso
2019-05-05 23:32 ` [PATCH 02/12] netfilter: nf_tables: fix implicit include of module.h Pablo Neira Ayuso
2019-05-05 23:32 ` [PATCH 03/12] netfilter: nf_tables: drop include of module.h from nf_tables.h Pablo Neira Ayuso
2019-05-05 23:32 ` [PATCH 04/12] netfilter: conntrack: limit sysctl setting for boolean options Pablo Neira Ayuso
2019-05-05 23:32 ` [PATCH 05/12] netfilter: use macros to create module aliases Pablo Neira Ayuso
2019-05-05 23:32 ` [PATCH 06/12] netfilter: add API to manage NAT helpers Pablo Neira Ayuso
2019-05-05 23:33 ` [PATCH 07/12] netfilter: nf_nat: register " Pablo Neira Ayuso
2019-05-05 23:33 ` Pablo Neira Ayuso [this message]
2019-05-05 23:33 ` [PATCH 09/12] netfilter: nft_ct: Add ct id support Pablo Neira Ayuso
2019-05-05 23:33 ` [PATCH 10/12] netfilter: connlabels: fix spelling mistake "trackling" -> "tracking" Pablo Neira Ayuso
2019-05-05 23:33 ` [PATCH 11/12] netfilter: xt_hashlimit: use struct_size() helper Pablo Neira Ayuso
2019-05-05 23:33 ` [PATCH 12/12] netfilter: slightly optimize nf_inet_addr_mask Pablo Neira Ayuso
2019-05-06 4:35 ` [PATCH 00/12] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190505233305.13650-9-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).