[PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Simon Horman]

Hi,

This short series updates conditional compilation of label helpers to:

1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
   or not. It is safe to do so as the functions will always return 0 if
   CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
   optimise waway the code.  Which is the desired behaviour.

2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
   enabled.  This addresses a warning about this function being unused
   in this case.

Found by inspection.
Patches have been compile tested only.

---
Simon Horman (2):
      netfilter: conntrack: compile label helpers unconditionally
      netfilter: conntrack: conditionally compile ctnetlink_label_size

 net/netfilter/nf_conntrack_netlink.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

base-commit: d5c4546062fd6f5dbce575c7ea52ad66d1968678

[PATCH nf-next 1/2] netfilter: conntrack: compile label helpers unconditionally

[Simon Horman]

The condition on CONFIG_NF_CONNTRACK_LABELS being removed by
this patch guards compilation of non-trivial implementations
of ctnetlink_dump_labels() and ctnetlink_label_size().

However, this is not necessary as each of these functions
will always return 0 if CONFIG_NF_CONNTRACK_LABELS is not defined
as each function starts with the equivalent of:

	struct nf_conn_labels *labels = nf_ct_labels_find(ct);

	if (!labels)
		return 0;

And nf_ct_labels_find always returns NULL if CONFIG_NF_CONNTRACK_LABELS
is not enabled.  So I believe that the compiler optimises the code away
in such cases anyway.

Some advantages of this approach are:

1. Fewer #ifdefs, fewer headaches
2. The trivial implementations can be dropped
3. A follow-up patch, to conditionally compile ctnetlink_label_size
   only when it is used becomes simpler (see point 1)

Found by inspection.
Compile tested only.

Signed-off-by: Simon Horman <horms@kernel.org>
---
 net/netfilter/nf_conntrack_netlink.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 123e2e933e9b..f1f7dff08953 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -382,7 +382,6 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
 #define ctnetlink_dump_secctx(a, b) (0)
 #endif
 
-#ifdef CONFIG_NF_CONNTRACK_LABELS
 static inline int ctnetlink_label_size(const struct nf_conn *ct)
 {
 	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
@@ -411,10 +410,6 @@ ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
 
 	return 0;
 }
-#else
-#define ctnetlink_dump_labels(a, b) (0)
-#define ctnetlink_label_size(a)	(0)
-#endif
 
 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
 

-- 
2.45.2

[PATCH nf-next 2/2] netfilter: conntrack: conditionally compile ctnetlink_label_size

[Simon Horman]

Only provide ctnetlink_label_size when it is used,
which is when CONFIG_NF_CONNTRACK_EVENTS is configured.

Flagged by clang-18 W=1 builds as:

.../nf_conntrack_netlink.c:385:19: warning: unused function 'ctnetlink_label_size' [-Wunused-function]
  385 | static inline int ctnetlink_label_size(const struct nf_conn *ct)
      |                   ^~~~~~~~~~~~~~~~~~~~

Found by manually tweaking .config.
Compile tested only.

Link: https://lore.kernel.org/netfilter-devel/20240909151712.GZ2097826@kernel.org/
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Simon Horman <horms@kernel.org>
---
 net/netfilter/nf_conntrack_netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index f1f7dff08953..cac48277a7d5 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -382,6 +382,7 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
 #define ctnetlink_dump_secctx(a, b) (0)
 #endif
 
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
 static inline int ctnetlink_label_size(const struct nf_conn *ct)
 {
 	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
@@ -390,6 +391,7 @@ static inline int ctnetlink_label_size(const struct nf_conn *ct)
 		return 0;
 	return nla_total_size(sizeof(labels->bits));
 }
+#endif
 
 static int
 ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)

-- 
2.45.2

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Andy Shevchenko]

On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> Hi,
> 
> This short series updates conditional compilation of label helpers to:
> 
> 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
>    or not. It is safe to do so as the functions will always return 0 if
>    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
>    optimise waway the code.  Which is the desired behaviour.
> 
> 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
>    enabled.  This addresses a warning about this function being unused
>    in this case.

Both make sense to me, FWIW,
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Pablo Neira Ayuso]

On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> Hi,
> 
> This short series updates conditional compilation of label helpers to:
> 
> 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
>    or not. It is safe to do so as the functions will always return 0 if
>    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
>    optimise waway the code.  Which is the desired behaviour.
> 
> 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
>    enabled.  This addresses a warning about this function being unused
>    in this case.

Patch 1)

-#ifdef CONFIG_NF_CONNTRACK_LABELS
 static inline int ctnetlink_label_size(const struct nf_conn *ct)

Patch 2)

+#ifdef CONFIG_NF_CONNTRACK_EVENTS
 static inline int ctnetlink_label_size(const struct nf_conn *ct)

They both refer to ctnetlink_label_size(), #ifdef check is not
correct.

Would you mind if I collapsed these two patches before applying?

Thanks Simon.

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Andy Shevchenko]

On Wed, Sep 18, 2024 at 01:52:14PM +0200, Pablo Neira Ayuso wrote:
> On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> > Hi,
> > 
> > This short series updates conditional compilation of label helpers to:
> > 
> > 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
> >    or not. It is safe to do so as the functions will always return 0 if
> >    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
> >    optimise waway the code.  Which is the desired behaviour.
> > 
> > 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
> >    enabled.  This addresses a warning about this function being unused
> >    in this case.
> 
> Patch 1)
> 
> -#ifdef CONFIG_NF_CONNTRACK_LABELS
>  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> 
> Patch 2)
> 
> +#ifdef CONFIG_NF_CONNTRACK_EVENTS
>  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> 
> They both refer to ctnetlink_label_size(), #ifdef check is not
> correct.

But the first one touches more, no?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Pablo Neira Ayuso]

On Wed, Sep 18, 2024 at 04:55:15PM +0300, Andy Shevchenko wrote:
> On Wed, Sep 18, 2024 at 01:52:14PM +0200, Pablo Neira Ayuso wrote:
> > On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> > > Hi,
> > > 
> > > This short series updates conditional compilation of label helpers to:
> > > 
> > > 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
> > >    or not. It is safe to do so as the functions will always return 0 if
> > >    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
> > >    optimise waway the code.  Which is the desired behaviour.
> > > 
> > > 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
> > >    enabled.  This addresses a warning about this function being unused
> > >    in this case.
> > 
> > Patch 1)
> > 
> > -#ifdef CONFIG_NF_CONNTRACK_LABELS
> >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > 
> > Patch 2)
> > 
> > +#ifdef CONFIG_NF_CONNTRACK_EVENTS
> >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > 
> > They both refer to ctnetlink_label_size(), #ifdef check is not
> > correct.
> 
> But the first one touches more, no?

Yes, it also remove a #define ctnetlink_label_size() macro in patch #1.
I am fine with this series as is.

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Andy Shevchenko]

On Wed, Sep 18, 2024 at 04:29:14PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Sep 18, 2024 at 04:55:15PM +0300, Andy Shevchenko wrote:
> > On Wed, Sep 18, 2024 at 01:52:14PM +0200, Pablo Neira Ayuso wrote:
> > > On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> > > > Hi,
> > > > 
> > > > This short series updates conditional compilation of label helpers to:
> > > > 
> > > > 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
> > > >    or not. It is safe to do so as the functions will always return 0 if
> > > >    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
> > > >    optimise waway the code.  Which is the desired behaviour.
> > > > 
> > > > 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
> > > >    enabled.  This addresses a warning about this function being unused
> > > >    in this case.
> > > 
> > > Patch 1)
> > > 
> > > -#ifdef CONFIG_NF_CONNTRACK_LABELS
> > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > 
> > > Patch 2)
> > > 
> > > +#ifdef CONFIG_NF_CONNTRACK_EVENTS
> > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > 
> > > They both refer to ctnetlink_label_size(), #ifdef check is not
> > > correct.
> > 
> > But the first one touches more, no?
> 
> Yes, it also remove a #define ctnetlink_label_size() macro in patch #1.
> I am fine with this series as is.

What I meant is that the original patch 1 takes care about definitions of
two functions. Not just a single one.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Simon Horman]

On Wed, Sep 18, 2024 at 01:52:14PM +0200, Pablo Neira Ayuso wrote:
> On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> > Hi,
> > 
> > This short series updates conditional compilation of label helpers to:
> > 
> > 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
> >    or not. It is safe to do so as the functions will always return 0 if
> >    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
> >    optimise waway the code.  Which is the desired behaviour.
> > 
> > 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
> >    enabled.  This addresses a warning about this function being unused
> >    in this case.
> 
> Patch 1)
> 
> -#ifdef CONFIG_NF_CONNTRACK_LABELS
>  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> 
> Patch 2)
> 
> +#ifdef CONFIG_NF_CONNTRACK_EVENTS
>  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> 
> They both refer to ctnetlink_label_size(), #ifdef check is not
> correct.
> 
> Would you mind if I collapsed these two patches before applying?

Sure, no problem.

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Pablo Neira Ayuso]

On Wed, Sep 18, 2024 at 08:01:21PM +0300, Andy Shevchenko wrote:
> On Wed, Sep 18, 2024 at 04:29:14PM +0200, Pablo Neira Ayuso wrote:
> > On Wed, Sep 18, 2024 at 04:55:15PM +0300, Andy Shevchenko wrote:
> > > On Wed, Sep 18, 2024 at 01:52:14PM +0200, Pablo Neira Ayuso wrote:
> > > > On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> > > > > Hi,
> > > > > 
> > > > > This short series updates conditional compilation of label helpers to:
> > > > > 
> > > > > 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
> > > > >    or not. It is safe to do so as the functions will always return 0 if
> > > > >    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
> > > > >    optimise waway the code.  Which is the desired behaviour.
> > > > > 
> > > > > 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
> > > > >    enabled.  This addresses a warning about this function being unused
> > > > >    in this case.
> > > > 
> > > > Patch 1)
> > > > 
> > > > -#ifdef CONFIG_NF_CONNTRACK_LABELS
> > > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > > 
> > > > Patch 2)
> > > > 
> > > > +#ifdef CONFIG_NF_CONNTRACK_EVENTS
> > > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > > 
> > > > They both refer to ctnetlink_label_size(), #ifdef check is not
> > > > correct.
> > > 
> > > But the first one touches more, no?
> > 
> > Yes, it also remove a #define ctnetlink_label_size() macro in patch #1.
> > I am fine with this series as is.
> 
> What I meant is that the original patch 1 takes care about definitions of
> two functions. Not just a single one.

My understanding is that #ifdef CONFIG_NF_CONNTRACK_LABELS that wraps
ctnetlink_label_size() is not correct (patch 1), instead
CONFIG_NF_CONNTRACK_EVENTS should be used (patch 2).

Then, as a side effect this goes away (patch 1):

-#else
-#define ctnetlink_dump_labels(a, b) (0)
-#define ctnetlink_label_size(a)     (0)
-#endif

that is why I am proposing to coaleasce these two patches in one.

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Simon Horman]

On Wed, Sep 18, 2024 at 11:56:24PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Sep 18, 2024 at 08:01:21PM +0300, Andy Shevchenko wrote:
> > On Wed, Sep 18, 2024 at 04:29:14PM +0200, Pablo Neira Ayuso wrote:
> > > On Wed, Sep 18, 2024 at 04:55:15PM +0300, Andy Shevchenko wrote:
> > > > On Wed, Sep 18, 2024 at 01:52:14PM +0200, Pablo Neira Ayuso wrote:
> > > > > On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> > > > > > Hi,
> > > > > > 
> > > > > > This short series updates conditional compilation of label helpers to:
> > > > > > 
> > > > > > 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
> > > > > >    or not. It is safe to do so as the functions will always return 0 if
> > > > > >    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
> > > > > >    optimise waway the code.  Which is the desired behaviour.
> > > > > > 
> > > > > > 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
> > > > > >    enabled.  This addresses a warning about this function being unused
> > > > > >    in this case.
> > > > > 
> > > > > Patch 1)
> > > > > 
> > > > > -#ifdef CONFIG_NF_CONNTRACK_LABELS
> > > > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > > > 
> > > > > Patch 2)
> > > > > 
> > > > > +#ifdef CONFIG_NF_CONNTRACK_EVENTS
> > > > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > > > 
> > > > > They both refer to ctnetlink_label_size(), #ifdef check is not
> > > > > correct.
> > > > 
> > > > But the first one touches more, no?
> > > 
> > > Yes, it also remove a #define ctnetlink_label_size() macro in patch #1.
> > > I am fine with this series as is.
> > 
> > What I meant is that the original patch 1 takes care about definitions of
> > two functions. Not just a single one.
> 
> My understanding is that #ifdef CONFIG_NF_CONNTRACK_LABELS that wraps
> ctnetlink_label_size() is not correct (patch 1), instead
> CONFIG_NF_CONNTRACK_EVENTS should be used (patch 2).
> 
> Then, as a side effect this goes away (patch 1):
> 
> -#else
> -#define ctnetlink_dump_labels(a, b) (0)
> -#define ctnetlink_label_size(a)     (0)
> -#endif
> 
> that is why I am proposing to coaleasce these two patches in one.

Thanks,

Just to clarify. I did think there is value in separating the two changes.
But that was a subjective judgement on my part.

Your understanding of the overall change is correct.
And if it is preferred to have a single patch - as seems to be the case -
then that is fine by me.

Going forward, I'll try to remember not to split-up patches for netfilter
so much.

Kind regards,
Simon

Re: [PATCH nf-next 0/2] netfilter: conntrack: label helpers conditional compilation updates

[Pablo Neira Ayuso]

On Thu, Sep 19, 2024 at 08:19:37AM +0100, Simon Horman wrote:
> On Wed, Sep 18, 2024 at 11:56:24PM +0200, Pablo Neira Ayuso wrote:
> > On Wed, Sep 18, 2024 at 08:01:21PM +0300, Andy Shevchenko wrote:
> > > On Wed, Sep 18, 2024 at 04:29:14PM +0200, Pablo Neira Ayuso wrote:
> > > > On Wed, Sep 18, 2024 at 04:55:15PM +0300, Andy Shevchenko wrote:
> > > > > On Wed, Sep 18, 2024 at 01:52:14PM +0200, Pablo Neira Ayuso wrote:
> > > > > > On Mon, Sep 16, 2024 at 04:14:40PM +0100, Simon Horman wrote:
> > > > > > > Hi,
> > > > > > > 
> > > > > > > This short series updates conditional compilation of label helpers to:
> > > > > > > 
> > > > > > > 1) Compile them regardless of if CONFIG_NF_CONNTRACK_LABELS is enabled
> > > > > > >    or not. It is safe to do so as the functions will always return 0 if
> > > > > > >    CONFIG_NF_CONNTRACK_LABELS is not enabled.  And the compiler should
> > > > > > >    optimise waway the code.  Which is the desired behaviour.
> > > > > > > 
> > > > > > > 2) Only compile ctnetlink_label_size if CONFIG_NF_CONNTRACK_EVENTS is
> > > > > > >    enabled.  This addresses a warning about this function being unused
> > > > > > >    in this case.
> > > > > > 
> > > > > > Patch 1)
> > > > > > 
> > > > > > -#ifdef CONFIG_NF_CONNTRACK_LABELS
> > > > > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > > > > 
> > > > > > Patch 2)
> > > > > > 
> > > > > > +#ifdef CONFIG_NF_CONNTRACK_EVENTS
> > > > > >  static inline int ctnetlink_label_size(const struct nf_conn *ct)
> > > > > > 
> > > > > > They both refer to ctnetlink_label_size(), #ifdef check is not
> > > > > > correct.
> > > > > 
> > > > > But the first one touches more, no?
> > > > 
> > > > Yes, it also remove a #define ctnetlink_label_size() macro in patch #1.
> > > > I am fine with this series as is.
> > > 
> > > What I meant is that the original patch 1 takes care about definitions of
> > > two functions. Not just a single one.
> > 
> > My understanding is that #ifdef CONFIG_NF_CONNTRACK_LABELS that wraps
> > ctnetlink_label_size() is not correct (patch 1), instead
> > CONFIG_NF_CONNTRACK_EVENTS should be used (patch 2).
> > 
> > Then, as a side effect this goes away (patch 1):
> > 
> > -#else
> > -#define ctnetlink_dump_labels(a, b) (0)
> > -#define ctnetlink_label_size(a)     (0)
> > -#endif
> > 
> > that is why I am proposing to coaleasce these two patches in one.
> 
> Thanks,
> 
> Just to clarify. I did think there is value in separating the two changes.
> But that was a subjective judgement on my part.
> 
> Your understanding of the overall change is correct.
> And if it is preferred to have a single patch - as seems to be the case -
> then that is fine by me.
> 
> Going forward, I'll try to remember not to split-up patches for netfilter
> so much.

Never mind too much, your splitting helps for reviewing.

This is also subjective judgement on my side.