Commit f0a3c086 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Patrick McHardy

netfilter: ctnetlink: move event reporting for new entries outside the lock

This patch moves the event reporting outside the lock section. With
this patch, the creation and update of entries is homogeneous from
the event reporting perspective. Moreover, as the event reporting is
done outside the lock section, the netlink broadcast delivery can
benefit of the yield() call under congestion.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent e098360f
...@@ -1128,12 +1128,10 @@ ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report) ...@@ -1128,12 +1128,10 @@ ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
report); report);
} }
static int static struct nf_conn *
ctnetlink_create_conntrack(struct nlattr *cda[], ctnetlink_create_conntrack(struct nlattr *cda[],
struct nf_conntrack_tuple *otuple, struct nf_conntrack_tuple *otuple,
struct nf_conntrack_tuple *rtuple, struct nf_conntrack_tuple *rtuple,
u32 pid,
int report,
u8 u3) u8 u3)
{ {
struct nf_conn *ct; struct nf_conn *ct;
...@@ -1142,7 +1140,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[], ...@@ -1142,7 +1140,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC); ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
if (IS_ERR(ct)) if (IS_ERR(ct))
return -ENOMEM; return ERR_PTR(-ENOMEM);
if (!cda[CTA_TIMEOUT]) if (!cda[CTA_TIMEOUT])
goto err; goto err;
...@@ -1265,18 +1263,14 @@ ctnetlink_create_conntrack(struct nlattr *cda[], ...@@ -1265,18 +1263,14 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
ct->master = master_ct; ct->master = master_ct;
} }
nf_conntrack_get(&ct->ct_general);
add_timer(&ct->timeout); add_timer(&ct->timeout);
nf_conntrack_hash_insert(ct); nf_conntrack_hash_insert(ct);
rcu_read_unlock(); rcu_read_unlock();
ctnetlink_event_report(ct, pid, report);
nf_ct_put(ct);
return 0;
return ct;
err: err:
nf_conntrack_free(ct); nf_conntrack_free(ct);
return err; return ERR_PTR(err);
} }
static int static int
...@@ -1309,14 +1303,25 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, ...@@ -1309,14 +1303,25 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
if (h == NULL) { if (h == NULL) {
err = -ENOENT; err = -ENOENT;
if (nlh->nlmsg_flags & NLM_F_CREATE) if (nlh->nlmsg_flags & NLM_F_CREATE) {
err = ctnetlink_create_conntrack(cda, struct nf_conn *ct;
&otuple,
&rtuple, ct = ctnetlink_create_conntrack(cda, &otuple,
&rtuple, u3);
if (IS_ERR(ct)) {
err = PTR_ERR(ct);
goto out_unlock;
}
err = 0;
nf_conntrack_get(&ct->ct_general);
spin_unlock_bh(&nf_conntrack_lock);
ctnetlink_event_report(ct,
NETLINK_CB(skb).pid, NETLINK_CB(skb).pid,
nlmsg_report(nlh), nlmsg_report(nlh));
u3); nf_ct_put(ct);
} else
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
return err; return err;
} }
/* implicit 'else' */ /* implicit 'else' */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment