netfilter: nf_conncount: merge lookup and add functions

Browse source

'lookup' is always followed by 'add'.
Merge both and make the list-walk part of nf_conncount_add().

This also avoids one unneeded unlock/re-lock pair.

Extra care needs to be taken in count_tree, as we only hold rcu
read lock, i.e. we can only insert to an existing tree node after
acquiring its lock and making sure it has a nonzero count.

As a zero count should be rare, just fall back to insert_tree()
(which acquires tree lock).

This issue and its solution were pointed out by Shawn Bohrer
during patch review.

Reviewed-by: Shawn Bohrer <sbohrer@cloudflare.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Florian Westphal 2018-12-28 01:24:46 +01:00 • committed by Pablo Neira Ayuso

parent e8cfb372b3

commit df4a902509

3 changed files with 72 additions and 106 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

18

include/net/netfilter/nf_conntrack_count.h

View file

146

net/netfilter/nf_conncount.c

View file

14

net/netfilter/nft_connlimit.c

View file