[PATCH 03/11] netfilter: nf_tables: move hgenerator from chain to table

[kaber@xxxxxxxxx]

From: Patrick McHardy <kaber@xxxxxxxxx>

With 48 bits rule handles, there's no risk of overflowing even when the
handles are unique per table and not per chain. Save a few bytes in the
chain structure and move the hgenerator to the table.

Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
---
 include/net/netfilter/nf_tables.h | 4 ++--
 net/netfilter/nf_tables_api.c     | 8 ++++----
 2 Dateien geändert, 6 Zeilen hinzugefügt(+), 6 Zeilen entfernt(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 99c500f..86fd951 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -349,7 +349,6 @@ enum nft_chain_flags {
  *	@flags: bitmask of enum nft_chain_flags
  *	@use: number of jump references to this chain
  *	@level: length of longest path to this chain
- *	@hgenerator: handle generator state
  *	@name: name of the chain
  */
 struct nft_chain {
@@ -359,7 +358,6 @@ struct nft_chain {
 	u8				policy;
 	u16				use;
 	u16				level;
-	u64				hgenerator;
 	char				name[NFT_CHAIN_MAXNAMELEN];
 };
 
@@ -400,12 +398,14 @@ extern unsigned int nft_do_chain(const struct nf_hook_ops *ops,
  *	@chains: chains in the table
  *	@sets: sets in the table
  *	@flags: table flag (see enum nft_table_flags)
+ *	@hgenerator: handle generator state
  *	@name: name of the table
  */
 struct nft_table {
 	struct list_head		list;
 	struct list_head		chains;
 	struct list_head		sets;
+	u64				hgenerator;
 	u16				flags;
 	char				name[];
 };
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 63d71e7..9768881 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1116,9 +1116,9 @@ static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
 	return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
 }
 
-static inline u64 nf_tables_rule_alloc_handle(struct nft_chain *chain)
+static inline u64 nf_tables_rule_alloc_handle(struct nft_table *table)
 {
-	return ++chain->hgenerator;
+	return ++table->hgenerator;
 }
 
 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
@@ -1338,7 +1338,7 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 {
 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	const struct nft_af_info *afi;
-	const struct nft_table *table;
+	struct nft_table *table;
 	struct nft_chain *chain;
 	struct nft_rule *rule, *old_rule = NULL;
 	struct nft_expr_info info[NFT_RULE_MAXEXPRS];
@@ -1383,7 +1383,7 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 				return 0;
 		}
 	} else
-		handle = nf_tables_rule_alloc_handle(chain);
+		handle = nf_tables_rule_alloc_handle(table);
 
 	if (handle == 0)
 		return -EINVAL;
-- 
1.7.11.7

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html