This is an automated email from the ASF dual-hosted git repository.
Donny9 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new e6dd9f88c3f net/ipfilter: cache IPv4 addresses during filter matching
e6dd9f88c3f is described below
commit e6dd9f88c3f32cba7996febbb66ecccab33a9383
Author: chao an <[email protected]>
AuthorDate: Wed Oct 21 11:57:27 2026 +0800
net/ipfilter: cache IPv4 addresses during filter matching
ipv4_filter_match() walks all filters in the selected chain for each
packet. The source and destination IPv4 addresses do not change during
that walk, but the old code converted them from the packet header for
each filter entry before doing the masked address comparison.
Convert the packet source and destination addresses once before entering
the filter loop and reuse the cached values for each rule. This avoids
repeated byte-order conversion work on the rule matching path without
changing the matching result.
Signed-off-by: chao an <[email protected]>
---
net/ipfilter/ipfilter.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/net/ipfilter/ipfilter.c b/net/ipfilter/ipfilter.c
index da971899cee..97f05ca86d8 100644
--- a/net/ipfilter/ipfilter.c
+++ b/net/ipfilter/ipfilter.c
@@ -165,6 +165,7 @@ static bool ipfilter_match_proto(FAR const struct
ipfilter_entry_s *entry,
/* Ports in TCP & UDP headers have same offset. */
FAR const struct udp_hdr_s *udp = l4hdr;
+
return SPORT_MATCH(entry, NTOHS(udp->srcport)) &&
DPORT_MATCH(entry, NTOHS(udp->destport));
}
@@ -173,6 +174,7 @@ static bool ipfilter_match_proto(FAR const struct
ipfilter_entry_s *entry,
if (entry->match_icmp)
{
FAR const struct icmp_hdr_s *icmp = l4hdr;
+
return ICMP_MATCH(entry, icmp);
}
@@ -180,6 +182,7 @@ static bool ipfilter_match_proto(FAR const struct
ipfilter_entry_s *entry,
if (entry->match_icmp)
{
FAR const struct icmpv6_hdr_s *icmpv6 = l4hdr;
+
return ICMP_MATCH(entry, icmpv6);
}
@@ -217,7 +220,8 @@ static int ipv4_filter_match(FAR const struct net_driver_s
*indev,
FAR const sq_queue_t *queue = &g_ipv4_filters[chain];
FAR const sq_entry_t *entry;
FAR const void *l4hdr;
- in_addr_t ipaddr;
+ in_addr_t srcip;
+ in_addr_t dstip;
bool matched;
/* Handle unexpected status, return ACCEPT to indicate doing nothing. */
@@ -228,6 +232,8 @@ static int ipv4_filter_match(FAR const struct net_driver_s
*indev,
}
l4hdr = IPv4_L4HDR(ipv4);
+ srcip = net_ip4addr_conv32(ipv4->srcipaddr);
+ dstip = net_ip4addr_conv32(ipv4->destipaddr);
sq_for_every(queue, entry)
{
@@ -242,16 +248,14 @@ static int ipv4_filter_match(FAR const struct
net_driver_s *indev,
/* Match addresses */
- ipaddr = net_ip4addr_conv32(ipv4->srcipaddr);
- matched = net_ipv4addr_maskcmp(filter->sip, ipaddr, filter->smsk)
+ matched = net_ipv4addr_maskcmp(filter->sip, srcip, filter->smsk)
^ filter->common.inv_srcip;
if (!matched)
{
continue;
}
- ipaddr = net_ip4addr_conv32(ipv4->destipaddr);
- matched = net_ipv4addr_maskcmp(filter->dip, ipaddr, filter->dmsk)
+ matched = net_ipv4addr_maskcmp(filter->dip, dstip, filter->dmsk)
^ filter->common.inv_dstip;
if (!matched)
{
@@ -444,6 +448,7 @@ void ipfilter_cfg_clear(sa_family_t family, enum
ipfilter_chain_e chain)
if (family == PF_INET)
{
FAR sq_queue_t *queue = &g_ipv4_filters[chain];
+
while (!sq_empty(queue))
{
kmm_free(sq_remfirst(queue));
@@ -455,6 +460,7 @@ void ipfilter_cfg_clear(sa_family_t family, enum
ipfilter_chain_e chain)
if (family == PF_INET6)
{
FAR sq_queue_t *queue = &g_ipv6_filters[chain];
+
while (!sq_empty(queue))
{
kmm_free(sq_remfirst(queue));
