linux-stable.git/net/netfilter/xt_connbytes.c, branch v4.7 Linux kernel stable tree netfilter: Convert pr_warning to pr_warn 2014-09-10T19:40:10+00:00 Joe Perches joe@perches.com 2014-09-10T04:17:32+00:00 b167a37c7bbc6f7589f439ba7d9a49af5ad37ff5 Use the more common pr_warn. Other miscellanea: o Coalesce formats o Realign arguments Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
Use the more common pr_warn.

Other miscellanea:

o Coalesce formats
o Realign arguments

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
netfilter: introduce nf_conn_acct structure 2013-11-03T20:48:49+00:00 Holger Eitzenberger holger@eitzenberger.org 2013-09-26T15:31:51+00:00 f7b13e4330ef3c20e62ac4908cc96c1c318056c2 Encapsulate counters for both directions into nf_conn_acct. During that process also consistently name pointers to the extend 'acct', not 'counters'. This patch is a cleanup. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
Encapsulate counters for both directions into nf_conn_acct. During
that process also consistently name pointers to the extend 'acct',
not 'counters'. This patch is a cleanup.

Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'nf-next' of git://1984.lsi.us.es/net-next 2011-12-25T07:21:45+00:00 David S. Miller davem@davemloft.net 2011-12-25T07:21:45+00:00 c5e1fd8ccae09f574d6f978c90c2b968ee29030c 






netfilter: xt_connbytes: handle negation correctly
2011-12-23T13:50:19+00:00

Florian Westphal
fw@strlen.de

2011-12-16T17:35:15+00:00

0354b48f633ae435acbc01b470a1ce8cfeff3e9f

"! --connbytes 23:42" should match if the packet/byte count is not in range.

As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).

However, "what <= 23 && what >= 42" will always be false.

Change things so we use "||" in case "from" is larger than "to".

This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>





"! --connbytes 23:42" should match if the packet/byte count is not in range.

As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).

However, "what <= 23 && what >= 42" will always be false.

Change things so we use "||" in case "from" is larger than "to".

This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>







netfilter: nf_conntrack: use atomic64 for accounting counters
2011-12-18T00:19:19+00:00

Eric Dumazet
eric.dumazet@gmail.com

2011-12-14T13:45:20+00:00

b3e0bfa71b1db9d7a9fbea6965867784fd00ca3c

We can use atomic64_t infrastructure to avoid taking a spinlock in fast
path, and remove inaccuracies while reading values in
ctnetlink_dump_counters() and connbytes_mt() on 32bit arches.

Suggested by Pablo.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>





We can use atomic64_t infrastructure to avoid taking a spinlock in fast
path, and remove inaccuracies while reading values in
ctnetlink_dump_counters() and connbytes_mt() on 32bit arches.

Suggested by Pablo.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>







netfilter: xt_connbytes: Force CT accounting to be enabled
2010-06-25T12:44:07+00:00

Tim Gardner
tim.gardner@canonical.com

2010-06-25T12:44:07+00:00

a8756201ba4189bca3ee1a6ec4e290f467ee09ab

Check at rule install time that CT accounting is enabled. Force it
to be enabled if not while also emitting a warning since this is not
the default state.

This is in preparation for deprecating CONFIG_NF_CT_ACCT upon which
CONFIG_NETFILTER_XT_MATCH_CONNBYTES depended being set.

Added 2 CT accounting support functions:

nf_ct_acct_enabled() - Get CT accounting state.
nf_ct_set_acct() - Enable/disable CT accountuing.

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>





Check at rule install time that CT accounting is enabled. Force it
to be enabled if not while also emitting a warning since this is not
the default state.

This is in preparation for deprecating CONFIG_NF_CT_ACCT upon which
CONFIG_NETFILTER_XT_MATCH_CONNBYTES depended being set.

Added 2 CT accounting support functions:

nf_ct_acct_enabled() - Get CT accounting state.
nf_ct_set_acct() - Enable/disable CT accountuing.

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>







netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11T16:33:37+00:00

Jan Engelhardt
jengelh@medozas.de

2009-07-07T18:42:08+00:00

62fc8051083a334578c3f4b3488808f210b4565f

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>







netfilter: xtables: substitute temporary defines by final name
2010-05-11T16:31:17+00:00

Jan Engelhardt
jengelh@medozas.de

2009-07-05T17:43:26+00:00

4b560b447df83368df44bd3712c0c39b1d79ba04

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





Signed-off-by: Jan Engelhardt <jengelh@medozas.de>







netfilter: xtables: shorten up return clause
2010-03-25T15:56:09+00:00

Jan Engelhardt
jengelh@medozas.de

2010-03-21T03:05:56+00:00

f95c74e33eff5e3fe9798e2dc0a7749150ea3f80

The return value of nf_ct_l3proto_get can directly be returned even in
the case of success.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





The return value of nf_ct_l3proto_get can directly be returned even in
the case of success.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>







netfilter: xtables: slightly better error reporting
2010-03-25T15:56:09+00:00

Jan Engelhardt
jengelh@medozas.de

2010-03-19T16:32:59+00:00

4a5a5c73b7cfee46a0b1411903cfa0dea532deec

When extended status codes are available, such as ENOMEM on failed
allocations, or subsequent functions (e.g. nf_ct_get_l3proto), passing
them up to userspace seems like a good idea compared to just always
EINVAL.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





When extended status codes are available, such as ENOMEM on failed
allocations, or subsequent functions (e.g. nf_ct_get_l3proto), passing
them up to userspace seems like a good idea compared to just always
EINVAL.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>