linux.git/include/linux/netfilter, branch v2.6.35

netfilter: xtables: stackptr should be percpu

2010-05-31T14:41:35+00:00

commit f3c5c1bfd4 (netfilter: xtables: make ip_tables reentrant)
introduced a performance regression, because stackptr array is shared by
all cpus, adding cache line ping pongs. (16 cpus share a 64 bytes cache
line)

Fix this using alloc_percpu()

Signed-off-by: Eric Dumazet 
Acked-By: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: fix description of expected checkentry return code on xt_target

2010-05-20T13:59:16+00:00

The text describing the return codes that are expected on calls to
checkentry() was incorrect.  Instead of returning true or false, or an error
code, it should return 0 or an error code.

Signed-off-by: Luciano Coelho 
Signed-off-by: Patrick McHardy

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11T16:35:27+00:00

Since xt_action_param is writable, let's use it. The pointer to
'bool hotdrop' always worried (8 bytes (64-bit) to write 1 byte!).
Surprisingly results in a reduction in size:

   text    data     bss filename
5457066  692730  357892 vmlinux.o-prev
5456554  692730  357892 vmlinux.o

Signed-off-by: Jan Engelhardt

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11T16:33:37+00:00

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt

netfilter: xtables: substitute temporary defines by final name

2010-05-11T16:31:17+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: combine struct xt_match_param and xt_target_param

2010-05-11T16:23:43+00:00

The structures carried - besides match/target - almost the same data.
It is possible to combine them, as extensions are evaluated serially,
and so, the callers end up a little smaller.

  text  data  bss  filename
-15318   740  104  net/ipv4/netfilter/ip_tables.o
+15286   740  104  net/ipv4/netfilter/ip_tables.o
-15333   540  152  net/ipv6/netfilter/ip6_tables.o
+15269   540  152  net/ipv6/netfilter/ip6_tables.o

Signed-off-by: Jan Engelhardt

netfilter: x_tables: rectify XT_FUNCTION_MAXNAMELEN usage

2010-04-27T13:34:34+00:00

There has been quite a confusion in userspace about
XT_FUNCTION_MAXNAMELEN; because struct xt_entry_match used MAX-1,
userspace would have to do an awkward MAX-2 for maximum length
checking (due to '\0'). This patch adds a new define that matches the
definition of XT_TABLE_MAXNAMELEN - being the size of the actual
struct member, not one off.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: nf_conntrack: extend with extra stat counter

2010-04-23T10:34:56+00:00

I suspect an unfortunatly series of events occuring under a DDoS
attack, in function __nf_conntrack_find() nf_contrack_core.c.

Adding a stats counter to see if the search is restarted too often.

Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: Patrick McHardy

Merge branch 'master' of /repos/git/net-next-2.6

2010-04-20T14:02:01+00:00

Conflicts:
	Documentation/feature-removal-schedule.txt
	net/ipv6/netfilter/ip6t_REJECT.c
	net/netfilter/xt_limit.c

Signed-off-by: Patrick McHardy

netfilter: xt_TEE: resolve oif using netdevice notifiers

2010-04-20T13:07:32+00:00

Replace the runtime oif name resolving by netdevice notifier based
resolving. When an oif is given, a netdevice notifier is registered
to resolve the name on NETDEV_REGISTER or NETDEV_CHANGE and unresolve
it again on NETDEV_UNREGISTER or NETDEV_CHANGE to a different name.

Signed-off-by: Patrick McHardy