linux.git/net/ipv6/netfilter, branch v2.6.35

netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT

2010-07-02T08:05:01+00:00

We should release dst if dst->error is set.

Bug introduced in 2.6.14 by commit e104411b82f5c
([XFRM]: Always release dst_entry on error in xfrm_lookup)

Signed-off-by: Eric Dumazet 
Cc: stable@kernel.org
Signed-off-by: Patrick McHardy

netfilter: xtables: stackptr should be percpu

2010-05-31T14:41:35+00:00

commit f3c5c1bfd4 (netfilter: xtables: make ip_tables reentrant)
introduced a performance regression, because stackptr array is shared by
all cpus, adding cache line ping pongs. (16 cpus share a 64 bytes cache
line)

Fix this using alloc_percpu()

Signed-off-by: Eric Dumazet 
Acked-By: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: remove unnecessary returns from void function()s

2010-05-13T13:16:27+00:00

This patch removes from net/ netfilter files
all the unnecessary return; statements that precede the
last closing brace of void functions.

It does not remove the returns that are immediately
preceded by a label as gcc doesn't like that.

Done via:
$ grep -rP --include=*.[ch] -l "return;\n}" net/ | \
  xargs perl -i -e 'local $/ ; while (<>) { s/\n[ \t\n]+return;\n}/\n}/g; print; }'

Signed-off-by: Joe Perches 
[Patrick: changed to keep return statements in otherwise empty function bodies]
Signed-off-by: Patrick McHardy

netfilter: cleanup printk messages

2010-05-13T13:02:08+00:00

Make sure all printk messages have a severity level.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Patrick McHardy

netfilter: change NF_ASSERT to WARN_ON

2010-05-13T13:00:20+00:00

Change netfilter asserts to standard WARN_ON. This has the
benefit of backtrace info and also causes netfilter errors
to show up on kerneloops.org.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Patrick McHardy

netfilter: xtables: combine built-in extension structs

2010-05-11T16:36:18+00:00

Prepare the arrays for use with the multiregister function. The
future layer-3 xt matches can then be easily added to it without
needing more (un)register code.

Signed-off-by: Jan Engelhardt

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11T16:35:27+00:00

Since xt_action_param is writable, let's use it. The pointer to
'bool hotdrop' always worried (8 bytes (64-bit) to write 1 byte!).
Surprisingly results in a reduction in size:

   text    data     bss filename
5457066  692730  357892 vmlinux.o-prev
5456554  692730  357892 vmlinux.o

Signed-off-by: Jan Engelhardt

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11T16:33:37+00:00

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt

netfilter: xtables: substitute temporary defines by final name

2010-05-11T16:31:17+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: combine struct xt_match_param and xt_target_param

2010-05-11T16:23:43+00:00

The structures carried - besides match/target - almost the same data.
It is possible to combine them, as extensions are evaluated serially,
and so, the callers end up a little smaller.

  text  data  bss  filename
-15318   740  104  net/ipv4/netfilter/ip_tables.o
+15286   740  104  net/ipv4/netfilter/ip_tables.o
-15333   540  152  net/ipv6/netfilter/ip6_tables.o
+15269   540  152  net/ipv6/netfilter/ip6_tables.o

Signed-off-by: Jan Engelhardt