linux.git/net/netfilter/xt_cluster.c, branch v5.0

netfilter: xt_cluster: add dependency on conntrack module

2018-08-23T18:26:53+00:00

The cluster match requires conntrack for matching packets. If the
netns does not have conntrack hooks registered, the match does not
work at all.

Implicitly load the conntrack hook for the family, exactly as many
other extensions do. This ensures that the match works even if the
hooks have not been registered by other means.

Signed-off-by: Martin Willi 
Acked-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_cluster: get rid of xt_cluster_ipv6_is_multicast

2018-03-05T22:15:43+00:00

If use the ipv6_addr_is_multicast instead of xt_cluster_ipv6_is_multicast,
then we can reduce code size.

Signed-off-by: Taehee Yoo 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: use pr ratelimiting in all remaining spots

2018-02-14T20:05:38+00:00

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: remove nf_ct_is_untracked

2017-04-15T09:51:33+00:00

This function is now obsolete and always returns false.
This change has no effect on generated code.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: move hook state into xt_action_param structure

2016-11-03T09:56:21+00:00

Place pointer to hook state in xt_action_param structure instead of
copying the fields that we need. After this change xt_action_param fits
into one cacheline.

This patch also adds a set of new wrapper functions to fetch relevant
hook state structure fields.

Signed-off-by: Pablo Neira Ayuso

net: use reciprocal_scale() helper

2014-08-23T19:21:21+00:00

Replace open codings of (((u64)  * ) >> 32) with reciprocal_scale().

Signed-off-by: Daniel Borkmann 
Cc: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

netfilter: nf_conntrack: IPS_UNTRACKED bit

2010-06-08T14:09:52+00:00

NOTRACK makes all cpus share a cache line on nf_conntrack_untracked
twice per packet. This is bad for performance.
__read_mostly annotation is also a bad choice.

This patch introduces IPS_UNTRACKED bit so that we can use later a
per_cpu untrack structure more easily.

A new helper, nf_ct_untracked_get() returns a pointer to
nf_conntrack_untracked.

Another one, nf_ct_untracked_status_or() is used by nf_nat_init() to add
IPS_NAT_DONE_MASK bits to untracked status.

nf_ct_is_untracked() prototype is changed to work on a nf_conn pointer.

Signed-off-by: Eric Dumazet 
Signed-off-by: Patrick McHardy

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11T16:33:37+00:00

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt

netfilter: xtables: substitute temporary defines by final name

2010-05-11T16:31:17+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: slightly better error reporting

2010-03-25T15:56:09+00:00

When extended status codes are available, such as ENOMEM on failed
allocations, or subsequent functions (e.g. nf_ct_get_l3proto), passing
them up to userspace seems like a good idea compared to just always
EINVAL.

Signed-off-by: Jan Engelhardt