linux.git/net/netfilter/xt_connbytes.c, branch v4.19 Linux kernel source tree netfilter: x_tables: use pr ratelimiting in all remaining spots 2018-02-14T20:05:38+00:00 Florian Westphal fw@strlen.de 2018-02-09T14:52:07+00:00 b26066447bb8599b393b2dd2bbeb68767e09ba07 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: add and use nf_ct_netns_get/put 2016-12-04T20:16:50+00:00 Florian Westphal fw@strlen.de 2016-11-15T20:36:40+00:00 ecb2421b5ddf48e6e116fced7f74c985bb546138 currently aliased to try_module_get/_put. Will be changed in next patch when we add functions to make use of ->net argument to store usercount per l3proto tracker. This is needed to avoid registering the conntrack hooks in all netns and later only enable connection tracking in those that need conntrack. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
currently aliased to try_module_get/_put.
Will be changed in next patch when we add functions to make use of ->net
argument to store usercount per l3proto tracker.

This is needed to avoid registering the conntrack hooks in all netns and
later only enable connection tracking in those that need conntrack.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: Convert pr_warning to pr_warn 2014-09-10T19:40:10+00:00 Joe Perches joe@perches.com 2014-09-10T04:17:32+00:00 b167a37c7bbc6f7589f439ba7d9a49af5ad37ff5 Use the more common pr_warn. Other miscellanea: o Coalesce formats o Realign arguments Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
Use the more common pr_warn.

Other miscellanea:

o Coalesce formats
o Realign arguments

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
netfilter: introduce nf_conn_acct structure 2013-11-03T20:48:49+00:00 Holger Eitzenberger holger@eitzenberger.org 2013-09-26T15:31:51+00:00 f7b13e4330ef3c20e62ac4908cc96c1c318056c2 Encapsulate counters for both directions into nf_conn_acct. During that process also consistently name pointers to the extend 'acct', not 'counters'. This patch is a cleanup. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
Encapsulate counters for both directions into nf_conn_acct. During
that process also consistently name pointers to the extend 'acct',
not 'counters'. This patch is a cleanup.

Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'nf-next' of git://1984.lsi.us.es/net-next 2011-12-25T07:21:45+00:00 David S. Miller davem@davemloft.net 2011-12-25T07:21:45+00:00 c5e1fd8ccae09f574d6f978c90c2b968ee29030c 






netfilter: xt_connbytes: handle negation correctly
2011-12-23T13:50:19+00:00

Florian Westphal
fw@strlen.de

2011-12-16T17:35:15+00:00

0354b48f633ae435acbc01b470a1ce8cfeff3e9f

"! --connbytes 23:42" should match if the packet/byte count is not in range.

As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).

However, "what <= 23 && what >= 42" will always be false.

Change things so we use "||" in case "from" is larger than "to".

This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>





"! --connbytes 23:42" should match if the packet/byte count is not in range.

As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).

However, "what <= 23 && what >= 42" will always be false.

Change things so we use "||" in case "from" is larger than "to".

This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>







netfilter: nf_conntrack: use atomic64 for accounting counters
2011-12-18T00:19:19+00:00

Eric Dumazet
eric.dumazet@gmail.com

2011-12-14T13:45:20+00:00

b3e0bfa71b1db9d7a9fbea6965867784fd00ca3c

We can use atomic64_t infrastructure to avoid taking a spinlock in fast
path, and remove inaccuracies while reading values in
ctnetlink_dump_counters() and connbytes_mt() on 32bit arches.

Suggested by Pablo.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>





We can use atomic64_t infrastructure to avoid taking a spinlock in fast
path, and remove inaccuracies while reading values in
ctnetlink_dump_counters() and connbytes_mt() on 32bit arches.

Suggested by Pablo.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>







netfilter: xt_connbytes: Force CT accounting to be enabled
2010-06-25T12:44:07+00:00

Tim Gardner
tim.gardner@canonical.com

2010-06-25T12:44:07+00:00

a8756201ba4189bca3ee1a6ec4e290f467ee09ab

Check at rule install time that CT accounting is enabled. Force it
to be enabled if not while also emitting a warning since this is not
the default state.

This is in preparation for deprecating CONFIG_NF_CT_ACCT upon which
CONFIG_NETFILTER_XT_MATCH_CONNBYTES depended being set.

Added 2 CT accounting support functions:

nf_ct_acct_enabled() - Get CT accounting state.
nf_ct_set_acct() - Enable/disable CT accountuing.

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>





Check at rule install time that CT accounting is enabled. Force it
to be enabled if not while also emitting a warning since this is not
the default state.

This is in preparation for deprecating CONFIG_NF_CT_ACCT upon which
CONFIG_NETFILTER_XT_MATCH_CONNBYTES depended being set.

Added 2 CT accounting support functions:

nf_ct_acct_enabled() - Get CT accounting state.
nf_ct_set_acct() - Enable/disable CT accountuing.

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>







netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11T16:33:37+00:00

Jan Engelhardt
jengelh@medozas.de

2009-07-07T18:42:08+00:00

62fc8051083a334578c3f4b3488808f210b4565f

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>







netfilter: xtables: substitute temporary defines by final name
2010-05-11T16:31:17+00:00

Jan Engelhardt
jengelh@medozas.de

2009-07-05T17:43:26+00:00

4b560b447df83368df44bd3712c0c39b1d79ba04

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





Signed-off-by: Jan Engelhardt <jengelh@medozas.de>