Eric Lee / smarc-fsl-linux-kernel

15 Apr, 2017

1 commit

  • cc41c84b7   netfilter: kill the fake untracked conntrack objects ... Browse Code »

    resurrect an old patch from Pablo Neira to remove the untracked objects.

    Currently, there are four possible states of an skb wrt. conntrack.

    1. No conntrack attached, ct is NULL.
    2. Normal (kmem cache allocated) ct attached.
    3. a template (kmalloc'd), not in any hash tables at any point in time
    4. the 'untracked' conntrack, a percpu nf_conn object, tagged via
    IPS_UNTRACKED_BIT in ct->status.

    Untracked is supposed to be identical to case 1. It exists only
    so users can check

    -m conntrack --ctstate UNTRACKED vs.
    -m conntrack --ctstate INVALID

    e.g. attempts to set connmark on INVALID or UNTRACKED conntracks is
    supposed to be a no-op.

    Thus currently we need to check
    ct == NULL || nf_ct_is_untracked(ct)

    in a lot of places in order to avoid altering untracked objects.

    The other consequence of the percpu untracked object is that all
    -j NOTRACK (and, later, kfree_skb of such skbs) result in an atomic op
    (inc/dec the untracked conntracks refcount).

    This adds a new kernel-private ctinfo state, IP_CT_UNTRACKED, to
    make the distinction instead.

    The (few) places that care about packet invalid (ct is NULL) vs.
    packet untracked now need to test ct == NULL vs. ctinfo == IP_CT_UNTRACKED,
    but all other places can omit the nf_ct_is_untracked() check.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

05 Dec, 2016

1 commit

  • ecb2421b5   netfilter: add and use nf_ct_netns_get/put ... Browse Code »

    currently aliased to try_module_get/_put.
    Will be changed in next patch when we add functions to make use of ->net
    argument to store usercount per l3proto tracker.

    This is needed to avoid registering the conntrack hooks in all netns and
    later only enable connection tracking in those that need conntrack.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

08 Jun, 2010

1 commit

  • 5bfddbd46   netfilter: nf_conntrack: IPS_UNTRACKED bit ... Browse Code »

    NOTRACK makes all cpus share a cache line on nf_conntrack_untracked
    twice per packet. This is bad for performance.
    __read_mostly annotation is also a bad choice.

    This patch introduces IPS_UNTRACKED bit so that we can use later a
    per_cpu untrack structure more easily.

    A new helper, nf_ct_untracked_get() returns a pointer to
    nf_conntrack_untracked.

    Another one, nf_ct_untracked_status_or() is used by nf_nat_init() to add
    IPS_NAT_DONE_MASK bits to untracked status.

    nf_ct_is_untracked() prototype is changed to work on a nf_conn pointer.

    Signed-off-by: Eric Dumazet
    Signed-off-by: Patrick McHardy

    Eric Dumazet
     

12 May, 2010

2 commits

26 Mar, 2010

1 commit

25 Mar, 2010

4 commits

18 Mar, 2010

2 commits

08 Oct, 2008

4 commits

29 Jan, 2008

2 commits

11 Jul, 2007

4 commits

26 Apr, 2007

1 commit

14 Dec, 2006

1 commit

23 Sep, 2006

2 commits

29 Mar, 2006

1 commit

  • 65b4b4e81   [NETFILTER]: Rename init functions. ... Browse Code »

    Every netfilter module uses `init' for its module_init() function and
    `fini' or `cleanup' for its module_exit() function.

    Problem is, this creates uninformative initcall_debug output and makes
    ctags rather useless.

    So go through and rename them all to $(filename)_init and
    $(filename)_fini.

    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    Andrew Morton
     

23 Mar, 2006

2 commits

21 Mar, 2006

2 commits

13 Jan, 2006

1 commit

  • 2e4e6a17a   [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables ... Browse Code »

    This monster-patch tries to do the best job for unifying the data
    structures and backend interfaces for the three evil clones ip_tables,
    ip6_tables and arp_tables. In an ideal world we would never have
    allowed this kind of copy+paste programming... but well, our world
    isn't (yet?) ideal.

    o introduce a new x_tables module
    o {ip,arp,ip6}_tables depend on this x_tables module
    o registration functions for tables, matches and targets are only
    wrappers around x_tables provided functions
    o all matches/targets that are used from ip_tables and ip6_tables
    are now implemented as xt_FOOBAR.c files and provide module aliases
    to ipt_FOOBAR and ip6t_FOOBAR
    o header files for xt_matches are in include/linux/netfilter/,
    include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
    around the xt_FOOBAR.h headers

    Based on this patchset we're going to further unify the code,
    gradually getting rid of all the layer 3 specific assumptions.

    Signed-off-by: Harald Welte
    Signed-off-by: David S. Miller

    Harald Welte