- 11 Jul, 2007 40 commits
-
-
Patrick McHardy authored
This patch brings back the per-conntrack expectation list that was removed around 2.6.10 to avoid walking all expectations on expectation eviction and conntrack destruction. As these were the last users of the global expectation list, this patch also kills that. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Patrick McHardy authored
Convert from the global expectation list to the hash table. Signed-off-by:
-
Patrick McHardy authored
Convert from the global expectation list to the hash table. Signed-off-by:
-
Patrick McHardy authored
Currently all expectations are kept on a global list that - needs to be searched for every new conncetion - needs to be walked for evicting expectations when a master connection has reached its limit - needs to be walked on connection destruction for connections that have open expectations This is obviously not good, especially when considering helpers like H.323 that register *lots* of expectations and can set up permanent expectations, but it also allows for an easy DoS against firewalls using connection tracking helpers. Use a hashtable for expectations to avoid incurring the search overhead for every new connection. The default hash size is 1/256 of the conntrack hash table size, this can be overriden using a module parameter. This patch only introduces the hash table for expectation lookups and keeps other users to reduce the noise, the following patches will get rid of it completely. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Resync expectation table dumping code with conntrack dumping: don't rely on the unique ID anymore since that requires to walk the list backwards, which doesn't work with the upcoming conversion to hlists. Signed-off-by:
-
Patrick McHardy authored
Don't walk the list when unexpecting an expectation, we already have a reference and the timer check is enough to guarantee that it still is on the list. This comment suggests that it was copied there by mistake from expectation eviction: /* choose the oldest expectation to evict */ Signed-off-by:
-
Patrick McHardy authored
Since conntrack currently allows to use masks for every bit of both helper and expectation tuples, we can't hash them and have to keep them on two global lists that are searched for every new connection. This patch removes the never used ability to use masks for the destination part of the expectation tuple and completely removes masks from helpers since the only reasonable choice is a full match on l3num, protonum and src.u.all. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Currently there is a wild mix of nf_conntrack_expect_, nf_ct_exp_, expect_, exp_, ... Consistently use nf_ct_ as prefix for exported functions. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
All callers pass NULL, this also doesn't seem very useful for modules. Signed-off-by:
-
Patrick McHardy authored
Convert conntrack hash to hlists to reduce its size and cache footprint. Since the default hashsize to max. entries ratio sucks (1:16), this patch doesn't reduce the amount of memory used for the hash by default, but instead uses a better ratio of 1:8, which results in the same max. entries value. One thing worth noting is early_drop. It really should use LRU, so it now has to iterate over the entire chain to find the last unconfirmed entry. Since chains shouldn't be very long and the entire operation is very rare this shouldn't be a problem. Signed-off-by:
-
Patrick McHardy authored
Don't let the rest of the page go to waste. Signed-off-by:
-
Patrick McHardy authored
Also make them static. Signed-off-by:
-
Yasuyuki Kozakai authored
Signed-off-by:
Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Signed-off-by:
-
Yasuyuki Kozakai authored
This kills the global 'destroy' operation which was used by NAT. Instead it uses the extension infrastructure so that multiple extensions can register own operations. Signed-off-by:
-
Yasuyuki Kozakai authored
Now memory space for help and NAT are allocated by extension infrastructure. Signed-off-by:
-
Yasuyuki Kozakai authored
Signed-off-by:
-
Yasuyuki Kozakai authored
Signed-off-by:
-
Yasuyuki Kozakai authored
I will split 'struct nf_nat_info' out from conntrack. So I cannot use 'offsetof' to get the pointer to conntrack from it. Signed-off-by:
-
Yasuyuki Kozakai authored
Signed-off-by:
-
Yasuyuki Kozakai authored
Old space allocator of conntrack had problems about extensibility. - It required slab cache per combination of extensions. - It expected what extensions would be assigned, but it was impossible to expect that completely, then we allocated bigger memory object than really required. - It needed to search helper twice due to lock issue. Now basic informations of a connection are stored in 'struct nf_conn'. And a storage for extension (helper, NAT) is allocated by kmalloc. Signed-off-by:
-
Yasuyuki Kozakai authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Jozsef Kadlecsik authored
The TRACE target can be used to follow IP and IPv6 packets through the ruleset. Signed-off-by:
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by:
-
Jan Engelhardt authored
Along comes... xt_u32, a revamped ipt_u32 from POM-NG, Plus: * 2007-06-02: added ipv6 support * 2007-06-05: uses kmalloc for the big buffer * 2007-06-05: added inversion * 2007-06-20: use skb_copy_bits() and get rid of the big buffer and lock (suggested by Pablo Neira Ayuso) Signed-off-by:Jan Engelhardt <jengelh@gmx.de> Signed-off-by:
-
Jerome Borsboom authored
DNAT of the the RTP session is only necessary if the SIP session has been SNATed. Signed-off-by:
Jerome Borsboom <j.borsboom@erasmusmc.nl> Signed-off-by:
-
Jan Engelhardt authored
Removes redundant parentheses and braces (And add one pair in a xt_tcpudp.c macro). Signed-off-by:
-
Jan Engelhardt authored
device_cmp: the function's address is taken (call to nf_ct_iterate_cleanup) alloc_null_binding: referenced externally Signed-off-by:
-
Jan Engelhardt authored
Make a number of variables const and/or remove unneeded casts. Signed-off-by:
-
Jan Engelhardt authored
Switch the return type of target checkentry functions to boolean. Signed-off-by:
-
Jan Engelhardt authored
Switch the return type of match functions to boolean Signed-off-by:
-
Jan Engelhardt authored
Switch the return type of match functions to boolean Signed-off-by:
-
Jan Engelhardt authored
Switch the "hotdrop" variables to boolean Signed-off-by:
-
Yasuyuki Kozakai authored
This explains the allowed upper protocol numbers. IP6T_F_NOPROTO was introduced to use 0 as Hop-by-Hop option header, not wildcard. But that seemed to be forgotten. 0 has been used as wildcard since 2002-08-23. Signed-off-by:
Yasuyuki Kozakai <yasuyuki@netfilter.org> Signed-off-by:
-
Jing Min Zhao authored
Check range before checking STOP flag. This optimization may save a nanosecond or less :) Signed-off-by:
Jing Min Zhao <zhaojingmin@vivecode.com> Signed-off-by:
-
James Chapman authored
This cleanup fell out after adding L2TP support where a new encap_rcv funcptr was added to struct udp_sock. Have XFRM use the new encap_rcv funcptr, which allows us to move the XFRM encap code from udp.c into xfrm4_input.c. Make xfrm4_rcv_encap() static since it is no longer called externally. Signed-off-by:
James Chapman <jchapman@katalix.com> Acked-by:
-
G. Liakhovetski authored
This patch extracts common code from irttp_open_tsap() and irttp_dup() into a new function to 1) avoid code duplication, 2) help avoid forgetting object initialization in the tsap duplication path in the future. Signed-off-by:
G. Liakhovetski <gl@dsa-ac.de> Signed-off-by:
Samuel Ortiz <samuel@sortiz.org> Signed-off-by:
-
