linux.git/net/netfilter/xt_state.c, branch v4.3

netfilter: nf_conntrack: IPS_UNTRACKED bit

2010-06-08T14:09:52+00:00

NOTRACK makes all cpus share a cache line on nf_conntrack_untracked
twice per packet. This is bad for performance.
__read_mostly annotation is also a bad choice.

This patch introduces IPS_UNTRACKED bit so that we can use later a
per_cpu untrack structure more easily.

A new helper, nf_ct_untracked_get() returns a pointer to
nf_conntrack_untracked.

Another one, nf_ct_untracked_status_or() is used by nf_nat_init() to add
IPS_NAT_DONE_MASK bits to untracked status.

nf_ct_is_untracked() prototype is changed to work on a nf_conn pointer.

Signed-off-by: Eric Dumazet 
Signed-off-by: Patrick McHardy

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11T16:33:37+00:00

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt

netfilter: xtables: substitute temporary defines by final name

2010-05-11T16:31:17+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: merge registration structure to NFPROTO_UNSPEC

2010-03-25T16:05:10+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: shorten up return clause

2010-03-25T15:56:09+00:00

The return value of nf_ct_l3proto_get can directly be returned even in
the case of success.

Signed-off-by: Jan Engelhardt

netfilter: xtables: slightly better error reporting

2010-03-25T15:56:09+00:00

When extended status codes are available, such as ENOMEM on failed
allocations, or subsequent functions (e.g. nf_ct_get_l3proto), passing
them up to userspace seems like a good idea compared to just always
EINVAL.

Signed-off-by: Jan Engelhardt

netfilter: xtables: change matches to return error code

2010-03-25T15:55:24+00:00

The following semantic patch does part of the transformation:
// 
@ rule1 @
struct xt_match ops;
identifier check;
@@
 ops.checkentry = check;

@@
identifier rule1.check;
@@
 check(...) { <...
-return true;
+return 0;
 ...> }

@@
identifier rule1.check;
@@
 check(...) { <...
-return false;
+return -EINVAL;
 ...> }
// 

Signed-off-by: Jan Engelhardt

netfilter: xtables: change xt_match.checkentry return type

2010-03-25T15:03:13+00:00

Restore function signatures from bool to int so that we can report
memory allocation failures or similar using -ENOMEM rather than
always having to pass -EINVAL back.

This semantic patch may not be too precise (checking for functions
that use xt_mtchk_param rather than functions referenced by
xt_match.checkentry), but reviewed, it produced the intended result.

// 
@@
type bool;
identifier check, par;
@@
-bool check
+int check
 (struct xt_mtchk_param *par) { ... }
// 

Signed-off-by: Jan Engelhardt

netfilter: xt extensions: use pr_

2010-03-18T13:20:07+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: make use of caller family rather than match family

2010-03-18T13:20:06+00:00

The matches can have .family = NFPROTO_UNSPEC, and though that is not
the case for the touched modules, it seems better to just use the
nfproto from the caller.

Signed-off-by: Jan Engelhardt