summaryrefslogtreecommitdiffstats
path: root/net/netfilter
Commit message (Collapse)AuthorAgeFilesLines
* [NETFILTER]: xt_hashlimit: fix mask calculationPatrick McHardy2008-04-101-18/+5Star
| | | | | | | | | | | Shifts larger than the data type are undefined, don't try to shift an u32 by 32. Also remove some special-casing of bitmasks divisible by 32. Based on patch by Jan Engelhardt <jengelh@computergmbh.de>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: Replate direct proc_fops assignment with proc_create call.Denis V. Lunev2008-03-286-39/+19Star
| | | | | | | | This elliminates infamous race during module loading when one could lookup proc entry without proc_fops assigned. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack_h323: logical-bitwise & confusion in process_setup()Roel Kluin2008-03-201-1/+1
| | | | | | | | logical-bitwise & confusion Signed-off-by: Roel Kluin <12o3l@tiscali.nl> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_queue: don't return error when unregistering a non-existant ↵Patrick McHardy2008-03-111-1/+1
| | | | | | | | | | | | | | | | | | handler Commit ce7663d84: [NETFILTER]: nfnetlink_queue: don't unregister handler of other subsystem changed nf_unregister_queue_handler to return an error when attempting to unregister a queue handler that is not identical to the one passed in. This is correct in case we really do have a different queue handler already registered, but some existing userspace code always does an unbind before bind and aborts if that fails, so try to be nice and return success in that case. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nfnetlink_queue: fix EPERM when binding/unbinding and instance ↵Patrick McHardy2008-03-111-11/+4Star
| | | | | | | | | | | | | 0 exists Similar to the nfnetlink_log problem, nfnetlink_queue incorrectly returns -EPERM when binding or unbinding to an address family and queueing instance 0 exists and is owned by a different process. Unlike nfnetlink_log it previously completes the operation, but it is still incorrect. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nfnetlink_log: fix EPERM when binding/unbinding and instance 0 ↵Patrick McHardy2008-03-111-14/+16
| | | | | | | | | | | | | | | | | | exists When binding or unbinding to an address family, the res_id is usually set to zero. When logging instance 0 already exists and is owned by a different process, this makes nfunl_recv_config return -EPERM without performing the bind operation. Since no operation on the foreign logging instance itself was requested, this is incorrect. Move bind/unbind commands before the queue instance permissions checks. Also remove an incorrect comment. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: replace horrible hack with ksize()Pekka Enberg2008-03-111-16/+3Star
| | | | | | | | | | There's a horrible slab abuse in net/netfilter/nf_conntrack_extend.c that can be replaced with a call to ksize(). Cc: Christoph Lameter <clameter@sgi.com> Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: add \n to "expectation table full" messageAlexey Dobriyan2008-03-111-1/+1
| | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_time: fix failure to match on SundaysJan Engelhardt2008-03-111-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | From: Andrew Schulman <andrex@alumni.utexas.net> xt_time_match() in net/netfilter/xt_time.c in kernel 2.6.24 never matches on Sundays. On my host I have a rule like iptables -A OUTPUT -m time --weekdays Sun -j REJECT and it never matches. The problem is in localtime_2(), which uses r->weekday = (4 + r->dse) % 7; to map the epoch day onto a weekday in {0,...,6}. In particular this gives 0 for Sundays. But 0 has to be wrong; a weekday of 0 can never match. xt_time_match() has if (!(info->weekdays_match & (1 << current_time.weekday))) return false; and when current_time.weekday = 0, the result of the & is always zero, even when info->weekdays_match = XT_TIME_ALL_WEEKDAYS = 0xFE. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nfnetlink_log: fix computation of netlink skb sizeEric Leblond2008-03-111-1/+1
| | | | | | | | | This patch is similar to nfnetlink_queue fixes. It fixes the computation of skb size by using NLMSG_SPACE instead of NLMSG_ALIGN. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nfnetlink_queue: fix computation of allocated size for netlink skb.Eric Leblond2008-03-111-1/+1
| | | | | | | | | | | | | | Size of the netlink skb was wrongly computed because the formula was using NLMSG_ALIGN instead of NLMSG_SPACE. NLMSG_ALIGN does not add the room for netlink header as NLMSG_SPACE does. This was causing a failure of message building in some cases. On my test system, all messages for packets in range [8*k+41, 8*k+48] where k is an integer were invalid and the corresponding packets were dropped. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_conntrack: fix IPv4 address comparisonJan Engelhardt2008-02-271-1/+1
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_conntrack: fix missing boolean clampingJan Engelhardt2008-02-271-1/+1
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: fix smp_processor_id() in preemptible code warningPatrick McHardy2008-02-271-3/+12
| | | | | | | | | | | | | | | | | | | | Since we're using RCU for the conntrack hash now, we need to avoid getting preempted or interrupted by BHs while changing the stats. Fixes warning reported by Tilman Schmidt <tilman@imap.cc> when using preemptible RCU: [ 48.180297] BUG: using smp_processor_id() in preemptible [00000000] code: ntpdate/3562 [ 48.180297] caller is __nf_conntrack_find+0x9b/0xeb [nf_conntrack] [ 48.180297] Pid: 3562, comm: ntpdate Not tainted 2.6.25-rc2-mm1-testing #1 [ 48.180297] [<c02015b9>] debug_smp_processor_id+0x99/0xb0 [ 48.180297] [<fac643a7>] __nf_conntrack_find+0x9b/0xeb [nf_conntrack] Tested-by: Tilman Schmidt <tilman@imap.cc> Tested-by: Christian Casteyde <casteyde.christian@free.fr> [Bugzilla #10097] Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_iprange: fix subtraction-based comparisonJan Engelhardt2008-02-201-1/+1
| | | | | | | | | The host address parts need to be converted to host-endian first before arithmetic makes any sense on them. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_hashlimit: remove unneeded struct memberJan Engelhardt2008-02-201-3/+0Star
| | | | | | | | | | | By allocating ->hinfo, we already have the needed indirection to cope with the per-cpu xtables struct match_entry. [Patrick: do this now before the revision 1 struct is used by userspace] Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_u32: drop the actually unused variable from u32_match_itPavel Emelyanov2008-02-201-6/+5Star
| | | | | | | | | | The int ret variable is used only to trigger the BUG_ON() after the skb_copy_bits() call, so check the call failure directly and drop the variable. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: {ip,ip6,nfnetlink}_queue: fix SKB_LINEAR_ASSERT when mangling ↵Patrick McHardy2008-02-201-4/+6
| | | | | | | | | | | | | | | | | | packet data As reported by Tomas Simonaitis <tomas.simonaitis@gmail.com>, inserting new data in skbs queued over {ip,ip6,nfnetlink}_queue triggers a SKB_LINEAR_ASSERT in skb_put(). Going back through the git history, it seems this bug is present since at least 2.6.12-rc2, probably even since the removal of skb_linearize() for netfilter. Linearize non-linear skbs through skb_copy_expand() when enlarging them. Tested by Thomas, fixes bugzilla #9933. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER] nf_conntrack_proto_tcp.c: Mistyped state corrected.Jozsef Kadlecsik2008-02-141-1/+1
| | | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: make secmark_tg_destroy() staticAdrian Bunk2008-02-141-1/+1
| | | | | | | This patch makes the needlessly global secmark_tg_destroy() static. Signed-off-by: Adrian Bunk <bunk@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_iprange: add missing #includeJan Engelhardt2008-02-081-0/+1
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_iprange: fix typo in address familyPatrick McHardy2008-02-081-1/+1
| | | | | | | | The family for iprange_mt4 should be AF_INET, not AF_INET6. Noticed by Jiri Moravec <jim.lkml@gmail.com>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: fix ct_extend ->move operationPatrick McHardy2008-02-081-1/+2
| | | | | | | | | | | | | | | | | | | The ->move operation has two bugs: - It is called with the same extension as source and destination, so it doesn't update the new extension. - The address of the old extension is calculated incorrectly, instead of (void *)ct->ext + ct->ext->offset[i] it uses ct->ext + ct->ext->offset[i]. Fixes a crash on x86_64 reported by Chuck Ebbert <cebbert@redhat.com> and Thomas Woerner <twoerner@redhat.com>. Tested-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: TCP conntrack reopening fixJozsef Kadlecsik2008-02-081-6/+26
| | | | | | | | | | | | TCP connection tracking in netfilter did not handle TCP reopening properly: active close was taken into account for one side only and not for any side, which is fixed now. The patch includes more comments to explain the logic how the different cases are handled. The bug was discovered by Jeff Chua. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: Ipv6-related xt_hashlimit compilation fix.Pavel Emelyanov2008-02-011-0/+2
| | | | | | | | | | | The hashlimit_ipv6_mask() is called from under IP6_NF_IPTABLES config option, but is not under it by itself. gcc warns us about it :) : net/netfilter/xt_hashlimit.c:473: warning: "hashlimit_ipv6_mask" defined but not used Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_iprange: fix sparse warningsPatrick McHardy2008-02-011-1/+1
| | | | | | | | | | | | | | | CHECK net/netfilter/xt_iprange.c net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer net/netfilter/xt_iprange.c:104:19: warning: restricted degrades to integer net/netfilter/xt_iprange.c:104:37: warning: restricted degrades to integer Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: fix sparse warningPatrick McHardy2008-02-011-1/+1
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: annotate l3protos with constJan Engelhardt2008-02-011-5/+5
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_{conntrack,nat}_proto_gre: annotate with constJan Engelhardt2008-02-011-2/+4
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_{conntrack,nat}_proto_udp{,lite}: annotate with constJan Engelhardt2008-02-012-4/+8
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_{conntrack,nat}_proto_tcp: constify and annotate TCP modulesJan Engelhardt2008-02-011-20/+24
| | | | | | | | | Constify a few data tables use const qualifiers on variables where possible in the nf_*_proto_tcp sources. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack_sane: annotate SANE helper with constJan Engelhardt2008-02-011-4/+5
| | | | | | | | | Annotate nf_conntrack_sane variables with const qualifier and remove a few casts. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_{conntrack,nat}_pptp: annotate PPtP helper with constJan Engelhardt2008-02-011-6/+8
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_{conntrack,nat}_tftp: annotate TFTP helper with constJan Engelhardt2008-02-011-1/+2
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_{conntrack,nat}_sip: annotate SIP helper with constJan Engelhardt2008-02-011-12/+13
| | | | | | Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack_h323: constify and annotate H.323 helperJan Engelhardt2008-02-013-214/+227
| | | | | | | | | | Constify data tables (predominantly in nf_conntrack_h323_types.c, but also a few in nf_conntrack_h323_asn1.c) and use const qualifiers on variables where possible in the h323 sources. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: x_tables: create per-netns /proc/net/*_tables_*Alexey Dobriyan2008-02-011-10/+10
| | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: x_tables: netns propagation for /proc/net/*_tables_namesAlexey Dobriyan2008-02-011-12/+19
| | | | | | | | | Propagate netns together with AF down to ->start/->next/->stop iterators. Choose table based on netns and AF for showing. Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: x_tables: semi-rewrite of /proc/net/foo_tables_*Alexey Dobriyan2008-02-011-85/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are many small but still wrong things with /proc/net/*_tables_* so I decided to do overhaul simultaneously making it more suitable for per-netns /proc/net/*_tables_* implementation. Fix a) xt_get_idx() duplicating now standard seq_list_start/seq_list_next iterators b) tables/matches/targets list was chosen again and again on every ->next c) multiple useless "af >= NPROTO" checks -- we simple don't supply invalid AFs there and registration function should BUG_ON instead. Regardless, the one in ->next() is the most useless -- ->next doesn't run at all if ->start fails. d) Don't use mutex_lock_interruptible() -- it can fail and ->stop is executed even if ->start failed, so unlock without lock is possible. As side effect, streamline code by splitting xt_tgt_ops into xt_target_ops, xt_matches_ops, xt_tables_ops. xt_tables_ops hooks will be changed by per-netns code. Code of xt_matches_ops, xt_target_ops is identical except the list chosen for iterating, but I think consolidating code for two files not worth it given "<< 16" hacks needed for it. [Patrick: removed unused enum in x_tables.c] Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: xt_hashlimit match, revision 1Jan Engelhardt2008-02-011-36/+286
| | | | | | | | | | | | | | | | | | | | | | | Introduces the xt_hashlimit match revision 1. It adds support for kernel-level inversion and grouping source and/or destination IP addresses, allowing to limit on a per-subnet basis. While this would technically obsolete xt_limit, xt_hashlimit is a more expensive due to the hashbucketing. Kernel-level inversion: Previously you had to do user-level inversion: iptables -N foo iptables -A foo -m hashlimit --hashlimit(-upto) 5/s -j RETURN iptables -A foo -j DROP iptables -A INPUT -j foo now it is simpler: iptables -A INPUT -m hashlimit --hashlimit-over 5/s -j DROP Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: kill unused static inline (do_iter)Ilpo Järvinen2008-02-011-8/+0Star
| | | | | | Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack_netlink: transmit mark during all eventsEric Leblond2008-02-011-5/+6
| | | | | | | | | | | The following feature was submitted some months ago. It forces the dump of mark during the connection destruction event. The induced load is quiet small and the patch is usefull to provide an easy way to filter event on user side without having to keep an hash in userspace. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack_h323: clean up code a bitJan Engelhardt2008-02-011-64/+64
| | | | | | | | | | | -total: 81 errors, 3 warnings, 876 lines checked +total: 44 errors, 3 warnings, 876 lines checked There is still work to be done, but that's for another patch. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: naming unificationPatrick McHardy2008-02-017-145/+135Star
| | | | | | | | Rename all "conntrack" variables to "ct" for more consistency and avoiding some overly long lines. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: don't inline early_drop()Patrick McHardy2008-02-011-3/+3
| | | | | | | | | early_drop() is only called *very* rarely, unfortunately gcc inlines it into the hotpath because there is only a single caller. Explicitly mark it noinline. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: optimize hash_conntrack()Patrick McHardy2008-02-011-7/+11
| | | | | | | | | | Avoid calling jhash three times and hash the entire tuple in one go. __hash_conntrack | -485 # 760 -> 275, # inlines: 3 -> 1, size inlines: 717 -> 252 1 function changed, 485 bytes removed Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: optimize __nf_conntrack_find()Patrick McHardy2008-02-013-11/+19
| | | | | | | | | | | | | | | | Ignoring specific entries in __nf_conntrack_find() is only needed by NAT for nf_conntrack_tuple_taken(). Remove it from __nf_conntrack_find() and make nf_conntrack_tuple_taken() search the hash itself. Saves 54 bytes of text in the hotpath on x86_64: __nf_conntrack_find | -54 # 321 -> 267, # inlines: 3 -> 2, size inlines: 181 -> 127 nf_conntrack_tuple_taken | +305 # 15 -> 320, lexblocks: 0 -> 3, # inlines: 0 -> 3, size inlines: 0 -> 181 nf_conntrack_find_get | -2 # 90 -> 88 3 functions changed, 305 bytes added, 56 bytes removed, diff: +249 Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: switch rwlock to spinlockPatrick McHardy2008-02-015-40/+40
| | | | | | | | | With the RCU conversion only write_lock usages of nf_conntrack_lock are left (except one read_lock that should actually use write_lock in the H.323 helper). Switch to a spinlock. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack: use RCU for conntrack hashPatrick McHardy2008-02-014-37/+59
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_conntrack_expect: use RCU for expectation hashPatrick McHardy2008-02-012-19/+31
| | | | | | | | | Use RCU for expectation hash. This doesn't buy much for conntrack runtime performance, but allows to reduce the use of nf_conntrack_lock for /proc and nf_netlink_conntrack. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-09 01:30:11 +0200