1. 29 9月, 2014 1 次提交
  2. 27 9月, 2014 3 次提交
    • P
      netfilter: bridge: move br_netfilter out of the core · 34666d46
      Pablo Neira Ayuso 提交于
      Jesper reported that br_netfilter always registers the hooks since
      this is part of the bridge core. This harms performance for people that
      don't need this.
      
      This patch modularizes br_netfilter so it can be rmmod'ed, thus,
      the hooks can be unregistered. I think the bridge netfilter should have
      been a separated module since the beginning, Patrick agreed on that.
      
      Note that this is breaking compatibility for users that expect that
      bridge netfilter is going to be available after explicitly 'modprobe
      bridge' or via automatic load through brctl.
      
      However, the damage can be easily undone by modprobing br_netfilter.
      The bridge core also spots a message to provide a clue to people that
      didn't notice that this has been deprecated.
      
      On top of that, the plan is that nftables will not rely on this software
      layer, but integrate the connection tracking into the bridge layer to
      enable stateful filtering and NAT, which is was bridge netfilter users
      seem to require.
      
      This patch still keeps the fake_dst_ops in the bridge core, since this
      is required by when the bridge port is initialized. So we can safely
      modprobe/rmmod br_netfilter anytime.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      Acked-by: NFlorian Westphal <fw@strlen.de>
      34666d46
    • P
      netfilter: bridge: nf_bridge_copy_header as static inline in header · 7276ca3f
      Pablo Neira Ayuso 提交于
      Move nf_bridge_copy_header() as static inline in netfilter_bridge.h
      header file. This patch prepares the modularization of the br_netfilter
      code.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      7276ca3f
    • R
      net/netfilter/x_tables.c: use __seq_open_private() · 772476df
      Rob Jones 提交于
      Reduce boilerplate code by using __seq_open_private() instead of seq_open()
      in xt_match_open() and xt_target_open().
      Signed-off-by: NRob Jones <rob.jones@codethink.co.uk>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      772476df
  3. 19 9月, 2014 2 次提交
    • P
      netfilter: nf_tables: export rule-set generation ID · 84d7fce6
      Pablo Neira Ayuso 提交于
      This patch exposes the ruleset generation ID in three ways:
      
      1) The new command NFT_MSG_GETGEN that exposes the 32-bits ruleset
         generation ID. This ID is incremented in every commit and it
         should be large enough to avoid wraparound problems.
      
      2) The less significant 16-bits of the generation ID are exposed through
         the nfgenmsg->res_id header field. This allows us to quickly catch
         if the ruleset has change between two consecutive list dumps from
         different object lists (in this specific case I think the risk of
         wraparound is unlikely).
      
      3) Userspace subscribers may receive notifications of new rule-set
         generation after every commit. This also provides an alternative
         way to monitor the generation ID. If the events are lost, the
         userspace process hits a overrun error, so it knows that it is
         working with a stale ruleset anyway.
      
      Patrick spotted that rule-set transformations in userspace may take
      quite some time. In that case, it annotates the 32-bits generation ID
      before fetching the rule-set, then:
      
      1) it compares it to what we obtain after the transformation to
         make sure it is not working with a stale rule-set and no wraparound
         has ocurred.
      
      2) it subscribes to ruleset notifications, so it can watch for new
         generation ID.
      
      This is complementary to the NLM_F_DUMP_INTR approach, which allows
      us to detect an interference in the middle one single list dumping.
      There is no way to explicitly check that an interference has occurred
      between two list dumps from the kernel, since it doesn't know how
      many lists the userspace client is actually going to dump.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      84d7fce6
    • P
      netfilter: nfnetlink: use original skbuff when committing/aborting · fc04733a
      Pablo Neira Ayuso 提交于
      This allows us to access the original content of the batch from
      the commit and the abort paths.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      fc04733a
  4. 18 9月, 2014 4 次提交
  5. 16 9月, 2014 20 次提交
  6. 12 9月, 2014 2 次提交
  7. 11 9月, 2014 8 次提交