aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4/netfilter/ip_tables.c
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: xtables: resolve indirect macros 3/3Jan Engelhardt2010-10-131-9/+9
|
* netfilter: xtables: resolve indirect macros 2/3Jan Engelhardt2010-10-131-27/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: resolve indirect macros 1/3Jan Engelhardt2010-10-131-6/+6
| | | | | | | | Many of the used macros are just there for userspace compatibility. Substitute the in-kernel code to directly use the terminal macro and stuff the defines into #ifndef __KERNEL__ sections. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: fix CONFIG_COMPAT supportFlorian Westphal2010-08-231-0/+3
| | | | | | | | | | | | | | | | | | commit f3c5c1bfd430858d3a05436f82c51e53104feb6b (netfilter: xtables: make ip_tables reentrant) forgot to also compute the jumpstack size in the compat handlers. Result is that "iptables -I INPUT -j userchain" turns into -j DROP. Reported by Sebastian Roesner on #netfilter, closes http://bugzilla.netfilter.org/show_bug.cgi?id=669. Note: arptables change is compile-tested only. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Mikael Pettersson <mikpe@it.uu.se> Signed-off-by: David S. Miller <davem@davemloft.net>
* netfilter: {ip,ip6,arp}_tables: avoid lockdep false positiveEric Dumazet2010-08-171-0/+2
| | | | | | | | | | | | | | After commit 24b36f019 (netfilter: {ip,ip6,arp}_tables: dont block bottom half more than necessary), lockdep can raise a warning because we attempt to lock a spinlock with BH enabled, while the same lock is usually locked by another cpu in a softirq context. Disable again BH to avoid these lockdep warnings. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Diagnosed-by: David S. Miller <davem@davemloft.net> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* netfilter: {ip,ip6,arp}_tables: dont block bottom half more than necessaryEric Dumazet2010-08-021-4/+6
| | | | | | | | | | | | We currently disable BH for the whole duration of get_counters() On machines with a lot of cpus and large tables, this might be too long. We can disable preemption during the whole function, and disable BH only while fetching counters for the current cpu. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: iptables: use skb->len for accountingChangli Gao2010-07-231-1/+1
| | | | | | | Use skb->len for accounting as xt_quota does. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge branch 'master' of /repos/git/net-next-2.6Patrick McHardy2010-06-151-1/+1
|\ | | | | | | | | | | | | | | | | Conflicts: include/net/netfilter/xt_rateest.h net/bridge/br_netfilter.c net/netfilter/nf_conntrack_core.c Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: stackptr should be percpuEric Dumazet2010-05-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | commit f3c5c1bfd4 (netfilter: xtables: make ip_tables reentrant) introduced a performance regression, because stackptr array is shared by all cpus, adding cache line ping pongs. (16 cpus share a 64 bytes cache line) Fix this using alloc_percpu() Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-By: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: vmalloc_node cleanupEric Dumazet2010-06-041-2/+2
|/ | | | | | | | Using vmalloc_node(size, numa_node_id()) for temporary storage is not needed. vmalloc(size) is more respectful of user NUMA policy. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: cleanup printk messagesStephen Hemminger2010-05-131-1/+1
| | | | | | | Make sure all printk messages have a severity level. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: change NF_ASSERT to WARN_ONStephen Hemminger2010-05-131-6/+1
| | | | | | | | | Change netfilter asserts to standard WARN_ON. This has the benefit of backtrace info and also causes netfilter errors to show up on kerneloops.org. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: combine built-in extension structsJan Engelhardt2010-05-111-35/+30
| | | | | | | | Prepare the arrays for use with the multiregister function. The future layer-3 xt matches can then be easily added to it without needing more (un)register code. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: change hotdrop pointer to direct modificationJan Engelhardt2010-05-111-5/+4
| | | | | | | | | | | | Since xt_action_param is writable, let's use it. The pointer to 'bool hotdrop' always worried (8 bytes (64-bit) to write 1 byte!). Surprisingly results in a reduction in size: text data bss filename 5457066 692730 357892 vmlinux.o-prev 5456554 692730 357892 vmlinux.o Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: deconstify struct xt_action_param for matchesJan Engelhardt2010-05-111-1/+1
| | | | | | | | | In future, layer-3 matches will be an xt module of their own, and need to set the fragoff and thoff fields. Adding more pointers would needlessy increase memory requirements (esp. so for 64-bit, where pointers are wider). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: substitute temporary defines by final nameJan Engelhardt2010-05-111-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: combine struct xt_match_param and xt_target_paramJan Engelhardt2010-05-111-17/+15
| | | | | | | | | | | | | | The structures carried - besides match/target - almost the same data. It is possible to combine them, as extensions are evaluated serially, and so, the callers end up a little smaller. text data bss filename -15318 740 104 net/ipv4/netfilter/ip_tables.o +15286 740 104 net/ipv4/netfilter/ip_tables.o -15333 540 152 net/ipv6/netfilter/ip6_tables.o +15269 540 152 net/ipv6/netfilter/ip6_tables.o Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: dissolve do_match functionJan Engelhardt2010-05-021-17/+5
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: ip_tables: fix compilation when debug is enabledJan Engelhardt2010-05-021-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: ip_tables: convert pr_devel() to pr_debug()Patrick McHardy2010-04-221-5/+5
| | | | | | | We want to be able to use CONFIG_DYNAMIC_DEBUG in netfilter code, switch the few existing pr_devel() calls to pr_debug(). Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: remove old comments about reentrancyJan Engelhardt2010-04-191-2/+0
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: make ip_tables reentrantJan Engelhardt2010-04-191-30/+35
| | | | | | | | | | | | | | | | | | | | | Currently, the table traverser stores return addresses in the ruleset itself (struct ip6t_entry->comefrom). This has a well-known drawback: the jumpstack is overwritten on reentry, making it necessary for targets to return absolute verdicts. Also, the ruleset (which might be heavy memory-wise) needs to be replicated for each CPU that can possibly invoke ip6t_do_table. This patch decouples the jumpstack from struct ip6t_entry and instead puts it into xt_table_info. Not being restricted by 'comefrom' anymore, we can set up a stack as needed. By default, there is room allocated for two entries into the traverser. arp_tables is not touched though, because there is just one/two modules and further patches seek to collapse the table traverser anyhow. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: change matches to return error codeJan Engelhardt2010-03-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following semantic patch does part of the transformation: // <smpl> @ rule1 @ struct xt_match ops; identifier check; @@ ops.checkentry = check; @@ identifier rule1.check; @@ check(...) { <... -return true; +return 0; ...> } @@ identifier rule1.check; @@ check(...) { <... -return false; +return -EINVAL; ...> } // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: change xt_match.checkentry return typeJan Engelhardt2010-03-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | Restore function signatures from bool to int so that we can report memory allocation failures or similar using -ENOMEM rather than always having to pass -EINVAL back. This semantic patch may not be too precise (checking for functions that use xt_mtchk_param rather than functions referenced by xt_match.checkentry), but reviewed, it produced the intended result. // <smpl> @@ type bool; identifier check, par; @@ -bool check +int check (struct xt_mtchk_param *par) { ... } // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: consolidate code into xt_request_find_matchJan Engelhardt2010-03-251-10/+8
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: make use of xt_request_find_targetJan Engelhardt2010-03-251-12/+8
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xt extensions: use pr_<level> (2)Jan Engelhardt2010-03-251-10/+8
| | | | | | | | | | | Supplement to 1159683ef48469de71dc26f0ee1a9c30d131cf89. Downgrade the log level to INFO for most checkentry messages as they are, IMO, just an extra information to the -EINVAL code that is returned as part of a parameter "constraint violation". Leave errors to real errors, such as being unable to create a LED trigger. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: restore indentationJan Engelhardt2010-02-261-10/+15
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: reduce arguments to translate_tableJan Engelhardt2010-02-241-27/+15
| | | | | | | | | Just pass in the entire repl struct. In case of a new table (e.g. ip6t_register_table), the repldata has been previously filled with table->name and table->size already (in ip6t_alloc_initial_table). Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: optimize call flow around xt_ematch_foreachJan Engelhardt2010-02-241-62/+31
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: replace XT_MATCH_ITERATE macroJan Engelhardt2010-02-241-17/+61
| | | | | | | | The macro is replaced by a list.h-like foreach loop. This makes the code more inspectable. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: optimize call flow around xt_entry_foreachJan Engelhardt2010-02-241-120/+63
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: replace XT_ENTRY_ITERATE macroJan Engelhardt2010-02-241-56/+104
| | | | | | | | The macro is replaced by a list.h-like foreach loop. This makes the code much more inspectable. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: add const qualifiersJan Engelhardt2010-02-151-39/+49
| | | | | | This should make it easier to remove redundant arguments later. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: constify args in compat copying functionsJan Engelhardt2010-02-151-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: generate initial table on-demandJan Engelhardt2010-02-101-0/+7
| | | | | | | | | | | The static initial tables are pretty large, and after the net namespace has been instantiated, they just hang around for nothing. This commit removes them and creates tables on-demand at runtime when needed. Size shrinks by 7735 bytes (x86_64). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of /repos/git/net-next-2.6Patrick McHardy2010-02-101-2/+2
|\ | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: compat out of scope fixAlexey Dobriyan2010-02-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per C99 6.2.4(2) when temporary table data goes out of scope, the behaviour is undefined: if (compat) { struct foo tmp; ... private = &tmp; } [dereference private] Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Cc: stable@kernel.org Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: add struct net * to target parametersPatrick McHardy2010-02-031-3/+5
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: xtables: add struct xt_mtdtor_param::netAlexey Dobriyan2010-01-181-12/+13
| | | | | | | | | | | | | | | | | | | | Add ->net to match destructor list like ->net in constructor list. Make sure it's set in ebtables/iptables/ip6tables, this requires to propagate netns up to *_unregister_table(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: xtables: add struct xt_mtchk_param::netAlexey Dobriyan2010-01-181-10/+14
|/ | | | | | | | | | | | Some complex match modules (like xt_hashlimit/xt_recent) want netns information at constructor and destructor time. We propably can play games at match destruction time, because netns can be passed in object, but I think it's cleaner to explicitly pass netns. Add ->net, make sure it's set from ebtables/iptables/ip6tables code. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: net/ipv[46]/netfilter: Move && and || to end of previous lineJoe Perches2009-11-231-23/+23
| | | | | | | Compile tested only. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: mark initial tables constantJan Engelhardt2009-08-241-1/+2
| | | | | | | The inputted table is never modified, so should be considered const. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: check for standard verdicts in policiesJan Engelhardt2009-08-101-2/+19
| | | | | | | | | | This adds the second check that Rusty wanted to have a long time ago. :-) Base chain policies must have absolute verdicts that cease processing in the table, otherwise rule execution may continue in an unexpected spurious fashion (e.g. next chain that follows in memory). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: check for unconditionality of policiesJan Engelhardt2009-08-101-4/+7
| | | | | | | | | | | | | This adds a check that iptables's original author Rusty set forth in a FIXME comment. Underflows in iptables are better known as chain policies, and are required to be unconditional or there would be a stochastical chance for the policy rule to be skipped if it does not match. If that were to happen, rule execution would continue in an unexpected spurious fashion. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: ignore unassigned hooks in check_entry_size_and_hooksJan Engelhardt2009-08-101-1/+4
| | | | | | | | | | | | | | The "hook_entry" and "underflow" array contains values even for hooks not provided, such as PREROUTING in conjunction with the "filter" table. Usually, the values point to whatever the next rule is. For the upcoming unconditionality and underflow checking patches however, we must not inspect that arbitrary rule. Skipping unassigned hooks seems like a good idea, also because newinfo->hook_entry and newinfo->underflow will then continue to have the poison value for detecting abnormalities. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: use memcmp in unconditional checkJan Engelhardt2009-08-101-8/+3
| | | | | | | | | Instead of inspecting each u32/char open-coded, clean up and make use of memcmp. On some arches, memcmp is implemented as assembly or GCC's __builtin_memcmp which can possibly take advantages of known alignment. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: iptables: remove unused datalen variableJan Engelhardt2009-08-101-4/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: ip_tables: fix build errorPatrick McHardy2009-06-121-1/+1
| | | | | | | | | | | | Fix build error introduced by commit bb70dfa5 (netfilter: xtables: consolidate comefrom debug cast access): net/ipv4/netfilter/ip_tables.c: In function 'ipt_do_table': net/ipv4/netfilter/ip_tables.c:421: error: 'comefrom' undeclared (first use in this function) net/ipv4/netfilter/ip_tables.c:421: error: (Each undeclared identifier is reported only once net/ipv4/netfilter/ip_tables.c:421: error: for each function it appears in.) Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: x_tables: added hook number into match extension parameter structure.Evgeniy Polyakov2009-06-041-1/+1
| | | | | Signed-off-by: Evgeniy Polyakov <zbr@ioremap.net> Signed-off-by: Patrick McHardy <kaber@trash.net>