Changeset 17421

Timestamp:

08/05/11 13:04:51 (23 months ago)

Author:

BrainSlayer

Message:

netfilter speedup patches by felix

Location:

src/linux/x86/linux-2.6.39

Files:

• include/linux/netfilter_ipv4/ip_tables.h (modified) (1 diff)
• net/ipv4/netfilter/ip_tables.c (modified) (9 diffs)
• net/netfilter/nf_conntrack_proto_tcp.c (modified) (3 diffs)

src/linux/x86/linux-2.6.39/include/linux/netfilter_ipv4/ip_tables.h

@@ -94 +94 @@
 #define IPT_F_GOTO              0x02    /* Set if jump is a goto */
 #define IPT_F_MASK              0x03    /* All possible flag bits mask. */
+#define IPT_F_NO_DEF_MATCH      0x80    /* Internal: no default match rules present */
 
 /* Values for "inv" field in struct ipt_ip. */

src/linux/x86/linux-2.6.39/net/ipv4/netfilter/ip_tables.c

@@ -91 +91 @@
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 
-        if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
+        if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
+                return true;
+
+        if (FWINV(ipinfo->smsk.s_addr &&
+                  (ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
                   IPT_INV_SRCIP) ||
-            FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+            FWINV(ipinfo->smsk.s_addr &&
+                  (ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
                   IPT_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
@@ -142 +147 @@
 
         return true;
+}
+
+static void
+ip_checkdefault(struct ipt_ip *ip)
+{
+        static const char iface_mask[IFNAMSIZ] = {};
+
+        if (ip->invflags || ip->flags & IPT_F_FRAG)
+                return;
+
+        if (memcmp(ip->iniface_mask, iface_mask, IFNAMSIZ) != 0)
+                return;
+
+        if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
+                return;
+
+        if (ip->proto)
+                return;
+
+        ip->flags |= IPT_F_NO_DEF_MATCH;
 }
 
@@ -294 +319 @@
 }
 
+static bool
+ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict)
+{
+        struct xt_entry_target *t;
+        struct xt_standard_target *st;
+
+        if (e->target_offset != sizeof(struct ipt_entry))
+                return false;
+
+        if (!(e->ip.flags & IPT_F_NO_DEF_MATCH))
+                return false;
+
+        t = ipt_get_target(e);
+        if (t->u.kernel.target->target)
+                return false;
+
+        st = (struct xt_standard_target *) t;
+        if (st->verdict == XT_RETURN)
+                return false;
+
+        if (st->verdict >= 0)
+                return false;
+
+        *verdict = (unsigned)(-st->verdict) - 1;
+        return true;
+}
+
 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 unsigned int
@@ -317 +369 @@
         indev = in ? in->name : nulldevname;
         outdev = out ? out->name : nulldevname;
+
+        IP_NF_ASSERT(table->valid_hooks & (1 << hook));
+        xt_info_rdlock_bh();
+        private = table->private;
+        cpu        = smp_processor_id();
+        table_base = private->entries[cpu];
+        jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
+        stackptr   = per_cpu_ptr(private->stackptr, cpu);
+        origptr    = *stackptr;
+
+        e = get_entry(table_base, private->hook_entry[hook]);
+        if (ipt_handle_default_rule(e, &verdict)) {
+                ADD_COUNTER(e->counters, skb->len, 1);
+                xt_info_rdunlock_bh();
+                return verdict;
+        }
+
         /* We handle fragments by dealing with the first fragment as
          * if it was a normal packet.  All other fragments are treated
@@ -330 +399 @@
         acpar.family  = NFPROTO_IPV4;
         acpar.hooknum = hook;
-
-        IP_NF_ASSERT(table->valid_hooks & (1 << hook));
-        xt_info_rdlock_bh();
-        private = table->private;
-        cpu        = smp_processor_id();
-        table_base = private->entries[cpu];
-        jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
-        stackptr   = per_cpu_ptr(private->stackptr, cpu);
-        origptr    = *stackptr;
-
-        e = get_entry(table_base, private->hook_entry[hook]);
 
         pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
@@ -567 +625 @@
 
 static int
-check_entry(const struct ipt_entry *e, const char *name)
+check_entry(struct ipt_entry *e, const char *name)
 {
         const struct xt_entry_target *t;
@@ -575 +633 @@
                 return -EINVAL;
         }
+
+        ip_checkdefault(&e->ip);
 
         if (e->target_offset + sizeof(struct xt_entry_target) >
@@ -937 +997 @@
         int ret = 0;
         const void *loc_cpu_entry;
+        u8 flags;
 
         counters = alloc_counters(table);
@@ -964 +1025 @@
                                  &counters[num],
                                  sizeof(counters[num])) != 0) {
+                        ret = -EFAULT;
+                        goto free_counters;
+                }
+
+                flags = e->ip.flags & IPT_F_MASK;
+                if (copy_to_user(userptr + off
+                                 + offsetof(struct ipt_entry, ip.flags),
+                                 &flags, sizeof(flags)) != 0) {
                         ret = -EFAULT;
                         goto free_counters;

src/linux/x86/linux-2.6.39/net/netfilter/nf_conntrack_proto_tcp.c

@@ -29 +29 @@
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+
+/* Do not check the TCP window for incoming packets  */
+static int nf_ct_tcp_no_window_check __read_mostly = 1;
 
 /* "Be conservative in what you do,
@@ -525 +528 @@
         bool res;
 
+        if (nf_ct_tcp_no_window_check)
+                return true;
+
         /*
          * Get the required data from the packet.
@@ -1322 +1328 @@
         },
         {
+                .procname       = "nf_conntrack_tcp_no_window_check",
+                .data           = &nf_ct_tcp_no_window_check,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
                 .procname       = "nf_conntrack_tcp_be_liberal",
                 .data           = &nf_ct_tcp_be_liberal,