Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c973dfc authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "defconfig: arm64: sdm845: Enable IP6_NF_IPTABLES_128"

parents 6eb3f604 e2e584d0

arch/arm64/configs/sdm845-perf_defconfig

+1 −0
Original line number Diff line number Diff line
@@ -188,6 +188,7 @@ CONFIG_IP_NF_ARPFILTER=y 
CONFIG_IP_NF_ARP_MANGLE=y

CONFIG_NF_CONNTRACK_IPV6=y

CONFIG_IP6_NF_IPTABLES=y

CONFIG_IP6_NF_IPTABLES_128=y

CONFIG_IP6_NF_MATCH_RPFILTER=y

CONFIG_IP6_NF_FILTER=y

CONFIG_IP6_NF_TARGET_REJECT=y

arch/arm64/configs/sdm845_defconfig

+1 −0
Original line number Diff line number Diff line
@@ -194,6 +194,7 @@ CONFIG_IP_NF_ARPFILTER=y 
CONFIG_IP_NF_ARP_MANGLE=y

CONFIG_NF_CONNTRACK_IPV6=y

CONFIG_IP6_NF_IPTABLES=y

CONFIG_IP6_NF_IPTABLES_128=y

CONFIG_IP6_NF_MATCH_RPFILTER=y

CONFIG_IP6_NF_FILTER=y

CONFIG_IP6_NF_TARGET_REJECT=y

net/ipv6/netfilter/Kconfig

+12 −0
Original line number Diff line number Diff line
@@ -135,6 +135,18 @@ config IP6_NF_IPTABLES 


if IP6_NF_IPTABLES



config IP6_NF_IPTABLES_128

	tristate "128 bit arithmetic for iptables matching"

	depends on IP6_NF_IPTABLES

	help

	  This enables 128 bit matching in ip6tables to help optimize cases

          where there is no match required. ip6tables matching for ipv6 always

	  has a mask if an address is specified for match. Adding a check for

	  mask prior to that helps to improve performance as it avoids the

	  masked comparison.



	  Note that this feature depends on the architecture. If unsure, say N.



# The simple matches.

config IP6_NF_MATCH_AH

	tristate '"ah" match support'

net/ipv6/netfilter/ip6_tables.c

+16 −7
Original line number Diff line number Diff line
@@ -72,7 +72,15 @@ ip6_packet_match(const struct sk_buff *skb, 
{

	unsigned long ret;

	const struct ipv6hdr *ipv6 = ipv6_hdr(skb);

#if IS_ENABLED(IP6_NF_IPTABLES_128)

	const __uint128_t *ulm1 = (const __uint128_t *)&ip6info->smsk;

	const __uint128_t *ulm2 = (const __uint128_t *)&ip6info->dmsk;

#endif



#if IS_ENABLED(IP6_NF_IPTABLES_128)

	if (*ulm1 || *ulm2)

#endif

	{

		if (NF_INVF(ip6info, IP6T_INV_SRCIP,

			    ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,

						 &ip6info->src)) ||
@@ -80,6 +88,7 @@ ip6_packet_match(const struct sk_buff *skb, 
			    ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,

						 &ip6info->dst)))

			return false;

	}



	ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);