Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3872b284 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

parents 07df5294 8a80c79a

include/net/ip_vs.h

+17 −1
Original line number Diff line number Diff line
@@ -494,7 +494,7 @@ struct ip_vs_conn_param { 
 *	IP_VS structure allocated for each dynamically scheduled connection

 */

struct ip_vs_conn {

	struct list_head        c_list;         /* hashed list heads */

	struct hlist_node	c_list;         /* hashed list heads */

#ifdef CONFIG_NET_NS

	struct net              *net;           /* Name space */

#endif
@@ -1019,6 +1019,8 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 
extern int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,

			struct ip_vs_proto_data *pd);



extern void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg);





/*

 *      IPVS control data and functions (from ip_vs_ctl.c)
@@ -1241,6 +1243,20 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) 
/* CONFIG_IP_VS_NFCT */

#endif



static inline unsigned int

ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)

{

	/*

	 * We think the overhead of processing active connections is 256

	 * times higher than that of inactive connections in average. (This

	 * 256 times might not be accurate, we will change it later) We

	 * use the following formula to estimate the overhead now:

	 *		  dest->activeconns*256 + dest->inactconns

	 */

	return (atomic_read(&dest->activeconns) << 8) +

		atomic_read(&dest->inactconns);

}



#endif /* __KERNEL__ */



#endif	/* _NET_IP_VS_H */

net/bridge/netfilter/ebtables.c

+2 −0
Original line number Diff line number Diff line
@@ -1107,6 +1107,8 @@ static int do_replace(struct net *net, const void __user *user, 
	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))

		return -ENOMEM;



	tmp.name[sizeof(tmp.name) - 1] = 0;



	countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;

	newinfo = vmalloc(sizeof(*newinfo) + countersize);

	if (!newinfo)

net/netfilter/ipset/Kconfig

+1 −0
Original line number Diff line number Diff line 
menuconfig IP_SET

	tristate "IP set support"

	depends on INET && NETFILTER

	depends on NETFILTER_NETLINK

	help

	  This option adds IP set support to the kernel.

	  In order to define and use the sets, you need the userspace utility

net/netfilter/ipvs/ip_vs_conn.c

+29 −23
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ static int ip_vs_conn_tab_mask __read_mostly; 
/*

 *  Connection hash table: for input and output packets lookups of IPVS

 */

static struct list_head *ip_vs_conn_tab __read_mostly;

static struct hlist_head *ip_vs_conn_tab __read_mostly;



/*  SLAB cache for IPVS connections */

static struct kmem_cache *ip_vs_conn_cachep __read_mostly;
@@ -201,7 +201,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp) 
	spin_lock(&cp->lock);



	if (!(cp->flags & IP_VS_CONN_F_HASHED)) {

		list_add(&cp->c_list, &ip_vs_conn_tab[hash]);

		hlist_add_head(&cp->c_list, &ip_vs_conn_tab[hash]);

		cp->flags |= IP_VS_CONN_F_HASHED;

		atomic_inc(&cp->refcnt);

		ret = 1;
@@ -234,7 +234,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp) 
	spin_lock(&cp->lock);



	if (cp->flags & IP_VS_CONN_F_HASHED) {

		list_del(&cp->c_list);

		hlist_del(&cp->c_list);

		cp->flags &= ~IP_VS_CONN_F_HASHED;

		atomic_dec(&cp->refcnt);

		ret = 1;
@@ -259,12 +259,13 @@ __ip_vs_conn_in_get(const struct ip_vs_conn_param *p) 
{

	unsigned hash;

	struct ip_vs_conn *cp;

	struct hlist_node *n;



	hash = ip_vs_conn_hashkey_param(p, false);



	ct_read_lock(hash);



	list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {

	hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {

		if (cp->af == p->af &&

		    p->cport == cp->cport && p->vport == cp->vport &&

		    ip_vs_addr_equal(p->af, p->caddr, &cp->caddr) &&
@@ -345,12 +346,13 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p) 
{

	unsigned hash;

	struct ip_vs_conn *cp;

	struct hlist_node *n;



	hash = ip_vs_conn_hashkey_param(p, false);



	ct_read_lock(hash);



	list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {

	hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {

		if (!ip_vs_conn_net_eq(cp, p->net))

			continue;

		if (p->pe_data && p->pe->ct_match) {
@@ -394,6 +396,7 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) 
{

	unsigned hash;

	struct ip_vs_conn *cp, *ret=NULL;

	struct hlist_node *n;



	/*

	 *	Check for "full" addressed entries
@@ -402,7 +405,7 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) 


	ct_read_lock(hash);



	list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {

	hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {

		if (cp->af == p->af &&

		    p->vport == cp->cport && p->cport == cp->dport &&

		    ip_vs_addr_equal(p->af, p->vaddr, &cp->caddr) &&
@@ -818,7 +821,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p, 
		return NULL;

	}



	INIT_LIST_HEAD(&cp->c_list);

	INIT_HLIST_NODE(&cp->c_list);

	setup_timer(&cp->timer, ip_vs_conn_expire, (unsigned long)cp);

	ip_vs_conn_net_set(cp, p->net);

	cp->af		   = p->af;
@@ -895,7 +898,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p, 
#ifdef CONFIG_PROC_FS

struct ip_vs_iter_state {

	struct seq_net_private	p;

	struct list_head *l;

	struct hlist_head	*l;

};



static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos)
@@ -903,10 +906,11 @@ static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos) 
	int idx;

	struct ip_vs_conn *cp;

	struct ip_vs_iter_state *iter = seq->private;

	struct hlist_node *n;



	for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {

		ct_read_lock_bh(idx);

		list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {

		hlist_for_each_entry(cp, n, &ip_vs_conn_tab[idx], c_list) {

			if (pos-- == 0) {

				iter->l = &ip_vs_conn_tab[idx];

				return cp;
@@ -930,7 +934,8 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos) 
{

	struct ip_vs_conn *cp = v;

	struct ip_vs_iter_state *iter = seq->private;

	struct list_head *e, *l = iter->l;

	struct hlist_node *e;

	struct hlist_head *l = iter->l;

	int idx;



	++*pos;
@@ -938,15 +943,15 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos) 
		return ip_vs_conn_array(seq, 0);



	/* more on same hash chain? */

	if ((e = cp->c_list.next) != l)

		return list_entry(e, struct ip_vs_conn, c_list);

	if ((e = cp->c_list.next))

		return hlist_entry(e, struct ip_vs_conn, c_list);



	idx = l - ip_vs_conn_tab;

	ct_read_unlock_bh(idx);



	while (++idx < ip_vs_conn_tab_size) {

		ct_read_lock_bh(idx);

		list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {

		hlist_for_each_entry(cp, e, &ip_vs_conn_tab[idx], c_list) {

			iter->l = &ip_vs_conn_tab[idx];

			return cp;

		}
@@ -959,7 +964,7 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos) 
static void ip_vs_conn_seq_stop(struct seq_file *seq, void *v)

{

	struct ip_vs_iter_state *iter = seq->private;

	struct list_head *l = iter->l;

	struct hlist_head *l = iter->l;



	if (l)

		ct_read_unlock_bh(l - ip_vs_conn_tab);
@@ -1148,13 +1153,14 @@ void ip_vs_random_dropentry(struct net *net) 
	 */

	for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) {

		unsigned hash = net_random() & ip_vs_conn_tab_mask;

		struct hlist_node *n;



		/*

		 *  Lock is actually needed in this loop.

		 */

		ct_write_lock_bh(hash);



		list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {

		hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {

			if (cp->flags & IP_VS_CONN_F_TEMPLATE)

				/* connection template */

				continue;
@@ -1202,12 +1208,14 @@ static void ip_vs_conn_flush(struct net *net) 


flush_again:

	for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {

		struct hlist_node *n;



		/*

		 *  Lock is actually needed in this loop.

		 */

		ct_write_lock_bh(idx);



		list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {

		hlist_for_each_entry(cp, n, &ip_vs_conn_tab[idx], c_list) {

			if (!ip_vs_conn_net_eq(cp, net))

				continue;

			IP_VS_DBG(4, "del connection\n");
@@ -1265,8 +1273,7 @@ int __init ip_vs_conn_init(void) 
	/*

	 * Allocate the connection hash table and initialize its list heads

	 */

	ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size *

				 sizeof(struct list_head));

	ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size * sizeof(*ip_vs_conn_tab));

	if (!ip_vs_conn_tab)

		return -ENOMEM;
@@ -1286,9 +1293,8 @@ int __init ip_vs_conn_init(void) 
	IP_VS_DBG(0, "Each connection entry needs %Zd bytes at least\n",

		  sizeof(struct ip_vs_conn));



	for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {

		INIT_LIST_HEAD(&ip_vs_conn_tab[idx]);

	}

	for (idx = 0; idx < ip_vs_conn_tab_size; idx++)

		INIT_HLIST_HEAD(&ip_vs_conn_tab[idx]);



	for (idx = 0; idx < CT_LOCKARRAY_SIZE; idx++)  {

		rwlock_init(&__ip_vs_conntbl_lock_array[idx].l);

net/netfilter/ipvs/ip_vs_core.c

+3 −25
Original line number Diff line number Diff line
@@ -729,7 +729,7 @@ void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp, 
#endif



/* Handle relevant response ICMP messages - forward to the right

 * destination host. Used for NAT and local client.

 * destination host.

 */

static int handle_response_icmp(int af, struct sk_buff *skb,

				union nf_inet_addr *snet,
@@ -979,7 +979,6 @@ static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len) 
}



/* Handle response packets: rewrite addresses and send away...

 * Used for NAT and local client.

 */

static unsigned int

handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
@@ -1280,7 +1279,6 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) 
	struct ip_vs_protocol *pp;

	struct ip_vs_proto_data *pd;

	unsigned int offset, ihl, verdict;

	union nf_inet_addr snet;



	*related = 1;
@@ -1339,17 +1337,8 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) 
	ip_vs_fill_iphdr(AF_INET, cih, &ciph);

	/* The embedded headers contain source and dest in reverse order */

	cp = pp->conn_in_get(AF_INET, skb, &ciph, offset, 1);

	if (!cp) {

		/* The packet could also belong to a local client */

		cp = pp->conn_out_get(AF_INET, skb, &ciph, offset, 1);

		if (cp) {

			snet.ip = iph->saddr;

			return handle_response_icmp(AF_INET, skb, &snet,

						    cih->protocol, cp, pp,

						    offset, ihl);

		}

	if (!cp)

		return NF_ACCEPT;

	}



	verdict = NF_DROP;
@@ -1395,7 +1384,6 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum) 
	struct ip_vs_protocol *pp;

	struct ip_vs_proto_data *pd;

	unsigned int offset, verdict;

	union nf_inet_addr snet;

	struct rt6_info *rt;



	*related = 1;
@@ -1455,18 +1443,8 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum) 
	ip_vs_fill_iphdr(AF_INET6, cih, &ciph);

	/* The embedded headers contain source and dest in reverse order */

	cp = pp->conn_in_get(AF_INET6, skb, &ciph, offset, 1);

	if (!cp) {

		/* The packet could also belong to a local client */

		cp = pp->conn_out_get(AF_INET6, skb, &ciph, offset, 1);

		if (cp) {

			ipv6_addr_copy(&snet.in6, &iph->saddr);

			return handle_response_icmp(AF_INET6, skb, &snet,

						    cih->nexthdr,

						    cp, pp, offset,

						    sizeof(struct ipv6hdr));

		}

	if (!cp)

		return NF_ACCEPT;

	}



	verdict = NF_DROP;