sysmocom
/
openwrt
11
0
Fork 0
Code Pull Requests Releases Activity

kernel: improve ipv4 netfilter optimization patch 

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

Backport of r42045

git-svn-id: svn://svn.openwrt.org/openwrt/branches/barrier_breaker@42049 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
nbd 2014-08-07 19:31:16 +00:00
parent f7bc58852f
commit 74ba76e43c
1 changed files with 14 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
target/linux/generic/patches-3.10/611-netfilter_match_bypass_default_table.patch
View File

@ -34,33 +34,35 @@
/* Returns one of the generic firewall policies, like NF_ACCEPT. */ /* Returns one of the generic firewall policies, like NF_ACCEPT. */
unsigned int unsigned int
ipt_do_table(struct sk_buff *skb, ipt_do_table(struct sk_buff *skb,
@@ -334,6 +361,25 @@ ipt_do_table(struct sk_buff *skb, @@ -331,9 +358,27 @@ ipt_do_table(struct sk_buff *skb,
ip = ip_hdr(skb); unsigned int addend;
indev = in ? in->name : nulldevname;
outdev = out ? out->name : nulldevname; /* Initialization */
+
+ IP_NF_ASSERT(table->valid_hooks & (1 << hook)); + IP_NF_ASSERT(table->valid_hooks & (1 << hook));
+ local_bh_disable(); + local_bh_disable();
+ addend = xt_write_recseq_begin();
+ private = table->private; + private = table->private;
+ cpu = smp_processor_id(); + cpu = smp_processor_id();
+ table_base = private->entries[cpu]; + table_base = private->entries[cpu];
+ jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
+ stackptr = per_cpu_ptr(private->stackptr, cpu);
+ origptr = *stackptr;
+
+ e = get_entry(table_base, private->hook_entry[hook]); + e = get_entry(table_base, private->hook_entry[hook]);
+ if (ipt_handle_default_rule(e, &verdict)) { + if (ipt_handle_default_rule(e, &verdict)) {
+ ADD_COUNTER(e->counters, skb->len, 1); + ADD_COUNTER(e->counters, skb->len, 1);
+ xt_write_recseq_end(addend);
+ local_bh_enable(); + local_bh_enable();
+ return verdict; + return verdict;
+ } + }
+
ip = ip_hdr(skb);
indev = in ? in->name : nulldevname;
outdev = out ? out->name : nulldevname;
+
+ addend = xt_write_recseq_begin();
+ jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
+ stackptr = per_cpu_ptr(private->stackptr, cpu);
+ origptr = *stackptr;
+ +
/* We handle fragments by dealing with the first fragment as /* We handle fragments by dealing with the first fragment as
* if it was a normal packet. All other fragments are treated * if it was a normal packet. All other fragments are treated
* normally, except that they will NEVER match rules that ask * normally, except that they will NEVER match rules that ask
@@ -348,18 +394,6 @@ ipt_do_table(struct sk_buff *skb, @@ -348,18 +393,6 @@ ipt_do_table(struct sk_buff *skb,
acpar.family = NFPROTO_IPV4; acpar.family = NFPROTO_IPV4;
acpar.hooknum = hook; acpar.hooknum = hook;