[NETFILTER]: nf_conntrack: reduce masks to a subset of tuples

Browse source

Since conntrack currently allows to use masks for every bit of both
helper and expectation tuples, we can't hash them and have to keep
them on two global lists that are searched for every new connection.

This patch removes the never used ability to use masks for the
destination part of the expectation tuple and completely removes
masks from helpers since the only reasonable choice is a full
match on l3num, protonum and src.u.all.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Patrick McHardy 2007-07-07 22:31:32 -07:00 • committed by David S. Miller

parent df43b4e7ca

commit d4156e8cd9

16 changed files with 71 additions and 116 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

include/net/netfilter/nf_conntrack_expect.h

View file

5

include/net/netfilter/nf_conntrack_helper.h

View file

65

include/net/netfilter/nf_conntrack_tuple.h

View file