mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-13 22:25:03 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/ipv4/netfilter
History
Subash Abhinov Kasiviswanathan 902d6a4c2a netfilter: nf_defrag: Skip defrag if NOTRACK is set 
conntrack defrag is needed only if some module like CONNTRACK or NAT
explicitly requests it. For plain forwarding scenarios, defrag is
not needed and can be skipped if NOTRACK is set in a rule.

Since conntrack defrag is currently higher priority than raw table,
setting NOTRACK is not sufficient. We need to move raw to a higher
priority for iptables only.

This is achieved by introducing a module parameter "raw_before_defrag"
which allows to change the priority of raw table to place it before
defrag. By default, the parameter is disabled and the priority of raw
table is NF_IP_PRI_RAW to support legacy behavior. If the module
parameter is enabled, then the priority of the raw table is set to
NF_IP_PRI_RAW_BEFORE_DEFRAG.

Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-01-11 13:14:20 +01:00
..
arp_tables.c netfilter: xtables: add and use xt_request_find_table_lock 2018-01-08 18:01:12 +01:00
arpt_mangle.c
arptable_filter.c netfilter: arp_tables: register table in initns 2016-04-07 11:58:49 +02:00
ip_tables.c netfilter: xtables: add and use xt_request_find_table_lock 2018-01-08 18:01:12 +01:00
ipt_ah.c netfilter: ipv4: whitespace around operators 2015-10-16 19:19:23 +02:00
ipt_CLUSTERIP.c netfilter: ipt_CLUSTERIP: fix clusterip_net_exit build regression 2017-12-07 23:19:58 +01:00
ipt_ECN.c
ipt_MASQUERADE.c netfilter: nat: add dependencies on conntrack module 2016-12-04 21:16:51 +01:00
ipt_REJECT.c netfilter: x_tables: move hook state into xt_action_param structure 2016-11-03 10:56:21 +01:00
ipt_rpfilter.c netfilter: rpfilter: fix incorrect loopback packet judgment 2017-01-16 14:23:01 +01:00
ipt_SYNPROXY.c netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook 2017-10-09 13:08:39 +02:00
iptable_filter.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
iptable_mangle.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
iptable_nat.c netfilter: core: only allow one nat hook per hook point 2018-01-08 18:01:13 +01:00
iptable_raw.c netfilter: nf_defrag: Skip defrag if NOTRACK is set 2018-01-11 13:14:20 +01:00
iptable_security.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
Kconfig netfilter: clusterip: make sure arp hooks are available 2018-01-11 13:12:26 +01:00
Makefile netfilter: flow table support for IPv4 2018-01-08 18:11:08 +01:00
nf_conntrack_l3proto_ipv4.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
nf_conntrack_proto_icmp.c netfilter: conntrack: timeouts can be const 2018-01-08 18:01:02 +01:00
nf_defrag_ipv4.c netfilter: nf_defrag: Skip defrag if NOTRACK is set 2018-01-11 13:14:20 +01:00
nf_dup_ipv4.c netfilter: kill the fake untracked conntrack objects 2017-04-15 11:47:57 +02:00
nf_flow_table_ipv4.c netfilter: flow table support for the mixed IPv4/IPv6 family 2018-01-08 18:11:09 +01:00
nf_log_arp.c netfilter: constify nf_loginfo structures 2017-08-02 14:25:59 +02:00
nf_log_ipv4.c netfilter: constify nf_loginfo structures 2017-08-02 14:25:59 +02:00
nf_nat_h323.c netfilter: nf_nat_h323: fix logical-not-parentheses warning 2017-08-24 18:48:05 +02:00
nf_nat_l3proto_ipv4.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
nf_nat_masquerade_ipv4.c net: Replace NF_CT_ASSERT() with WARN_ON(). 2017-09-04 13:25:19 +02:00
nf_nat_pptp.c netfilter: pptp: attach nat extension when needed 2017-04-26 09:30:22 +02:00
nf_nat_proto_gre.c netfilter: gre: Use consistent GRE and PTTP header structure instead of the ones defined by netfilter 2016-09-07 10:36:52 +02:00
nf_nat_proto_icmp.c
nf_nat_snmp_basic.c netfilter: snmp: avoid stack size warning 2017-05-01 11:43:58 +02:00
nf_reject_ipv4.c netfilter: nf_reject_ipv4: Fix use-after-free in send_reset 2017-11-01 12:15:29 +01:00
nf_socket_ipv4.c netfilter: remove nf_ct_is_untracked 2017-04-15 11:51:33 +02:00
nf_tables_arp.c netfilter: nf_tables: get rid of struct nft_af_info abstraction 2018-01-10 15:32:11 +01:00
nf_tables_ipv4.c netfilter: nf_tables: get rid of struct nft_af_info abstraction 2018-01-10 15:32:11 +01:00
nft_chain_nat_ipv4.c netfilter: nf_tables: explicit nft_set_pktinfo() call from hook path 2018-01-08 18:01:15 +01:00
nft_chain_route_ipv4.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
nft_dup_ipv4.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-11-15 10:54:36 -05:00
nft_fib_ipv4.c netfilter: nf_tables: fib: use skb_header_pointer 2017-07-31 19:01:39 +02:00
nft_masq_ipv4.c netfilter: nf_tables: fix mismatch in big-endian system 2017-03-13 13:30:28 +01:00
nft_redir_ipv4.c netfilter: nf_tables: fix mismatch in big-endian system 2017-03-13 13:30:28 +01:00
nft_reject_ipv4.c netfilter: nf_tables: use hook state from xt_action_param structure 2016-11-03 11:52:34 +01:00