summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [PATCH]: libxt_TOS/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-205-170/+289
| | | | | | | Move libipt_TOS revision 0 to libxt_TOS revision 0 and add support for xt_TOS target revision 1. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* [PATCH]: libxt_tos/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-206-172/+298
| | | | | | | Move libipt_tos revision 0 to libxt_tos revision 0 and add support for xt_tos match revision 1. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* [PATCH]: libxt_owner/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-207-532/+606
| | | | | | | libxt_owner merges libipt_owner and libip6t_owner, and adds support for the xt_owner match revision 1. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* [PATCH]: common error messages/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-202-1/+55
| | | | | | | | Error messages vary wildly among modules, and there is a lot of reundance in it too. Introduce a helper function that does all of the parameter checking boilerplate and gives unique messages. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* Introduce strtonum(), which works like string_to_number(), but passes/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-202-0/+49
| | | | | | | | | | | | | | | | | | | | back the 'end' pointer. It is useful where you want to do boundary checking yet work with strings that are not entirely slurped by strtoul(), e.g.: s = "1/2"; /* one half */ if (!strtonum(s, &end, &value, 0, 5)) error("Zero-length string, or value out of bounds"); if (*end != '/') error("Malformed string"); info->param1 = value; if (!strtonum(end + 1, &end, &value, 2, 4)) error(".."); if (*end != '\0') error("Malformed string"); info->param2 = value; Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* Converts the iptables build infrastructure to autotools./C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-2017-709/+416
| | | | | | | | | | | | | - Can build both static and dynamic at the same time - iptables-static will be a multi-binary, semi-static (link against libc but w/o dynamic plugins) - Always build IPv6 modules - consider INSTALL Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* - cleanup several code wraparounds/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-171-4/+21
| | | | | - check for malloc() return value in merge_opts() - check for merge_opts() return value
* Add rateest match extension/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-153-1/+495
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Add RATEEST target extension/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-154-3/+254
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* [PATCH 3/3] Solving scalability issue: for chain list "name" searching./C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-151-4/+414
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Solving scalability issue: for chain list "name" searching. Functions: iptcc_find_label(), iptc_is_chain(). Testing if a chain exist, requires a linearly walk of linked list with chain-names (doing a strcmp(3) in each step). Giving a worst-case runtime of O(n) where n is the number of chains. Why is this important to fix?! If only called once, this should not be a big concern, even-though the string compares are expensive. The performance issue arise with many chains for example; when using "iptables-restore", or when listing all "iptables -nL" rules, or when using CPAN IPTables::libiptc. Having 50k chains, the rule listing, with the command: "./iptables -nL > /dev/null", Without patch it takes approximately 5 minutes, With the patch it takes 0.5 seconds. Listing without patch: real 4m49.426s user 4m37.993s sys 0m0.280s Listing with patch: real 0m0.558s user 0m0.484s sys 0m0.064s How is it solved?! The issue is solved introducing a new data structure, that allow us to do binary search of chain names. Thus, reducing the worst-case runtime to O(log n). Being more specific: The new data structure is called "chain index", which is an array with pointers into the chain list, with CHAIN_INDEX_BUCKET_LEN spacing. This facilitates the ability to speedup chain list searching, by find a more optimal starting points when searching the linked list. The runtime complexity is actually also affected by this "bucket" size concept. Thus, O(log(n/k) + k) where k is CHAIN_INDEX_BUCKET_LEN. A nice property of the chain index, is that the "bucket" list length is max CHAIN_INDEX_BUCKET_LEN (when just build, inserts will change this). Oppose to hashing, where the "bucket" list length can vary a lot. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>
* [PATCH 2/3] Introduce a counter for number of user defined chains./C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-151-1/+7
| | | | | | Introduce a counter for number of user defined chains. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>
* [PATCH 1/3] Inline functions iptcc_is_builtin() and set_changed()./C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-151-2/+2
| | | | | | | The two functions are obvious candidates for inlining. Using gprof(1) shows that they actually affects performance. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>
* Fix CONNMARK mask initialisation/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-151-2/+10
| | | | | | | | | | This patch fixes the problem that the CONNMARK mask value has been set to 0 whenever the CONNMARK target options were not the last options to be processed. It initalizes the mask value rather than setting it for each parse. Signed-off-by: Peter Warasin <peter@endian.com>
* bump version from 1.4.0rc1 to 1.4.0 finaliptables_1_4_0/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-12-221-2/+2
|
* [patch] iptables and NO_SHARED_LIBS/dlfcn.h/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2007-12-193-3/+12
| | | | | | | | if NO_SHARED_LIBS is defined, then iptables shouldnt even include dlfcn.h. otherwise you hit a build failure when using toolchains that do not provide dlfcn.h because they do not support shared objects. Signed-Off-By: Mike Frysinger <vapier@gentoo.org>
* [PATCH]: use <linux/types.h>/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2007-12-173-5/+3
| | | | | | | | Remove our own definitions of the Linux types and use <linux/types.h> instead. libiptc needs it too, or otherwise will choke on union nf_inet_addr. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* [PATCH] More safe chain sorting, improving r7098/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2007-12-121-1/+17
| | | | | | | | | | | | | | | | | This patch is an improvment of r7098 (made by me). Assuring compatibility between 1.4.0 and older versions, regarding chain sorting. Chains from kernel are already sorted, as they are inserted sorted. But there exists an issue when shifting to 1.4.0 from an older version, as old versions allow last created chain to be unsorted. This unsorted chain would survive in 1.4.0, as chains are now only sorted on creation. This patch verifies that chains are sorted, if not it fixes the sorting. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>
* Fix sockfd use accounting for kernels without autoloading/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2007-12-041-4/+0
|
* Fix showing help text for matches/targets with revision as user/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2007-12-031-0/+9
| | | | | | | When running as a user iptables can't determine the highest supported revision and exits. Assume all revision are supported in case we get a EPERM. If the user is not showing the help text but trying to add new rules he'll get EPERM later anyway.
* Unifies libip[6]t_SECMARK.man to libxt_SECMARK.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-7/+0
|
* Unifies libip[6]t_CONNSECMARK.man to libxt_CONNSECMARK.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-15/+0
|
* Fixes missing '6' and 'X' in definitions of selinux related extension lists./C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-2/+2
|
* Remove libip6t_state.c. libxt_state.c supports IPv6./C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-156/+0
|
* Unifies libip[6]t_udp.man to libxt_udp.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-14/+0
|
* Removes libip6t_u32.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-129/+0
| | | | libxt_u32.man already exists.
* Unifies libip[6]t_physdev.man to libxt_physdev.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-42/+0
|
* Unifies libip[6]t_mark.man to libxt_mark.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-9/+0
|
* Unifies libip[6]t_mac.man to libxt_mac.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-10/+0
|
* Unifies libip[6]t_limit.man to libxt_limit.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-15/+0
|
* Unifies libip[6]t_esp.man to libxt_esp.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-3/+0
|
* Unifies libip[6]t_NFQUEUE.man to libxt_NFQUEUE.man/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-292-12/+0
|
* Move libipt_tcpmss.man to libxt_tcpmss.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_string.man to libxt_string.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_state.man to libxt_state.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_sctp.man to libxt_sctp.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_quota.man to libxt_quota.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_pkttype.man to libxt_pkttype.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_helper.man to libxt_helper.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_hashlimit.man to libxt_hashlimit.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_dscp.man to libxt_dscp.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_dccp.man to libxt_dccp.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_connmark.man to libxt_connmark.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_connbytes.man to libxt_connbytes.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_comment.man to libxt_comment.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_NOTRACK.man to libxt_NOTRACK.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Move libipt_DSCP.man to libxt_DSCP.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Moves libipt_CONNMARK.man to libxt_CONNMARK.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Moves libipt_CLASSYFY.man to libxt_CLASSYFY.man for ip6tables.8/C=JP/ST=JP/CN=Yasuyuki Kozakai/emailAddress=yasuyuki@netfilter.org2007-11-291-0/+0
|
* Fix connlimit output for inverted --connlimit-above: ! > is <=, not </C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2007-11-281-2/+2
|
* [PATCH]: iptables/libiptc perf issue: Sorting chain during pull-out/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2007-11-281-3/+3
| | | | | | | | | | | | | | | | | | | Performance optimize scalability issue: Sorting chain during pull-out give worst-case runtime O(Chains2). When pulling out the blob, every chain name is inserted alphabetically into a linked list (by function iptc_insert_chain()). The problem with this approach is that the chain names delivered in the blob is already sorted (as we push it back to the kernel sorted). This cause chain parsing to always process every element in the chain list and finish with a tail add. Causing worst-case runtime O(C2/2) for alphabetically sorting of chains. The patch solves this by only calling iptc_insert_chain() when creating new chains. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>