summaryrefslogtreecommitdiffstats
path: root/include/internal/object.h
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2009-07-14 16:43:55 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2009-07-14 16:43:55 +0200
commitdd73e5708cc2cd127ba03fd5a82fb96b3928e7fb (patch)
tree51c6fcb589cdb399bda4f5b134dedf2d1ca5b328 /include/internal/object.h
parent1c450e1595afdc8d1bfabb4f640c9251808426eb (diff)
bsf: add support for IPv6 address filtering
This patch adds support to auto-generate BSF code for IPv6. It requires a Linux kernel >= 2.6.29. The maximum number of addresses is limited to 20 (12 BSF lines per IPv6 address comparison). I am not sure that to remove this limit is useful given that oprofile does not show very good numbers for very large (in terms of lines) filters. This completes one feature that is available in IPv4 but that was missing in IPv6. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/internal/object.h')
-rw-r--r--include/internal/object.h13
1 files changed, 13 insertions, 0 deletions
diff --git a/include/internal/object.h b/include/internal/object.h
index ef49590..df002fd 100644
--- a/include/internal/object.h
+++ b/include/internal/object.h
@@ -222,6 +222,19 @@ struct nfct_filter {
u_int32_t mask;
} l3proto[2][__FILTER_ADDR_MAX];
+ /*
+ * FIXME: For IPv6 filtering, up to 20 IPs/masks (12 BSF lines
+ * per comparison). I think that it is not worthy to try to support
+ * more than that for performance reasons. It seems that oprofile
+ * shows bad numbers for very large BSF code.
+ */
+ u_int32_t l3proto_elems_ipv6[2];
+ struct {
+#define __FILTER_IPV6_MAX 20
+ u_int32_t addr[4];
+ u_int32_t mask[4];
+ } l3proto_ipv6[2][__FILTER_IPV6_MAX];
+
u_int32_t set[1];
};