summaryrefslogtreecommitdiffstats
path: root/src/conntrack/compare.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2012-01-04 11:50:28 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2012-01-04 12:08:22 +0100
commit00c2c9dca32eb8eb8687b42fc6d135f35eaa5ff8 (patch)
tree165dc4759be70221168fe401c8c7b8114ea3039e /src/conntrack/compare.c
parentac39464a7619955adf9b317c829a0de0379d7c04 (diff)
src: put nf_expect and nf_conntrack into diet
Now, struct nf_expect takes only 192 bytes, instead of 1KB. struct nf_conntrack takes 296 bytes instead of 328 bytes. The size of the nf_expect structure has been reduced by rearranging the layout of the nf_conntrack structure. For the nf_conntrack case, this removes the allocation of room for attributes that the master tuple does not use (more specifically, the NATseq bytes). This patch modifies the binary layout of struct nf_conntrack. This should not be a problem since the definition of this object is opaque (it can be only accessed via get/set API). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/conntrack/compare.c')
-rw-r--r--src/conntrack/compare.c61
1 files changed, 25 insertions, 36 deletions
diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c
index cc0afc9..f94f1b9 100644
--- a/src/conntrack/compare.c
+++ b/src/conntrack/compare.c
@@ -17,10 +17,10 @@ static int __cmp(int attr,
const struct nf_conntrack *ct2,
unsigned int flags))
{
- if (test_bit(attr, ct1->set) && test_bit(attr, ct2->set)) {
+ if (test_bit(attr, ct1->head.set) && test_bit(attr, ct2->head.set)) {
return cmp(ct1, ct2, flags);
} else if (flags & NFCT_CMP_MASK &&
- test_bit(attr, ct1->set)) {
+ test_bit(attr, ct1->head.set)) {
return 0;
} else if (flags & NFCT_CMP_STRICT) {
return 0;
@@ -33,8 +33,7 @@ cmp_orig_l3proto(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].l3protonum ==
- ct2->tuple[__DIR_ORIG].l3protonum);
+ return (ct1->head.orig.l3protonum == ct2->head.orig.l3protonum);
}
static int
@@ -42,8 +41,7 @@ cmp_icmp_id(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].l4src.icmp.id ==
- ct2->tuple[__DIR_ORIG].l4src.icmp.id);
+ return (ct1->head.orig.l4src.icmp.id == ct2->head.orig.l4src.icmp.id);
}
static int
@@ -51,8 +49,8 @@ cmp_icmp_type(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].l4dst.icmp.type ==
- ct2->tuple[__DIR_ORIG].l4dst.icmp.type);
+ return (ct1->head.orig.l4dst.icmp.type ==
+ ct2->head.orig.l4dst.icmp.type);
}
static int
@@ -60,8 +58,8 @@ cmp_icmp_code(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].l4dst.icmp.code ==
- ct2->tuple[__DIR_ORIG].l4dst.icmp.code);
+ return (ct1->head.orig.l4dst.icmp.code ==
+ ct2->head.orig.l4dst.icmp.code);
}
static int
@@ -69,8 +67,7 @@ cmp_orig_port_src(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].l4src.all ==
- ct2->tuple[__DIR_ORIG].l4src.all);
+ return (ct1->head.orig.l4src.all == ct2->head.orig.l4src.all);
}
static int
@@ -78,8 +75,7 @@ cmp_orig_port_dst(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].l4dst.all ==
- ct2->tuple[__DIR_ORIG].l4dst.all);
+ return (ct1->head.orig.l4dst.all == ct2->head.orig.l4dst.all);
}
static int
@@ -87,10 +83,10 @@ cmp_orig_l4proto(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- if (ct1->tuple[__DIR_ORIG].protonum != ct2->tuple[__DIR_ORIG].protonum)
+ if (ct1->head.orig.protonum != ct2->head.orig.protonum)
return 0;
- switch(ct1->tuple[__DIR_ORIG].protonum) {
+ switch(ct1->head.orig.protonum) {
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
if (!__cmp(ATTR_ICMP_ID, ct1, ct2, flags, cmp_icmp_id))
@@ -121,22 +117,21 @@ cmp_orig_ipv4_src(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].src.v4 == ct2->tuple[__DIR_ORIG].src.v4);}
+ return (ct1->head.orig.src.v4 == ct2->head.orig.src.v4);}
static int
cmp_orig_ipv4_dst(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_ORIG].dst.v4 == ct2->tuple[__DIR_ORIG].dst.v4);}
+ return (ct1->head.orig.dst.v4 == ct2->head.orig.dst.v4);}
static int
cmp_orig_ipv6_src(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (memcmp(&ct1->tuple[__DIR_ORIG].src.v6,
- &ct2->tuple[__DIR_ORIG].src.v6,
+ return (memcmp(&ct1->head.orig.src.v6, &ct2->head.orig.src.v6,
sizeof(struct in6_addr)) == 0);
}
@@ -145,8 +140,7 @@ cmp_orig_ipv6_dst(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (memcmp(&ct1->tuple[__DIR_ORIG].dst.v6,
- &ct2->tuple[__DIR_ORIG].dst.v6,
+ return (memcmp(&ct1->head.orig.dst.v6, &ct2->head.orig.dst.v6,
sizeof(struct in6_addr)) == 0);
}
@@ -175,8 +169,7 @@ cmp_repl_l3proto(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_REPL].l3protonum ==
- ct2->tuple[__DIR_REPL].l3protonum);
+ return (ct1->repl.l3protonum == ct2->repl.l3protonum);
}
static int
@@ -184,8 +177,7 @@ cmp_repl_port_src(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_REPL].l4src.all ==
- ct2->tuple[__DIR_REPL].l4src.all);
+ return (ct1->repl.l4src.all == ct2->repl.l4src.all);
}
static int
@@ -193,8 +185,7 @@ cmp_repl_port_dst(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_REPL].l4dst.all ==
- ct2->tuple[__DIR_REPL].l4dst.all);
+ return (ct1->repl.l4dst.all == ct2->repl.l4dst.all);
}
static int
@@ -202,10 +193,10 @@ cmp_repl_l4proto(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- if (ct1->tuple[__DIR_REPL].protonum != ct2->tuple[__DIR_REPL].protonum)
+ if (ct1->repl.protonum != ct2->repl.protonum)
return 0;
- switch(ct1->tuple[__DIR_REPL].protonum) {
+ switch(ct1->repl.protonum) {
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
if (!__cmp(ATTR_ICMP_ID, ct1, ct2, flags, cmp_icmp_id))
@@ -236,22 +227,21 @@ cmp_repl_ipv4_src(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_REPL].src.v4 == ct2->tuple[__DIR_REPL].src.v4);}
+ return (ct1->repl.src.v4 == ct2->repl.src.v4);}
static int
cmp_repl_ipv4_dst(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->tuple[__DIR_REPL].dst.v4 == ct2->tuple[__DIR_REPL].dst.v4);}
+ return (ct1->repl.dst.v4 == ct2->repl.dst.v4);}
static int
cmp_repl_ipv6_src(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (memcmp(&ct1->tuple[__DIR_REPL].src.v6,
- &ct2->tuple[__DIR_REPL].src.v6,
+ return (memcmp(&ct1->repl.src.v6, &ct2->repl.src.v6,
sizeof(struct in6_addr)) == 0);
}
@@ -260,8 +250,7 @@ cmp_repl_ipv6_dst(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (memcmp(&ct1->tuple[__DIR_REPL].dst.v6,
- &ct2->tuple[__DIR_REPL].dst.v6,
+ return (memcmp(&ct1->repl.dst.v6, &ct2->repl.dst.v6,
sizeof(struct in6_addr)) == 0);
}