davidlt/kernel-ark
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
44bd4de9c2
kernel-ark/net/netfilter
History
Stefan Berger 44bd4de9c2 netfilter: xt_connlimit: connlimit-above early loop termination 
The patch below introduces an early termination of the loop that is
counting matches. It terminates once the counter has exceeded the
threshold provided by the user. There's no point in continuing the loop
afterwards and looking at other entries.

It plays together with the following code further below:

return (connections > info->limit) ^ info->inverse;

where connections is the result of the counted connection, which in turn
is the matches variable in the loop. So once

        -> matches = info->limit + 1
alias   -> matches > info->limit
alias   -> matches > threshold

we can terminate the loop.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-11 18:00:07 +01:00
..
ipset netfilter: ipset: add dependency on CONFIG_NETFILTER_NETLINK 2011-02-10 10:13:07 +01:00
ipvs IPVS: precedence bug in ip_vs_sync_switch_mode() 2011-02-07 20:40:00 +09:00
core.c netfilter: allow NFQUEUE bypass if no listener is available 2011-01-18 16:08:30 +01:00
Kconfig netfilter: xtables: add device group match 2011-02-03 00:05:43 +01:00
Makefile netfilter: xtables: add device group match 2011-02-03 00:05:43 +01:00
nf_conntrack_acct.c netfilter: complete the deprecation of CONFIG_NF_CT_ACCT 2010-06-25 14:46:56 +02:00
nf_conntrack_amanda.c netfilter: cleanup printk messages 2010-05-13 15:02:08 +02:00
nf_conntrack_broadcast.c netfilter: nf_conntrack: nf_conntrack snmp helper 2011-01-18 18:12:24 +01:00
nf_conntrack_core.c netfilter: nf_conntrack_tstamp: add flow-based timestamp extension 2011-01-19 16:00:07 +01:00
nf_conntrack_ecache.c net/netfilter: __rcu annotations 2010-08-19 17:18:01 -07:00
nf_conntrack_expect.c netfilter: nf_conntrack: use is_vmalloc_addr() 2011-01-14 15:45:56 +01:00
nf_conntrack_extend.c netfilter: rcu sparse cleanups 2010-11-15 19:45:13 +01:00
nf_conntrack_ftp.c netfilter: cleanup printk messages 2010-05-13 15:02:08 +02:00
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c net-next: remove useless union keyword 2010-06-10 23:31:35 -07:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c netfilter: nf_conntrack: use is_vmalloc_addr() 2011-01-14 15:45:56 +01:00
nf_conntrack_irc.c netfilter: cleanup printk messages 2010-05-13 15:02:08 +02:00
nf_conntrack_l3proto_generic.c
nf_conntrack_netbios_ns.c netfilter: nf_conntrack: nf_conntrack snmp helper 2011-01-18 18:12:24 +01:00
nf_conntrack_netlink.c netfilter: ctnetlink: fix ctnetlink_parse_tuple() warning 2011-02-01 17:26:37 +01:00
nf_conntrack_pptp.c
nf_conntrack_proto_dccp.c netfilter: nf_conntrack: don't always initialize ct->proto 2010-11-12 17:33:17 +01:00
nf_conntrack_proto_generic.c
nf_conntrack_proto_gre.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
nf_conntrack_proto_sctp.c netfilter: nf_conntrack: don't always initialize ct->proto 2010-11-12 17:33:17 +01:00
nf_conntrack_proto_tcp.c netfilter: nf_conntrack: don't always initialize ct->proto 2010-11-12 17:33:17 +01:00
nf_conntrack_proto_udp.c
nf_conntrack_proto_udplite.c
nf_conntrack_proto.c netfilter: rcu sparse cleanups 2010-11-15 19:45:13 +01:00
nf_conntrack_sane.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
nf_conntrack_sip.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6 2010-10-21 08:21:34 -07:00
nf_conntrack_snmp.c netfilter: nf_conntrack: nf_conntrack snmp helper 2011-01-18 18:12:24 +01:00
nf_conntrack_standalone.c netfilter: nf_conntrack: fix lifetime display for disabled connections 2011-01-19 19:10:49 +01:00
nf_conntrack_tftp.c netfilter: cleanup printk messages 2010-05-13 15:02:08 +02:00
nf_conntrack_timestamp.c netfilter: nf_conntrack_tstamp: add flow-based timestamp extension 2011-01-19 16:00:07 +01:00
nf_internals.h netfilter: cleanup printk messages 2010-05-13 15:02:08 +02:00
nf_log.c netfilter: add __rcu annotations 2010-11-15 18:17:21 +01:00
nf_queue.c netfilter: allow NFQUEUE bypass if no listener is available 2011-01-18 16:08:30 +01:00
nf_sockopt.c
nf_tproxy_core.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6 2010-10-21 08:21:34 -07:00
nfnetlink_log.c netfilter: add __rcu annotations 2010-11-15 18:17:21 +01:00
nfnetlink_queue.c netfilter: nfnetlink_queue: return error number to caller 2011-01-18 15:27:28 +01:00
nfnetlink.c netfilter: cleanup printk messages 2010-05-13 15:02:08 +02:00
x_tables.c Merge branch 'master' of /repos/git/net-next-2.6 2011-01-19 23:51:37 +01:00
xt_AUDIT.c netfilter: audit target to record accepted/dropped packets 2011-01-16 18:10:28 +01:00
xt_CHECKSUM.c netfilter: add CHECKSUM target 2010-07-15 17:20:46 +02:00
xt_CLASSIFY.c netfilter: xt_CLASSIFY: add ARP support, allow CLASSIFY target on any table 2010-11-15 13:57:56 +01:00
xt_cluster.c netfilter: nf_conntrack: IPS_UNTRACKED bit 2010-06-08 16:09:52 +02:00
xt_comment.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_connbytes.c netfilter: xt_connbytes: Force CT accounting to be enabled 2010-06-25 14:44:07 +02:00
xt_connlimit.c netfilter: xt_connlimit: connlimit-above early loop termination 2011-02-11 18:00:07 +01:00
xt_connmark.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_CONNSECMARK.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
xt_conntrack.c netfilter: xt_conntrack: support matching on port ranges 2011-01-13 12:05:12 +01:00
xt_cpu.c netfilter: xtables: add missing aliases for autoloading via iptables 2011-01-18 06:33:54 +01:00
xt_CT.c secmark: make secmark object handling generic 2010-10-21 10:12:48 +11:00
xt_dccp.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
xt_devgroup.c netfilter: xtables: add device group match 2011-02-03 00:05:43 +01:00
xt_dscp.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_DSCP.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
xt_esp.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
xt_hashlimit.c netfilter: xt_hashlimit: use proto_ports_offset() to support AH message 2010-08-19 17:16:25 -07:00
xt_helper.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_hl.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_HL.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
xt_IDLETIMER.c netfilter: xtables: add missing aliases for autoloading via iptables 2011-01-18 06:33:54 +01:00
xt_iprange.c netfilter: xt_iprange: add IPv6 match debug print code 2011-01-28 19:33:13 +01:00
xt_ipvs.c IPVS: netns, use ip_vs_proto_data as param. 2011-01-13 10:30:27 +09:00
xt_LED.c netfilter: xtables: add missing aliases for autoloading via iptables 2011-01-18 06:33:54 +01:00
xt_length.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_limit.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_mac.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_mark.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_multiport.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
xt_NFLOG.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
xt_NFQUEUE.c netfilter: allow NFQUEUE bypass if no listener is available 2011-01-18 16:08:30 +01:00
xt_NOTRACK.c netfilter: nf_conntrack: IPS_UNTRACKED bit 2010-06-08 16:09:52 +02:00
xt_osf.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_owner.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_physdev.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_pkttype.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_policy.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_quota.c xt_quota: report initial quota value instead of current value to userspace 2010-07-23 14:07:47 +02:00
xt_rateest.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_RATEEST.c pkt_sched: gen_kill_estimator() rcu fixes 2010-06-11 18:37:08 -07:00
xt_realm.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_recent.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
xt_repldata.h
xt_sctp.c netfilter: xt_sctp: use WORD_ROUND macro to calculate length of multiple of 4 bytes 2010-06-09 14:47:40 +02:00
xt_SECMARK.c secmark: make secmark object handling generic 2010-10-21 10:12:48 +11:00
xt_set.c netfilter: xtables: "set" match and "SET" target support 2011-02-01 15:56:00 +01:00
xt_socket.c netfilter: xt_socket: Make tproto signed in socket_mt6_v1(). 2010-10-28 12:59:53 -07:00
xt_state.c netfilter: nf_conntrack: IPS_UNTRACKED bit 2010-06-08 16:09:52 +02:00
xt_statistic.c netfilter: xt_statistic: remove nth_lock spinlock 2010-06-01 12:00:41 +02:00
xt_string.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
xt_tcpmss.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
xt_TCPMSS.c tcp: unify tcp flag macros 2010-06-15 11:56:19 -07:00
xt_TCPOPTSTRIP.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
xt_tcpudp.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
xt_TEE.c net: use the macros defined for the members of flowi 2010-11-17 12:27:45 -08:00
xt_time.c netfilter: remove unnecessary returns from void function()s 2010-05-13 15:16:27 +02:00
xt_TPROXY.c netfilter: fix module dependency issues with IPv6 defragmentation, ip6tables and xt_TPROXY 2010-10-25 13:58:36 -07:00
xt_TRACE.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
xt_u32.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00