1. 08 Apr, 2015 1 commit
    • Daniel Borkmann's avatar
      netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match · d64d80a2
      Daniel Borkmann authored
      Currently in xt_socket, we take advantage of early demuxed sockets
      since commit 00028aa3 ("netfilter: xt_socket: use IP early demux")
      in order to avoid a second socket lookup in the fast path, but we
      only make partial use of this:
      
      We still unnecessarily parse headers, extract proto, {s,d}addr and
      {s,d}ports from the skb data, accessing possible conntrack information,
      etc even though we were not even calling into the socket lookup via
      xt_socket_get_sock_{v4,v6}() due to skb->sk hit, meaning those cycles
      can be spared.
      
      After this patch, we only proceed the slower, manual lookup path
      when we have a skb->sk miss, thus time to match verdict for early
      demuxed sockets will improve further, which might be i.e. interesting
      for use cases such as mentioned in 681f130f ("netfilter: xt_socket:
      add XT_SOCKET_NOWILDCARD flag").
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      d64d80a2
  2. 02 Apr, 2015 1 commit
  3. 01 Apr, 2015 7 commits
  4. 31 Mar, 2015 31 commits