mirror of
https://git.openwrt.org/openwrt/openwrt.git
synced 2024-05-19 05:56:22 +02:00
5efd41c10b
Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.28 Removed upstream: pending-6.6/796-net-dsa-mt7530-trap-link-local-frames-regardless-of-.patch All oither patches automatically rebased. 1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.28&id=8b6c4b62582606c62074a7e7c64156f56d2785f2 Build system: x86/64 Build-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3 Run-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3 Signed-off-by: John Audia <therealgraysky@proton.me>
111 lines
3.1 KiB
Diff
111 lines
3.1 KiB
Diff
From: Felix Fietkau <nbd@nbd.name>
|
|
Subject: kernel: add a new version of my netfilter speedup patches for linux 2.6.39 and 3.0
|
|
|
|
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
|
---
|
|
include/uapi/linux/netfilter_ipv4/ip_tables.h | 1 +
|
|
net/ipv4/netfilter/ip_tables.c | 37 +++++++++++++++++++++++++++
|
|
2 files changed, 38 insertions(+)
|
|
|
|
--- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
|
|
+++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
|
|
@@ -89,6 +89,7 @@ struct ipt_ip {
|
|
#define IPT_F_FRAG 0x01 /* Set if rule is a fragment rule */
|
|
#define IPT_F_GOTO 0x02 /* Set if jump is a goto */
|
|
#define IPT_F_MASK 0x03 /* All possible flag bits mask. */
|
|
+#define IPT_F_NO_DEF_MATCH 0x80 /* Internal: no default match rules present */
|
|
|
|
/* Values for "inv" field in struct ipt_ip. */
|
|
#define IPT_INV_VIA_IN 0x01 /* Invert the sense of IN IFACE. */
|
|
--- a/net/ipv4/netfilter/ip_tables.c
|
|
+++ b/net/ipv4/netfilter/ip_tables.c
|
|
@@ -48,6 +48,9 @@ ip_packet_match(const struct iphdr *ip,
|
|
{
|
|
unsigned long ret;
|
|
|
|
+ if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
|
|
+ return true;
|
|
+
|
|
if (NF_INVF(ipinfo, IPT_INV_SRCIP,
|
|
(ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
|
|
NF_INVF(ipinfo, IPT_INV_DSTIP,
|
|
@@ -78,6 +81,29 @@ ip_packet_match(const struct iphdr *ip,
|
|
return true;
|
|
}
|
|
|
|
+static void
|
|
+ip_checkdefault(struct ipt_ip *ip)
|
|
+{
|
|
+ static const char iface_mask[IFNAMSIZ] = {};
|
|
+
|
|
+ if (ip->invflags || ip->flags & IPT_F_FRAG)
|
|
+ return;
|
|
+
|
|
+ if (memcmp(ip->iniface_mask, iface_mask, IFNAMSIZ) != 0)
|
|
+ return;
|
|
+
|
|
+ if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
|
|
+ return;
|
|
+
|
|
+ if (ip->smsk.s_addr || ip->dmsk.s_addr)
|
|
+ return;
|
|
+
|
|
+ if (ip->proto)
|
|
+ return;
|
|
+
|
|
+ ip->flags |= IPT_F_NO_DEF_MATCH;
|
|
+}
|
|
+
|
|
static bool
|
|
ip_checkentry(const struct ipt_ip *ip)
|
|
{
|
|
@@ -523,6 +549,8 @@ find_check_entry(struct ipt_entry *e, st
|
|
struct xt_mtchk_param mtpar;
|
|
struct xt_entry_match *ematch;
|
|
|
|
+ ip_checkdefault(&e->ip);
|
|
+
|
|
if (!xt_percpu_counter_alloc(alloc_state, &e->counters))
|
|
return -ENOMEM;
|
|
|
|
@@ -817,6 +845,7 @@ copy_entries_to_user(unsigned int total_
|
|
const struct xt_table_info *private = table->private;
|
|
int ret = 0;
|
|
const void *loc_cpu_entry;
|
|
+ u8 flags;
|
|
|
|
counters = alloc_counters(table);
|
|
if (IS_ERR(counters))
|
|
@@ -844,6 +873,14 @@ copy_entries_to_user(unsigned int total_
|
|
goto free_counters;
|
|
}
|
|
|
|
+ flags = e->ip.flags & IPT_F_MASK;
|
|
+ if (copy_to_user(userptr + off
|
|
+ + offsetof(struct ipt_entry, ip.flags),
|
|
+ &flags, sizeof(flags)) != 0) {
|
|
+ ret = -EFAULT;
|
|
+ goto free_counters;
|
|
+ }
|
|
+
|
|
for (i = sizeof(struct ipt_entry);
|
|
i < e->target_offset;
|
|
i += m->u.match_size) {
|
|
@@ -1225,12 +1262,15 @@ compat_copy_entry_to_user(struct ipt_ent
|
|
compat_uint_t origsize;
|
|
const struct xt_entry_match *ematch;
|
|
int ret = 0;
|
|
+ u8 flags = e->ip.flags & IPT_F_MASK;
|
|
|
|
origsize = *size;
|
|
ce = *dstptr;
|
|
if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
|
|
copy_to_user(&ce->counters, &counters[i],
|
|
- sizeof(counters[i])) != 0)
|
|
+ sizeof(counters[i])) != 0 ||
|
|
+ copy_to_user(&ce->ip.flags, &flags,
|
|
+ sizeof(flags)) != 0)
|
|
return -EFAULT;
|
|
|
|
*dstptr += sizeof(struct compat_ipt_entry);
|