Age | Commit message (Collapse) | Author | Files | Lines | |
---|---|---|---|---|---|
2023-05-03 | netfilter: nf_tables: fix ct untracked match breakage | Florian Westphal | 1 | -4/+10 | |
"ct untracked" no longer works properly due to erroneous NFT_BREAK. We have to check ctinfo enum first. Fixes: d9e789147605 ("netfilter: nf_tables: avoid retpoline overhead for some ct expression calls") Reported-by: Rvfg <i@rvf6.com> Link: https://marc.info/?l=netfilter&m=168294996212038&w=2 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> | |||||
2023-01-18 | netfilter: nf_tables: avoid retpoline overhead for some ct expression calls | Florian Westphal | 1 | -0/+56 | |
nft_ct expression cannot be made builtin to nf_tables without also forcing the conntrack itself to be builtin. However, this can be avoided by splitting retrieval of a few selector keys that only need to access the nf_conn structure, i.e. no function calls to nf_conntrack code. Many rulesets start with something like "ct status established,related accept" With this change, this no longer requires an indirect call, which gives about 1.8% more throughput with a simple conntrack-enabled forwarding test (retpoline thunk used). Signed-off-by: Florian Westphal <fw@strlen.de> |