summaryrefslogtreecommitdiff
path: root/include/uapi/drm
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2017-02-03 13:35:50 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2017-02-08 14:16:23 +0100
commitedee4f1e92458299505ff007733f676b00c516a1 (patch)
treeb237da21e982d0cc5700448b12e375a3bf196363 /include/uapi/drm
parent5c178d81b69f08ca3195427a6ea9a46d9af23127 (diff)
netfilter: nft_ct: add zone id set support
zones allow tracking multiple connections sharing identical tuples, this is needed e.g. when tracking distinct vlans with overlapping ip addresses (conntrack is l2 agnostic). Thus the zone has to be set before the packet is picked up by the connection tracker. This is done by means of 'conntrack templates' which are conntrack structures used solely to pass this info from one netfilter hook to the next. The iptables CT target instantiates these connection tracking templates once per rule, i.e. the template is fixed/tied to particular zone, can be read-only and therefore be re-used by as many skbs simultaneously as needed. We can't follow this model because we want to take the zone id from an sreg at rule eval time so we could e.g. fill in the zone id from the packets vlan id or a e.g. nftables key : value maps. To avoid cost of per packet alloc/free of the template, use a percpu template 'scratch' object and use the refcount to detect the (unlikely) case where the template is still attached to another skb (i.e., previous skb was nfqueued ...). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/uapi/drm')
0 files changed, 0 insertions, 0 deletions