Florian Westphal 4d3a57f23d netfilter: conntrack: do not enable connection tracking unless needed ... Discussion during NFWS 2017 in Faro has shown that the current conntrack behaviour is unreasonable. Even if conntrack module is loaded on behalf of a single net namespace, its turned on for all namespaces, which is expensive. Commit 481fa37347 ("netfilter: conntrack: add nf_conntrack_default_on sysctl") attempted to provide an alternative to the 'default on' behaviour by adding a sysctl to change it. However, as Eric points out, the sysctl only becomes available once the module is loaded, and then its too late. So we either have to move the sysctl to the core, or, alternatively, change conntrack to become active only once the rule set requires this. This does the latter, conntrack is only enabled when a rule needs it. Reported-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2017-07-31 20:42:00 +02:00
..
arp_tables.c	netfilter: Remove unnecessary cast on void pointer	2017-04-07 17:29:17 +02:00
arpt_mangle.c
arptable_filter.c	netfilter: arp_tables: register table in initns	2016-04-07 11:58:49 +02:00
ip_tables.c	netfilter: Remove unnecessary cast on void pointer	2017-04-07 17:29:17 +02:00
ipt_ah.c	netfilter: ipv4: whitespace around operators	2015-10-16 19:19:23 +02:00
ipt_CLUSTERIP.c	netfilter: nf_hook_ops structs can be const	2017-07-31 19:10:44 +02:00
ipt_ECN.c	net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool	2015-08-17 21:33:06 -07:00
ipt_MASQUERADE.c	netfilter: nat: add dependencies on conntrack module	2016-12-04 21:16:51 +01:00
ipt_REJECT.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
ipt_rpfilter.c	netfilter: rpfilter: fix incorrect loopback packet judgment	2017-01-16 14:23:01 +01:00
ipt_SYNPROXY.c	netfilter: nf_hook_ops structs can be const	2017-07-31 19:10:44 +02:00
iptable_filter.c	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
iptable_mangle.c	netfilter: x_tables: simplify ip{6}table_mangle_hook()	2016-07-01 16:37:02 +02:00
iptable_nat.c	netfilter: nf_hook_ops structs can be const	2017-07-31 19:10:44 +02:00
iptable_raw.c	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
iptable_security.c	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
Kconfig	netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c	2016-11-01 20:50:31 +01:00
Makefile	netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c	2016-11-01 20:50:31 +01:00
nf_conntrack_l3proto_ipv4.c	netfilter: conntrack: do not enable connection tracking unless needed	2017-07-31 20:42:00 +02:00
nf_conntrack_proto_icmp.c	netfilter: add and use nf_ct_set helper	2017-02-02 14:31:54 +01:00
nf_defrag_ipv4.c	netfilter: nf_hook_ops structs can be const	2017-07-31 19:10:44 +02:00
nf_dup_ipv4.c	netfilter: kill the fake untracked conntrack objects	2017-04-15 11:47:57 +02:00
nf_log_arp.c	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
nf_log_ipv4.c	netfilter: allow logging from non-init namespaces	2017-02-02 14:31:58 +01:00
nf_nat_h323.c	netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report()	2014-02-05 17:46:05 +01:00
nf_nat_l3proto_ipv4.c	netfilter: don't attach a nat extension by default	2017-04-26 09:30:22 +02:00
nf_nat_masquerade_ipv4.c	netfilter: conntrack: rename nf_ct_iterate_cleanup	2017-05-29 12:46:08 +02:00
nf_nat_pptp.c	netfilter: pptp: attach nat extension when needed	2017-04-26 09:30:22 +02:00
nf_nat_proto_gre.c	netfilter: gre: Use consistent GRE and PTTP header structure instead of the ones defined by netfilter	2016-09-07 10:36:52 +02:00
nf_nat_proto_icmp.c	net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool	2015-08-17 21:33:06 -07:00
nf_nat_snmp_basic.c	netfilter: snmp: avoid stack size warning	2017-05-01 11:43:58 +02:00
nf_reject_ipv4.c	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
nf_socket_ipv4.c	netfilter: remove nf_ct_is_untracked	2017-04-15 11:51:33 +02:00
nf_tables_arp.c	netfilter: nf_tables: only allow in/output for arp packets	2017-07-17 17:02:44 +02:00
nf_tables_ipv4.c	netfilter: Add the missed return value check of nft_register_chain_type	2016-09-12 19:54:45 +02:00
nft_chain_nat_ipv4.c	netfilter: Pass priv instead of nf_hook_ops to netfilter hooks	2015-09-18 22:00:16 +02:00
nft_chain_route_ipv4.c	netfilter: nft_chain_route: re-route before skb is queued to userspace	2016-09-06 18:02:37 +02:00
nft_dup_ipv4.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-11-15 10:54:36 -05:00
nft_fib_ipv4.c	netfilter: nf_tables: fib: use skb_header_pointer	2017-07-31 19:01:39 +02:00
nft_masq_ipv4.c	netfilter: nf_tables: fix mismatch in big-endian system	2017-03-13 13:30:28 +01:00
nft_redir_ipv4.c	netfilter: nf_tables: fix mismatch in big-endian system	2017-03-13 13:30:28 +01:00
nft_reject_ipv4.c	netfilter: nf_tables: use hook state from xt_action_param structure	2016-11-03 11:52:34 +01:00