Florian Westphal eaf9e7192e netfilter: conntrack: don't fold port numbers into addresses before hashing ... Originally this used jhash2() over tuple and folded the zone id, the pernet hash value, destination port and l4 protocol number into the 32bit seed value. When the switch to siphash was done, I used an on-stack temporary buffer to build a suitable key to be hashed via siphash(). But this showed up as performance regression, so I got rid of the temporary copy and collected to-be-hashed data in 4 u64 variables. This makes it easy to build tuples that produce the same hash, which isn't desirable even though chain lengths are limited. Switch back to plain siphash, but just like with jhash2(), take advantage of the fact that most of to-be-hashed data is already in a suitable order. Use an empty struct as annotation in 'struct nf_conntrack_tuple' to mark last member that can be used as hash input. The only remaining data that isn't present in the tuple structure are the zone identifier and the pernet hash: fold those into the key. Fixes: d2c806abcf ("netfilter: conntrack: use siphash_4u64") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2023-07-05 14:42:16 +02:00
..
ipv4	netfilter: disable defrag once its no longer needed	2021-04-26 03:20:07 +02:00
ipv6	netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1	2021-09-28 13:04:55 +02:00
br_netfilter.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_bpf_link.h	bpf: minimal support for programs hooked into netfilter framework	2023-04-21 11:34:14 -07:00
nf_conntrack_acct.h	netfilter: conntrack: remove extension register api	2022-02-04 06:30:28 +01:00
nf_conntrack_act_ct.h	net/sched: act_ct: Fill offloading tuple iifidx	2022-01-04 12:12:55 +00:00
nf_conntrack_bpf.h	net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c	2022-10-03 09:17:32 -07:00
nf_conntrack_bridge.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_conntrack_core.h	netfilter: conntrack: fix wrong ct->timeout value	2023-04-19 12:08:38 +02:00
nf_conntrack_count.h	netfilter: nf_conncount: reduce unnecessary GC	2022-05-16 13:05:40 +02:00
nf_conntrack_ecache.h	netfilter: prefer extension check to pointer check	2022-05-13 18:56:28 +02:00
nf_conntrack_expect.h	netfilter: Reorder fields in 'struct nf_conntrack_expect'	2023-05-18 08:48:54 +02:00
nf_conntrack_extend.h	netfilter: extensions: introduce extension genid count	2022-05-13 18:52:16 +02:00
nf_conntrack_helper.h	net: move add ct helper function to nf_conntrack_helper for ovs and tc	2022-11-08 12:15:19 +01:00
nf_conntrack_l4proto.h	netfilter: conntrack: pass hook state to log functions	2021-06-18 14:47:43 +02:00
nf_conntrack_labels.h	netfilter: extensions: introduce extension genid count	2022-05-13 18:52:16 +02:00
nf_conntrack_seqadj.h	netfilter: conntrack: remove extension register api	2022-02-04 06:30:28 +01:00
nf_conntrack_synproxy.h	netfilter: conntrack: wrap two inline functions in config checks.	2019-09-13 12:47:10 +02:00
nf_conntrack_timeout.h	netfilter: nf_conntrack: add missing __rcu annotations	2022-07-11 16:25:15 +02:00
nf_conntrack_timestamp.h	netfilter: conntrack: remove extension register api	2022-02-04 06:30:28 +01:00
nf_conntrack_tuple.h	netfilter: conntrack: don't fold port numbers into addresses before hashing	2023-07-05 14:42:16 +02:00
nf_conntrack_zones.h	netfilter: conntrack: remove CONFIG_NF_CONNTRACK checks from nf_conntrack_zones.h.	2019-09-13 12:47:41 +02:00
nf_conntrack.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next	2023-02-20 10:53:56 +00:00
nf_dup_netdev.h	netfilter: nft_{fwd,dup}_netdev: add offload support	2019-09-10 22:44:29 +02:00
nf_flow_table.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-15 22:19:41 -07:00
nf_hooks_lwtunnel.h	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
nf_log.h	netfilter: nf_log_common: merge with nf_log_syslog	2021-03-31 22:34:10 +02:00
nf_nat_helper.h	netfilter: nat: move repetitive nat port reserve loop to a helper	2022-09-07 16:46:04 +02:00
nf_nat_masquerade.h	netfilter: update include directives.	2019-09-13 12:33:06 +02:00
nf_nat_redirect.h	netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs	2023-03-22 21:48:59 +01:00
nf_nat.h	net: move the nat function to nf_nat_ovs for ovs and tc	2022-12-12 10:14:03 +00:00
nf_queue.h	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
nf_reject.h	netfilter: conntrack: skip verification of zero UDP checksum	2022-05-13 18:56:28 +02:00
nf_socket.h	netfilter: Decrease code duplication regarding transparent socket option	2018-06-03 00:02:01 +02:00
nf_synproxy.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_tables_core.h	netfilter: nf_tables: avoid retpoline overhead for some ct expression calls	2023-01-18 13:05:25 +01:00
nf_tables_ipv4.h	netfilter: use skb_ip_totlen and iph_totlen	2023-02-01 20:54:27 -08:00
nf_tables_ipv6.h	netfilter: nf_tables: reduce nft_pktinfo by 8 bytes	2022-10-25 13:44:14 +02:00
nf_tables_offload.h	netfilter: nf_tables: bail out early if hardware offload is not supported	2022-06-06 19:19:15 +02:00
nf_tables.h	netfilter: nf_tables: report use refcount overflow	2023-07-05 14:42:15 +02:00
nf_tproxy.h	netfilter: tproxy: fix deadlock due to missing BH disable	2023-03-06 12:09:48 +01:00
nft_fib.h	netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters	2022-11-15 10:46:34 +01:00
nft_meta.h	netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters	2022-11-15 10:46:34 +01:00
nft_reject.h	netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters	2022-11-15 10:46:34 +01:00
xt_rateest.h	net: sched: Merge Qdisc::bstats and Qdisc::cpu_bstats data types	2021-10-18 12:54:41 +01:00