: Add xt_rateest match
Subsystems (2)
RFC 2/4 : Add xt_rateest match
commit 2bc64ffb3599d4dd8bb3e9bc9b98e07d404c5b3e
Author: Patrick McHardy <[email protected]> Date: Sun Nov 25 17:20:18 2007 +0100
[NETFILTER]: Add xt_rateest match
Signed-off-by Patrick McHardy <[email protected]>
include/linux/netfilter/Kbuild +1 -0
@@ -29,6 +29,7 @@ header-y += xt_mark.h header-y += xt_multiport.h header-y += xt_pkttype.h header-y += xt_policy.h +header-y += xt_rateest.h header-y += xt_realm.h header-y += xt_sctp.h header-y += xt_state.h
include/linux/netfilter/xt_rateest.h new file +33 -0
@@ -0,0 +1,33 @@ +#ifndef _XT_RATEEST_MATCH_H +#define _XT_RATEEST_MATCH_H + +enum xt_rateest_match_flags { +XT_RATEEST_MATCH_INVERT =0x01 , +XT_RATEEST_MATCH_ABS =0x02 , +XT_RATEEST_MATCH_REL =0x04 , +XT_RATEEST_MATCH_DELTA =0x08 , +XT_RATEEST_MATCH_BPS =0x10 , +XT_RATEEST_MATCH_PPS =0x20 , +}; + +enum xt_rateest_match_mode { +XT_RATEEST_MATCH_NONE , +XT_RATEEST_MATCH_EQ , +XT_RATEEST_MATCH_LT , +XT_RATEEST_MATCH_GT , +}; + +struct xt_rateest_match_info { +char name1[IFNAMSIZ ]; +char name2[IFNAMSIZ ]; +u_int16_t flags; +u_int16_t mode; +u_int32_t bps1; +u_int32_t pps1; +u_int32_t bps2; +u_int32_t pps2; +struct xt_rateest *est1 __attribute__((aligned (8 ))); +struct xt_rateest *est2 __attribute__((aligned (8 ))); +}; + +#endif /* _XT_RATEEST_MATCH_H */
net/netfilter/Kconfig +10 -0
@@ -607,6 +607,16 @@ config NETFILTER_XT_MATCH_QUOTA If you want to compile it as a module, say M here and read <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. +config NETFILTER_XT_MATCH_RATEEST + tristate '"rateest" match support' + depends on NETFILTER_XTABLES + select NETFILTER_XT_TARGET_RATEEST + help + This option adds a `rateest' match, which allows to match on the + rate estimated by the RATEEST target. + + To compile it as a module, choose M here. If unsure, say N. + config NETFILTER_XT_MATCH_REALM tristate '"realm" match support' depends on NETFILTER_XTABLES
net/netfilter/Makefile +1 -0
@@ -71,6 +71,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o +obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
net/netfilter/xt_rateest.c new file +182 -0
182 lines not on this page · raw message
Quoted 11 lines · Patrick McHardy
Date: Sun, 25 Nov 2007 18:11:48 +0100
From: Patrick McHardy <[email protected]>
To: Netfilter Development Mailinglist <[email protected]>
Subject: [RFC NETFILTER 2/4]: Addxt_rateestmatchindex 0000000..e4e0653
include/linux/netfilter/xt_rateest.h new file +1
-0@@ -0,0 +1,33 @@ +#ifndef _XT_RATEEST_MATCH_H
include/linux/netfilter/xt_rateest.h line 11
Quoted 10 lines
include/linux/netfilter/xt_rateest.h new file +10
-0+#define _XT_RATEEST_MATCH_H + +enum xt_rateest_match_flags { +XT_RATEEST_MATCH_INVERT =0x01 , +XT_RATEEST_MATCH_ABS =0x02 , +XT_RATEEST_MATCH_REL =0x04 , +XT_RATEEST_MATCH_DELTA =0x08 , +XT_RATEEST_MATCH_BPS =0x10 , +XT_RATEEST_MATCH_PPS =0x20 , +};
Perhaps 1<<0, 1<<1, 1<<2, ...?
Quoted 6 lines
include/linux/netfilter/xt_rateest.h new file +6
-0+spin_lock_bh (&info->est1->lock); + rstats = &info->est1->rstats; +if (info->flags &XT_RATEEST_MATCH_DELTA ) { + bps1 = info->bps1 >= rstats->bps ? + info->bps1 - rstats->bps :0 ; + pps1 = info->pps1 >= rstats->pps ?
include/linux/netfilter/xt_rateest.h line 27
Quoted 10 lines
include/linux/netfilter/xt_rateest.h new file +10
-0+ info->pps1 - rstats->pps : 0; + }else { + bps1 = rstats->bps; + pps1 = rstats->pps; + } +spin_unlock_bh (&info->est1->lock); + +if (info->flags &XT_RATEEST_MATCH_ABS ) { + bps2 = info->bps2; + pps2 = info->pps2;
I think you can cut down on the extra whitespace around = here, it already lines up nicely anyway.
Quoted 29 lines
include/linux/netfilter/xt_rateest.h new file +29
-0+ }else { +spin_lock_bh (&info->est2->lock); + rstats = &info->est2->rstats; +if (info->flags &XT_RATEEST_MATCH_DELTA ) { + bps2 = info->bps2 >= rstats->bps ? + info->bps2 - rstats->bps :0 ; + pps2 = info->pps2 >= rstats->pps ? + info->pps2 - rstats->pps :0 ; + }else { + bps2 = rstats->bps; + pps2 = rstats->pps; + } +spin_unlock_bh (&info->est2->lock); + } + +switch (info->mode) { +case XT_RATEEST_MATCH_LT : +if (info->flags &XT_RATEEST_MATCH_BPS ) + ret &= bps1 < bps2; +if (info->flags &XT_RATEEST_MATCH_PPS ) + ret &= pps1 < pps2; +break ; +case XT_RATEEST_MATCH_GT : +if (info->flags &XT_RATEEST_MATCH_BPS ) + ret &= bps1 > bps2; +if (info->flags &XT_RATEEST_MATCH_PPS ) + ret &= pps1 > pps2; +break ; +case XT_RATEEST_MATCH_EQ :
include/linux/netfilter/xt_rateest.h
Quoted 10 lines
include/linux/netfilter/xt_rateest.h new file +10
-0+if (info->flags &XT_RATEEST_MATCH_BPS ) + ret &= bps1 == bps2; +if (info->flags &XT_RATEEST_MATCH_PPS ) + ret &= pps2 == pps2; +break ; + } + + ret ^= info->flags &XT_RATEEST_MATCH_INVERT ? true : false; +return ret; +}
return ret ^ !!(info->flags & XT_RATEEST_MATCH_INVERT);
Quoted 17 lines · Jan Engelhardt
Quoted 15 lines · Patrick McHardy
Date: Sun, 25 Nov 2007 18:11:48 +0100
From: Patrick McHardy <[email protected]>
To: Netfilter Development Mailinglist <[email protected]>
Subject: [RFC NETFILTER 2/4]: Addxt_rateestmatchindex 0000000..e4e0653
include/linux/netfilter/xt_rateest.h new file +5
-0@@ -0,0 +1,33 @@ +#ifndef _XT_RATEEST_MATCH_H +#define _XT_RATEEST_MATCH_H + +enum xt_rateest_match_flags { + XT_RATEEST_MATCH_INVERT = 0x01,
Quoted 8 lines
include/linux/netfilter/xt_rateest.h line 11
Quoted 6 lines
include/linux/netfilter/xt_rateest.h new file +6
-0+XT_RATEEST_MATCH_ABS =0x02 , +XT_RATEEST_MATCH_REL =0x04 , +XT_RATEEST_MATCH_DELTA =0x08 , +XT_RATEEST_MATCH_BPS =0x10 , + XT_RATEEST_MATCH_PPS = 0x20, +};Perhaps 1<<0, 1<<1, 1<<2, ...?
I don't really care, so why not :)
Quoted 11 lines
Quoted 11 lines
include/linux/netfilter/xt_rateest.h new file +11
-0+spin_lock_bh (&info->est1->lock); + rstats = &info->est1->rstats; +if (info->flags &XT_RATEEST_MATCH_DELTA ) { + bps1 = info->bps1 >= rstats->bps ? + info->bps1 - rstats->bps :0 ; + pps1 = info->pps1 >= rstats->pps ? + info->pps1 - rstats->pps :0 ; + }else { + bps1 = rstats->bps; + pps1 = rstats->pps; + }
Quoted 8 lines
include/linux/netfilter/xt_rateest.h line 27
Quoted 5 lines
include/linux/netfilter/xt_rateest.h new file +5
-0+spin_unlock_bh (&info->est1->lock); + +if (info->flags &XT_RATEEST_MATCH_ABS ) { + bps2 = info->bps2; + pps2 = info->pps2;I think you can cut down on the extra whitespace around = here, it already lines up nicely anyway.
True, that needs some reformatting anyway, especially the ? .. : .. looks weird.
Quoted 20 lines · Patrick McHardy
Quoted 11 lines
Quoted 11 lines
net/netfilter/xt_rateest.c new file +11
-0+spin_lock_bh (&info->est1->lock); + rstats = &info->est1->rstats; +if (info->flags &XT_RATEEST_MATCH_DELTA ) { + bps1 = info->bps1 >= rstats->bps ? + info->bps1 - rstats->bps :0 ; + pps1 = info->pps1 >= rstats->pps ? + info->pps1 - rstats->pps :0 ; + }else { + bps1 = rstats->bps; + pps1 = rstats->pps; + }Quoted 8 lines
net/netfilter/xt_rateest.c line 46
Quoted 5 lines
net/netfilter/xt_rateest.c new file +5
-0+spin_unlock_bh (&info->est1->lock); + +if (info->flags &XT_RATEEST_MATCH_ABS ) { + bps2 = info->bps2; + pps2 = info->pps2;I think you can cut down on the extra whitespace around = here, it already lines up nicely anyway.
Quoted 3 lines
True, that needs some reformatting anyway, especially the ? .. : .. looks weird.
Try moving the assign-zero out of the if;
Or maybe it is already zero.
rstats = &info->est1->rstat;
bps1 = 0;
pps1 = 0;
if (delta) {
if (info->bps1 >= rstats->bps)
bps1 = info->bps1 - rstats->bps;
if (info->pps1 >= rstats->pps)
pps1 = info->pps1 - rstats->pps;
} else ...