Skip to contentSkip to conversation

: Add xt_rateest match

RFC In review Patrick McHardy 2 participants 2 messages Nov 25, 2007

Subsystems (2)
Kbuild netfilter
lore
Share & tools
lore

Patrick McHardy

author
#0 lore raw

RFC 4/4 : Add xt_rateest match

[IPTABLES]: Add xt_rateest match

Signed-off-by Patrick McHardy <[email protected]>
linux/netfilter/xt_rateest.h +33 -0
Index: include/linux/netfilter/xt_rateest.h
===================================================================
@@ -0,0 +1,33 @@
+#ifndef _XT_RATEEST_MATCH_H
+#define _XT_RATEEST_MATCH_H
+
+enum xt_rateest_match_flags {
+	XT_RATEEST_MATCH_INVERT	= 0x01,
+	XT_RATEEST_MATCH_ABS	= 0x02,
+	XT_RATEEST_MATCH_REL	= 0x04,
+	XT_RATEEST_MATCH_DELTA	= 0x08,
+	XT_RATEEST_MATCH_BPS	= 0x10,
+	XT_RATEEST_MATCH_PPS	= 0x20,
+};
+
+enum xt_rateest_match_mode {
+	XT_RATEEST_MATCH_NONE,
+	XT_RATEEST_MATCH_EQ,
+	XT_RATEEST_MATCH_LT,
+	XT_RATEEST_MATCH_GT,
+};
+
+struct xt_rateest_match_info {
+	char			name1[IFNAMSIZ];
+	char			name2[IFNAMSIZ];
+	u_int16_t		flags;
+	u_int16_t		mode;
+	u_int32_t		bps1;
+	u_int32_t		pps1;
+	u_int32_t		bps2;
+	u_int32_t		pps2;
+	struct xt_rateest	*est1 __attribute__((aligned(8)));
+	struct xt_rateest	*est2 __attribute__((aligned(8)));
+};
+
+#endif /* _XT_RATEEST_MATCH_H */
Makefile +1 -1
Index: extensions/Makefile
===================================================================
@@ -7,7 +7,7 @@
 #
 PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG
 PF6_EXT_SLIB:=ah dst eui64 frag hbh hl icmp6 ipv6header mh owner policy rt HL LOG REJECT
-PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK RATEEST TCPMSS TRACE
+PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota rateest sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK RATEEST TCPMSS TRACE
 
 PF_EXT_SELINUX_SLIB:=
 PF6_EXT_SELINUX_SLIB:=
libxt_rateest.c +461 -0

461 lines not on this page · raw message

#1 lore raw
Quoted 11 lines · Patrick McHardy

Date: Sun, 25 Nov 2007 18:12:00 +0100
From: Patrick McHardy <[email protected]>
To: Netfilter Development Mailinglist <[email protected]>
Subject: [RFC IPTABLES 4/4]: Add xt_rateest match

libxt_rateest.c +3 -0
+	printf(
+"rateest match v%s options:\n"
+" --rateest1 name		Rate estimator name\n"

libxt_rateest.c line 27

Quoted 10 lines
libxt_rateest.c +10 -0
+" --rateest2 name		Rate estimator name\n"
+" --rateest-delta		Compare difference(s) to given rate(s)\n"
+" --rateest-bps1 [bps]		Compare bps\n"
+" --rateest-pps1 [pps]		Compare pps\n"
+" --rateest-bps2 [bps]		Compare bps\n"
+" --rateest-pps2 [pps]		Compare pps\n"
+" [!] --rateest-lt		Match if rate is less than given rate/estimator\n"
+" [!] --rateest-gt		Match if rate is greater than given rate/estimator\n"
+" [!] --rateest-eq		Match if rate is equal to given rate/estimator\n"
+"\n",

This is bordering on the 80 column limit (esp --rateest-gt). I have been using 2 spaces at the front and 4 spaces in the center recently (try not to pull anything with tabs - see above), e.g.:

"rateest match v%s options:\n"

"  --rateest1 name         Rate estimator name\n"
"  --rateest2 name         Rate estimator name\n"
"  --rateest-delta         Compare difference(s) to given rate(s)\n"
"  --rateest-bps1 [bps]    Compare bps\n"
"  --rateest-pps1 [pps]    Compare pps\n"
"  --rateest-bps2 [bps]    Compare bps\n"
"  --rateest-pps2 [pps]    Compare pps\n"
"  [!] --rateest-lt        Match if rate is less than given rate/estimator\n"
"  [!] --rateest-gt        Match if rate is greater than given rate/estimator\n"
"  [!] --rateest-eq        Match if rate is equal to given rate/estimator\n"

"\n",

libxt_rateest.c line 66

Quoted 6 lines
libxt_rateest.c +6 -0
+/* Copied from iproute. See http://physics.nist.gov/cuu/Units/binary.html */
+static const struct rate_suffix {
+	const char *name;
+	double scale;
+} suffixes[] = {
+	{ "bit",	1. },

You do not need the dots on the lower ones :)

Quoted 6 lines
libxt_rateest.c +6 -0
+	{ "TBps",	8000000000000. },
+	{ }
+};
+
+static int
+rateest_get_rate(u_int32_t *rate, const char *str)

libxt_rateest.c line 98

Quoted 10 lines
libxt_rateest.c +10 -0
+{
+	char *p;
+	double bps = strtod(str, &p);
+	const struct rate_suffix *s;
+
+	if (p == str)
+		return -1;
+
+	if (*p == '\0') {
+		*rate = bps / 8.;	/* assume bytes/sec */

LHS is already double, dot won't change it.

libxt_rateest.c line 104

Quoted 6 lines
libxt_rateest.c +6 -0
+		return 0;
+	}
+
+	for (s = suffixes; s->name; ++s) {
+		if (strcasecmp(s->name, p) == 0) {
+			*rate = (bps * s->scale) / 8.;

-()

libxt_rateest.c line 106

Quoted 3 lines
libxt_rateest.c +3 -0
+			return 0;
+		}
+	}

-{}

libxt_rateest.c line 347

Quoted 3 lines
libxt_rateest.c +3 -0
+		break;
+	default:
+		exit(1);

I'd use abort() if it is a can-never-happen case,
or just leave it out completely. Or there is something behind it.

Interesting module.