ipt_connrate: round two.
Subsystems (2)
PATCH 1/1 ipt_connrate: round two.
So, I have reworked my patch based on the suggestions received on the list. Notable changes are:
* RWLOCK for conntrack->rate structures.
* 'unsigned long' to 'u_int32_t' in 'from' and 'to' values.
* Proper .connrate-test file.
With the CVS being down right at this moment, I wasn't able to fetch the latest patch-o-matic-ng to build these patches against it. I will do so with the next iteration.
The first patch is against the 2.6.3 kernel on this round but should apply against any 2.6.x - and the second is still built against the debian iptables version, but should apply against any most iptables versions.
With this iteration I hope to get the kernel parts more or less finalized. And with the next iteration, I hope to make this a patch against patch-o-matic-ng and rewrite the libipt_connrate.c file to be much cleaner and more in line with the extensions in the mainline iptables.
Any feedback is greatly appreciated.
-- Naked
include/linux/netfilter_ipv4/ip_conntrack.h +8 -0
@@ -98,6 +98,10 @@ union ip_conntrack_nat_help { };#endif +#ifdef CONFIG_IP_NF_CONNTRACK_RATE +#include <linux/netfilter_ipv4/ip_conntrack_rate.h> +#endif +#ifdef __KERNEL__#include <linux/types.h>
@@ -206,6 +210,10 @@ struct ip_conntrack } nat;#endif /* CONFIG_IP_NF_NAT_NEEDED */ +#ifdef CONFIG_IP_NF_CONNTRACK_RATE +struct ip_conntrack_rate rate; +#endif + };/* get master conntrack via master expectation */
include/linux/netfilter_ipv4/ip_conntrack_rate.h +33 -0
@@ -0,0 +1,33 @@ +#ifndef _IP_CONNTRACK_RATE_H +#define _IP_CONNTRACK_RATE_H + +/* estimation interval, in jiffies */ +#define IP_CONNTRACK_RATE_INTERVAL (3 * HZ) + +/* scale on how many tokens per byte to generate */ +#define IP_CONNTRACK_RATE_SCALE 100 + +/* per conntrack: transfer rate in connection */ +struct ip_conntrack_rate { +/* jiffies of previous received packet */ +unsigned long prev; +/* average rate of tokens per jiffy */ +u_int32_t avgrate; +}; + +#ifdef __KERNEL__ + +/* Count a packet of len into given rate structure. */ +extern void +ip_conntrack_rate_count (struct ip_conntrack_rate *ctr, +unsigned int len); + +/* Return current rate as bytes per second. Note that the returned +rate is the rate at last received packet, not counting time has +that passed after it. */ +extern u_int32_t +ip_conntrack_rate_get (struct ip_conntrack_rate *ctr); + +#endif /* __KERNEL__ */ + +#endif /* _IP_CONNTRACK_RATE_H */
include/linux/netfilter_ipv4/ipt_connrate.h +12 -0
@@ -0,0 +1,12 @@ +#ifndef _IPT_CONNRATE_H +#define _IPT_CONNRATE_H + +struct ipt_connrate_info +{ +/* Per connection transfer rate, in bytes per second. If +'from' is smaller or equal to 'to', rate is matched to be +inside the inclusive range [from,to], otherwise rate is +matched to be outside the inclusive range [to,from]. */ +u_int32_t from, to; +}; +#endif
net/ipv4/netfilter/Kconfig +29 -0
@@ -19,6 +19,22 @@ config IP_NF_CONNTRACK To compile it as a module, choose M here. If unsure, say N. +config IP_NF_CONNTRACK_RATE + bool "Connection rate estimation" + depends on IP_NF_CONNTRACK + help + + This enables per connection transfer rate estimation in connection + tracking code. This enlarges the amount of memory required by each + connection tracked a bit and adds the overhead of calculating the + transmission rate on every received packet. + + This is required to be able to match on the per connection transfer + rate, and can be a nice statistic to see in the connection tracking + table, but is useless otherwise. + + If unsure, say N. + config IP_NF_FTP tristate "FTP protocol support" depends on IP_NF_CONNTRACK
@@ -256,6 +272,19 @@ config IP_NF_MATCH_CONNTRACK To compile it as a module, choose M here. If unsure, say N. +config IP_NF_MATCH_CONNRATE + tristate "Connection rate match support" + depends on IP_NF_CONNTRACK_RATE && IP_NF_CONNTRACK && IP_NF_IPTABLES + help + This allows matching on the transfer rate on a per connection basis. + + Connection transfer rate estimation is performed separately by the + connection tracking code and is unaffected by the presence of matches + on it. Several connection rate matches may match a single packet and + every match will see the same rate. + + To compile it as a module, choose M here. If unsure, say N. + config IP_NF_MATCH_OWNER tristate "Owner match support" depends on IP_NF_IPTABLES
net/ipv4/netfilter/Makefile +2 -0
@@ -18,6 +18,7 @@ ipchains-objs := $(ip_nf_compat-objs) i # connection tracking obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o +obj-$(CONFIG_IP_NF_CONNTRACK_RATE) += ip_conntrack_rate.o # connection tracking helpers obj-$(CONFIG_IP_NF_AMANDA) += ip_conntrack_amanda.o
@@ -62,6 +63,7 @@ obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_ obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o +obj-$(CONFIG_IP_NF_MATCH_CONNRATE) += ipt_connrate.o obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
net/ipv4/netfilter/ip_conntrack_core.c +5 -0
@@ -778,6 +778,11 @@ resolve_normal_ct(struct sk_buff *skb, *set_reply =0 ; } skb->nfct = &h->ctrack->infos[*ctinfo]; + +#ifdef CONFIG_IP_NF_CONNTRACK_RATE +ip_conntrack_rate_count (&h->ctrack->rate, skb->len); +#endif +return h->ctrack; }
net/ipv4/netfilter/ip_conntrack_rate.c +127 -0
127 lines not on this page · raw message
net/ipv4/netfilter/ip_conntrack_standalone.c +4 -0
@@ -110,6 +110,10 @@ print_conntrack(char *buffer, struct ip_ len +=sprintf (buffer + len,"[ASSURED] " ); len +=sprintf (buffer + len,"use=%u " ,atomic_read (&conntrack->ct_general.use)); +#ifdef CONFIG_IP_NF_CONNTRACK_RATE + len +=sprintf (buffer + len,"rate=%u " , +ip_conntrack_rate_get (&conntrack->rate)); +#endif len +=sprintf (buffer + len,"\n" );return len;
net/ipv4/netfilter/ipt_connrate.c +70 -0
70 lines not on this page · raw message
extensions/.connrate-test renamed from ../debian.old/build/iptables-1.2.9/extensions/.connrate-test +2 -0
@@ -0,0 +1,2 @@ +#! /bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_connrate.h ] && echo connrate
extensions/libipt_connrate.c renamed from ../debian.old/build/iptables-1.2.9/extensions/libipt_connrate.c +135 -0
135 lines not on this page · raw message