connrate for patch-o-matic-ng
PATCH 1/1 connrate for patch-o-matic-ng
Here is the next revision for the connrate patch I've been sending here occasionally.
Notable changes in the patch:
* Conversion to patch-o-matic-ng for the kernel part.
* Trivial guard against jiffies wrap.
* Reworked libipt_connrate part, now cleaner and more consistent.
* Man snippet for libipt_connrate.
Right now I don't have any pending issues on these patches - they are more or less ready. I might tweak the documentation or some other little things later on after it has matured a bit in actual use. A couple questions have arisen though.
Is there any way to specify *where* the Kconfig snippets are added? The other option the patch adds should be added below connection tracking and not modules. Should I include that part in the patch.linux part, or is there a better way?
There's way too many places where to put documentation. Source files, header files, kernel configure help, iptables connrate module help option, iptables connrate man snippet, patch-o-matic-ng help text. Where should the definitive documentation, with examples and all be placed for the match?
And just to be sure - adding a snippet to iptables man page doesn't require anything more than the libipt_connrate.man file? Again, it is hard for me to test properly with the debian package.
So, reviews and comments would be very welcome on this version.
-- Naked
Index: connrate/help
===================================================================
RCS file: connrate/help
help new file +34 -0
@@ -0,0 +1,34 @@ +The connrate match is used to match against the current transfer speed of a +connection. The algorithm averages transferred bytes over a time sliding window +of constant size. The maximum and minimum rates measurable are explained in the +code, along the algorithm used in the measurements. + +This match can easily be used to reclassify connections based on their current +transfer rate, but is not meant for directly dropping packets, because packet +drops affect the rate being estimated. + +The transfer rate per connection can also be viewed through +/proc/net/ip_conntrack. + +Usage: +--connrate [!] [FROM]:[TO] + +will match packet from a connection which is currently transferring more than +FROM bytes per second and less than TO byte per second. 'inf' can be used to +signify largest measurable transfer rate. If FROM is omitted, it defaults to +zero. If TO is omitted, it defaults to infinity. "!" is used to match packets +not falling in the range. + +Example: + +iptables .. -m connrate --connrate 10000:100000 ... + + => match packets in connections transferring faster than 10kbps, but slower + than 100kbps. + +iptables .. -m tos --tos Minimize-Delay \ + -m connrate --connrate 20000:inf \ + -j TOS --set-tos Maximize-Throughput + + => match packets in minimize-delay TOS connections that are transferring + faster than 20kbps and change their tos to maximize-throughput instead.
Index: connrate/info
===================================================================
RCS file: connrate/info
info new file +4 -0
@@ -0,0 +1,4 @@ +Author: Nuutti Kotivuori <[email protected]> +Status: Working, but received only minimal testing +Repository: extra +Requires: linux >= 2.6.0
Index: connrate/linux.patch
===================================================================
RCS file: connrate/linux.patch
linux.patch new file +54 -0
54 lines not on this page · raw message
Index: connrate/linux/include/linux/netfilter_ipv4/ip_conntrack_rate.h
===================================================================
RCS file: connrate/linux/include/linux/netfilter_ipv4/ip_conntrack_rate.h
linux/include/linux/netfilter_ipv4/ip_conntrack_rate.h new file +33 -0
@@ -0,0 +1,33 @@ +#ifndef _IP_CONNTRACK_RATE_H +#define _IP_CONNTRACK_RATE_H + +/* estimation interval, in jiffies */ +#define IP_CONNTRACK_RATE_INTERVAL (3 * HZ) + +/* scale on how many tokens per byte to generate */ +#define IP_CONNTRACK_RATE_SCALE 100 + +/* per conntrack: transfer rate in connection */ +struct ip_conntrack_rate { +/* jiffies of previous received packet */ +unsigned long prev; +/* average rate of tokens per jiffy */ +u_int32_t avgrate; +}; + +#ifdef __KERNEL__ + +/* Count a packet of len into given rate structure. */ +extern void +ip_conntrack_rate_count (struct ip_conntrack_rate *ctr, +unsigned int len); + +/* Return current rate as bytes per second. Note that the returned +rate is the rate at last received packet, not counting time has +that passed after it. */ +extern u_int32_t +ip_conntrack_rate_get (struct ip_conntrack_rate *ctr); + +#endif /* __KERNEL__ */ + +#endif /* _IP_CONNTRACK_RATE_H */
Index: connrate/linux/include/linux/netfilter_ipv4/ipt_connrate.h
===================================================================
RCS file: connrate/linux/include/linux/netfilter_ipv4/ipt_connrate.h
linux/include/linux/netfilter_ipv4/ipt_connrate.h new file +12 -0
@@ -0,0 +1,12 @@ +#ifndef _IPT_CONNRATE_H +#define _IPT_CONNRATE_H + +struct ipt_connrate_info +{ +/* Per connection transfer rate, in bytes per second. If +'from' is smaller or equal to 'to', rate is matched to be +inside the inclusive range [from,to], otherwise rate is +matched to be outside the inclusive range [to,from]. */ +u_int32_t from, to; +}; +#endif
Index: connrate/linux/net/ipv4/netfilter/Kconfig.ladd
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/Kconfig.ladd
linux/net/ipv4/netfilter/Kconfig.ladd new file +28 -0
@@ -0,0 +1,28 @@ +config IP_NF_CONNTRACK_RATE + bool "Connection rate estimation" + depends on IP_NF_CONNTRACK + help + + This enables per connection transfer rate estimation in connection + tracking code. This enlarges the amount of memory required by each + connection tracked a bit and adds the overhead of calculating the + transmission rate on every received packet. + + This is required to be able to match on the per connection transfer + rate, and can be a nice statistic to see in the connection tracking + table, but is useless otherwise. + + If unsure, say N. + +config IP_NF_MATCH_CONNRATE + tristate "Connection rate match support" + depends on IP_NF_CONNTRACK_RATE && IP_NF_CONNTRACK && IP_NF_IPTABLES + help + This allows matching on the transfer rate on a per connection basis. + + Connection transfer rate estimation is performed separately by the + connection tracking code and is unaffected by the presence of matches + on it. Several connection rate matches may match a single packet and + every match will see the same rate. + + To compile it as a module, choose M here. If unsure, say N.
Index: connrate/linux/net/ipv4/netfilter/Makefile.ladd
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/Makefile.ladd
linux/net/ipv4/netfilter/Makefile.ladd new file +2 -0
@@ -0,0 +1,2 @@ +obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o +obj-$(CONFIG_IP_NF_CONNTRACK_RATE) += ip_conntrack_rate.o
Index: connrate/linux/net/ipv4/netfilter/Makefile.ladd_2
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/Makefile.ladd_2
linux/net/ipv4/netfilter/Makefile.ladd_2 new file +2 -0
@@ -0,0 +1,2 @@ +obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o +obj-$(CONFIG_IP_NF_MATCH_CONNRATE) += ipt_connrate.o
Index: connrate/linux/net/ipv4/netfilter/ip_conntrack_rate.c
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/ip_conntrack_rate.c
linux/net/ipv4/netfilter/ip_conntrack_rate.c new file +128 -0
128 lines not on this page · raw message
Index: connrate/linux/net/ipv4/netfilter/ipt_connrate.c
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/ipt_connrate.c
linux/net/ipv4/netfilter/ipt_connrate.c new file +70 -0
70 lines not on this page · raw message
Index: extensions/.connrate-test
===================================================================
RCS file: extensions/.connrate-test
.connrate-test new file +2 -0
@@ -0,0 +1,2 @@ +#! /bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_connrate.h ] && echo connrate
Index: extensions/libipt_connrate.c
===================================================================
RCS file: extensions/libipt_connrate.c
libipt_connrate.c new file +182 -0
182 lines not on this page · raw message
Index: extensions/libipt_connrate.man
===================================================================
RCS file: extensions/libipt_connrate.man
libipt_connrate.man new file +6 -0
@@ -0,0 +1,6 @@ +This module matches the current transfer rate in a connection. +.TP +.BI "--connrate " "[!] [\fIfrom\fP]:[\fIto\fP]" +Match against the current connection transfer rate being within 'from' +and 'to' bytes per second. When the "!" argument is used before the +range, the sense of the match is inverted.
Quoted 2 lines · Nuutti Kotivuori
Here is the next revision for the connrate patch I've been sending here occasionally.
Sorry, I've been too busy lately :(
Due to recent events
[http://www.netfilter.org/news/2004-03-02-fsc-gpl.html and others] we would ask you to explicitly include a GPL disclaimer in the header of all your .c files.
Please then re-submit to this list (and add me as Cc, this way I won't miss it).
Thanks for your patience
Signature · 5 lines
- Harald Welte <[email protected]> http://www.netfilter.org/ ============================================================================ "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie
Quoted 4 lines · Harald Welte
Due to recent events
[http://www.netfilter.org/news/2004-03-02-fsc-gpl.html and others] we would ask you to explicitly include a GPL disclaimer in the header of all your .c files.
Fair enough. I have now done so.
Quoted 2 lines
Please then re-submit to this list (and add me as Cc, this way I won't miss it).
Here they are again.
Quoted 1 line
Thanks for your patience
No worries. I am not a hasty man. Why, I have been expecting a reply from Patrick McHardy that was coming tomorrow for a couple weeks already ;-)
Thanks,
-- Naked
Index: connrate/help
===================================================================
RCS file: connrate/help
help new file +34 -0
@@ -0,0 +1,34 @@ +The connrate match is used to match against the current transfer speed of a +connection. The algorithm averages transferred bytes over a time sliding window +of constant size. The maximum and minimum rates measurable are explained in the +code, along the algorithm used in the measurements. + +This match can easily be used to reclassify connections based on their current +transfer rate, but is not meant for directly dropping packets, because packet +drops affect the rate being estimated. + +The transfer rate per connection can also be viewed through +/proc/net/ip_conntrack. + +Usage: +--connrate [!] [FROM]:[TO] + +will match packet from a connection which is currently transferring more than +FROM bytes per second and less than TO byte per second. 'inf' can be used to +signify largest measurable transfer rate. If FROM is omitted, it defaults to +zero. If TO is omitted, it defaults to infinity. "!" is used to match packets +not falling in the range. + +Example: + +iptables .. -m connrate --connrate 10000:100000 ... + + => match packets in connections transferring faster than 10kbps, but slower + than 100kbps. + +iptables .. -m tos --tos Minimize-Delay \ + -m connrate --connrate 20000:inf \ + -j TOS --set-tos Maximize-Throughput + + => match packets in minimize-delay TOS connections that are transferring + faster than 20kbps and change their tos to maximize-throughput instead.
Index: connrate/info
===================================================================
RCS file: connrate/info
info new file +4 -0
@@ -0,0 +1,4 @@ +Author: Nuutti Kotivuori <[email protected]> +Status: Working, but received only minimal testing +Repository: extra +Requires: linux >= 2.6.0
Index: connrate/linux.patch
===================================================================
RCS file: connrate/linux.patch
linux.patch new file +54 -0
54 lines not on this page · raw message
Index: connrate/linux/include/linux/netfilter_ipv4/ip_conntrack_rate.h
===================================================================
RCS file: connrate/linux/include/linux/netfilter_ipv4/ip_conntrack_rate.h
linux/include/linux/netfilter_ipv4/ip_conntrack_rate.h new file +33 -0
@@ -0,0 +1,33 @@ +#ifndef _IP_CONNTRACK_RATE_H +#define _IP_CONNTRACK_RATE_H + +/* estimation interval, in jiffies */ +#define IP_CONNTRACK_RATE_INTERVAL (3 * HZ) + +/* scale on how many tokens per byte to generate */ +#define IP_CONNTRACK_RATE_SCALE 100 + +/* per conntrack: transfer rate in connection */ +struct ip_conntrack_rate { +/* jiffies of previous received packet */ +unsigned long prev; +/* average rate of tokens per jiffy */ +u_int32_t avgrate; +}; + +#ifdef __KERNEL__ + +/* Count a packet of len into given rate structure. */ +extern void +ip_conntrack_rate_count (struct ip_conntrack_rate *ctr, +unsigned int len); + +/* Return current rate as bytes per second. Note that the returned +rate is the rate at last received packet, not counting time has +that passed after it. */ +extern u_int32_t +ip_conntrack_rate_get (struct ip_conntrack_rate *ctr); + +#endif /* __KERNEL__ */ + +#endif /* _IP_CONNTRACK_RATE_H */
Index: connrate/linux/include/linux/netfilter_ipv4/ipt_connrate.h
===================================================================
RCS file: connrate/linux/include/linux/netfilter_ipv4/ipt_connrate.h
linux/include/linux/netfilter_ipv4/ipt_connrate.h new file +12 -0
@@ -0,0 +1,12 @@ +#ifndef _IPT_CONNRATE_H +#define _IPT_CONNRATE_H + +struct ipt_connrate_info +{ +/* Per connection transfer rate, in bytes per second. If +'from' is smaller or equal to 'to', rate is matched to be +inside the inclusive range [from,to], otherwise rate is +matched to be outside the inclusive range [to,from]. */ +u_int32_t from, to; +}; +#endif
Index: connrate/linux/net/ipv4/netfilter/Kconfig.ladd
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/Kconfig.ladd
linux/net/ipv4/netfilter/Kconfig.ladd new file +28 -0
@@ -0,0 +1,28 @@ +config IP_NF_CONNTRACK_RATE + bool "Connection rate estimation" + depends on IP_NF_CONNTRACK + help + + This enables per connection transfer rate estimation in connection + tracking code. This enlarges the amount of memory required by each + connection tracked a bit and adds the overhead of calculating the + transmission rate on every received packet. + + This is required to be able to match on the per connection transfer + rate, and can be a nice statistic to see in the connection tracking + table, but is useless otherwise. + + If unsure, say N. + +config IP_NF_MATCH_CONNRATE + tristate "Connection rate match support" + depends on IP_NF_CONNTRACK_RATE && IP_NF_CONNTRACK && IP_NF_IPTABLES + help + This allows matching on the transfer rate on a per connection basis. + + Connection transfer rate estimation is performed separately by the + connection tracking code and is unaffected by the presence of matches + on it. Several connection rate matches may match a single packet and + every match will see the same rate. + + To compile it as a module, choose M here. If unsure, say N.
Index: connrate/linux/net/ipv4/netfilter/Makefile.ladd
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/Makefile.ladd
linux/net/ipv4/netfilter/Makefile.ladd new file +2 -0
@@ -0,0 +1,2 @@ +obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o +obj-$(CONFIG_IP_NF_CONNTRACK_RATE) += ip_conntrack_rate.o
Index: connrate/linux/net/ipv4/netfilter/Makefile.ladd_2
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/Makefile.ladd_2
linux/net/ipv4/netfilter/Makefile.ladd_2 new file +2 -0
@@ -0,0 +1,2 @@ +obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o +obj-$(CONFIG_IP_NF_MATCH_CONNRATE) += ipt_connrate.o
Index: connrate/linux/net/ipv4/netfilter/ip_conntrack_rate.c
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/ip_conntrack_rate.c
linux/net/ipv4/netfilter/ip_conntrack_rate.c new file +131 -0
131 lines not on this page · raw message
Index: connrate/linux/net/ipv4/netfilter/ipt_connrate.c
===================================================================
RCS file: connrate/linux/net/ipv4/netfilter/ipt_connrate.c
linux/net/ipv4/netfilter/ipt_connrate.c new file +74 -0
74 lines not on this page · raw message
Index: extensions/.connrate-test
===================================================================
RCS file: extensions/.connrate-test
.connrate-test new file +2 -0
@@ -0,0 +1,2 @@ +#! /bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_connrate.h ] && echo connrate
Index: extensions/libipt_connrate.c
===================================================================
RCS file: extensions/libipt_connrate.c
libipt_connrate.c new file +189 -0
189 lines not on this page · raw message
Index: extensions/libipt_connrate.man
===================================================================
RCS file: extensions/libipt_connrate.man
libipt_connrate.man new file +6 -0
@@ -0,0 +1,6 @@ +This module matches the current transfer rate in a connection. +.TP +.BI "--connrate " "[!] [\fIfrom\fP]:[\fIto\fP]" +Match against the current connection transfer rate being within 'from' +and 'to' bytes per second. When the "!" argument is used before the +range, the sense of the match is inverted.
Quoted 3 lines · Nuutti Kotivuori
No worries. I am not a hasty man. Why, I have been expecting a reply from Patrick McHardy that was coming tomorrow for a couple weeks already ;-)
Sorry, I've been busy with private stuff lately (and, admittedly, I forgot). Expect a reply soon ;)
Regards
Patrick
Quoted 3 lines
Thanks,
-- Naked