netfilter: connlimit: split xt_connlimit into front/backend
Subsystems (2)
Florian Westphal
maintainerPATCH 1/1 netfilter: connlimit: split xt_connlimit into front/backend
This allows to reuse xt_connlimit infrastructure from nf_tables.
The upcoming nf_tables frontend can just pass in an nftables register as input key, this allows limiting by arbitrary keys via concatenations.
For xt_connlimit, pass in the zone and the ip/ipv6 address as key to keep same behaviour.
Signed-off-by Florian Westphal <[email protected]>
--- include/net/netfilter/nf_conntrack_count.h | 13 + include/uapi/linux/netfilter/xt_connlimit.h | 2 +- net/netfilter/Kconfig | 3 + net/netfilter/Makefile | 2 + net/netfilter/nf_conncount.c | 368 ++++++++++++++++++++++++++++ net/netfilter/xt_connlimit.c | 367 ++------------------------- 6 files changed, 411 insertions(+), 344 deletions(-) create mode 100644 include/net/netfilter/nf_conntrack_count.h create mode 100644 net/netfilter/nf_conncount.c
include/net/netfilter/nf_conntrack_count.h new file +13 -0
@@ -0,0 +1,13 @@ +struct nf_conncount_data ; + +struct nf_conncount_data *nf_conncount_init (struct net *net,unsigned int family, +unsigned int keylen); +void nf_conncount_destroy (struct net *net,unsigned int family, +struct nf_conncount_data *data); + +unsigned int nf_conncount_count (struct net *net, +struct nf_conncount_data *data, +const u32 *key, +unsigned int family, +const struct nf_conntrack_tuple *tuple, +const struct nf_conntrack_zone *zone);
include/uapi/linux/netfilter/xt_connlimit.h +1 -1
@@ -27,7 +27,7 @@ struct xt_connlimit_info {__u32 flags;/* Used internally by the kernel */ - struct xt_connlimit_data *data __attribute__((aligned(8))); + struct nf_conncount_data *data __attribute__((aligned(8))); };#endif /* _XT_CONNLIMIT_H */
net/netfilter/Kconfig +3 -0
@@ -62,6 +62,8 @@ config NF_LOG_NETDEV select NF_LOG_COMMON if NF_CONNTRACK +config NETFILTER_CONNCOUNT + tristate config NF_CONNTRACK_MARK bool 'Connection mark tracking support'
@@ -1120,6 +1122,7 @@ config NETFILTER_XT_MATCH_CONNLIMIT tristate '"connlimit" match support' depends on NF_CONNTRACK depends on NETFILTER_ADVANCED + select NETFILTER_CONNCOUNT ---help--- This match allows you to match against the number of parallel connections to a server per client IP address (or address block).
net/netfilter/Makefile +2 -0
@@ -67,6 +67,8 @@ obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o # SYNPROXY obj-$(CONFIG_NETFILTER_SYNPROXY) += nf_synproxy_core.o +obj-$(CONFIG_NETFILTER_CONNCOUNT) += nf_conncount.o + # generic packet duplication from netdev family obj-$(CONFIG_NF_DUP_NETDEV) += nf_dup_netdev.o
net/netfilter/nf_conncount.c new file +368 -0
368 lines not on this page · raw message
net/netfilter/xt_connlimit.c +24 -343
445 lines not on this page · raw message
Signature · 1 line
2.13.6
kbuild test robot
build botI love your patch! Yet something to improve:
Hi Florian,
I love your patch! Yet something to improve:
[auto build test ERROR on nf-next/master]
url: https://github.com/0day-ci/linux/commits/Florian-Westphal/netfilter-connlimit-split-xt_connlimit-into-front-backend/20171204-122025 base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master config: x86_64-rhel (attached as .config) compiler: gcc-7 (Debian 7.2.0-12) 7.2.1 20171025 reproduce: # save the attached .config to linux build tree make ARCH=x86_64
All errors (new ones prefixed by >>):
>> ERROR: "nf_conncount_count" [net/netfilter/xt_connlimit.ko] undefined! >> ERROR: "nf_conncount_init" [net/netfilter/xt_connlimit.ko] undefined! >> ERROR: "nf_conncount_destroy" [net/netfilter/xt_connlimit.ko] undefined!
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation