netfilter: nft_limit: add burst parameter
This patch adds the burst parameter. This burst indicates the number of packets that can exceed the limit. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
f8d3a6bc76
commit
3e87baafa4
|
@ -761,11 +761,13 @@ enum nft_ct_attributes {
|
||||||
*
|
*
|
||||||
* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
|
* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
|
||||||
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
|
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
|
||||||
|
* @NFTA_LIMIT_BURST: burst (NLA_U32)
|
||||||
*/
|
*/
|
||||||
enum nft_limit_attributes {
|
enum nft_limit_attributes {
|
||||||
NFTA_LIMIT_UNSPEC,
|
NFTA_LIMIT_UNSPEC,
|
||||||
NFTA_LIMIT_RATE,
|
NFTA_LIMIT_RATE,
|
||||||
NFTA_LIMIT_UNIT,
|
NFTA_LIMIT_UNIT,
|
||||||
|
NFTA_LIMIT_BURST,
|
||||||
__NFTA_LIMIT_MAX
|
__NFTA_LIMIT_MAX
|
||||||
};
|
};
|
||||||
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
|
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
|
||||||
|
|
|
@ -25,6 +25,7 @@ struct nft_limit {
|
||||||
u64 tokens_max;
|
u64 tokens_max;
|
||||||
u64 rate;
|
u64 rate;
|
||||||
u64 nsecs;
|
u64 nsecs;
|
||||||
|
u32 burst;
|
||||||
};
|
};
|
||||||
|
|
||||||
static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
|
static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
|
||||||
|
@ -65,6 +66,18 @@ static int nft_limit_init(struct nft_limit *limit,
|
||||||
if (limit->rate == 0 || limit->nsecs < unit)
|
if (limit->rate == 0 || limit->nsecs < unit)
|
||||||
return -EOVERFLOW;
|
return -EOVERFLOW;
|
||||||
limit->tokens = limit->tokens_max = limit->nsecs;
|
limit->tokens = limit->tokens_max = limit->nsecs;
|
||||||
|
|
||||||
|
if (tb[NFTA_LIMIT_BURST]) {
|
||||||
|
u64 rate;
|
||||||
|
|
||||||
|
limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
|
||||||
|
|
||||||
|
rate = limit->rate + limit->burst;
|
||||||
|
if (rate < limit->rate)
|
||||||
|
return -EOVERFLOW;
|
||||||
|
|
||||||
|
limit->rate = rate;
|
||||||
|
}
|
||||||
limit->last = ktime_get_ns();
|
limit->last = ktime_get_ns();
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
|
@ -73,9 +86,11 @@ static int nft_limit_init(struct nft_limit *limit,
|
||||||
static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit)
|
static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit)
|
||||||
{
|
{
|
||||||
u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
|
u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
|
||||||
|
u64 rate = limit->rate - limit->burst;
|
||||||
|
|
||||||
if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate)) ||
|
if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(rate)) ||
|
||||||
nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)))
|
nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)) ||
|
||||||
|
nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)))
|
||||||
goto nla_put_failure;
|
goto nla_put_failure;
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
@ -96,6 +111,7 @@ static void nft_limit_pkts_eval(const struct nft_expr *expr,
|
||||||
static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
|
static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
|
||||||
[NFTA_LIMIT_RATE] = { .type = NLA_U64 },
|
[NFTA_LIMIT_RATE] = { .type = NLA_U64 },
|
||||||
[NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
|
[NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
|
||||||
|
[NFTA_LIMIT_BURST] = { .type = NLA_U32 },
|
||||||
};
|
};
|
||||||
|
|
||||||
static int nft_limit_pkts_init(const struct nft_ctx *ctx,
|
static int nft_limit_pkts_init(const struct nft_ctx *ctx,
|
||||||
|
|
Loading…
Reference in New Issue