Release 4.11 net/netfilter/xt_hashlimit.c
/*
* xt_hashlimit - Netfilter module to limit the number of packets per time
* separately for each hashbucket (sourceip/sourceport/dstip/dstport)
*
* (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
* (C) 2006-2012 Patrick McHardy <kaber@trash.net>
* Copyright © CC Computer Consultants GmbH, 2007 - 2008
*
* Development of this code was funded by Astaro AG, http://www.astaro.com/
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/spinlock.h>
#include <linux/random.h>
#include <linux/jhash.h>
#include <linux/slab.h>
#include <linux/vmalloc.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/list.h>
#include <linux/skbuff.h>
#include <linux/mm.h>
#include <linux/in.h>
#include <linux/ip.h>
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
#include <linux/ipv6.h>
#include <net/ipv6.h>
#endif
#include <net/net_namespace.h>
#include <net/netns/generic.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter/xt_hashlimit.h>
#include <linux/mutex.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
MODULE_ALIAS("ipt_hashlimit");
MODULE_ALIAS("ip6t_hashlimit");
struct hashlimit_net {
struct hlist_head htables;
struct proc_dir_entry *ipt_hashlimit;
struct proc_dir_entry *ip6t_hashlimit;
};
static unsigned int hashlimit_net_id;
static inline struct hashlimit_net *hashlimit_pernet(struct net *net)
{
return net_generic(net, hashlimit_net_id);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Alexey Dobriyan | 22 | 100.00% | 1 | 100.00% |
Total | 22 | 100.00% | 1 | 100.00% |
/* need to declare this at the top */
static const struct file_operations dl_file_ops_v1;
static const struct file_operations dl_file_ops;
/* hash table crap */
struct dsthash_dst {
union {
struct {
__be32 src;
__be32 dst;
}
ip;
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
struct {
__be32 src[4];
__be32 dst[4];
}
ip6;
#endif
};
__be16 src_port;
__be16 dst_port;
};
struct dsthash_ent {
/* static / read-only parts in the beginning */
struct hlist_node node;
struct dsthash_dst dst;
/* modified structure members in the end */
spinlock_t lock;
unsigned long expires; /* precalculated expiry time */
struct {
unsigned long prev; /* last modification */
u_int64_t credit;
u_int64_t credit_cap, cost;
}
rateinfo;
struct rcu_head rcu;
};
struct xt_hashlimit_htable {
struct hlist_node node; /* global list of all htables */
int use;
u_int8_t family;
bool rnd_initialized;
struct hashlimit_cfg2 cfg; /* config */
/* used internally */
spinlock_t lock; /* lock for list_head */
u_int32_t rnd; /* random seed for hash */
unsigned int count; /* number entries in table */
struct delayed_work gc_work;
/* seq_file stuff */
struct proc_dir_entry *pde;
const char *name;
struct net *net;
struct hlist_head hash[0]; /* hashtable itself */
};
static int
cfg_copy(struct hashlimit_cfg2 *to, void *from, int revision)
{
if (revision == 1) {
struct hashlimit_cfg1 *cfg = (struct hashlimit_cfg1 *)from;
to->mode = cfg->mode;
to->avg = cfg->avg;
to->burst = cfg->burst;
to->size = cfg->size;
to->max = cfg->max;
to->gc_interval = cfg->gc_interval;
to->expire = cfg->expire;
to->srcmask = cfg->srcmask;
to->dstmask = cfg->dstmask;
} else if (revision == 2) {
memcpy(to, from, sizeof(struct hashlimit_cfg2));
} else {
return -EINVAL;
}
return 0;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Vishwanath Pai | 142 | 100.00% | 1 | 100.00% |
Total | 142 | 100.00% | 1 | 100.00% |
static DEFINE_MUTEX(hashlimit_mutex); /* protects htables list */
static struct kmem_cache *hashlimit_cachep __read_mostly;
static inline bool dst_cmp(const struct dsthash_ent *ent,
const struct dsthash_dst *b)
{
return !memcmp(&ent->dst, b, sizeof(ent->dst));
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Harald Welte | 26 | 68.42% | 1 | 25.00% |
Patrick McHardy | 10 | 26.32% | 1 | 25.00% |
Jan Engelhardt | 2 | 5.26% | 2 | 50.00% |
Total | 38 | 100.00% | 4 | 100.00% |
static u_int32_t
hash_dst(const struct xt_hashlimit_htable *ht, const struct dsthash_dst *dst)
{
u_int32_t hash = jhash2((const u32 *)dst,
sizeof(*dst)/sizeof(u32),
ht->rnd);
/*
* Instead of returning hash % ht->cfg.size (implying a divide)
* we return the high 32 bits of the (hash * ht->cfg.size) that will
* give results between [0 and cfg.size-1] and same hash distribution,
* but using a multiply, less expensive than a divide
*/
return reciprocal_scale(hash, ht->cfg.size);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Harald Welte | 32 | 54.24% | 1 | 25.00% |
Eric Dumazet | 18 | 30.51% | 1 | 25.00% |
Patrick McHardy | 5 | 8.47% | 1 | 25.00% |
Daniel Borkmann | 4 | 6.78% | 1 | 25.00% |
Total | 59 | 100.00% | 4 | 100.00% |
static struct dsthash_ent *
dsthash_find(const struct xt_hashlimit_htable *ht,
const struct dsthash_dst *dst)
{
struct dsthash_ent *ent;
u_int32_t hash = hash_dst(ht, dst);
if (!hlist_empty(&ht->hash[hash])) {
hlist_for_each_entry_rcu(ent, &ht->hash[hash], node)
if (dst_cmp(ent, dst)) {
spin_lock(&ent->lock);
return ent;
}
}
return NULL;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Harald Welte | 65 | 77.38% | 2 | 33.33% |
Eric Dumazet | 11 | 13.10% | 1 | 16.67% |
jix@bugmachine.ca | 4 | 4.76% | 1 | 16.67% |
Patrick McHardy | 3 | 3.57% | 1 | 16.67% |
Jan Engelhardt | 1 | 1.19% | 1 | 16.67% |
Total | 84 | 100.00% | 6 | 100.00% |
/* allocate dsthash_ent, initialize dst, put in htable and lock it */
static struct dsthash_ent *
dsthash_alloc_init(struct xt_hashlimit_htable *ht,
const struct dsthash_dst *dst, bool *race)
{
struct dsthash_ent *ent;
spin_lock(&ht->lock);
/* Two or more packets may race to create the same entry in the
* hashtable, double check if this packet lost race.
*/
ent = dsthash_find(ht, dst);
if (ent != NULL) {
spin_unlock(&ht->lock);
*race = true;
return ent;
}
/* initialize hash with random val at the time we allocate
* the first hashtable entry */
if (unlikely(!ht->rnd_initialized)) {
get_random_bytes(&ht->rnd, sizeof(ht->rnd));
ht->rnd_initialized = true;
}
if (ht->cfg.max && ht->count >= ht->cfg.max) {
/* FIXME: do something. question is what.. */
net_err_ratelimited("max count of %u reached\n", ht->cfg.max);
ent = NULL;
} else
ent = kmem_cache_alloc(hashlimit_cachep, GFP_ATOMIC);
if (ent) {
memcpy(&ent->dst, dst, sizeof(ent->dst));
spin_lock_init(&ent->lock);
spin_lock(&ent->lock);
hlist_add_head_rcu(&ent->node, &ht->hash[hash_dst(ht, dst)]);
ht->count++;
}
spin_unlock(&ht->lock);
return ent;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Harald Welte | 115 | 50.88% | 2 | 18.18% |
Eric Dumazet | 41 | 18.14% | 1 | 9.09% |
Pablo Neira Ayuso | 38 | 16.81% | 1 | 9.09% |
Patrick McHardy | 22 | 9.73% | 2 | 18.18% |
Hagen Paul Pfeifer | 6 | 2.65% | 1 | 9.09% |
Jan Engelhardt | 3 | 1.33% | 3 | 27.27% |
Joe Perches | 1 | 0.44% | 1 | 9.09% |
Total | 226 | 100.00% | 11 | 100.00% |
static void dsthash_free_rcu(struct rcu_head *head)
{
struct dsthash_ent *ent = container_of(head, struct dsthash_ent, rcu);
kmem_cache_free(hashlimit_cachep, ent);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Eric Dumazet | 33 | 100.00% | 1 | 100.00% |
Total | 33 | 100.00% | 1 | 100.00% |
static inline void
dsthash_free(struct xt_hashlimit_htable *ht, struct dsthash_ent *ent)
{
hlist_del_rcu(&ent->node);
call_rcu_bh(&ent->rcu, dsthash_free_rcu);
ht->count--;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Harald Welte | 30 | 75.00% | 2 | 50.00% |
Eric Dumazet | 7 | 17.50% | 1 | 25.00% |
Patrick McHardy | 3 | 7.50% | 1 | 25.00% |
Total | 40 | 100.00% | 4 | 100.00% |
static void htable_gc(struct work_struct *work);
static int htable_create(struct net *net, struct hashlimit_cfg2 *cfg,
const char *name, u_int8_t family,
struct xt_hashlimit_htable **out_hinfo,
int revision)
{
struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
struct xt_hashlimit_htable *hinfo;
unsigned int size, i;
int ret;
if (cfg->size) {
size = cfg->size;
} else {
size = (totalram_pages << PAGE_SHIFT) / 16384 /
sizeof(struct list_head);
if (totalram_pages > 1024 * 1024 * 1024 / PAGE_SIZE)
size = 8192;
if (size < 16)
size = 16;
}
/* FIXME: don't use vmalloc() here or anywhere else -HW */
hinfo = vmalloc(sizeof(struct xt_hashlimit_htable) +
sizeof(struct list_head) * size);
if (hinfo == NULL)
return -ENOMEM;
*out_hinfo = hinfo;
/* copy match config into hashtable config */
ret = cfg_copy(&hinfo->cfg, (void *)cfg, 2);
if (ret)
return ret;
hinfo->cfg.size = size;
if (hinfo->cfg.max == 0)
hinfo->cfg.max = 8 * hinfo->cfg.size;
else if (hinfo->cfg.max < hinfo->cfg.size)
hinfo->cfg.max = hinfo->cfg.size;
for (i = 0; i < hinfo->cfg.size; i++)
INIT_HLIST_HEAD(&hinfo->hash[i]);
hinfo->use = 1;
hinfo->count = 0;
hinfo->family = family;
hinfo->rnd_initialized = false;
hinfo->name = kstrdup(name, GFP_KERNEL);
if (!hinfo->name) {
vfree(hinfo);
return -ENOMEM;
}
spin_lock_init(&hinfo->lock);
hinfo->pde = proc_create_data(name, 0,
(family == NFPROTO_IPV4) ?
hashlimit_net->ipt_hashlimit : hashlimit_net->ip6t_hashlimit,
(revision == 1) ? &dl_file_ops_v1 : &dl_file_ops,
hinfo);
if (hinfo->pde == NULL) {
kfree(hinfo->name);
vfree(hinfo);
return -ENOMEM;
}
hinfo->net = net;
INIT_DEFERRABLE_WORK(&hinfo->gc_work, htable_gc);
queue_delayed_work(system_power_efficient_wq, &hinfo->gc_work,
msecs_to_jiffies(hinfo->cfg.gc_interval));
hlist_add_head(&hinfo->node, &hashlimit_net->htables);
return 0;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Harald Welte | 257 | 58.28% | 2 | 9.09% |
Vishwanath Pai | 49 | 11.11% | 2 | 9.09% |
Al Viro | 36 | 8.16% | 1 | 4.55% |
Alexey Dobriyan | 30 | 6.80% | 1 | 4.55% |
Patrick McHardy | 27 | 6.12% | 4 | 18.18% |
Jan Engelhardt | 21 | 4.76% | 6 | 27.27% |
Eric Dumazet | 9 | 2.04% | 1 | 4.55% |
Denis V. Lunev | 5 | 1.13% | 2 | 9.09% |
Andrew Morton | 4 | 0.91% | 1 | 4.55% |
Jan Beulich | 2 | 0.45% | 1 | 4.55% |
Tobias Klauser | 1 | 0.23% | 1 | 4.55% |
Total | 441 | 100.00% | 22 | 100.00% |
static bool select_all(const struct xt_hashlimit_htable *ht,
const struct dsthash_ent *he)
{
return 1;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 12 | 57.14% | 1 | 33.33% |
Harald Welte | 6 | 28.57% | 1 | 33.33% |
Alexey Dobriyan | 3 | 14.29% | 1 | 33.33% |
Total | 21 | 100.00% | 3 | 100.00% |
static bool select_gc(const struct xt_hashlimit_htable *ht,
const struct dsthash_ent *he)
{
return time_after_eq(jiffies, he->expires);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 24 | 85.71% | 1 | 33.33% |
Alexey Dobriyan | 3 | 10.71% | 1 | 33.33% |
Harald Welte | 1 | 3.57% | 1 | 33.33% |
Total | 28 | 100.00% | 3 | 100.00% |
static void htable_selective_cleanup(struct xt_hashlimit_htable *ht,
bool (*select)(const struct xt_hashlimit_htable *ht,
const struct dsthash_ent *he))
{
unsigned int i;
for (i = 0; i < ht->cfg.size; i++) {
struct dsthash_ent *dh;
struct hlist_node *n;
spin_lock_bh(&ht->lock);
hlist_for_each_entry_safe(dh, n, &ht->hash[i], node) {
if ((*select)(ht, dh))
dsthash_free(ht, dh);
}
spin_unlock_bh(&ht->lock);
cond_resched();
}
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 85 | 75.22% | 2 | 33.33% |
Harald Welte | 13 | 11.50% | 1 | 16.67% |
Eric Dumazet | 12 | 10.62% | 1 | 16.67% |
Patrick McHardy | 2 | 1.77% | 1 | 16.67% |
Alexey Dobriyan | 1 | 0.88% | 1 | 16.67% |
Total | 113 | 100.00% | 6 | 100.00% |
static void htable_gc(struct work_struct *work)
{
struct xt_hashlimit_htable *ht;
ht = container_of(work, struct xt_hashlimit_htable, gc_work.work);
htable_selective_cleanup(ht, select_gc);
queue_delayed_work(system_power_efficient_wq,
&ht->gc_work, msecs_to_jiffies(ht->cfg.gc_interval));
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 28 | 50.00% | 2 | 50.00% |
Eric Dumazet | 24 | 42.86% | 1 | 25.00% |
Harald Welte | 4 | 7.14% | 1 | 25.00% |
Total | 56 | 100.00% | 4 | 100.00% |
static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
{
struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
struct proc_dir_entry *parent;
if (hinfo->family == NFPROTO_IPV4)
parent = hashlimit_net->ipt_hashlimit;
else
parent = hashlimit_net->ip6t_hashlimit;
if (parent != NULL)
remove_proc_entry(hinfo->name, parent);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 47 | 73.44% | 2 | 40.00% |
Harald Welte | 9 | 14.06% | 1 | 20.00% |
Vitaly E. Lavrov | 6 | 9.38% | 1 | 20.00% |
Sergey Popovich | 2 | 3.12% | 1 | 20.00% |
Total | 64 | 100.00% | 5 | 100.00% |
static void htable_destroy(struct xt_hashlimit_htable *hinfo)
{
cancel_delayed_work_sync(&hinfo->gc_work);
htable_remove_proc_entry(hinfo);
htable_selective_cleanup(hinfo, select_all);
kfree(hinfo->name);
vfree(hinfo);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Sergey Popovich | 21 | 48.84% | 1 | 16.67% |
Jan Engelhardt | 8 | 18.60% | 2 | 33.33% |
Al Viro | 7 | 16.28% | 1 | 16.67% |
Harald Welte | 5 | 11.63% | 1 | 16.67% |
Eric Dumazet | 2 | 4.65% | 1 | 16.67% |
Total | 43 | 100.00% | 6 | 100.00% |
static struct xt_hashlimit_htable *htable_find_get(struct net *net,
const char *name,
u_int8_t family)
{
struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
struct xt_hashlimit_htable *hinfo;
hlist_for_each_entry(hinfo, &hashlimit_net->htables, node) {
if (!strcmp(name, hinfo->name) &&
hinfo->family == family) {
hinfo->use++;
return hinfo;
}
}
return NULL;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 68 | 88.31% | 2 | 40.00% |
Harald Welte | 5 | 6.49% | 1 | 20.00% |
Patrick McHardy | 3 | 3.90% | 1 | 20.00% |
Denis V. Lunev | 1 | 1.30% | 1 | 20.00% |
Total | 77 | 100.00% | 5 | 100.00% |
static void htable_put(struct xt_hashlimit_htable *hinfo)
{
mutex_lock(&hashlimit_mutex);
if (--hinfo->use == 0) {
hlist_del(&hinfo->node);
htable_destroy(hinfo);
}
mutex_unlock(&hashlimit_mutex);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 31 | 65.96% | 2 | 50.00% |
Harald Welte | 15 | 31.91% | 1 | 25.00% |
Alexey Dobriyan | 1 | 2.13% | 1 | 25.00% |
Total | 47 | 100.00% | 4 | 100.00% |
/* The algorithm used is the Simple Token Bucket Filter (TBF)
* see net/sched/sch_tbf.c in the linux source tree
*/
/* Rusty: This is my (non-mathematically-inclined) understanding of
this algorithm. The `average rate' in jiffies becomes your initial
amount of credit `credit' and the most credit you can ever have
`credit_cap'. The `peak rate' becomes the cost of passing the
test, `cost'.
`prev' tracks the last packet hit: you gain one credit per jiffy.
If you get credit balance more than this, the extra credit is
discarded. Every time the match passes, you lose `cost' credits;
if you don't have that many, the test fails.
See Alexey's formal explanation in net/sched/sch_tbf.c.
To get the maximum range, we multiply by this factor (ie. you get N
credits per jiffy). We want to allow a rate as low as 1 per day
(slowest userspace tool allows), which means
CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32 ie.
*/
#define MAX_CPJ_v1 (0xFFFFFFFF / (HZ*60*60*24))
#define MAX_CPJ (0xFFFFFFFFFFFFFFFFULL / (HZ*60*60*24))
/* Repeated shift and or gives us all 1s, final shift and add 1 gives
* us the power of 2 below the theoretical max, so GCC simply does a
* shift. */
#define _POW2_BELOW2(x) ((x)|((x)>>1))
#define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
#define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
#define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
#define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
#define _POW2_BELOW64(x) (_POW2_BELOW32(x)|_POW2_BELOW32((x)>>32))
#define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
#define POW2_BELOW64(x) ((_POW2_BELOW64(x)>>1) + 1)
#define CREDITS_PER_JIFFY POW2_BELOW64(MAX_CPJ)
#define CREDITS_PER_JIFFY_v1 POW2_BELOW32(MAX_CPJ_v1)
/* in byte mode, the lowest possible rate is one packet/second.
* credit_cap is used as a counter that tells us how many times we can
* refill the "credits available" counter when it becomes empty.
*/
#define MAX_CPJ_BYTES (0xFFFFFFFF / HZ)
#define CREDITS_PER_JIFFY_BYTES POW2_BELOW32(MAX_CPJ_BYTES)
static u32 xt_hashlimit_len_to_chunks(u32 len)
{
return (len >> XT_HASHLIMIT_BYTE_SHIFT) + 1;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Florian Westphal | 18 | 100.00% | 1 | 100.00% |
Total | 18 | 100.00% | 1 | 100.00% |
/* Precision saver. */
static u64 user2credits(u64 user, int revision)
{
u64 scale = (revision == 1) ?
XT_HASHLIMIT_SCALE : XT_HASHLIMIT_SCALE_v2;
u64 cpj = (revision == 1) ?
CREDITS_PER_JIFFY_v1 : CREDITS_PER_JIFFY;
/* Avoid overflow: divide the constant operands first */
if (scale >= HZ * cpj)
return div64_u64(user, div64_u64(scale, HZ * cpj));
return user * div64_u64(HZ * cpj, scale);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Alban Browaeys | 33 | 44.59% | 1 | 16.67% |
Vishwanath Pai | 25 | 33.78% | 2 | 33.33% |
Jan Engelhardt | 15 | 20.27% | 2 | 33.33% |
Florian Westphal | 1 | 1.35% | 1 | 16.67% |
Total | 74 | 100.00% | 6 | 100.00% |
static u32 user2credits_byte(u32 user)
{
u64 us = user;
us *= HZ * CREDITS_PER_JIFFY_BYTES;
return (u32) (us >> 32);
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Vishwanath Pai | 16 | 53.33% | 1 | 50.00% |
Florian Westphal | 14 | 46.67% | 1 | 50.00% |
Total | 30 | 100.00% | 2 | 100.00% |
static void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now,
u32 mode, int revision)
{
unsigned long delta = now - dh->rateinfo.prev;
u64 cap, cpj;
if (delta == 0)
return;
dh->rateinfo.prev = now;
if (mode & XT_HASHLIMIT_BYTES) {
u64 tmp = dh->rateinfo.credit;
dh->rateinfo.credit += CREDITS_PER_JIFFY_BYTES * delta;
cap = CREDITS_PER_JIFFY_BYTES * HZ;
if (tmp >= dh->rateinfo.credit) {/* overflow */
dh->rateinfo.credit = cap;
return;
}
} else {
cpj = (revision == 1) ?
CREDITS_PER_JIFFY_v1 : CREDITS_PER_JIFFY;
dh->rateinfo.credit += delta * cpj;
cap = dh->rateinfo.credit_cap;
}
if (dh->rateinfo.credit > cap)
dh->rateinfo.credit = cap;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Florian Westphal | 84 | 52.83% | 1 | 25.00% |
Jan Engelhardt | 55 | 34.59% | 2 | 50.00% |
Vishwanath Pai | 20 | 12.58% | 1 | 25.00% |
Total | 159 | 100.00% | 4 | 100.00% |
static void rateinfo_init(struct dsthash_ent *dh,
struct xt_hashlimit_htable *hinfo, int revision)
{
dh->rateinfo.prev = jiffies;
if (hinfo->cfg.mode & XT_HASHLIMIT_BYTES) {
dh->rateinfo.credit = CREDITS_PER_JIFFY_BYTES * HZ;
dh->rateinfo.cost = user2credits_byte(hinfo->cfg.avg);
dh->rateinfo.credit_cap = hinfo->cfg.burst;
} else {
dh->rateinfo.credit = user2credits(hinfo->cfg.avg *
hinfo->cfg.burst, revision);
dh->rateinfo.cost = user2credits(hinfo->cfg.avg, revision);
dh->rateinfo.credit_cap = dh->rateinfo.credit;
}
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Florian Westphal | 124 | 94.66% | 2 | 66.67% |
Vishwanath Pai | 7 | 5.34% | 1 | 33.33% |
Total | 131 | 100.00% | 3 | 100.00% |
static inline __be32 maskl(__be32 a, unsigned int l)
{
return l ? htonl(ntohl(a) & ~0 << (32 - l)) : 0;
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 34 | 94.44% | 2 | 66.67% |
Harald Welte | 2 | 5.56% | 1 | 33.33% |
Total | 36 | 100.00% | 3 | 100.00% |
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
{
switch (p) {
case 0 ... 31:
i[0] = maskl(i[0], p);
i[1] = i[2] = i[3] = 0;
break;
case 32 ... 63:
i[1] = maskl(i[1], p - 32);
i[2] = i[3] = 0;
break;
case 64 ... 95:
i[2] = maskl(i[2], p - 64);
i[3] = 0;
break;
case 96 ... 127:
i[3] = maskl(i[3], p - 96);
break;
case 128:
break;
}
}
Contributors
Person | Tokens | Prop | Commits | CommitProp |
Jan Engelhardt | 142 | 94.67% | 2 | 40.00% |
Harald Welte | 5 | 3.33% | 1 | 20.00% |
Patrick McHardy | 3 | 2.00% | 2 | 40.00% |
Total | 150 | 100.00% | 5 | 100.00% |
#endif
static int
hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
struct dsthash_dst *dst,
const struct sk_buff *skb, unsigned int protoff)
{
__be16 _ports[2], *ports;
u8 nexthdr;
int poff;
memset(dst, 0, sizeof(*dst));
switch (hinfo->family) {
case NFPROTO_IPV4:
if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP)
dst->ip.dst = maskl(ip_hdr(skb)->daddr,
hinfo->cfg.dstmask);
if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP)
dst->ip.src = maskl(ip_hdr(skb)->saddr,
hinfo->cfg.srcmask);
if (!(hinfo->cfg.mode &
(XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
return 0;
nexthdr = ip_hdr(skb)->protocol;
break;
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
case NFPROTO_IPV6:
{
__be16 frag_off;
if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
memcpy(&dst->ip6.dst, &ipv6_hdr(skb)->daddr,
sizeof(dst->ip6.dst));
hashlimit_ipv6_mask(dst->ip6.dst, hinfo->cfg.dstmask);
}
if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP) {
memcpy(&dst->ip6.src, &ipv6_hdr(skb)->saddr,
sizeof(dst->ip6.src));
hashlimit_ipv6_mask(dst->ip6.src, hinfo->cfg.srcmask);
}
if (!(hinfo->cfg.mode &
(XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
return 0;
nexthdr = ipv6_hdr(skb)->nexthdr;
protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, &frag_off);
if ((int)protoff <