]>
git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - net/netfilter/xt_limit.c
1 /* (C) 1999 Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr>
2 * (C) 1999 Hervé Eychenne <eychenne@info.enserb.u-bordeaux.fr>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
11 #include <linux/spinlock.h>
12 #include <linux/interrupt.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_limit.h>
17 MODULE_LICENSE("GPL");
18 MODULE_AUTHOR("Herve Eychenne <rv@wallfire.org>");
19 MODULE_DESCRIPTION("iptables rate limit match");
20 MODULE_ALIAS("ipt_limit");
21 MODULE_ALIAS("ip6t_limit");
23 /* The algorithm used is the Simple Token Bucket Filter (TBF)
24 * see net/sched/sch_tbf.c in the linux source tree
27 static DEFINE_SPINLOCK(limit_lock
);
29 /* Rusty: This is my (non-mathematically-inclined) understanding of
30 this algorithm. The `average rate' in jiffies becomes your initial
31 amount of credit `credit' and the most credit you can ever have
32 `credit_cap'. The `peak rate' becomes the cost of passing the
35 `prev' tracks the last packet hit: you gain one credit per jiffy.
36 If you get credit balance more than this, the extra credit is
37 discarded. Every time the match passes, you lose `cost' credits;
38 if you don't have that many, the test fails.
40 See Alexey's formal explanation in net/sched/sch_tbf.c.
42 To get the maxmum range, we multiply by this factor (ie. you get N
43 credits per jiffy). We want to allow a rate as low as 1 per day
44 (slowest userspace tool allows), which means
45 CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32. ie. */
46 #define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
48 /* Repeated shift and or gives us all 1s, final shift and add 1 gives
49 * us the power of 2 below the theoretical max, so GCC simply does a
51 #define _POW2_BELOW2(x) ((x)|((x)>>1))
52 #define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
53 #define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
54 #define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
55 #define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
56 #define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
58 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
61 ipt_limit_match(const struct sk_buff
*skb
,
62 const struct net_device
*in
,
63 const struct net_device
*out
,
64 const struct xt_match
*match
,
65 const void *matchinfo
,
70 struct xt_rateinfo
*r
=
71 ((const struct xt_rateinfo
*)matchinfo
)->master
;
72 unsigned long now
= jiffies
;
74 spin_lock_bh(&limit_lock
);
75 r
->credit
+= (now
- xchg(&r
->prev
, now
)) * CREDITS_PER_JIFFY
;
76 if (r
->credit
> r
->credit_cap
)
77 r
->credit
= r
->credit_cap
;
79 if (r
->credit
>= r
->cost
) {
80 /* We're not limited. */
82 spin_unlock_bh(&limit_lock
);
86 spin_unlock_bh(&limit_lock
);
90 /* Precision saver. */
92 user2credits(u_int32_t user
)
94 /* If multiplying would overflow... */
95 if (user
> 0xFFFFFFFF / (HZ
*CREDITS_PER_JIFFY
))
97 return (user
/ XT_LIMIT_SCALE
) * HZ
* CREDITS_PER_JIFFY
;
99 return (user
* HZ
* CREDITS_PER_JIFFY
) / XT_LIMIT_SCALE
;
103 ipt_limit_checkentry(const char *tablename
,
105 const struct xt_match
*match
,
107 unsigned int hook_mask
)
109 struct xt_rateinfo
*r
= matchinfo
;
111 /* Check for overflow. */
113 || user2credits(r
->avg
* r
->burst
) < user2credits(r
->avg
)) {
114 printk("Overflow in xt_limit, try lower: %u/%u\n",
119 /* For SMP, we only want to use one set of counters. */
122 /* User avg in seconds * XT_LIMIT_SCALE: convert to jiffies *
125 r
->credit
= user2credits(r
->avg
* r
->burst
); /* Credits full. */
126 r
->credit_cap
= user2credits(r
->avg
* r
->burst
); /* Credits full. */
127 r
->cost
= user2credits(r
->avg
);
133 struct compat_xt_rateinfo
{
139 u_int32_t credit_cap
, cost
;
144 /* To keep the full "prev" timestamp, the upper 32 bits are stored in the
145 * master pointer, which does not need to be preserved. */
146 static void compat_from_user(void *dst
, void *src
)
148 const struct compat_xt_rateinfo
*cm
= src
;
149 struct xt_rateinfo m
= {
152 .prev
= cm
->prev
| (unsigned long)cm
->master
<< 32,
153 .credit
= cm
->credit
,
154 .credit_cap
= cm
->credit_cap
,
157 memcpy(dst
, &m
, sizeof(m
));
160 static int compat_to_user(void __user
*dst
, void *src
)
162 const struct xt_rateinfo
*m
= src
;
163 struct compat_xt_rateinfo cm
= {
168 .credit_cap
= m
->credit_cap
,
170 .master
= m
->prev
>> 32,
172 return copy_to_user(dst
, &cm
, sizeof(cm
)) ? -EFAULT
: 0;
174 #endif /* CONFIG_COMPAT */
176 static struct xt_match xt_limit_match
[] = {
180 .checkentry
= ipt_limit_checkentry
,
181 .match
= ipt_limit_match
,
182 .matchsize
= sizeof(struct xt_rateinfo
),
184 .compatsize
= sizeof(struct compat_xt_rateinfo
),
185 .compat_from_user
= compat_from_user
,
186 .compat_to_user
= compat_to_user
,
193 .checkentry
= ipt_limit_checkentry
,
194 .match
= ipt_limit_match
,
195 .matchsize
= sizeof(struct xt_rateinfo
),
200 static int __init
xt_limit_init(void)
202 return xt_register_matches(xt_limit_match
, ARRAY_SIZE(xt_limit_match
));
205 static void __exit
xt_limit_fini(void)
207 xt_unregister_matches(xt_limit_match
, ARRAY_SIZE(xt_limit_match
));
210 module_init(xt_limit_init
);
211 module_exit(xt_limit_fini
);