hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

netfilter: xtables: connlimit revision 1 

This adds destination address-based selection. The old "inverse"
member is overloaded (memory-wise) with a new "flags" variable,
similar to how J.Park did it with xt_string rev 1. Since revision 0
userspace only sets flag 0x1, no great changes are made to explicitly
test for different revisions.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
This commit is contained in:
Jan Engelhardt 2011-01-18 17:32:40 +01:00
parent 93557f53e1
commit cc4fc02257
3 changed files with 49 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Documentation/feature-removal-schedule.txt
View File

@ -576,3 +576,10 @@ Why: The functions have been superceded by cancel_delayed_work_sync()
Who: Tejun Heo <tj@kernel.org> Who: Tejun Heo <tj@kernel.org>
---------------------------- ----------------------------
What: xt_connlimit rev 0
When: 2012
Who: Jan Engelhardt <jengelh@medozas.de>
Files: net/netfilter/xt_connlimit.c
----------------------------

12
include/linux/netfilter/xt_connlimit.h
View File

@ -3,6 +3,11 @@
struct xt_connlimit_data; struct xt_connlimit_data;
enum {
XT_CONNLIMIT_INVERT = 1 << 0,
XT_CONNLIMIT_DADDR = 1 << 1,
};
struct xt_connlimit_info { struct xt_connlimit_info {
union { union {
union nf_inet_addr mask; union nf_inet_addr mask;
@ -14,6 +19,13 @@ struct xt_connlimit_info {
#endif #endif
}; };
unsigned int limit, inverse; unsigned int limit, inverse;
union {
/* revision 0 */
unsigned int inverse;
/* revision 1 */
__u32 flags;
};
/* Used internally by the kernel */ /* Used internally by the kernel */
struct xt_connlimit_data *data __attribute__((aligned(8))); struct xt_connlimit_data *data __attribute__((aligned(8)));

44
net/netfilter/xt_connlimit.c
View File

@ -193,10 +193,12 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (par->family == NFPROTO_IPV6) { if (par->family == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb); const struct ipv6hdr *iph = ipv6_hdr(skb);
memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr)); memcpy(&addr.ip6, (info->flags & XT_CONNLIMIT_DADDR) ?
&iph->daddr : &iph->saddr, sizeof(addr.ip6));
} else { } else {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
addr.ip = iph->saddr; addr.ip = (info->flags & XT_CONNLIMIT_DADDR) ?
iph->daddr : iph->saddr;
} }
spin_lock_bh(&info->data->lock); spin_lock_bh(&info->data->lock);
@ -208,7 +210,8 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
/* kmalloc failed, drop it entirely */ /* kmalloc failed, drop it entirely */
goto hotdrop; goto hotdrop;
return (connections > info->limit) ^ info->inverse; return (connections > info->limit) ^
!!(info->flags & XT_CONNLIMIT_INVERT);
hotdrop: hotdrop:
par->hotdrop = true; par->hotdrop = true;
@ -266,25 +269,38 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
kfree(info->data); kfree(info->data);
} }
static struct xt_match connlimit_mt_reg __read_mostly = { static struct xt_match connlimit_mt_reg[] __read_mostly = {
.name = "connlimit", {
.revision = 0, .name = "connlimit",
.family = NFPROTO_UNSPEC, .revision = 0,
.checkentry = connlimit_mt_check, .family = NFPROTO_UNSPEC,
.match = connlimit_mt, .checkentry = connlimit_mt_check,
.matchsize = sizeof(struct xt_connlimit_info), .match = connlimit_mt,
.destroy = connlimit_mt_destroy, .matchsize = sizeof(struct xt_connlimit_info),
.me = THIS_MODULE, .destroy = connlimit_mt_destroy,
.me = THIS_MODULE,
},
{
.name = "connlimit",
.revision = 1,
.family = NFPROTO_UNSPEC,
.checkentry = connlimit_mt_check,
.match = connlimit_mt,
.matchsize = sizeof(struct xt_connlimit_info),
.destroy = connlimit_mt_destroy,
.me = THIS_MODULE,
},
}; };
static int __init connlimit_mt_init(void) static int __init connlimit_mt_init(void)
{ {
return xt_register_match(&connlimit_mt_reg); return xt_register_matches(connlimit_mt_reg,
ARRAY_SIZE(connlimit_mt_reg));
} }
static void __exit connlimit_mt_exit(void) static void __exit connlimit_mt_exit(void)
{ {
xt_unregister_match(&connlimit_mt_reg); xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
} }
module_init(connlimit_mt_init); module_init(connlimit_mt_init);