* [PATCH nf-next 2/6] netfilter: nft_limit: convert to token-based limiting at nanosecond granularity
2015-08-05 10:38 [PATCH nf-next 1/6] netfilter: nft_limit: rename to nft_limit_pkts Pablo Neira Ayuso
@ 2015-08-05 10:38 ` Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 3/6] netfilter: nft_limit: factor out shared code with per-byte limiting Pablo Neira Ayuso
` (3 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2015-08-05 10:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
Rework the limit expression to use a token-based limiting approach that refills
the bucket gradually. The tokens are calculated at nanosecond granularity
instead jiffies to improve precision.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_limit.c | 42 ++++++++++++++++++++++++++----------------
1 file changed, 26 insertions(+), 16 deletions(-)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index d0788e1..c79703e 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -20,10 +20,11 @@
static DEFINE_SPINLOCK(limit_lock);
struct nft_limit {
+ u64 last;
u64 tokens;
+ u64 tokens_max;
u64 rate;
- u64 unit;
- unsigned long stamp;
+ u64 nsecs;
};
static void nft_limit_pkts_eval(const struct nft_expr *expr,
@@ -31,18 +32,23 @@ static void nft_limit_pkts_eval(const struct nft_expr *expr,
const struct nft_pktinfo *pkt)
{
struct nft_limit *priv = nft_expr_priv(expr);
+ u64 now, tokens, cost = div_u64(priv->nsecs, priv->rate);
+ s64 delta;
spin_lock_bh(&limit_lock);
- if (time_after_eq(jiffies, priv->stamp)) {
- priv->tokens = priv->rate;
- priv->stamp = jiffies + priv->unit * HZ;
- }
-
- if (priv->tokens >= 1) {
- priv->tokens--;
+ now = ktime_get_ns();
+ tokens = priv->tokens + now - priv->last;
+ if (tokens > priv->tokens_max)
+ tokens = priv->tokens_max;
+
+ priv->last = now;
+ delta = tokens - cost;
+ if (delta >= 0) {
+ priv->tokens = delta;
spin_unlock_bh(&limit_lock);
return;
}
+ priv->tokens = tokens;
spin_unlock_bh(&limit_lock);
regs->verdict.code = NFT_BREAK;
@@ -58,25 +64,29 @@ static int nft_limit_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
{
struct nft_limit *priv = nft_expr_priv(expr);
+ u64 unit;
if (tb[NFTA_LIMIT_RATE] == NULL ||
tb[NFTA_LIMIT_UNIT] == NULL)
return -EINVAL;
- priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
- priv->unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
- priv->stamp = jiffies + priv->unit * HZ;
- priv->tokens = priv->rate;
+ priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
+ unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
+ priv->nsecs = unit * NSEC_PER_SEC;
+ if (priv->rate == 0 || priv->nsecs < unit)
+ return -EOVERFLOW;
+ priv->tokens = priv->tokens_max = priv->nsecs;
+ priv->last = ktime_get_ns();
return 0;
}
static int nft_limit_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
const struct nft_limit *priv = nft_expr_priv(expr);
+ u64 secs = div_u64(priv->nsecs, NSEC_PER_SEC);
- if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(priv->rate)))
- goto nla_put_failure;
- if (nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(priv->unit)))
+ if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(priv->rate)) ||
+ nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)))
goto nla_put_failure;
return 0;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH nf-next 3/6] netfilter: nft_limit: factor out shared code with per-byte limiting
2015-08-05 10:38 [PATCH nf-next 1/6] netfilter: nft_limit: rename to nft_limit_pkts Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 2/6] netfilter: nft_limit: convert to token-based limiting at nanosecond granularity Pablo Neira Ayuso
@ 2015-08-05 10:38 ` Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 4/6] netfilter: nft_limit: add burst parameter Pablo Neira Ayuso
` (2 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2015-08-05 10:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
This patch prepares the introduction of per-byte limiting.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_limit.c | 86 ++++++++++++++++++++++++++++-----------------
1 file changed, 53 insertions(+), 33 deletions(-)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index c79703e..c4d1b1b 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -27,65 +27,54 @@ struct nft_limit {
u64 nsecs;
};
-static void nft_limit_pkts_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
{
- struct nft_limit *priv = nft_expr_priv(expr);
- u64 now, tokens, cost = div_u64(priv->nsecs, priv->rate);
+ u64 now, tokens;
s64 delta;
spin_lock_bh(&limit_lock);
now = ktime_get_ns();
- tokens = priv->tokens + now - priv->last;
- if (tokens > priv->tokens_max)
- tokens = priv->tokens_max;
+ tokens = limit->tokens + now - limit->last;
+ if (tokens > limit->tokens_max)
+ tokens = limit->tokens_max;
- priv->last = now;
+ limit->last = now;
delta = tokens - cost;
if (delta >= 0) {
- priv->tokens = delta;
+ limit->tokens = delta;
spin_unlock_bh(&limit_lock);
- return;
+ return false;
}
- priv->tokens = tokens;
+ limit->tokens = tokens;
spin_unlock_bh(&limit_lock);
-
- regs->verdict.code = NFT_BREAK;
+ return true;
}
-static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
- [NFTA_LIMIT_RATE] = { .type = NLA_U64 },
- [NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
-};
-
-static int nft_limit_init(const struct nft_ctx *ctx,
- const struct nft_expr *expr,
+static int nft_limit_init(struct nft_limit *limit,
const struct nlattr * const tb[])
{
- struct nft_limit *priv = nft_expr_priv(expr);
u64 unit;
if (tb[NFTA_LIMIT_RATE] == NULL ||
tb[NFTA_LIMIT_UNIT] == NULL)
return -EINVAL;
- priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
+ limit->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
- priv->nsecs = unit * NSEC_PER_SEC;
- if (priv->rate == 0 || priv->nsecs < unit)
+ limit->nsecs = unit * NSEC_PER_SEC;
+ if (limit->rate == 0 || limit->nsecs < unit)
return -EOVERFLOW;
- priv->tokens = priv->tokens_max = priv->nsecs;
- priv->last = ktime_get_ns();
+ limit->tokens = limit->tokens_max = limit->nsecs;
+ limit->last = ktime_get_ns();
+
return 0;
}
-static int nft_limit_dump(struct sk_buff *skb, const struct nft_expr *expr)
+static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit)
{
- const struct nft_limit *priv = nft_expr_priv(expr);
- u64 secs = div_u64(priv->nsecs, NSEC_PER_SEC);
+ u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
- if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(priv->rate)) ||
+ if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate)) ||
nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)))
goto nla_put_failure;
return 0;
@@ -94,13 +83,44 @@ nla_put_failure:
return -1;
}
+static void nft_limit_pkts_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
+{
+ struct nft_limit *priv = nft_expr_priv(expr);
+
+ if (nft_limit_eval(priv, div_u64(priv->nsecs, priv->rate)))
+ regs->verdict.code = NFT_BREAK;
+}
+
+static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
+ [NFTA_LIMIT_RATE] = { .type = NLA_U64 },
+ [NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
+};
+
+static int nft_limit_pkts_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+{
+ struct nft_limit *priv = nft_expr_priv(expr);
+
+ return nft_limit_init(priv, tb);
+}
+
+static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
+{
+ const struct nft_limit *priv = nft_expr_priv(expr);
+
+ return nft_limit_dump(skb, priv);
+}
+
static struct nft_expr_type nft_limit_type;
static const struct nft_expr_ops nft_limit_pkts_ops = {
.type = &nft_limit_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_limit)),
.eval = nft_limit_pkts_eval,
- .init = nft_limit_init,
- .dump = nft_limit_dump,
+ .init = nft_limit_pkts_init,
+ .dump = nft_limit_pkts_dump,
};
static struct nft_expr_type nft_limit_type __read_mostly = {
--
1.7.10.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH nf-next 4/6] netfilter: nft_limit: add burst parameter
2015-08-05 10:38 [PATCH nf-next 1/6] netfilter: nft_limit: rename to nft_limit_pkts Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 2/6] netfilter: nft_limit: convert to token-based limiting at nanosecond granularity Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 3/6] netfilter: nft_limit: factor out shared code with per-byte limiting Pablo Neira Ayuso
@ 2015-08-05 10:38 ` Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 5/6] netfilter: nft_limit: constant token cost per packet Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 6/6] netfilter: nft_limit: add per-byte limiting Pablo Neira Ayuso
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2015-08-05 10:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
This patch adds the burst parameter. This burst indicates the number of packets
that can exceed the limit.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_limit.c | 20 ++++++++++++++++++--
2 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index d18de00..ef037dc 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -788,11 +788,13 @@ enum nft_ct_attributes {
*
* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
+ * @NFTA_LIMIT_BURST: burst (NLA_U32)
*/
enum nft_limit_attributes {
NFTA_LIMIT_UNSPEC,
NFTA_LIMIT_RATE,
NFTA_LIMIT_UNIT,
+ NFTA_LIMIT_BURST,
__NFTA_LIMIT_MAX
};
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index c4d1b1b..d8c5ff1 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -25,6 +25,7 @@ struct nft_limit {
u64 tokens_max;
u64 rate;
u64 nsecs;
+ u32 burst;
};
static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
@@ -65,6 +66,18 @@ static int nft_limit_init(struct nft_limit *limit,
if (limit->rate == 0 || limit->nsecs < unit)
return -EOVERFLOW;
limit->tokens = limit->tokens_max = limit->nsecs;
+
+ if (tb[NFTA_LIMIT_BURST]) {
+ u64 rate;
+
+ limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
+
+ rate = limit->rate + limit->burst;
+ if (rate < limit->rate)
+ return -EOVERFLOW;
+
+ limit->rate = rate;
+ }
limit->last = ktime_get_ns();
return 0;
@@ -73,9 +86,11 @@ static int nft_limit_init(struct nft_limit *limit,
static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit)
{
u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
+ u64 rate = limit->rate - limit->burst;
- if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate)) ||
- nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)))
+ if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(rate)) ||
+ nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)) ||
+ nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)))
goto nla_put_failure;
return 0;
@@ -96,6 +111,7 @@ static void nft_limit_pkts_eval(const struct nft_expr *expr,
static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
[NFTA_LIMIT_RATE] = { .type = NLA_U64 },
[NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
+ [NFTA_LIMIT_BURST] = { .type = NLA_U32 },
};
static int nft_limit_pkts_init(const struct nft_ctx *ctx,
--
1.7.10.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH nf-next 5/6] netfilter: nft_limit: constant token cost per packet
2015-08-05 10:38 [PATCH nf-next 1/6] netfilter: nft_limit: rename to nft_limit_pkts Pablo Neira Ayuso
` (2 preceding siblings ...)
2015-08-05 10:38 ` [PATCH nf-next 4/6] netfilter: nft_limit: add burst parameter Pablo Neira Ayuso
@ 2015-08-05 10:38 ` Pablo Neira Ayuso
2015-08-05 10:38 ` [PATCH nf-next 6/6] netfilter: nft_limit: add per-byte limiting Pablo Neira Ayuso
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2015-08-05 10:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
The cost per packet can be calculated from the control plane path since this
doesn't ever change.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_limit.c | 25 ++++++++++++++++++-------
1 file changed, 18 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index d8c5ff1..b418698 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -98,13 +98,18 @@ nla_put_failure:
return -1;
}
+struct nft_limit_pkts {
+ struct nft_limit limit;
+ u64 cost;
+};
+
static void nft_limit_pkts_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
- struct nft_limit *priv = nft_expr_priv(expr);
+ struct nft_limit_pkts *priv = nft_expr_priv(expr);
- if (nft_limit_eval(priv, div_u64(priv->nsecs, priv->rate)))
+ if (nft_limit_eval(&priv->limit, priv->cost))
regs->verdict.code = NFT_BREAK;
}
@@ -118,22 +123,28 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
{
- struct nft_limit *priv = nft_expr_priv(expr);
+ struct nft_limit_pkts *priv = nft_expr_priv(expr);
+ int err;
- return nft_limit_init(priv, tb);
+ err = nft_limit_init(&priv->limit, tb);
+ if (err < 0)
+ return err;
+
+ priv->cost = div_u64(priv->limit.nsecs, priv->limit.rate);
+ return 0;
}
static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
- const struct nft_limit *priv = nft_expr_priv(expr);
+ const struct nft_limit_pkts *priv = nft_expr_priv(expr);
- return nft_limit_dump(skb, priv);
+ return nft_limit_dump(skb, &priv->limit);
}
static struct nft_expr_type nft_limit_type;
static const struct nft_expr_ops nft_limit_pkts_ops = {
.type = &nft_limit_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_limit)),
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),
.eval = nft_limit_pkts_eval,
.init = nft_limit_pkts_init,
.dump = nft_limit_pkts_dump,
--
1.7.10.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH nf-next 6/6] netfilter: nft_limit: add per-byte limiting
2015-08-05 10:38 [PATCH nf-next 1/6] netfilter: nft_limit: rename to nft_limit_pkts Pablo Neira Ayuso
` (3 preceding siblings ...)
2015-08-05 10:38 ` [PATCH nf-next 5/6] netfilter: nft_limit: constant token cost per packet Pablo Neira Ayuso
@ 2015-08-05 10:38 ` Pablo Neira Ayuso
2015-08-05 10:43 ` Patrick McHardy
4 siblings, 1 reply; 8+ messages in thread
From: Pablo Neira Ayuso @ 2015-08-05 10:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
This patch adds a new NFTA_LIMIT_TYPE netlink attribute to indicate the type of
limiting.
Contrary to per-packet limiting, the cost is calculated from the packet path
since this depends on the packet length.
The burst attribute indicates the number of bytes in which the rate can be
exceeded.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_tables.h | 7 ++++
net/netfilter/nft_limit.c | 63 ++++++++++++++++++++++++++++--
2 files changed, 66 insertions(+), 4 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index ef037dc..655fd04 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -783,18 +783,25 @@ enum nft_ct_attributes {
};
#define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
+enum nft_limit_type {
+ NFT_LIMIT_PKTS,
+ NFT_LIMIT_BYTES
+};
+
/**
* enum nft_limit_attributes - nf_tables limit expression netlink attributes
*
* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
* @NFTA_LIMIT_BURST: burst (NLA_U32)
+ * @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
*/
enum nft_limit_attributes {
NFTA_LIMIT_UNSPEC,
NFTA_LIMIT_RATE,
NFTA_LIMIT_UNIT,
NFTA_LIMIT_BURST,
+ NFTA_LIMIT_TYPE,
__NFTA_LIMIT_MAX
};
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index b418698..0322dd0 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -83,14 +83,16 @@ static int nft_limit_init(struct nft_limit *limit,
return 0;
}
-static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit)
+static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit,
+ enum nft_limit_type type)
{
u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
u64 rate = limit->rate - limit->burst;
if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(rate)) ||
nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)) ||
- nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)))
+ nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)) ||
+ nla_put_be32(skb, NFTA_LIMIT_TYPE, htonl(type)))
goto nla_put_failure;
return 0;
@@ -117,6 +119,7 @@ static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
[NFTA_LIMIT_RATE] = { .type = NLA_U64 },
[NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
[NFTA_LIMIT_BURST] = { .type = NLA_U32 },
+ [NFTA_LIMIT_TYPE] = { .type = NLA_U32 },
};
static int nft_limit_pkts_init(const struct nft_ctx *ctx,
@@ -138,7 +141,7 @@ static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
const struct nft_limit_pkts *priv = nft_expr_priv(expr);
- return nft_limit_dump(skb, &priv->limit);
+ return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
}
static struct nft_expr_type nft_limit_type;
@@ -150,9 +153,61 @@ static const struct nft_expr_ops nft_limit_pkts_ops = {
.dump = nft_limit_pkts_dump,
};
+static void nft_limit_bytes_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
+{
+ struct nft_limit *priv = nft_expr_priv(expr);
+ u64 cost = div_u64(priv->nsecs * pkt->skb->len, priv->rate);
+
+ if (nft_limit_eval(priv, cost))
+ regs->verdict.code = NFT_BREAK;
+}
+
+static int nft_limit_bytes_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+{
+ struct nft_limit *priv = nft_expr_priv(expr);
+
+ return nft_limit_init(priv, tb);
+}
+
+static int nft_limit_bytes_dump(struct sk_buff *skb,
+ const struct nft_expr *expr)
+{
+ const struct nft_limit *priv = nft_expr_priv(expr);
+
+ return nft_limit_dump(skb, priv, NFT_LIMIT_BYTES);
+}
+
+static const struct nft_expr_ops nft_limit_bytes_ops = {
+ .type = &nft_limit_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_limit)),
+ .eval = nft_limit_bytes_eval,
+ .init = nft_limit_bytes_init,
+ .dump = nft_limit_bytes_dump,
+};
+
+static const struct nft_expr_ops *
+nft_limit_select_ops(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+{
+ if (tb[NFTA_LIMIT_TYPE] == NULL)
+ return &nft_limit_pkts_ops;
+
+ switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) {
+ case NFT_LIMIT_PKTS:
+ return &nft_limit_pkts_ops;
+ case NFT_LIMIT_BYTES:
+ return &nft_limit_bytes_ops;
+ }
+ return ERR_PTR(-EOPNOTSUPP);
+}
+
static struct nft_expr_type nft_limit_type __read_mostly = {
.name = "limit",
- .ops = &nft_limit_pkts_ops,
+ .select_ops = nft_limit_select_ops,
.policy = nft_limit_policy,
.maxattr = NFTA_LIMIT_MAX,
.flags = NFT_EXPR_STATEFUL,
--
1.7.10.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH nf-next 6/6] netfilter: nft_limit: add per-byte limiting
2015-08-05 10:38 ` [PATCH nf-next 6/6] netfilter: nft_limit: add per-byte limiting Pablo Neira Ayuso
@ 2015-08-05 10:43 ` Patrick McHardy
2015-08-06 9:01 ` Pablo Neira Ayuso
0 siblings, 1 reply; 8+ messages in thread
From: Patrick McHardy @ 2015-08-05 10:43 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On 05.08, Pablo Neira Ayuso wrote:
> This patch adds a new NFTA_LIMIT_TYPE netlink attribute to indicate the type of
> limiting.
>
> Contrary to per-packet limiting, the cost is calculated from the packet path
> since this depends on the packet length.
>
> The burst attribute indicates the number of bytes in which the rate can be
> exceeded.
Thanks Pablo, I appreciate this rework. Just a suggestion, I'd propose to
use NFT_LIMIT_PKT_LENGTH instead of LIMIT_BYTES. I expect we might want to
add other limit types like connection rates etc in the future.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> include/uapi/linux/netfilter/nf_tables.h | 7 ++++
> net/netfilter/nft_limit.c | 63 ++++++++++++++++++++++++++++--
> 2 files changed, 66 insertions(+), 4 deletions(-)
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index ef037dc..655fd04 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -783,18 +783,25 @@ enum nft_ct_attributes {
> };
> #define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
>
> +enum nft_limit_type {
> + NFT_LIMIT_PKTS,
> + NFT_LIMIT_BYTES
> +};
> +
> /**
> * enum nft_limit_attributes - nf_tables limit expression netlink attributes
> *
> * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
> * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
> * @NFTA_LIMIT_BURST: burst (NLA_U32)
> + * @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
> */
> enum nft_limit_attributes {
> NFTA_LIMIT_UNSPEC,
> NFTA_LIMIT_RATE,
> NFTA_LIMIT_UNIT,
> NFTA_LIMIT_BURST,
> + NFTA_LIMIT_TYPE,
> __NFTA_LIMIT_MAX
> };
> #define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
> diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
> index b418698..0322dd0 100644
> --- a/net/netfilter/nft_limit.c
> +++ b/net/netfilter/nft_limit.c
> @@ -83,14 +83,16 @@ static int nft_limit_init(struct nft_limit *limit,
> return 0;
> }
>
> -static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit)
> +static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit,
> + enum nft_limit_type type)
> {
> u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
> u64 rate = limit->rate - limit->burst;
>
> if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(rate)) ||
> nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)) ||
> - nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)))
> + nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)) ||
> + nla_put_be32(skb, NFTA_LIMIT_TYPE, htonl(type)))
> goto nla_put_failure;
> return 0;
>
> @@ -117,6 +119,7 @@ static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
> [NFTA_LIMIT_RATE] = { .type = NLA_U64 },
> [NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
> [NFTA_LIMIT_BURST] = { .type = NLA_U32 },
> + [NFTA_LIMIT_TYPE] = { .type = NLA_U32 },
> };
>
> static int nft_limit_pkts_init(const struct nft_ctx *ctx,
> @@ -138,7 +141,7 @@ static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
> {
> const struct nft_limit_pkts *priv = nft_expr_priv(expr);
>
> - return nft_limit_dump(skb, &priv->limit);
> + return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
> }
>
> static struct nft_expr_type nft_limit_type;
> @@ -150,9 +153,61 @@ static const struct nft_expr_ops nft_limit_pkts_ops = {
> .dump = nft_limit_pkts_dump,
> };
>
> +static void nft_limit_bytes_eval(const struct nft_expr *expr,
> + struct nft_regs *regs,
> + const struct nft_pktinfo *pkt)
> +{
> + struct nft_limit *priv = nft_expr_priv(expr);
> + u64 cost = div_u64(priv->nsecs * pkt->skb->len, priv->rate);
> +
> + if (nft_limit_eval(priv, cost))
> + regs->verdict.code = NFT_BREAK;
> +}
> +
> +static int nft_limit_bytes_init(const struct nft_ctx *ctx,
> + const struct nft_expr *expr,
> + const struct nlattr * const tb[])
> +{
> + struct nft_limit *priv = nft_expr_priv(expr);
> +
> + return nft_limit_init(priv, tb);
> +}
> +
> +static int nft_limit_bytes_dump(struct sk_buff *skb,
> + const struct nft_expr *expr)
> +{
> + const struct nft_limit *priv = nft_expr_priv(expr);
> +
> + return nft_limit_dump(skb, priv, NFT_LIMIT_BYTES);
> +}
> +
> +static const struct nft_expr_ops nft_limit_bytes_ops = {
> + .type = &nft_limit_type,
> + .size = NFT_EXPR_SIZE(sizeof(struct nft_limit)),
> + .eval = nft_limit_bytes_eval,
> + .init = nft_limit_bytes_init,
> + .dump = nft_limit_bytes_dump,
> +};
> +
> +static const struct nft_expr_ops *
> +nft_limit_select_ops(const struct nft_ctx *ctx,
> + const struct nlattr * const tb[])
> +{
> + if (tb[NFTA_LIMIT_TYPE] == NULL)
> + return &nft_limit_pkts_ops;
> +
> + switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) {
> + case NFT_LIMIT_PKTS:
> + return &nft_limit_pkts_ops;
> + case NFT_LIMIT_BYTES:
> + return &nft_limit_bytes_ops;
> + }
> + return ERR_PTR(-EOPNOTSUPP);
> +}
> +
> static struct nft_expr_type nft_limit_type __read_mostly = {
> .name = "limit",
> - .ops = &nft_limit_pkts_ops,
> + .select_ops = nft_limit_select_ops,
> .policy = nft_limit_policy,
> .maxattr = NFTA_LIMIT_MAX,
> .flags = NFT_EXPR_STATEFUL,
> --
> 1.7.10.4
>
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH nf-next 6/6] netfilter: nft_limit: add per-byte limiting
2015-08-05 10:43 ` Patrick McHardy
@ 2015-08-06 9:01 ` Pablo Neira Ayuso
0 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2015-08-06 9:01 UTC (permalink / raw)
To: Patrick McHardy; +Cc: netfilter-devel
On Wed, Aug 05, 2015 at 12:43:54PM +0200, Patrick McHardy wrote:
> On 05.08, Pablo Neira Ayuso wrote:
> > This patch adds a new NFTA_LIMIT_TYPE netlink attribute to indicate the type of
> > limiting.
> >
> > Contrary to per-packet limiting, the cost is calculated from the packet path
> > since this depends on the packet length.
> >
> > The burst attribute indicates the number of bytes in which the rate can be
> > exceeded.
>
> Thanks Pablo, I appreciate this rework. Just a suggestion, I'd propose to
> use NFT_LIMIT_PKT_LENGTH instead of LIMIT_BYTES. I expect we might want to
> add other limit types like connection rates etc in the future.
Thanks Patrick. I'll rename this to a mixture of both: PKT_BYTES :)
^ permalink raw reply [flat|nested] 8+ messages in thread