Commit 8bdf3626 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_limit: constant token cost per packet 



The cost per packet can be calculated from the control plane path since this
doesn't ever change.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 3e87baaf

net/netfilter/nft_limit.c

+18 −7
Original line number Diff line number Diff line
@@ -98,13 +98,18 @@ static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit) 
	return -1;

}



struct nft_limit_pkts {

	struct nft_limit	limit;

	u64			cost;

};



static void nft_limit_pkts_eval(const struct nft_expr *expr,

				struct nft_regs *regs,

				const struct nft_pktinfo *pkt)

{

	struct nft_limit *priv = nft_expr_priv(expr);

	struct nft_limit_pkts *priv = nft_expr_priv(expr);



	if (nft_limit_eval(priv, div_u64(priv->nsecs, priv->rate)))

	if (nft_limit_eval(&priv->limit, priv->cost))

		regs->verdict.code = NFT_BREAK;

}
@@ -118,22 +123,28 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx, 
			       const struct nft_expr *expr,

			       const struct nlattr * const tb[])

{

	struct nft_limit *priv = nft_expr_priv(expr);

	struct nft_limit_pkts *priv = nft_expr_priv(expr);

	int err;



	return nft_limit_init(priv, tb);

	err = nft_limit_init(&priv->limit, tb);

	if (err < 0)

		return err;



	priv->cost = div_u64(priv->limit.nsecs, priv->limit.rate);

	return 0;

}



static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)

{

	const struct nft_limit *priv = nft_expr_priv(expr);

	const struct nft_limit_pkts *priv = nft_expr_priv(expr);



	return nft_limit_dump(skb, priv);

	return nft_limit_dump(skb, &priv->limit);

}



static struct nft_expr_type nft_limit_type;

static const struct nft_expr_ops nft_limit_pkts_ops = {

	.type		= &nft_limit_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_limit)),

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),

	.eval		= nft_limit_pkts_eval,

	.init		= nft_limit_pkts_init,

	.dump		= nft_limit_pkts_dump,