1
2
3
4
5
6
7
8
9
10
11
12
13#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14#include <linux/module.h>
15#include <linux/netdevice.h>
16#include <linux/spinlock.h>
17#include <linux/netfilter/x_tables.h>
18#include <linux/netfilter_bridge/ebtables.h>
19#include <linux/netfilter_bridge/ebt_limit.h>
20
21static DEFINE_SPINLOCK(limit_lock);
22
23#define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
24
25#define _POW2_BELOW2(x) ((x)|((x)>>1))
26#define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
27#define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
28#define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
29#define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
30#define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
31
32#define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
33
34static bool
35ebt_limit_mt(const struct sk_buff *skb, struct xt_action_param *par)
36{
37 struct ebt_limit_info *info = (void *)par->matchinfo;
38 unsigned long now = jiffies;
39
40 spin_lock_bh(&limit_lock);
41 info->credit += (now - xchg(&info->prev, now)) * CREDITS_PER_JIFFY;
42 if (info->credit > info->credit_cap)
43 info->credit = info->credit_cap;
44
45 if (info->credit >= info->cost) {
46
47 info->credit -= info->cost;
48 spin_unlock_bh(&limit_lock);
49 return true;
50 }
51
52 spin_unlock_bh(&limit_lock);
53 return false;
54}
55
56
57static u_int32_t
58user2credits(u_int32_t user)
59{
60
61 if (user > 0xFFFFFFFF / (HZ*CREDITS_PER_JIFFY))
62
63 return (user / EBT_LIMIT_SCALE) * HZ * CREDITS_PER_JIFFY;
64
65 return (user * HZ * CREDITS_PER_JIFFY) / EBT_LIMIT_SCALE;
66}
67
68static int ebt_limit_mt_check(const struct xt_mtchk_param *par)
69{
70 struct ebt_limit_info *info = par->matchinfo;
71
72
73 if (info->burst == 0 ||
74 user2credits(info->avg * info->burst) < user2credits(info->avg)) {
75 pr_info("overflow, try lower: %u/%u\n",
76 info->avg, info->burst);
77 return -EINVAL;
78 }
79
80
81 info->prev = jiffies;
82 info->credit = user2credits(info->avg * info->burst);
83 info->credit_cap = user2credits(info->avg * info->burst);
84 info->cost = user2credits(info->avg);
85 return 0;
86}
87
88
89#ifdef CONFIG_COMPAT
90
91
92
93
94struct ebt_compat_limit_info {
95 compat_uint_t avg, burst;
96 compat_ulong_t prev;
97 compat_uint_t credit, credit_cap, cost;
98};
99#endif
100
101static struct xt_match ebt_limit_mt_reg __read_mostly = {
102 .name = "limit",
103 .revision = 0,
104 .family = NFPROTO_BRIDGE,
105 .match = ebt_limit_mt,
106 .checkentry = ebt_limit_mt_check,
107 .matchsize = sizeof(struct ebt_limit_info),
108#ifdef CONFIG_COMPAT
109 .compatsize = sizeof(struct ebt_compat_limit_info),
110#endif
111 .me = THIS_MODULE,
112};
113
114static int __init ebt_limit_init(void)
115{
116 return xt_register_match(&ebt_limit_mt_reg);
117}
118
119static void __exit ebt_limit_fini(void)
120{
121 xt_unregister_match(&ebt_limit_mt_reg);
122}
123
124module_init(ebt_limit_init);
125module_exit(ebt_limit_fini);
126MODULE_DESCRIPTION("Ebtables: Rate-limit match");
127MODULE_LICENSE("GPL");
128