system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-21 19:47:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'connlimit' of git://dev.medozas.de/linux

Browse source 
Conflicts:
	Documentation/feature-removal-schedule.txt

Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Patrick McHardy 2011-01-20 10:33:55 +01:00
parent 28a51ba59a cc4fc02257
commit 82d800d8e7
3 changed files with 49 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
Documentation/feature-removal-schedule.txt
View file

@ -611,3 +611,10 @@ Why: The adm9240, w83792d and w83793 hardware monitoring drivers have
Who: Jean Delvare <khali@linux-fr.org> Who: Jean Delvare <khali@linux-fr.org>
---------------------------- ----------------------------
What: xt_connlimit rev 0
When: 2012
Who: Jan Engelhardt <jengelh@medozas.de>
Files: net/netfilter/xt_connlimit.c
----------------------------

12
include/linux/netfilter/xt_connlimit.h
View file

@ -3,6 +3,11 @@
struct xt_connlimit_data; struct xt_connlimit_data;
enum {
XT_CONNLIMIT_INVERT = 1 << 0,
XT_CONNLIMIT_DADDR = 1 << 1,
};
struct xt_connlimit_info { struct xt_connlimit_info {
union { union {
union nf_inet_addr mask; union nf_inet_addr mask;
@ -14,6 +19,13 @@ struct xt_connlimit_info {
#endif #endif
}; };
unsigned int limit, inverse; unsigned int limit, inverse;
union {
/* revision 0 */
unsigned int inverse;
/* revision 1 */
__u32 flags;
};
/* Used internally by the kernel */ /* Used internally by the kernel */
struct xt_connlimit_data *data __attribute__((aligned(8))); struct xt_connlimit_data *data __attribute__((aligned(8)));

44
net/netfilter/xt_connlimit.c
View file

@ -193,10 +193,12 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (par->family == NFPROTO_IPV6) { if (par->family == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb); const struct ipv6hdr *iph = ipv6_hdr(skb);
memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr)); memcpy(&addr.ip6, (info->flags & XT_CONNLIMIT_DADDR) ?
&iph->daddr : &iph->saddr, sizeof(addr.ip6));
} else { } else {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
addr.ip = iph->saddr; addr.ip = (info->flags & XT_CONNLIMIT_DADDR) ?
iph->daddr : iph->saddr;
} }
spin_lock_bh(&info->data->lock); spin_lock_bh(&info->data->lock);
@ -208,7 +210,8 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
/* kmalloc failed, drop it entirely */ /* kmalloc failed, drop it entirely */
goto hotdrop; goto hotdrop;
return (connections > info->limit) ^ info->inverse; return (connections > info->limit) ^
!!(info->flags & XT_CONNLIMIT_INVERT);
hotdrop: hotdrop:
par->hotdrop = true; par->hotdrop = true;
@ -266,25 +269,38 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
kfree(info->data); kfree(info->data);
} }
static struct xt_match connlimit_mt_reg __read_mostly = { static struct xt_match connlimit_mt_reg[] __read_mostly = {
.name = "connlimit", {
.revision = 0, .name = "connlimit",
.family = NFPROTO_UNSPEC, .revision = 0,
.checkentry = connlimit_mt_check, .family = NFPROTO_UNSPEC,
.match = connlimit_mt, .checkentry = connlimit_mt_check,
.matchsize = sizeof(struct xt_connlimit_info), .match = connlimit_mt,
.destroy = connlimit_mt_destroy, .matchsize = sizeof(struct xt_connlimit_info),
.me = THIS_MODULE, .destroy = connlimit_mt_destroy,
.me = THIS_MODULE,
},
{
.name = "connlimit",
.revision = 1,
.family = NFPROTO_UNSPEC,
.checkentry = connlimit_mt_check,
.match = connlimit_mt,
.matchsize = sizeof(struct xt_connlimit_info),
.destroy = connlimit_mt_destroy,
.me = THIS_MODULE,
},
}; };
static int __init connlimit_mt_init(void) static int __init connlimit_mt_init(void)
{ {
return xt_register_match(&connlimit_mt_reg); return xt_register_matches(connlimit_mt_reg,
ARRAY_SIZE(connlimit_mt_reg));
} }
static void __exit connlimit_mt_exit(void) static void __exit connlimit_mt_exit(void)
{ {
xt_unregister_match(&connlimit_mt_reg); xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
} }
module_init(connlimit_mt_init); module_init(connlimit_mt_init);