[NETFILTER]: xt_hashlimit match, revision 1

Introduces the xt_hashlimit match revision 1. It adds support for
kernel-level inversion and grouping source and/or destination IP
addresses, allowing to limit on a per-subnet basis. While this would
technically obsolete xt_limit, xt_hashlimit is a more expensive due
to the hashbucketing.

Kernel-level inversion: Previously you had to do user-level inversion:

	iptables -N foo
	iptables -A foo -m hashlimit --hashlimit(-upto) 5/s -j RETURN
	iptables -A foo -j DROP
	iptables -A INPUT -j foo

now it is simpler:

	iptables -A INPUT -m hashlimit --hashlimit-over 5/s -j DROP

Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 32 insertions, 5 deletions

diff --git a/include/linux/netfilter/xt_hashlimit.h b/include/linux/netfilter/xt_hashlimit.h
index c19972e4564d..58b818ee41ca 100644
--- a/include/linux/netfilter/xt_hashlimit.h
+++ b/include/linux/netfilter/xt_hashlimit.h
@@ -9,13 +9,16 @@
 /* details of this structure hidden by the implementation */
 struct xt_hashlimit_htable;
 
-#define XT_HASHLIMIT_HASH_DIP   0x0001
-#define XT_HASHLIMIT_HASH_DPT   0x0002
-#define XT_HASHLIMIT_HASH_SIP   0x0004
-#define XT_HASHLIMIT_HASH_SPT   0x0008
+enum {
+        XT_HASHLIMIT_HASH_DIP = 1 << 0,
+        XT_HASHLIMIT_HASH_DPT = 1 << 1,
+        XT_HASHLIMIT_HASH_SIP = 1 << 2,
+        XT_HASHLIMIT_HASH_SPT = 1 << 3,
+        XT_HASHLIMIT_INVERT   = 1 << 4,
+};
 
 struct hashlimit_cfg {
-        u_int32_t mode;   /* bitmask of IPT_HASHLIMIT_HASH_* */
+        u_int32_t mode;   /* bitmask of XT_HASHLIMIT_HASH_* */
         u_int32_t avg;    /* Average secs between packets * scale */
         u_int32_t burst;  /* Period multiplier for upper limit. */
 
@@ -37,4 +40,28 @@ struct xt_hashlimit_info {
                 struct xt_hashlimit_info *master;
         } u;
 };
+
+struct hashlimit_cfg1 {
+        u_int32_t mode;   /* bitmask of XT_HASHLIMIT_HASH_* */
+        u_int32_t avg;    /* Average secs between packets * scale */
+        u_int32_t burst;  /* Period multiplier for upper limit. */
+
+        /* user specified */
+        u_int32_t size;         /* how many buckets */
+        u_int32_t max;          /* max number of entries */
+        u_int32_t gc_interval;  /* gc interval */
+        u_int32_t expire;       /* when do entries expire? */
+
+        u_int8_t srcmask, dstmask;
+};
+
+struct xt_hashlimit_mtinfo1 {
+        char name[IFNAMSIZ];
+        struct hashlimit_cfg1 cfg;
+
+        /* Used internally by the kernel */
+        struct xt_hashlimit_htable *hinfo __attribute__((aligned(8)));
+        struct xt_hashlimit_mtinfo1 *master __attribute__((aligned(8)));
+};
+
 #endif /*_XT_HASHLIMIT_H*/