diff options
| author | Phil Oester <kernel@linuxace.com> | 2013-10-05 09:44:56 -0700 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-10-22 10:52:32 +0200 |
| commit | b259d1aca0db1bed5af3e4fe378f8aeb4d3ce645 (patch) | |
| tree | 0dea304c654a8c4d107720b4c73a561f623b1468 /src/parser.y | |
| parent | 2855909e46f4646f137a96892bd5c465fa1193f8 (diff) | |
src: operational limit match
The nft limit match currently does not work at all. Below patches to nftables,
libnftables, and kernel address the issue. A few notes on the implementation:
- Removed support for nano/micro/milli second limits. These seem pointless,
given we are using jiffies in the limit match, not a hpet. And who really
needs to limit items down to sub-second level??
- 'depth' member is removed as unnecessary. All we need in the kernel is the
rate and the unit.
- 'stamp' member becomes the time we need to next refresh the token bucket,
instead of being updated on every packet which goes through the match.
This closes netfilter bugzilla #827, reported by Eric Leblond.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/parser.y')
| -rw-r--r-- | src/parser.y | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/src/parser.y b/src/parser.y index 074f0758..cfe1e863 100644 --- a/src/parser.y +++ b/src/parser.y @@ -1003,14 +1003,11 @@ limit_stmt : LIMIT RATE NUM SLASH time_unit } ; -time_unit : NANOSECOND { $$ = 1ULL; } - | MICROSECOND { $$ = 1ULL * 1000; } - | MILLISECOND { $$ = 1ULL * 1000 * 1000; } - | SECOND { $$ = 1ULL * 1000 * 1000 * 1000; } - | MINUTE { $$ = 1ULL * 1000 * 1000 * 1000 * 60; } - | HOUR { $$ = 1ULL * 1000 * 1000 * 1000 * 60 * 60; } - | DAY { $$ = 1ULL * 1000 * 1000 * 1000 * 60 * 60 * 24; } - | WEEK { $$ = 1ULL * 1000 * 1000 * 1000 * 60 * 60 * 24 * 7; } +time_unit : SECOND { $$ = 1ULL; } + | MINUTE { $$ = 1ULL * 60; } + | HOUR { $$ = 1ULL * 60 * 60; } + | DAY { $$ = 1ULL * 60 * 60 * 24; } + | WEEK { $$ = 1ULL * 60 * 60 * 24 * 7; } ; reject_stmt : _REJECT |