From owner-freebsd-ipfw@FreeBSD.ORG Fri May 30 17:00:01 2014 Return-Path: Delivered-To: freebsd-ipfw@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4B1028D4 for ; Fri, 30 May 2014 17:00:01 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 38EE82A7B for ; Fri, 30 May 2014 17:00:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s4UH016R031306 for ; Fri, 30 May 2014 17:00:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s4UH00sv031305; Fri, 30 May 2014 17:00:00 GMT (envelope-from gnats) Date: Fri, 30 May 2014 17:00:00 GMT Message-Id: <201405301700.s4UH00sv031305@freefall.freebsd.org> To: freebsd-ipfw@FreeBSD.org Cc: From: "bycn82" Subject: Re: kern/189720: [ipfw] [patch] pps action for ipfw Reply-To: "bycn82" X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 May 2014 17:00:01 -0000 The following reply was made to PR kern/189720; it has been noted by GNATS. From: "bycn82" To: , Cc: "Luigi Rizzo" Subject: Re: kern/189720: [ipfw] [patch] pps action for ipfw Date: Sat, 31 May 2014 00:53:56 +0800 This is a multipart message in MIME format. ------=_NextPart_000_0002_01CF7C6A.CF4B9B50 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0003_01CF7C6A.CF4B9B50" ------=_NextPart_001_0003_01CF7C6A.CF4B9B50 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit 1. Add static int to store the value of kern.hz 2. Convert the duration into number of ticks based on kern.hz regards, bycn82 ------=_NextPart_001_0003_01CF7C6A.CF4B9B50 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

1. Add = static int to store the value of kern.hz

2. = Convert the duration into number of ticks based = on =C2=A0kern.hz

regards,

bycn82

------=_NextPart_001_0003_01CF7C6A.CF4B9B50-- ------=_NextPart_000_0002_01CF7C6A.CF4B9B50 Content-Type: application/octet-stream; name="pps.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="pps.patch" Index: sbin/ipfw/ipfw.8=0A= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= --- sbin/ipfw/ipfw.8 (revision 266886)=0A= +++ sbin/ipfw/ipfw.8 (working copy)=0A= @@ -602,6 +602,14 @@=0A= Note: logging is done after all other packet matching conditions=0A= have been successfully verified, and before performing the final=0A= action (accept, deny, etc.) on the packet.=0A= +.It Cm pps Ar limit duration=0A= +Rule with the =0A= +.Cm pps=0A= +keyword will allow the first=0A= +.Ar limit=0A= +packets in recent =0A= +.Ar duration =0A= +milliseconds=0A= .It Cm tag Ar number=0A= When a packet matches a rule with the=0A= .Cm tag=0A= Index: sbin/ipfw/ipfw2.c=0A= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= --- sbin/ipfw/ipfw2.c (revision 266886)=0A= +++ sbin/ipfw/ipfw2.c (working copy)=0A= @@ -244,6 +244,7 @@=0A= { "allow", TOK_ACCEPT },=0A= { "permit", TOK_ACCEPT },=0A= { "count", TOK_COUNT },=0A= + { "pps", TOK_PPS },=0A= { "pipe", TOK_PIPE },=0A= { "queue", TOK_QUEUE },=0A= { "divert", TOK_DIVERT },=0A= @@ -1232,6 +1233,13 @@=0A= PRINT_UINT_ARG("skipto ", cmd->arg1);=0A= break;=0A= =0A= + case O_PPS:=0A= + {=0A= + ipfw_insn_pps *pps=3D(ipfw_insn_pps *)cmd;=0A= + printf("pps %d %d",cmd->arg1,pps->duration);=0A= + break; =0A= + }=0A= +=0A= case O_PIPE:=0A= PRINT_UINT_ARG("pipe ", cmd->arg1);=0A= break;=0A= @@ -2985,6 +2993,24 @@=0A= case TOK_COUNT:=0A= action->opcode =3D O_COUNT;=0A= break;=0A= + =0A= + case TOK_PPS:=0A= + action->opcode =3D O_PPS;=0A= + ipfw_insn_pps *p =3D (ipfw_insn_pps *)action;=0A= + action->len =3D F_INSN_SIZE(ipfw_insn_pps);=0A= + if (isdigit(**av)) {=0A= + action->arg1 =3D strtoul(*av, NULL, 10);=0A= + av++;=0A= + }else{=0A= + errx(EX_USAGE, "illegal argument pps `limit` %s", *av);=0A= + }=0A= + if (isdigit(**av)) {=0A= + p->duration =3D strtoul(*av, NULL, 10);=0A= + av++;=0A= + }else{=0A= + errx(EX_USAGE,"illegal arugment pps `duration` %s", *av);=0A= + }=0A= + break; =0A= =0A= case TOK_NAT:=0A= action->opcode =3D O_NAT;=0A= Index: sbin/ipfw/ipfw2.h=0A= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= --- sbin/ipfw/ipfw2.h (revision 266886)=0A= +++ sbin/ipfw/ipfw2.h (working copy)=0A= @@ -92,6 +92,7 @@=0A= TOK_NGTEE,=0A= TOK_FORWARD,=0A= TOK_SKIPTO,=0A= + TOK_PPS,=0A= TOK_DENY,=0A= TOK_REJECT,=0A= TOK_RESET,=0A= Index: sys/netinet/ip_fw.h=0A= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= --- sys/netinet/ip_fw.h (revision 266886)=0A= +++ sys/netinet/ip_fw.h (working copy)=0A= @@ -165,6 +165,7 @@=0A= O_REJECT, /* arg1=3Dicmp arg (same as deny) */=0A= O_COUNT, /* none */=0A= O_SKIPTO, /* arg1=3Dnext rule number */=0A= + O_PPS, /* arg1=3Dlimit, pps->duration */=0A= O_PIPE, /* arg1=3Dpipe number */=0A= O_QUEUE, /* arg1=3Dqueue number */=0A= O_DIVERT, /* arg1=3Dport number */=0A= @@ -378,6 +379,16 @@=0A= } ipfw_insn_log;=0A= =0A= /*=0A= + * This is used for PPS=0A= + */=0A= +typedef struct _ipfw_insn_pps{=0A= + ipfw_insn o;=0A= + uint32_t start_time;=0A= + uint32_t count;=0A= + uint32_t duration;=0A= +} ipfw_insn_pps;=0A= +=0A= +/*=0A= * Data structures required by both ipfw(8) and ipfw(4) but not part of = the=0A= * management API are protected by IPFW_INTERNAL.=0A= */=0A= Index: sys/netpfil/ipfw/ip_fw2.c=0A= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= --- sys/netpfil/ipfw/ip_fw2.c (revision 266886)=0A= +++ sys/netpfil/ipfw/ip_fw2.c (working copy)=0A= @@ -124,6 +124,7 @@=0A= /* Use 128 tables by default */=0A= static unsigned int default_fw_tables =3D IPFW_TABLES_DEFAULT;=0A= =0A= +static unsigned int kern_hz=3D1000;=0A= /*=0A= * Each rule belongs to one of 32 different sets (0..31).=0A= * The variable set_disable contains one bit per set.=0A= @@ -186,6 +187,7 @@=0A= SYSCTL_VNET_INT(_net_inet_ip_fw, OID_AUTO, static_count,=0A= CTLFLAG_RD, &VNET_NAME(layer3_chain.n_rules), 0,=0A= "Number of static rules");=0A= +TUNABLE_INT("kern.hz", (int *)&kern_hz);=0A= =0A= #ifdef INET6=0A= SYSCTL_DECL(_net_inet6_ip6);=0A= @@ -2189,6 +2191,31 @@=0A= continue;=0A= break; /* not reached */=0A= =0A= + case O_PPS:{=0A= + int duration_in_ticks;=0A= + ipfw_insn_pps *pps =3D (ipfw_insn_pps *)cmd;=0A= + if(1000/kern_hz >=3D pps->duration){=0A= + duration_in_ticks=3D1;=0A= + }else{=0A= + duration_in_ticks=3Dpps->duration*kern_hz/1000+1;=0A= + }=0A= + if(pps->start_time+duration_in_ticks>=3D ticks){=0A= + if(pps->count < cmd->arg1){=0A= + retval =3D IP_FW_PASS;=0A= + }else{=0A= + retval =3D IP_FW_DENY;=0A= + }=0A= + pps->count++;=0A= + }else{=0A= + pps->start_time=3Dticks;=0A= + pps->count=3D1;=0A= + retval =3D IP_FW_PASS;=0A= + }=0A= + l =3D 0; =0A= + done =3D 1;=0A= + break; =0A= + }=0A= +=0A= case O_CALLRETURN: {=0A= /*=0A= * Implementation of `subroutine' call/return,=0A= Index: sys/netpfil/ipfw/ip_fw_sockopt.c=0A= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= --- sys/netpfil/ipfw/ip_fw_sockopt.c (revision 266886)=0A= +++ sys/netpfil/ipfw/ip_fw_sockopt.c (working copy)=0A= @@ -703,6 +703,12 @@=0A= goto bad_size;=0A= break;=0A= =0A= + case O_PPS:=0A= + have_action=3D1;=0A= + if (cmdlen !=3D F_INSN_SIZE(ipfw_insn_pps))=0A= + goto bad_size;=0A= + break;=0A= +=0A= case O_PIPE:=0A= case O_QUEUE:=0A= if (cmdlen !=3D F_INSN_SIZE(ipfw_insn))=0A= ------=_NextPart_000_0002_01CF7C6A.CF4B9B50--