Patch: ebt_limit update for 2.6
Tom Marshall <tommy-qZBa9ISwN9Q+/[email protected]>
| Newsgroups | gmane.linux.network.bridge.ebtables.devel |
|---|---|
| Message-ID | <[email protected]> |
From changelog for 2.6.0-test8: <rusty-8n+1lVoiYb80n/[email protected]> [PATCH] ipt_limit fix for HZ=1000 The range that the iptables limit extension can specify depends on HZ. This means that rules which worked i386 2.4 (100 HZ) won't work on 2.6. The solution is to adjust the precision based on the HZ value (keeping the range of possible values the same). For extra geek cred, this is done by calculating a power-of-two constant below the maximum multiplication factor, which gcc then turns into a simple shift. This is the same for ebt_limit. *WARNING* I have not yet compiled or tested this, it's an untested merge (my bridge machine is not accessible from my current location). -- Logic is a systematic method of coming to the wrong conclusion with confidence.
ebt_limit.diff
(text/x-diff, 1.5 KB)
--- linux-2.6.0-test7/net/bridge/netfilter/ebt_limit.c 2003-10-08 12:24:07.000000000 -0700
+++ linux-2.6.0-test8/net/bridge/netfilter/ebt_limit.c 2003-10-18 05:57:57.000000000 -0700
@@ -20,7 +20,25 @@
static spinlock_t limit_lock = SPIN_LOCK_UNLOCKED;
-#define CREDITS_PER_JIFFY 128
+/* To get the maxmum range, we multiply by this factor (ie. you get N
+ * credits per jiffy). We want to allow a rate as low as 1 per day
+ * (slowest userspace tool allows), which means
+ * CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32. ie.
+ */
+#define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
+
+/* Repeated shift and or gives us all 1s, final shift and add 1 gives
+ * us the power of 2 below the theoretical max, so GCC simply does a
+ * shift.
+ */
+#define _POW2_BELOW2(x) ((x)|((x)>>1))
+#define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
+#define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
+#define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
+#define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
+#define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
+
+#define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
static int ebt_limit_match(const struct sk_buff *skb,
const struct net_device *in, const struct net_device *out,
@@ -68,7 +86,7 @@
/* Check for overflow. */
if (info->burst == 0 ||
user2credits(info->avg * info->burst) < user2credits(info->avg)) {
- printk("Overflow in ebt_limit: %u/%u\n",
+ printk("Overflow in ebt_limit, try lower: %u/%u\n",
info->avg, info->burst);
return -EINVAL;
}
signature.asc
(application/pgp-signature, 240 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj+RRZQACgkQFMm9uvwPXW6KIQCfY/zpJNzRKAiis0om7Evyo+5I qmIAn1yuNYNtTi1vxnR/AOVyNFeHOb6z =KrIM -----END PGP SIGNATURE-----