forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

netfilter: nft_limit: allow to invert matching criteria

Browse source 
This patch allows you to invert the ratelimit matching criteria, so you
can match packets over the ratelimit. This is required to support what
hashlimit does.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2015-12-28 18:21:44 +01:00
commit c7862a5f0d
2 changed files with 19 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/uapi/linux/netfilter/nf_tables.h
View file

@ -780,6 +780,10 @@ enum nft_limit_type {
NFT_LIMIT_PKT_BYTES
};
enum nft_limit_flags {
NFT_LIMIT_F_INV = (1 << 0),
};
/**
* enum nft_limit_attributes - nf_tables limit expression netlink attributes
*
@ -787,6 +791,7 @@ enum nft_limit_type {
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
* @NFTA_LIMIT_BURST: burst (NLA_U32)
* @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
* @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
*/
enum nft_limit_attributes {
NFTA_LIMIT_UNSPEC,
@ -794,6 +799,7 @@ enum nft_limit_attributes {
NFTA_LIMIT_UNIT,
NFTA_LIMIT_BURST,
NFTA_LIMIT_TYPE,
NFTA_LIMIT_FLAGS,
__NFTA_LIMIT_MAX
};
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)