1414#include <linux/netfilter/nf_tables.h>
1515#include <net/netfilter/nf_tables.h>
1616
17- struct nft_limit {
17+ struct nft_limit_priv {
1818 spinlock_t lock ;
1919 u64 last ;
2020 u64 tokens ;
@@ -25,33 +25,33 @@ struct nft_limit {
2525 bool invert ;
2626};
2727
28- static inline bool nft_limit_eval (struct nft_limit * limit , u64 cost )
28+ static inline bool nft_limit_eval (struct nft_limit_priv * priv , u64 cost )
2929{
3030 u64 now , tokens ;
3131 s64 delta ;
3232
33- spin_lock_bh (& limit -> lock );
33+ spin_lock_bh (& priv -> lock );
3434 now = ktime_get_ns ();
35- tokens = limit -> tokens + now - limit -> last ;
36- if (tokens > limit -> tokens_max )
37- tokens = limit -> tokens_max ;
35+ tokens = priv -> tokens + now - priv -> last ;
36+ if (tokens > priv -> tokens_max )
37+ tokens = priv -> tokens_max ;
3838
39- limit -> last = now ;
39+ priv -> last = now ;
4040 delta = tokens - cost ;
4141 if (delta >= 0 ) {
42- limit -> tokens = delta ;
43- spin_unlock_bh (& limit -> lock );
44- return limit -> invert ;
42+ priv -> tokens = delta ;
43+ spin_unlock_bh (& priv -> lock );
44+ return priv -> invert ;
4545 }
46- limit -> tokens = tokens ;
47- spin_unlock_bh (& limit -> lock );
48- return !limit -> invert ;
46+ priv -> tokens = tokens ;
47+ spin_unlock_bh (& priv -> lock );
48+ return !priv -> invert ;
4949}
5050
5151/* Use same default as in iptables. */
5252#define NFT_LIMIT_PKT_BURST_DEFAULT 5
5353
54- static int nft_limit_init (struct nft_limit * limit ,
54+ static int nft_limit_init (struct nft_limit_priv * priv ,
5555 const struct nlattr * const tb [], bool pkts )
5656{
5757 u64 unit , tokens ;
@@ -60,58 +60,58 @@ static int nft_limit_init(struct nft_limit *limit,
6060 tb [NFTA_LIMIT_UNIT ] == NULL )
6161 return - EINVAL ;
6262
63- limit -> rate = be64_to_cpu (nla_get_be64 (tb [NFTA_LIMIT_RATE ]));
63+ priv -> rate = be64_to_cpu (nla_get_be64 (tb [NFTA_LIMIT_RATE ]));
6464 unit = be64_to_cpu (nla_get_be64 (tb [NFTA_LIMIT_UNIT ]));
65- limit -> nsecs = unit * NSEC_PER_SEC ;
66- if (limit -> rate == 0 || limit -> nsecs < unit )
65+ priv -> nsecs = unit * NSEC_PER_SEC ;
66+ if (priv -> rate == 0 || priv -> nsecs < unit )
6767 return - EOVERFLOW ;
6868
6969 if (tb [NFTA_LIMIT_BURST ])
70- limit -> burst = ntohl (nla_get_be32 (tb [NFTA_LIMIT_BURST ]));
70+ priv -> burst = ntohl (nla_get_be32 (tb [NFTA_LIMIT_BURST ]));
7171
72- if (pkts && limit -> burst == 0 )
73- limit -> burst = NFT_LIMIT_PKT_BURST_DEFAULT ;
72+ if (pkts && priv -> burst == 0 )
73+ priv -> burst = NFT_LIMIT_PKT_BURST_DEFAULT ;
7474
75- if (limit -> rate + limit -> burst < limit -> rate )
75+ if (priv -> rate + priv -> burst < priv -> rate )
7676 return - EOVERFLOW ;
7777
7878 if (pkts ) {
79- tokens = div64_u64 (limit -> nsecs , limit -> rate ) * limit -> burst ;
79+ tokens = div64_u64 (priv -> nsecs , priv -> rate ) * priv -> burst ;
8080 } else {
8181 /* The token bucket size limits the number of tokens can be
8282 * accumulated. tokens_max specifies the bucket size.
8383 * tokens_max = unit * (rate + burst) / rate.
8484 */
85- tokens = div64_u64 (limit -> nsecs * (limit -> rate + limit -> burst ),
86- limit -> rate );
85+ tokens = div64_u64 (priv -> nsecs * (priv -> rate + priv -> burst ),
86+ priv -> rate );
8787 }
8888
89- limit -> tokens = tokens ;
90- limit -> tokens_max = limit -> tokens ;
89+ priv -> tokens = tokens ;
90+ priv -> tokens_max = priv -> tokens ;
9191
9292 if (tb [NFTA_LIMIT_FLAGS ]) {
9393 u32 flags = ntohl (nla_get_be32 (tb [NFTA_LIMIT_FLAGS ]));
9494
9595 if (flags & NFT_LIMIT_F_INV )
96- limit -> invert = true;
96+ priv -> invert = true;
9797 }
98- limit -> last = ktime_get_ns ();
99- spin_lock_init (& limit -> lock );
98+ priv -> last = ktime_get_ns ();
99+ spin_lock_init (& priv -> lock );
100100
101101 return 0 ;
102102}
103103
104- static int nft_limit_dump (struct sk_buff * skb , const struct nft_limit * limit ,
104+ static int nft_limit_dump (struct sk_buff * skb , const struct nft_limit_priv * priv ,
105105 enum nft_limit_type type )
106106{
107- u32 flags = limit -> invert ? NFT_LIMIT_F_INV : 0 ;
108- u64 secs = div_u64 (limit -> nsecs , NSEC_PER_SEC );
107+ u32 flags = priv -> invert ? NFT_LIMIT_F_INV : 0 ;
108+ u64 secs = div_u64 (priv -> nsecs , NSEC_PER_SEC );
109109
110- if (nla_put_be64 (skb , NFTA_LIMIT_RATE , cpu_to_be64 (limit -> rate ),
110+ if (nla_put_be64 (skb , NFTA_LIMIT_RATE , cpu_to_be64 (priv -> rate ),
111111 NFTA_LIMIT_PAD ) ||
112112 nla_put_be64 (skb , NFTA_LIMIT_UNIT , cpu_to_be64 (secs ),
113113 NFTA_LIMIT_PAD ) ||
114- nla_put_be32 (skb , NFTA_LIMIT_BURST , htonl (limit -> burst )) ||
114+ nla_put_be32 (skb , NFTA_LIMIT_BURST , htonl (priv -> burst )) ||
115115 nla_put_be32 (skb , NFTA_LIMIT_TYPE , htonl (type )) ||
116116 nla_put_be32 (skb , NFTA_LIMIT_FLAGS , htonl (flags )))
117117 goto nla_put_failure ;
@@ -121,16 +121,16 @@ static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit,
121121 return -1 ;
122122}
123123
124- struct nft_limit_pkts {
125- struct nft_limit limit ;
124+ struct nft_limit_priv_pkts {
125+ struct nft_limit_priv limit ;
126126 u64 cost ;
127127};
128128
129129static void nft_limit_pkts_eval (const struct nft_expr * expr ,
130130 struct nft_regs * regs ,
131131 const struct nft_pktinfo * pkt )
132132{
133- struct nft_limit_pkts * priv = nft_expr_priv (expr );
133+ struct nft_limit_priv_pkts * priv = nft_expr_priv (expr );
134134
135135 if (nft_limit_eval (& priv -> limit , priv -> cost ))
136136 regs -> verdict .code = NFT_BREAK ;
@@ -148,7 +148,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
148148 const struct nft_expr * expr ,
149149 const struct nlattr * const tb [])
150150{
151- struct nft_limit_pkts * priv = nft_expr_priv (expr );
151+ struct nft_limit_priv_pkts * priv = nft_expr_priv (expr );
152152 int err ;
153153
154154 err = nft_limit_init (& priv -> limit , tb , true);
@@ -161,15 +161,15 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
161161
162162static int nft_limit_pkts_dump (struct sk_buff * skb , const struct nft_expr * expr )
163163{
164- const struct nft_limit_pkts * priv = nft_expr_priv (expr );
164+ const struct nft_limit_priv_pkts * priv = nft_expr_priv (expr );
165165
166166 return nft_limit_dump (skb , & priv -> limit , NFT_LIMIT_PKTS );
167167}
168168
169169static struct nft_expr_type nft_limit_type ;
170170static const struct nft_expr_ops nft_limit_pkts_ops = {
171171 .type = & nft_limit_type ,
172- .size = NFT_EXPR_SIZE (sizeof (struct nft_limit_pkts )),
172+ .size = NFT_EXPR_SIZE (sizeof (struct nft_limit_priv_pkts )),
173173 .eval = nft_limit_pkts_eval ,
174174 .init = nft_limit_pkts_init ,
175175 .dump = nft_limit_pkts_dump ,
@@ -179,7 +179,7 @@ static void nft_limit_bytes_eval(const struct nft_expr *expr,
179179 struct nft_regs * regs ,
180180 const struct nft_pktinfo * pkt )
181181{
182- struct nft_limit * priv = nft_expr_priv (expr );
182+ struct nft_limit_priv * priv = nft_expr_priv (expr );
183183 u64 cost = div64_u64 (priv -> nsecs * pkt -> skb -> len , priv -> rate );
184184
185185 if (nft_limit_eval (priv , cost ))
@@ -190,22 +190,22 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx,
190190 const struct nft_expr * expr ,
191191 const struct nlattr * const tb [])
192192{
193- struct nft_limit * priv = nft_expr_priv (expr );
193+ struct nft_limit_priv * priv = nft_expr_priv (expr );
194194
195195 return nft_limit_init (priv , tb , false);
196196}
197197
198198static int nft_limit_bytes_dump (struct sk_buff * skb ,
199199 const struct nft_expr * expr )
200200{
201- const struct nft_limit * priv = nft_expr_priv (expr );
201+ const struct nft_limit_priv * priv = nft_expr_priv (expr );
202202
203203 return nft_limit_dump (skb , priv , NFT_LIMIT_PKT_BYTES );
204204}
205205
206206static const struct nft_expr_ops nft_limit_bytes_ops = {
207207 .type = & nft_limit_type ,
208- .size = NFT_EXPR_SIZE (sizeof (struct nft_limit )),
208+ .size = NFT_EXPR_SIZE (sizeof (struct nft_limit_priv )),
209209 .eval = nft_limit_bytes_eval ,
210210 .init = nft_limit_bytes_init ,
211211 .dump = nft_limit_bytes_dump ,
@@ -240,7 +240,7 @@ static void nft_limit_obj_pkts_eval(struct nft_object *obj,
240240 struct nft_regs * regs ,
241241 const struct nft_pktinfo * pkt )
242242{
243- struct nft_limit_pkts * priv = nft_obj_data (obj );
243+ struct nft_limit_priv_pkts * priv = nft_obj_data (obj );
244244
245245 if (nft_limit_eval (& priv -> limit , priv -> cost ))
246246 regs -> verdict .code = NFT_BREAK ;
@@ -250,7 +250,7 @@ static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
250250 const struct nlattr * const tb [],
251251 struct nft_object * obj )
252252{
253- struct nft_limit_pkts * priv = nft_obj_data (obj );
253+ struct nft_limit_priv_pkts * priv = nft_obj_data (obj );
254254 int err ;
255255
256256 err = nft_limit_init (& priv -> limit , tb , true);
@@ -265,15 +265,15 @@ static int nft_limit_obj_pkts_dump(struct sk_buff *skb,
265265 struct nft_object * obj ,
266266 bool reset )
267267{
268- const struct nft_limit_pkts * priv = nft_obj_data (obj );
268+ const struct nft_limit_priv_pkts * priv = nft_obj_data (obj );
269269
270270 return nft_limit_dump (skb , & priv -> limit , NFT_LIMIT_PKTS );
271271}
272272
273273static struct nft_object_type nft_limit_obj_type ;
274274static const struct nft_object_ops nft_limit_obj_pkts_ops = {
275275 .type = & nft_limit_obj_type ,
276- .size = NFT_EXPR_SIZE (sizeof (struct nft_limit_pkts )),
276+ .size = NFT_EXPR_SIZE (sizeof (struct nft_limit_priv_pkts )),
277277 .init = nft_limit_obj_pkts_init ,
278278 .eval = nft_limit_obj_pkts_eval ,
279279 .dump = nft_limit_obj_pkts_dump ,
@@ -283,7 +283,7 @@ static void nft_limit_obj_bytes_eval(struct nft_object *obj,
283283 struct nft_regs * regs ,
284284 const struct nft_pktinfo * pkt )
285285{
286- struct nft_limit * priv = nft_obj_data (obj );
286+ struct nft_limit_priv * priv = nft_obj_data (obj );
287287 u64 cost = div64_u64 (priv -> nsecs * pkt -> skb -> len , priv -> rate );
288288
289289 if (nft_limit_eval (priv , cost ))
@@ -294,7 +294,7 @@ static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
294294 const struct nlattr * const tb [],
295295 struct nft_object * obj )
296296{
297- struct nft_limit * priv = nft_obj_data (obj );
297+ struct nft_limit_priv * priv = nft_obj_data (obj );
298298
299299 return nft_limit_init (priv , tb , false);
300300}
@@ -303,15 +303,15 @@ static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
303303 struct nft_object * obj ,
304304 bool reset )
305305{
306- const struct nft_limit * priv = nft_obj_data (obj );
306+ const struct nft_limit_priv * priv = nft_obj_data (obj );
307307
308308 return nft_limit_dump (skb , priv , NFT_LIMIT_PKT_BYTES );
309309}
310310
311311static struct nft_object_type nft_limit_obj_type ;
312312static const struct nft_object_ops nft_limit_obj_bytes_ops = {
313313 .type = & nft_limit_obj_type ,
314- .size = sizeof (struct nft_limit ),
314+ .size = sizeof (struct nft_limit_priv ),
315315 .init = nft_limit_obj_bytes_init ,
316316 .eval = nft_limit_obj_bytes_eval ,
317317 .dump = nft_limit_obj_bytes_dump ,
0 commit comments