diff options
| author | Tim Gardner <tim.gardner@canonical.com> | 2010-03-16 19:53:13 +0100 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2010-03-17 15:53:12 +0100 |
| commit | 0079c5aee34880bcee7feee9960f0502c73dc5fa (patch) | |
| tree | a828b04c52f6650cbd654ca7b7de5ccdab5762c7 /include/linux/netfilter | |
| parent | 5be4a4f589841ef06fd79b241de3d5353a6c5efa (diff) | |
| download | linux-0079c5aee34880bcee7feee9960f0502c73dc5fa.tar.gz linux-0079c5aee34880bcee7feee9960f0502c73dc5fa.tar.bz2 linux-0079c5aee34880bcee7feee9960f0502c73dc5fa.zip | |
netfilter: xt_recent: add an entry reaper
One of the problems with the way xt_recent is implemented is that
there is no efficient way to remove expired entries. Of course,
one can write a rule '-m recent --remove', but you have to know
beforehand which entry to delete. This commit adds reaper
logic which checks the head of the LRU list when a rule
is invoked that has a '--seconds' value and XT_RECENT_REAP set. If an
entry ceases to accumulate time stamps, then it will eventually bubble
to the top of the LRU list where it is then reaped.
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'include/linux/netfilter')
| -rw-r--r-- | include/linux/netfilter/xt_recent.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/linux/netfilter/xt_recent.h b/include/linux/netfilter/xt_recent.h index d2c276609925..bba990ecb018 100644 --- a/include/linux/netfilter/xt_recent.h +++ b/include/linux/netfilter/xt_recent.h @@ -9,6 +9,7 @@ enum { XT_RECENT_UPDATE = 1 << 2, XT_RECENT_REMOVE = 1 << 3, XT_RECENT_TTL = 1 << 4, + XT_RECENT_REAP = 1 << 5, XT_RECENT_SOURCE = 0, XT_RECENT_DEST = 1, @@ -16,6 +17,9 @@ enum { XT_RECENT_NAME_LEN = 200, }; +/* Only allowed with --rcheck and --update */ +#define XT_RECENT_MODIFIERS (XT_RECENT_TTL|XT_RECENT_REAP) + struct xt_recent_mtinfo { __u32 seconds; __u32 hit_count; |