| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263 |
- From: Linus Lüssing <linus.luessing@c0d3.blue>
- Date: Sun, 26 Nov 2017 05:19:21 +0100
- Subject: kernel: bridge: ebtables: Avoid resetting limit rule state
- Link: https://patchwork.ozlabs.org/patch/841210/
- Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
- diff --git a/target/linux/generic/patches-4.4/121-bridge-ebtables-Avoid-resetting-limit-rule-state.patch b/target/linux/generic/patches-4.4/121-bridge-ebtables-Avoid-resetting-limit-rule-state.patch
- new file mode 100644
- index 0000000000000000000000000000000000000000..417fdd75e543ebb6a3fdd56cb97fc83324eeb104
- --- /dev/null
- +++ b/target/linux/generic/patches-4.4/121-bridge-ebtables-Avoid-resetting-limit-rule-state.patch
- @@ -0,0 +1,50 @@
- +From 535097827e437bfa1906ed3210e6504750f4342b Mon Sep 17 00:00:00 2001
- +From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
- +Date: Sat, 25 Nov 2017 00:36:13 +0100
- +Subject: [PATCH] bridge: ebtables: Avoid resetting limit rule state
- +MIME-Version: 1.0
- +Content-Type: text/plain; charset=UTF-8
- +Content-Transfer-Encoding: 8bit
- +
- +So far any changes with ebtables will reset the state of limit rules,
- +leading to spikes in traffic. This is especially noticeable if changes
- +are done frequently, for instance via a daemon.
- +
- +This patch fixes this by bailing out from (re)setting if the limit
- +rule was initialized before.
- +
- +When sending packets every 250ms for 600s, with a
- +"--limit 1/sec --limit-burst 50" rule and a command like this
- +in the background:
- +
- +$ ebtables -N VOIDCHAIN
- +$ while true; do ebtables -F VOIDCHAIN; sleep 30; done
- +
- +The results are:
- +
- +Before: ~1600 packets
- +After: 650 packets
- +
- +Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
- +---
- + net/bridge/netfilter/ebt_limit.c | 4 ++++
- + 1 file changed, 4 insertions(+)
- +
- +diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
- +index 61a9f1be1263..f74b48633feb 100644
- +--- a/net/bridge/netfilter/ebt_limit.c
- ++++ b/net/bridge/netfilter/ebt_limit.c
- +@@ -69,6 +69,10 @@ static int ebt_limit_mt_check(const struct xt_mtchk_param *par)
- + {
- + struct ebt_limit_info *info = par->matchinfo;
- +
- ++ /* Do not reset state on unrelated table changes */
- ++ if (info->prev)
- ++ return 0;
- ++
- + /* Check for overflow. */
- + if (info->burst == 0 ||
- + user2credits(info->avg * info->burst) < user2credits(info->avg)) {
- +--
- +2.11.0
- +
|
