1 /* iptables match extension to limit the number of packets per second
2 * seperately for each hashbucket (sourceip/sourceport/dstip/dstport)
4 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
6 * $Id: ipt_hashlimit.c 3244 2004-10-20 16:24:29Z laforge@netfilter.org $
8 * Development of this code was funded by Astaro AG, http://www.astaro.com/
10 #include <linux/module.h>
11 #include <linux/spinlock.h>
12 #include <linux/random.h>
13 #include <linux/jhash.h>
14 #include <linux/slab.h>
15 #include <linux/vmalloc.h>
16 #include <linux/proc_fs.h>
17 #include <linux/seq_file.h>
18 #include <linux/list.h>
19 #include <linux/skbuff.h>
23 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
24 #include <linux/ipv6.h>
28 #include <linux/netfilter/x_tables.h>
29 #include <linux/netfilter_ipv4/ip_tables.h>
30 #include <linux/netfilter_ipv6/ip6_tables.h>
31 #include <linux/netfilter/xt_hashlimit.h>
32 #include <linux/mutex.h>
34 MODULE_LICENSE("GPL");
35 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
36 MODULE_DESCRIPTION("iptables match for limiting per hash-bucket");
37 MODULE_ALIAS("ipt_hashlimit");
38 MODULE_ALIAS("ip6t_hashlimit");
40 /* need to declare this at the top */
41 static struct proc_dir_entry
*hashlimit_procdir4
;
42 static struct proc_dir_entry
*hashlimit_procdir6
;
43 static const struct file_operations dl_file_ops
;
52 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
64 /* static / read-only parts in the beginning */
65 struct hlist_node node
;
66 struct dsthash_dst dst
;
68 /* modified structure members in the end */
69 unsigned long expires
; /* precalculated expiry time */
71 unsigned long prev
; /* last modification */
73 u_int32_t credit_cap
, cost
;
77 struct xt_hashlimit_htable
{
78 struct hlist_node node
; /* global list of all htables */
82 struct hashlimit_cfg cfg
; /* config */
85 spinlock_t lock
; /* lock for list_head */
86 u_int32_t rnd
; /* random seed for hash */
88 unsigned int count
; /* number entries in table */
89 struct timer_list timer
; /* timer for gc */
92 struct proc_dir_entry
*pde
;
94 struct hlist_head hash
[0]; /* hashtable itself */
97 static DEFINE_MUTEX(hashlimit_mutex
); /* protects htables list */
98 static HLIST_HEAD(hashlimit_htables
);
99 static struct kmem_cache
*hashlimit_cachep __read_mostly
;
101 static inline int dst_cmp(const struct dsthash_ent
*ent
, struct dsthash_dst
*b
)
103 return !memcmp(&ent
->dst
, b
, sizeof(ent
->dst
));
107 hash_dst(const struct xt_hashlimit_htable
*ht
, const struct dsthash_dst
*dst
)
109 u_int32_t hash
= jhash2((const u32
*)dst
,
110 sizeof(*dst
)/sizeof(u32
),
113 * Instead of returning hash % ht->cfg.size (implying a divide)
114 * we return the high 32 bits of the (hash * ht->cfg.size) that will
115 * give results between [0 and cfg.size-1] and same hash distribution,
116 * but using a multiply, less expensive than a divide
118 return ((u64
)hash
* ht
->cfg
.size
) >> 32;
121 static struct dsthash_ent
*
122 dsthash_find(const struct xt_hashlimit_htable
*ht
, struct dsthash_dst
*dst
)
124 struct dsthash_ent
*ent
;
125 struct hlist_node
*pos
;
126 u_int32_t hash
= hash_dst(ht
, dst
);
128 if (!hlist_empty(&ht
->hash
[hash
])) {
129 hlist_for_each_entry(ent
, pos
, &ht
->hash
[hash
], node
)
130 if (dst_cmp(ent
, dst
))
136 /* allocate dsthash_ent, initialize dst, put in htable and lock it */
137 static struct dsthash_ent
*
138 dsthash_alloc_init(struct xt_hashlimit_htable
*ht
, struct dsthash_dst
*dst
)
140 struct dsthash_ent
*ent
;
142 /* initialize hash with random val at the time we allocate
143 * the first hashtable entry */
144 if (!ht
->rnd_initialized
) {
145 get_random_bytes(&ht
->rnd
, 4);
146 ht
->rnd_initialized
= 1;
149 if (ht
->cfg
.max
&& ht
->count
>= ht
->cfg
.max
) {
150 /* FIXME: do something. question is what.. */
153 "xt_hashlimit: max count of %u reached\n",
158 ent
= kmem_cache_alloc(hashlimit_cachep
, GFP_ATOMIC
);
162 "xt_hashlimit: can't allocate dsthash_ent\n");
165 memcpy(&ent
->dst
, dst
, sizeof(ent
->dst
));
167 hlist_add_head(&ent
->node
, &ht
->hash
[hash_dst(ht
, dst
)]);
173 dsthash_free(struct xt_hashlimit_htable
*ht
, struct dsthash_ent
*ent
)
175 hlist_del(&ent
->node
);
176 kmem_cache_free(hashlimit_cachep
, ent
);
179 static void htable_gc(unsigned long htlong
);
181 static int htable_create(struct xt_hashlimit_info
*minfo
, int family
)
183 struct xt_hashlimit_htable
*hinfo
;
188 size
= minfo
->cfg
.size
;
190 size
= ((num_physpages
<< PAGE_SHIFT
) / 16384) /
191 sizeof(struct list_head
);
192 if (num_physpages
> (1024 * 1024 * 1024 / PAGE_SIZE
))
197 /* FIXME: don't use vmalloc() here or anywhere else -HW */
198 hinfo
= vmalloc(sizeof(struct xt_hashlimit_htable
) +
199 sizeof(struct list_head
) * size
);
201 printk(KERN_ERR
"xt_hashlimit: unable to create hashtable\n");
204 minfo
->hinfo
= hinfo
;
206 /* copy match config into hashtable config */
207 memcpy(&hinfo
->cfg
, &minfo
->cfg
, sizeof(hinfo
->cfg
));
208 hinfo
->cfg
.size
= size
;
210 hinfo
->cfg
.max
= 8 * hinfo
->cfg
.size
;
211 else if (hinfo
->cfg
.max
< hinfo
->cfg
.size
)
212 hinfo
->cfg
.max
= hinfo
->cfg
.size
;
214 for (i
= 0; i
< hinfo
->cfg
.size
; i
++)
215 INIT_HLIST_HEAD(&hinfo
->hash
[i
]);
219 hinfo
->family
= family
;
220 hinfo
->rnd_initialized
= 0;
221 spin_lock_init(&hinfo
->lock
);
222 hinfo
->pde
= create_proc_entry(minfo
->name
, 0,
223 family
== AF_INET
? hashlimit_procdir4
:
229 hinfo
->pde
->proc_fops
= &dl_file_ops
;
230 hinfo
->pde
->data
= hinfo
;
232 setup_timer(&hinfo
->timer
, htable_gc
, (unsigned long )hinfo
);
233 hinfo
->timer
.expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.gc_interval
);
234 add_timer(&hinfo
->timer
);
236 hlist_add_head(&hinfo
->node
, &hashlimit_htables
);
241 static int select_all(struct xt_hashlimit_htable
*ht
, struct dsthash_ent
*he
)
246 static int select_gc(struct xt_hashlimit_htable
*ht
, struct dsthash_ent
*he
)
248 return time_after_eq(jiffies
, he
->expires
);
251 static void htable_selective_cleanup(struct xt_hashlimit_htable
*ht
,
252 int (*select
)(struct xt_hashlimit_htable
*ht
,
253 struct dsthash_ent
*he
))
257 /* lock hash table and iterate over it */
258 spin_lock_bh(&ht
->lock
);
259 for (i
= 0; i
< ht
->cfg
.size
; i
++) {
260 struct dsthash_ent
*dh
;
261 struct hlist_node
*pos
, *n
;
262 hlist_for_each_entry_safe(dh
, pos
, n
, &ht
->hash
[i
], node
) {
263 if ((*select
)(ht
, dh
))
264 dsthash_free(ht
, dh
);
267 spin_unlock_bh(&ht
->lock
);
270 /* hash table garbage collector, run by timer */
271 static void htable_gc(unsigned long htlong
)
273 struct xt_hashlimit_htable
*ht
= (struct xt_hashlimit_htable
*)htlong
;
275 htable_selective_cleanup(ht
, select_gc
);
277 /* re-add the timer accordingly */
278 ht
->timer
.expires
= jiffies
+ msecs_to_jiffies(ht
->cfg
.gc_interval
);
279 add_timer(&ht
->timer
);
282 static void htable_destroy(struct xt_hashlimit_htable
*hinfo
)
284 del_timer_sync(&hinfo
->timer
);
286 /* remove proc entry */
287 remove_proc_entry(hinfo
->pde
->name
,
288 hinfo
->family
== AF_INET
? hashlimit_procdir4
:
290 htable_selective_cleanup(hinfo
, select_all
);
294 static struct xt_hashlimit_htable
*htable_find_get(char *name
, int family
)
296 struct xt_hashlimit_htable
*hinfo
;
297 struct hlist_node
*pos
;
299 hlist_for_each_entry(hinfo
, pos
, &hashlimit_htables
, node
) {
300 if (!strcmp(name
, hinfo
->pde
->name
) &&
301 hinfo
->family
== family
) {
309 static void htable_put(struct xt_hashlimit_htable
*hinfo
)
311 mutex_lock(&hashlimit_mutex
);
312 if (--hinfo
->use
== 0) {
313 hlist_del(&hinfo
->node
);
314 htable_destroy(hinfo
);
316 mutex_unlock(&hashlimit_mutex
);
319 /* The algorithm used is the Simple Token Bucket Filter (TBF)
320 * see net/sched/sch_tbf.c in the linux source tree
323 /* Rusty: This is my (non-mathematically-inclined) understanding of
324 this algorithm. The `average rate' in jiffies becomes your initial
325 amount of credit `credit' and the most credit you can ever have
326 `credit_cap'. The `peak rate' becomes the cost of passing the
329 `prev' tracks the last packet hit: you gain one credit per jiffy.
330 If you get credit balance more than this, the extra credit is
331 discarded. Every time the match passes, you lose `cost' credits;
332 if you don't have that many, the test fails.
334 See Alexey's formal explanation in net/sched/sch_tbf.c.
336 To get the maximum range, we multiply by this factor (ie. you get N
337 credits per jiffy). We want to allow a rate as low as 1 per day
338 (slowest userspace tool allows), which means
339 CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32 ie.
341 #define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
343 /* Repeated shift and or gives us all 1s, final shift and add 1 gives
344 * us the power of 2 below the theoretical max, so GCC simply does a
346 #define _POW2_BELOW2(x) ((x)|((x)>>1))
347 #define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
348 #define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
349 #define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
350 #define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
351 #define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
353 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
355 /* Precision saver. */
356 static inline u_int32_t
357 user2credits(u_int32_t user
)
359 /* If multiplying would overflow... */
360 if (user
> 0xFFFFFFFF / (HZ
*CREDITS_PER_JIFFY
))
362 return (user
/ XT_HASHLIMIT_SCALE
) * HZ
* CREDITS_PER_JIFFY
;
364 return (user
* HZ
* CREDITS_PER_JIFFY
) / XT_HASHLIMIT_SCALE
;
367 static inline void rateinfo_recalc(struct dsthash_ent
*dh
, unsigned long now
)
369 dh
->rateinfo
.credit
+= (now
- dh
->rateinfo
.prev
) * CREDITS_PER_JIFFY
;
370 if (dh
->rateinfo
.credit
> dh
->rateinfo
.credit_cap
)
371 dh
->rateinfo
.credit
= dh
->rateinfo
.credit_cap
;
372 dh
->rateinfo
.prev
= now
;
376 hashlimit_init_dst(struct xt_hashlimit_htable
*hinfo
, struct dsthash_dst
*dst
,
377 const struct sk_buff
*skb
, unsigned int protoff
)
379 __be16 _ports
[2], *ports
;
382 memset(dst
, 0, sizeof(*dst
));
384 switch (hinfo
->family
) {
386 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
)
387 dst
->addr
.ip
.dst
= ip_hdr(skb
)->daddr
;
388 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
)
389 dst
->addr
.ip
.src
= ip_hdr(skb
)->saddr
;
391 if (!(hinfo
->cfg
.mode
&
392 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
394 nexthdr
= ip_hdr(skb
)->protocol
;
396 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
398 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
)
399 memcpy(&dst
->addr
.ip6
.dst
, &ipv6_hdr(skb
)->daddr
,
400 sizeof(dst
->addr
.ip6
.dst
));
401 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
)
402 memcpy(&dst
->addr
.ip6
.src
, &ipv6_hdr(skb
)->saddr
,
403 sizeof(dst
->addr
.ip6
.src
));
405 if (!(hinfo
->cfg
.mode
&
406 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
408 nexthdr
= ipv6_hdr(skb
)->nexthdr
;
409 protoff
= ipv6_skip_exthdr(skb
, sizeof(struct ipv6hdr
), &nexthdr
);
410 if ((int)protoff
< 0)
422 case IPPROTO_UDPLITE
:
425 ports
= skb_header_pointer(skb
, protoff
, sizeof(_ports
),
429 _ports
[0] = _ports
[1] = 0;
435 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SPT
)
436 dst
->src_port
= ports
[0];
437 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DPT
)
438 dst
->dst_port
= ports
[1];
443 hashlimit_match(const struct sk_buff
*skb
,
444 const struct net_device
*in
,
445 const struct net_device
*out
,
446 const struct xt_match
*match
,
447 const void *matchinfo
,
449 unsigned int protoff
,
452 const struct xt_hashlimit_info
*r
= matchinfo
;
454 struct xt_hashlimit_htable
*hinfo
= r
->hinfo
;
455 unsigned long now
= jiffies
;
456 struct dsthash_ent
*dh
;
457 struct dsthash_dst dst
;
459 if (hashlimit_init_dst(hinfo
, &dst
, skb
, protoff
) < 0)
462 spin_lock_bh(&hinfo
->lock
);
463 dh
= dsthash_find(hinfo
, &dst
);
465 dh
= dsthash_alloc_init(hinfo
, &dst
);
467 spin_unlock_bh(&hinfo
->lock
);
471 dh
->expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
472 dh
->rateinfo
.prev
= jiffies
;
473 dh
->rateinfo
.credit
= user2credits(hinfo
->cfg
.avg
*
475 dh
->rateinfo
.credit_cap
= user2credits(hinfo
->cfg
.avg
*
477 dh
->rateinfo
.cost
= user2credits(hinfo
->cfg
.avg
);
479 /* update expiration timeout */
480 dh
->expires
= now
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
481 rateinfo_recalc(dh
, now
);
484 if (dh
->rateinfo
.credit
>= dh
->rateinfo
.cost
) {
485 /* We're underlimit. */
486 dh
->rateinfo
.credit
-= dh
->rateinfo
.cost
;
487 spin_unlock_bh(&hinfo
->lock
);
491 spin_unlock_bh(&hinfo
->lock
);
493 /* default case: we're overlimit, thus don't match */
502 hashlimit_checkentry(const char *tablename
,
504 const struct xt_match
*match
,
506 unsigned int hook_mask
)
508 struct xt_hashlimit_info
*r
= matchinfo
;
510 /* Check for overflow. */
511 if (r
->cfg
.burst
== 0 ||
512 user2credits(r
->cfg
.avg
* r
->cfg
.burst
) < user2credits(r
->cfg
.avg
)) {
513 printk(KERN_ERR
"xt_hashlimit: overflow, try lower: %u/%u\n",
514 r
->cfg
.avg
, r
->cfg
.burst
);
517 if (r
->cfg
.mode
== 0 ||
518 r
->cfg
.mode
> (XT_HASHLIMIT_HASH_DPT
|
519 XT_HASHLIMIT_HASH_DIP
|
520 XT_HASHLIMIT_HASH_SIP
|
521 XT_HASHLIMIT_HASH_SPT
))
523 if (!r
->cfg
.gc_interval
)
527 if (r
->name
[sizeof(r
->name
) - 1] != '\0')
530 mutex_lock(&hashlimit_mutex
);
531 r
->hinfo
= htable_find_get(r
->name
, match
->family
);
532 if (!r
->hinfo
&& htable_create(r
, match
->family
) != 0) {
533 mutex_unlock(&hashlimit_mutex
);
536 mutex_unlock(&hashlimit_mutex
);
542 hashlimit_destroy(const struct xt_match
*match
, void *matchinfo
)
544 struct xt_hashlimit_info
*r
= matchinfo
;
546 htable_put(r
->hinfo
);
550 struct compat_xt_hashlimit_info
{
552 struct hashlimit_cfg cfg
;
554 compat_uptr_t master
;
557 static void compat_from_user(void *dst
, void *src
)
559 int off
= offsetof(struct compat_xt_hashlimit_info
, hinfo
);
561 memcpy(dst
, src
, off
);
562 memset(dst
+ off
, 0, sizeof(struct compat_xt_hashlimit_info
) - off
);
565 static int compat_to_user(void __user
*dst
, void *src
)
567 int off
= offsetof(struct compat_xt_hashlimit_info
, hinfo
);
569 return copy_to_user(dst
, src
, off
) ? -EFAULT
: 0;
573 static struct xt_match xt_hashlimit
[] = {
577 .match
= hashlimit_match
,
578 .matchsize
= sizeof(struct xt_hashlimit_info
),
580 .compatsize
= sizeof(struct compat_xt_hashlimit_info
),
581 .compat_from_user
= compat_from_user
,
582 .compat_to_user
= compat_to_user
,
584 .checkentry
= hashlimit_checkentry
,
585 .destroy
= hashlimit_destroy
,
588 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
592 .match
= hashlimit_match
,
593 .matchsize
= sizeof(struct xt_hashlimit_info
),
595 .compatsize
= sizeof(struct compat_xt_hashlimit_info
),
596 .compat_from_user
= compat_from_user
,
597 .compat_to_user
= compat_to_user
,
599 .checkentry
= hashlimit_checkentry
,
600 .destroy
= hashlimit_destroy
,
607 static void *dl_seq_start(struct seq_file
*s
, loff_t
*pos
)
609 struct proc_dir_entry
*pde
= s
->private;
610 struct xt_hashlimit_htable
*htable
= pde
->data
;
611 unsigned int *bucket
;
613 spin_lock_bh(&htable
->lock
);
614 if (*pos
>= htable
->cfg
.size
)
617 bucket
= kmalloc(sizeof(unsigned int), GFP_ATOMIC
);
619 return ERR_PTR(-ENOMEM
);
625 static void *dl_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
627 struct proc_dir_entry
*pde
= s
->private;
628 struct xt_hashlimit_htable
*htable
= pde
->data
;
629 unsigned int *bucket
= (unsigned int *)v
;
632 if (*pos
>= htable
->cfg
.size
) {
639 static void dl_seq_stop(struct seq_file
*s
, void *v
)
641 struct proc_dir_entry
*pde
= s
->private;
642 struct xt_hashlimit_htable
*htable
= pde
->data
;
643 unsigned int *bucket
= (unsigned int *)v
;
647 spin_unlock_bh(&htable
->lock
);
650 static int dl_seq_real_show(struct dsthash_ent
*ent
, int family
,
653 /* recalculate to show accurate numbers */
654 rateinfo_recalc(ent
, jiffies
);
658 return seq_printf(s
, "%ld %u.%u.%u.%u:%u->"
659 "%u.%u.%u.%u:%u %u %u %u\n",
660 (long)(ent
->expires
- jiffies
)/HZ
,
661 NIPQUAD(ent
->dst
.addr
.ip
.src
),
662 ntohs(ent
->dst
.src_port
),
663 NIPQUAD(ent
->dst
.addr
.ip
.dst
),
664 ntohs(ent
->dst
.dst_port
),
665 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
667 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
669 return seq_printf(s
, "%ld " NIP6_FMT
":%u->"
670 NIP6_FMT
":%u %u %u %u\n",
671 (long)(ent
->expires
- jiffies
)/HZ
,
672 NIP6(*(struct in6_addr
*)&ent
->dst
.addr
.ip6
.src
),
673 ntohs(ent
->dst
.src_port
),
674 NIP6(*(struct in6_addr
*)&ent
->dst
.addr
.ip6
.dst
),
675 ntohs(ent
->dst
.dst_port
),
676 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
685 static int dl_seq_show(struct seq_file
*s
, void *v
)
687 struct proc_dir_entry
*pde
= s
->private;
688 struct xt_hashlimit_htable
*htable
= pde
->data
;
689 unsigned int *bucket
= (unsigned int *)v
;
690 struct dsthash_ent
*ent
;
691 struct hlist_node
*pos
;
693 if (!hlist_empty(&htable
->hash
[*bucket
])) {
694 hlist_for_each_entry(ent
, pos
, &htable
->hash
[*bucket
], node
)
695 if (dl_seq_real_show(ent
, htable
->family
, s
))
701 static struct seq_operations dl_seq_ops
= {
702 .start
= dl_seq_start
,
708 static int dl_proc_open(struct inode
*inode
, struct file
*file
)
710 int ret
= seq_open(file
, &dl_seq_ops
);
713 struct seq_file
*sf
= file
->private_data
;
714 sf
->private = PDE(inode
);
719 static const struct file_operations dl_file_ops
= {
720 .owner
= THIS_MODULE
,
721 .open
= dl_proc_open
,
724 .release
= seq_release
727 static int __init
xt_hashlimit_init(void)
731 err
= xt_register_matches(xt_hashlimit
, ARRAY_SIZE(xt_hashlimit
));
736 hashlimit_cachep
= kmem_cache_create("xt_hashlimit",
737 sizeof(struct dsthash_ent
), 0, 0,
739 if (!hashlimit_cachep
) {
740 printk(KERN_ERR
"xt_hashlimit: unable to create slab cache\n");
743 hashlimit_procdir4
= proc_mkdir("ipt_hashlimit", proc_net
);
744 if (!hashlimit_procdir4
) {
745 printk(KERN_ERR
"xt_hashlimit: unable to create proc dir "
750 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
751 hashlimit_procdir6
= proc_mkdir("ip6t_hashlimit", proc_net
);
752 if (!hashlimit_procdir6
) {
753 printk(KERN_ERR
"xt_hashlimit: unable to create proc dir "
760 remove_proc_entry("ipt_hashlimit", proc_net
);
762 kmem_cache_destroy(hashlimit_cachep
);
764 xt_unregister_matches(xt_hashlimit
, ARRAY_SIZE(xt_hashlimit
));
770 static void __exit
xt_hashlimit_fini(void)
772 remove_proc_entry("ipt_hashlimit", proc_net
);
773 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
774 remove_proc_entry("ip6t_hashlimit", proc_net
);
776 kmem_cache_destroy(hashlimit_cachep
);
777 xt_unregister_matches(xt_hashlimit
, ARRAY_SIZE(xt_hashlimit
));
780 module_init(xt_hashlimit_init
);
781 module_exit(xt_hashlimit_fini
);