| 529 | } |
| 530 | |
| 531 | static int |
| 532 | pf_src_connlimit(struct pf_state **state) |
| 533 | { |
| 534 | struct pf_overload_entry *pfoe; |
| 535 | int bad = 0; |
| 536 | |
| 537 | PF_STATE_LOCK_ASSERT(*state); |
| 538 | |
| 539 | (*state)->src_node->conn++; |
| 540 | (*state)->src.tcp_est = 1; |
| 541 | pf_add_threshold(&(*state)->src_node->conn_rate); |
| 542 | |
| 543 | if ((*state)->rule.ptr->max_src_conn && |
| 544 | (*state)->rule.ptr->max_src_conn < |
| 545 | (*state)->src_node->conn) { |
| 546 | counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONN], 1); |
| 547 | bad++; |
| 548 | } |
| 549 | |
| 550 | if ((*state)->rule.ptr->max_src_conn_rate.limit && |
| 551 | pf_check_threshold(&(*state)->src_node->conn_rate)) { |
| 552 | counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONNRATE], 1); |
| 553 | bad++; |
| 554 | } |
| 555 | |
| 556 | if (!bad) |
| 557 | return (0); |
| 558 | |
| 559 | /* Kill this state. */ |
| 560 | (*state)->timeout = PFTM_PURGE; |
| 561 | (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; |
| 562 | |
| 563 | if ((*state)->rule.ptr->overload_tbl == NULL) |
| 564 | return (1); |
| 565 | |
| 566 | /* Schedule overloading and flushing task. */ |
| 567 | pfoe = malloc(sizeof(*pfoe), M_PFTEMP, M_NOWAIT); |
| 568 | if (pfoe == NULL) |
| 569 | return (1); /* too bad :( */ |
| 570 | |
| 571 | bcopy(&(*state)->src_node->addr, &pfoe->addr, sizeof(pfoe->addr)); |
| 572 | pfoe->af = (*state)->key[PF_SK_WIRE]->af; |
| 573 | pfoe->rule = (*state)->rule.ptr; |
| 574 | pfoe->dir = (*state)->direction; |
| 575 | PF_OVERLOADQ_LOCK(); |
| 576 | SLIST_INSERT_HEAD(&V_pf_overloadqueue, pfoe, next); |
| 577 | PF_OVERLOADQ_UNLOCK(); |
| 578 | taskqueue_enqueue(taskqueue_swi, &V_pf_overloadtask); |
| 579 | |
| 580 | return (1); |
| 581 | } |
| 582 | |
| 583 | static void |
| 584 | pf_overload_task(void *v, int pending) |
no test coverage detected