From eae98244b267db50b2a2575df4b2702efa9f7f48 Mon Sep 17 00:00:00 2001 From: Christian Deacon Date: Sun, 23 Feb 2025 07:38:03 -0500 Subject: [PATCH] Move a couple constants from constants.h to config.h. --- src/common/config.h | 15 +++++++++++++-- src/common/constants.h | 2 -- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/src/common/config.h b/src/common/config.h index 2342df4..0140b41 100644 --- a/src/common/config.h +++ b/src/common/config.h @@ -1,9 +1,20 @@ #pragma once -// Feel free to comment this out if you don't want the `blocked` entry on the stats map to be incremented every single time a packet is dropped from the source IP being on the blocked map. Commenting this line out should increase performance when blocking malicious traffic. +// The maximum amount of filters allowed. +// Decrease this value if you receive errors related to the BPF program being too large. +#define MAX_FILTERS 60 + +// The maximum amount of IPs/flows to track stats for. +// The higher this value is, the more memory that'll be used. +#define MAX_TRACK_IPS 100000 + +// Feel free to comment this out if you don't want the `blocked` entry on the stats map to be incremented every single time a packet is dropped from the source IP being on the blocked map. +// Commenting this line out should increase performance when blocking malicious traffic. #define DO_STATS_ON_BLOCK_MAP -// When this is defined, a check will occur inside the IPv4 and IPv6 filters. For IPv6 packets, if no IPv6 source/destination IP addresses are set, but there is an IPv4 address, it will ignore the filter. The same goes for IPv4, if there is no IPv4 source/destination IP addresses set, if an IPv6 address is set, it will ignore the filter. +// When this is defined, a check will occur inside the IPv4 and IPv6 filters. +// For IPv6 packets, if no IPv6 source/destination IP addresses are set, but there is an IPv4 address, it will ignore the filter. +// The same goes for IPv4, if there is no IPv4 source/destination IP addresses set, if an IPv6 address is set, it will ignore the filter. #define ALLOW_SINGLE_IP_V4_V6 // If uncommented, rate limits for clients are determined using the source IP, port, and protocol instead of just the source IP. diff --git a/src/common/constants.h b/src/common/constants.h index 8f77026..82aedd4 100644 --- a/src/common/constants.h +++ b/src/common/constants.h @@ -1,7 +1,5 @@ #pragma once #define MAX_PCKT_LENGTH 65535 -#define MAX_FILTERS 60 -#define MAX_TRACK_IPS 100000 #define MAX_CPUS 256 #define NANO_TO_SEC 1000000000 \ No newline at end of file