+ if low_bytes & (1 << 31) != 0:
+ assert False # Negative ratelimit?
+ exp = (low_bytes & (0xff << 23)) >> 23
+ if exp == 0xff:
+ assert False # NaN/INF?
+ if exp <= 127: # < 1
+ first_action = "return XDP_DROP;"
+ if exp >= 127 + 63: # The count won't even fit in 64-bits, just accept
+ first_action = "return XDP_PASS;"
+ mantissa = low_bytes & ((1 << 23) - 1)
+ value = 1.0 + mantissa / (2**23)
+ value *= 2**(exp-127)
+ first_action = "uint64_t secs = bpf_ktime_get_ns() / 1000000000;\n"
+ first_action += f"const uint32_t ratelimitidx = {ratelimitcnt};\n"
+ first_action += "struct ratelimit *rate = bpf_map_lookup_elem(&rate_map, &ratelimitidx);\n"
+ first_action += "if (rate) {\n"
+ first_action += "\tbpf_spin_lock(&rate->lock);\n"
+ first_action += "\tif (secs != rate->bucket_secs) {\n"
+ first_action += "\t\trate->bucket_secs = secs;\n"
+ first_action += "\t\trate->bucket_count = 0;\n"
+ first_action += "\t}\n"
+ first_action += f"\tif (rate->bucket_count + (data_end - pktdata) > {math.floor(value)})\n"
+ first_action += "\t\t{ bpf_spin_unlock(&rate->lock); return XDP_DROP; }\n"
+ first_action += "\trate->bucket_count += data_end - pktdata;\n"
+ first_action += "\tbpf_spin_unlock(&rate->lock);\n"
+ first_action += "}\n"
+ ratelimitcnt += 1