| /* iptables match extension for limiting packets per destination |
| * |
| * (C) 2003 by Harald Welte <laforge@netfilter.org> |
| * |
| * Development of this code was funded by Astaro AG, http://www.astaro.com/ |
| * |
| * Based on ipt_limit.c by |
| * Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr> |
| * Hervé Eychenne <rv@wallfire.org> |
| */ |
| |
| #include <stdio.h> |
| #include <string.h> |
| #include <stdlib.h> |
| #include <getopt.h> |
| #include <iptables.h> |
| #include <stddef.h> |
| #include <linux/netfilter_ipv4/ip_tables.h> |
| #include <linux/netfilter_ipv4/ipt_dstlimit.h> |
| |
| #define IPT_DSTLIMIT_BURST 5 |
| |
| /* miliseconds */ |
| #define IPT_DSTLIMIT_GCINTERVAL 1000 |
| #define IPT_DSTLIMIT_EXPIRE 10000 |
| |
| /* Function which prints out usage message. */ |
| static void |
| help(void) |
| { |
| printf( |
| "dstlimit v%s options:\n" |
| "--dstlimit <avg> max average match rate\n" |
| " [Packets per second unless followed by \n" |
| " /sec /minute /hour /day postfixes]\n" |
| "--dstlimit-mode <mode> mode\n" |
| " dstip\n" |
| " dstip-dstport\n" |
| " srcip-dstip\n" |
| " srcip-dstip-dstport\n" |
| "--dstlimit-name <name> name for /proc/net/ipt_dstlimit/\n" |
| "[--dstlimit-burst <num>] number to match in a burst, default %u\n" |
| "[--dstlimit-htable-size <num>] number of hashtable buckets\n" |
| "[--dstlimit-htable-max <num>] number of hashtable entries\n" |
| "[--dstlimit-htable-gcinterval] interval between garbage collection runs\n" |
| "[--dstlimit-htable-expire] after which time are idle entries expired?\n" |
| "\n", IPTABLES_VERSION, IPT_DSTLIMIT_BURST); |
| } |
| |
| static struct option opts[] = { |
| { "dstlimit", 1, 0, '%' }, |
| { "dstlimit-burst", 1, 0, '$' }, |
| { "dstlimit-htable-size", 1, 0, '&' }, |
| { "dstlimit-htable-max", 1, 0, '*' }, |
| { "dstlimit-htable-gcinterval", 1, 0, '(' }, |
| { "dstlimit-htable-expire", 1, 0, ')' }, |
| { "dstlimit-mode", 1, 0, '_' }, |
| { "dstlimit-name", 1, 0, '"' }, |
| { 0 } |
| }; |
| |
| static |
| int parse_rate(const char *rate, u_int32_t *val) |
| { |
| const char *delim; |
| u_int32_t r; |
| u_int32_t mult = 1; /* Seconds by default. */ |
| |
| delim = strchr(rate, '/'); |
| if (delim) { |
| if (strlen(delim+1) == 0) |
| return 0; |
| |
| if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0) |
| mult = 1; |
| else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0) |
| mult = 60; |
| else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0) |
| mult = 60*60; |
| else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0) |
| mult = 24*60*60; |
| else |
| return 0; |
| } |
| r = atoi(rate); |
| if (!r) |
| return 0; |
| |
| /* This would get mapped to infinite (1/day is minimum they |
| can specify, so we're ok at that end). */ |
| if (r / mult > IPT_DSTLIMIT_SCALE) |
| exit_error(PARAMETER_PROBLEM, "Rate too fast `%s'\n", rate); |
| |
| *val = IPT_DSTLIMIT_SCALE * mult / r; |
| return 1; |
| } |
| |
| /* Initialize the match. */ |
| static void |
| init(struct ipt_entry_match *m, unsigned int *nfcache) |
| { |
| struct ipt_dstlimit_info *r = (struct ipt_dstlimit_info *)m->data; |
| |
| r->cfg.burst = IPT_DSTLIMIT_BURST; |
| r->cfg.gc_interval = IPT_DSTLIMIT_GCINTERVAL; |
| r->cfg.expire = IPT_DSTLIMIT_EXPIRE; |
| |
| } |
| |
| #define PARAM_LIMIT 0x00000001 |
| #define PARAM_BURST 0x00000002 |
| #define PARAM_MODE 0x00000004 |
| #define PARAM_NAME 0x00000008 |
| #define PARAM_SIZE 0x00000010 |
| #define PARAM_MAX 0x00000020 |
| #define PARAM_GCINTERVAL 0x00000040 |
| #define PARAM_EXPIRE 0x00000080 |
| |
| /* Function which parses command options; returns true if it |
| ate an option */ |
| static int |
| parse(int c, char **argv, int invert, unsigned int *flags, |
| const struct ipt_entry *entry, |
| unsigned int *nfcache, |
| struct ipt_entry_match **match) |
| { |
| struct ipt_dstlimit_info *r = |
| (struct ipt_dstlimit_info *)(*match)->data; |
| unsigned int num; |
| |
| switch(c) { |
| case '%': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (!parse_rate(optarg, &r->cfg.avg)) |
| exit_error(PARAMETER_PROBLEM, |
| "bad rate `%s'", optarg); |
| *flags |= PARAM_LIMIT; |
| break; |
| |
| case '$': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (string_to_number(optarg, 0, 10000, &num) == -1) |
| exit_error(PARAMETER_PROBLEM, |
| "bad --dstlimit-burst `%s'", optarg); |
| r->cfg.burst = num; |
| *flags |= PARAM_BURST; |
| break; |
| case '&': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) |
| exit_error(PARAMETER_PROBLEM, |
| "bad --dstlimit-htable-size: `%s'", optarg); |
| r->cfg.size = num; |
| *flags |= PARAM_SIZE; |
| break; |
| case '*': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) |
| exit_error(PARAMETER_PROBLEM, |
| "bad --dstlimit-htable-max: `%s'", optarg); |
| r->cfg.max = num; |
| *flags |= PARAM_MAX; |
| break; |
| case '(': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) |
| exit_error(PARAMETER_PROBLEM, |
| "bad --dstlimit-htable-gcinterval: `%s'", |
| optarg); |
| /* FIXME: not HZ dependent!! */ |
| r->cfg.gc_interval = num; |
| *flags |= PARAM_GCINTERVAL; |
| break; |
| case ')': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) |
| exit_error(PARAMETER_PROBLEM, |
| "bad --dstlimit-htable-expire: `%s'", optarg); |
| /* FIXME: not HZ dependent */ |
| r->cfg.expire = num; |
| *flags |= PARAM_EXPIRE; |
| break; |
| case '_': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (!strcmp(optarg, "dstip")) |
| r->cfg.mode = IPT_DSTLIMIT_HASH_DIP; |
| else if (!strcmp(optarg, "dstip-destport") || |
| !strcmp(optarg, "dstip-dstport")) |
| r->cfg.mode = IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT; |
| else if (!strcmp(optarg, "srcip-dstip")) |
| r->cfg.mode = IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP; |
| else if (!strcmp(optarg, "srcip-dstip-destport") || |
| !strcmp(optarg, "srcip-dstip-dstport")) |
| r->cfg.mode = IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT; |
| else |
| exit_error(PARAMETER_PROBLEM, |
| "bad --dstlimit-mode: `%s'\n", optarg); |
| *flags |= PARAM_MODE; |
| break; |
| case '"': |
| if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; |
| if (strlen(optarg) == 0) |
| exit_error(PARAMETER_PROBLEM, "Zero-length name?"); |
| strncpy(r->name, optarg, sizeof(r->name)); |
| *flags |= PARAM_NAME; |
| break; |
| default: |
| return 0; |
| } |
| |
| if (invert) |
| exit_error(PARAMETER_PROBLEM, |
| "dstlimit does not support invert"); |
| |
| return 1; |
| } |
| |
| /* Final check; nothing. */ |
| static void final_check(unsigned int flags) |
| { |
| if (!(flags & PARAM_LIMIT)) |
| exit_error(PARAMETER_PROBLEM, |
| "You have to specify --dstlimit"); |
| if (!(flags & PARAM_MODE)) |
| exit_error(PARAMETER_PROBLEM, |
| "You have to specify --dstlimit-mode"); |
| if (!(flags & PARAM_NAME)) |
| exit_error(PARAMETER_PROBLEM, |
| "You have to specify --dstlimit-name"); |
| } |
| |
| static struct rates |
| { |
| const char *name; |
| u_int32_t mult; |
| } rates[] = { { "day", IPT_DSTLIMIT_SCALE*24*60*60 }, |
| { "hour", IPT_DSTLIMIT_SCALE*60*60 }, |
| { "min", IPT_DSTLIMIT_SCALE*60 }, |
| { "sec", IPT_DSTLIMIT_SCALE } }; |
| |
| static void print_rate(u_int32_t period) |
| { |
| unsigned int i; |
| |
| for (i = 1; i < sizeof(rates)/sizeof(struct rates); i++) { |
| if (period > rates[i].mult |
| || rates[i].mult/period < rates[i].mult%period) |
| break; |
| } |
| |
| printf("%u/%s ", rates[i-1].mult / period, rates[i-1].name); |
| } |
| |
| /* Prints out the matchinfo. */ |
| static void |
| print(const struct ipt_ip *ip, |
| const struct ipt_entry_match *match, |
| int numeric) |
| { |
| struct ipt_dstlimit_info *r = |
| (struct ipt_dstlimit_info *)match->data; |
| printf("limit: avg "); print_rate(r->cfg.avg); |
| printf("burst %u ", r->cfg.burst); |
| switch (r->cfg.mode) { |
| case (IPT_DSTLIMIT_HASH_DIP): |
| printf("mode dstip "); |
| break; |
| case (IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): |
| printf("mode dstip-dstport "); |
| break; |
| case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP): |
| printf("mode srcip-dstip "); |
| break; |
| case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): |
| printf("mode srcip-dstip-dstport "); |
| break; |
| } |
| if (r->cfg.size) |
| printf("htable-size %u ", r->cfg.size); |
| if (r->cfg.max) |
| printf("htable-max %u ", r->cfg.max); |
| if (r->cfg.gc_interval != IPT_DSTLIMIT_GCINTERVAL) |
| printf("htable-gcinterval %u ", r->cfg.gc_interval); |
| if (r->cfg.expire != IPT_DSTLIMIT_EXPIRE) |
| printf("htable-expire %u ", r->cfg.expire); |
| } |
| |
| /* FIXME: Make minimalist: only print rate if not default --RR */ |
| static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match) |
| { |
| struct ipt_dstlimit_info *r = |
| (struct ipt_dstlimit_info *)match->data; |
| |
| printf("--dstlimit "); print_rate(r->cfg.avg); |
| if (r->cfg.burst != IPT_DSTLIMIT_BURST) |
| printf("--dstlimit-burst %u ", r->cfg.burst); |
| switch (r->cfg.mode) { |
| case (IPT_DSTLIMIT_HASH_DIP): |
| printf("--mode dstip "); |
| break; |
| case (IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): |
| printf("--mode dstip-dstport "); |
| break; |
| case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP): |
| printf("--mode srcip-dstip "); |
| break; |
| case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): |
| printf("--mode srcip-dstip-dstport "); |
| break; |
| } |
| if (r->cfg.size) |
| printf("--dstlimit-htable-size %u ", r->cfg.size); |
| if (r->cfg.max) |
| printf("--dstlimit-htable-max %u ", r->cfg.max); |
| if (r->cfg.gc_interval != IPT_DSTLIMIT_GCINTERVAL) |
| printf("--dstlimit-htable-gcinterval %u", r->cfg.gc_interval); |
| if (r->cfg.expire != IPT_DSTLIMIT_EXPIRE) |
| printf("--dstlimit-htable-expire %u ", r->cfg.expire); |
| } |
| |
| static struct iptables_match dstlimit = { |
| .next = NULL, |
| .name = "dstlimit", |
| .version = IPTABLES_VERSION, |
| .size = IPT_ALIGN(sizeof(struct ipt_dstlimit_info)), |
| .userspacesize = IPT_ALIGN(sizeof(struct ipt_dstlimit_info)), |
| //offsetof(struct ipt_dstlimit_info, prev), |
| .help = &help, |
| .init = &init, |
| .parse = &parse, |
| .final_check = &final_check, |
| .print = &print, |
| .save = &save, |
| .extra_opts = opts |
| }; |
| |
| void _init(void) |
| { |
| register_match(&dstlimit); |
| } |