blob: f59b66724b46baa7c856bc2196bf442634b93523 [file] [log] [blame]
/* iptables match extension for limiting packets per destination
*
* (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
*
* Development of this code was funded by Astaro AG, http://www.astaro.com/
*
* Based on ipt_limit.c by
* Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr>
* Hervé Eychenne <rv@wallfire.org>
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <iptables.h>
#include <stddef.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_hashlimit.h>
#define IPT_HASHLIMIT_BURST 5
/* miliseconds */
#define IPT_HASHLIMIT_GCINTERVAL 1000
#define IPT_HASHLIMIT_EXPIRE 10000
/* Function which prints out usage message. */
static void
help(void)
{
printf(
"hashlimit v%s options:\n"
"--hashlimit <avg> max average match rate\n"
" [Packets per second unless followed by \n"
" /sec /minute /hour /day postfixes]\n"
"--hashlimit-mode <mode> mode is a comma-separated list of\n"
" dstip,srcip,dstport,srcport\n"
"--hashlimit-name <name> name for /proc/net/ipt_hashlimit/\n"
"[--hashlimit-burst <num>] number to match in a burst, default %u\n"
"[--hashlimit-htable-size <num>] number of hashtable buckets\n"
"[--hashlimit-htable-max <num>] number of hashtable entries\n"
"[--hashlimit-htable-gcinterval] interval between garbage collection runs\n"
"[--hashlimit-htable-expire] after which time are idle entries expired?\n"
"\n", IPTABLES_VERSION, IPT_HASHLIMIT_BURST);
}
static struct option opts[] = {
{ "hashlimit", 1, 0, '%' },
{ "hashlimit-burst", 1, 0, '$' },
{ "hashlimit-htable-size", 1, 0, '&' },
{ "hashlimit-htable-max", 1, 0, '*' },
{ "hashlimit-htable-gcinterval", 1, 0, '(' },
{ "hashlimit-htable-expire", 1, 0, ')' },
{ "hashlimit-mode", 1, 0, '_' },
{ "hashlimit-name", 1, 0, '"' },
{ 0 }
};
static
int parse_rate(const char *rate, u_int32_t *val)
{
const char *delim;
u_int32_t r;
u_int32_t mult = 1; /* Seconds by default. */
delim = strchr(rate, '/');
if (delim) {
if (strlen(delim+1) == 0)
return 0;
if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0)
mult = 1;
else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0)
mult = 60;
else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0)
mult = 60*60;
else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0)
mult = 24*60*60;
else
return 0;
}
r = atoi(rate);
if (!r)
return 0;
/* This would get mapped to infinite (1/day is minimum they
can specify, so we're ok at that end). */
if (r / mult > IPT_HASHLIMIT_SCALE)
exit_error(PARAMETER_PROBLEM, "Rate too fast `%s'\n", rate);
*val = IPT_HASHLIMIT_SCALE * mult / r;
return 1;
}
/* Initialize the match. */
static void
init(struct ipt_entry_match *m, unsigned int *nfcache)
{
struct ipt_hashlimit_info *r = (struct ipt_hashlimit_info *)m->data;
r->cfg.burst = IPT_HASHLIMIT_BURST;
r->cfg.gc_interval = IPT_HASHLIMIT_GCINTERVAL;
r->cfg.expire = IPT_HASHLIMIT_EXPIRE;
/* Can't cache this */
*nfcache |= NFC_UNKNOWN;
}
/* Parse a 'mode' parameter into the required bitmask */
static int parse_mode(struct ipt_hashlimit_info *r, char *optarg)
{
char *tok;
char *arg = strdup(optarg);
if (!arg)
return -1;
r->cfg.mode = 0;
for (tok = strtok(arg, ",|");
tok;
tok = strtok(NULL, ",|")) {
if (!strcmp(tok, "dstip"))
r->cfg.mode |= IPT_HASHLIMIT_HASH_DIP;
else if (!strcmp(tok, "srcip"))
r->cfg.mode |= IPT_HASHLIMIT_HASH_SIP;
else if (!strcmp(tok, "srcport"))
r->cfg.mode |= IPT_HASHLIMIT_HASH_SPT;
else if (!strcmp(tok, "dstport"))
r->cfg.mode |= IPT_HASHLIMIT_HASH_DPT;
else {
free(arg);
return -1;
}
}
free(arg);
return 0;
}
#define PARAM_LIMIT 0x00000001
#define PARAM_BURST 0x00000002
#define PARAM_MODE 0x00000004
#define PARAM_NAME 0x00000008
#define PARAM_SIZE 0x00000010
#define PARAM_MAX 0x00000020
#define PARAM_GCINTERVAL 0x00000040
#define PARAM_EXPIRE 0x00000080
/* Function which parses command options; returns true if it
ate an option */
static int
parse(int c, char **argv, int invert, unsigned int *flags,
const struct ipt_entry *entry,
unsigned int *nfcache,
struct ipt_entry_match **match)
{
struct ipt_hashlimit_info *r =
(struct ipt_hashlimit_info *)(*match)->data;
unsigned int num;
switch(c) {
case '%':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (!parse_rate(optarg, &r->cfg.avg))
exit_error(PARAMETER_PROBLEM,
"bad rate `%s'", optarg);
*flags |= PARAM_LIMIT;
break;
case '$':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (string_to_number(optarg, 0, 10000, &num) == -1)
exit_error(PARAMETER_PROBLEM,
"bad --hashlimit-burst `%s'", optarg);
r->cfg.burst = num;
*flags |= PARAM_BURST;
break;
case '&':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
exit_error(PARAMETER_PROBLEM,
"bad --hashlimit-htable-size: `%s'", optarg);
r->cfg.size = num;
*flags |= PARAM_SIZE;
break;
case '*':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
exit_error(PARAMETER_PROBLEM,
"bad --hashlimit-htable-max: `%s'", optarg);
r->cfg.max = num;
*flags |= PARAM_MAX;
break;
case '(':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
exit_error(PARAMETER_PROBLEM,
"bad --hashlimit-htable-gcinterval: `%s'",
optarg);
/* FIXME: not HZ dependent!! */
r->cfg.gc_interval = num;
*flags |= PARAM_GCINTERVAL;
break;
case ')':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
exit_error(PARAMETER_PROBLEM,
"bad --hashlimit-htable-expire: `%s'", optarg);
/* FIXME: not HZ dependent */
r->cfg.expire = num;
*flags |= PARAM_EXPIRE;
break;
case '_':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (parse_mode(r, optarg) < 0)
exit_error(PARAMETER_PROBLEM,
"bad --hashlimit-mode: `%s'\n", optarg);
*flags |= PARAM_MODE;
break;
case '"':
if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
if (strlen(optarg) == 0)
exit_error(PARAMETER_PROBLEM, "Zero-length name?");
strncpy(r->name, optarg, sizeof(r->name));
*flags |= PARAM_NAME;
break;
default:
return 0;
}
if (invert)
exit_error(PARAMETER_PROBLEM,
"hashlimit does not support invert");
return 1;
}
/* Final check; nothing. */
static void final_check(unsigned int flags)
{
if (!(flags & PARAM_LIMIT))
exit_error(PARAMETER_PROBLEM,
"You have to specify --hashlimit");
if (!(flags & PARAM_MODE))
exit_error(PARAMETER_PROBLEM,
"You have to specify --hashlimit-mode");
if (!(flags & PARAM_NAME))
exit_error(PARAMETER_PROBLEM,
"You have to specify --hashlimit-name");
}
static struct rates
{
const char *name;
u_int32_t mult;
} rates[] = { { "day", IPT_HASHLIMIT_SCALE*24*60*60 },
{ "hour", IPT_HASHLIMIT_SCALE*60*60 },
{ "min", IPT_HASHLIMIT_SCALE*60 },
{ "sec", IPT_HASHLIMIT_SCALE } };
static void print_rate(u_int32_t period)
{
unsigned int i;
for (i = 1; i < sizeof(rates)/sizeof(struct rates); i++) {
if (period > rates[i].mult
|| rates[i].mult/period < rates[i].mult%period)
break;
}
printf("%u/%s ", rates[i-1].mult / period, rates[i-1].name);
}
static void print_mode(const struct ipt_hashlimit_info *r, char separator)
{
int prevmode = 0;
if (r->cfg.mode & IPT_HASHLIMIT_HASH_SIP) {
if (prevmode)
putchar(separator);
fputs("srcip", stdout);
prevmode = 1;
}
if (r->cfg.mode & IPT_HASHLIMIT_HASH_SPT) {
if (prevmode)
putchar(separator);
fputs("srcport", stdout);
prevmode = 1;
}
if (r->cfg.mode & IPT_HASHLIMIT_HASH_DIP) {
if (prevmode)
putchar(separator);
fputs("dstip", stdout);
prevmode = 1;
}
if (r->cfg.mode & IPT_HASHLIMIT_HASH_SPT) {
if (prevmode)
putchar(separator);
fputs("dstport", stdout);
}
putchar(' ');
}
/* Prints out the matchinfo. */
static void
print(const struct ipt_ip *ip,
const struct ipt_entry_match *match,
int numeric)
{
struct ipt_hashlimit_info *r =
(struct ipt_hashlimit_info *)match->data;
fputs("limit: avg ", stdout); print_rate(r->cfg.avg);
printf("burst %u ", r->cfg.burst);
fputs("mode ", stdout);
print_mode(r, '-');
if (r->cfg.size)
printf("htable-size %u ", r->cfg.size);
if (r->cfg.max)
printf("htable-max %u ", r->cfg.max);
if (r->cfg.gc_interval != IPT_HASHLIMIT_GCINTERVAL)
printf("htable-gcinterval %u ", r->cfg.gc_interval);
if (r->cfg.expire != IPT_HASHLIMIT_EXPIRE)
printf("htable-expire %u ", r->cfg.expire);
}
/* FIXME: Make minimalist: only print rate if not default --RR */
static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
{
struct ipt_hashlimit_info *r =
(struct ipt_hashlimit_info *)match->data;
fputs("--hashlimit ", stdout); print_rate(r->cfg.avg);
if (r->cfg.burst != IPT_HASHLIMIT_BURST)
printf("--hashlimit-burst %u ", r->cfg.burst);
fputs("--mode ", stdout);
print_mode(r, ',');
if (r->cfg.size)
printf("--hashlimit-htable-size %u ", r->cfg.size);
if (r->cfg.max)
printf("--hashlimit-htable-max %u ", r->cfg.max);
if (r->cfg.gc_interval != IPT_HASHLIMIT_GCINTERVAL)
printf("--hashlimit-htable-gcinterval %u", r->cfg.gc_interval);
if (r->cfg.expire != IPT_HASHLIMIT_EXPIRE)
printf("--hashlimit-htable-expire %u ", r->cfg.expire);
}
static struct iptables_match hashlimit = { NULL,
.name = "hashlimit",
.version = IPTABLES_VERSION,
.size = IPT_ALIGN(sizeof(struct ipt_hashlimit_info)),
.userspacesize = IPT_ALIGN(sizeof(struct ipt_hashlimit_info)),
//offsetof(struct ipt_hashlimit_info, prev),
.help = &help,
.init = &init,
.parse = &parse,
.final_check = &final_check,
.print = &print,
.save = &save,
.extra_opts = opts
};
void _init(void)
{
register_match(&hashlimit);
}