extensions/libxt_recent.c - maze/iptables - Git at Google

 /* Shared library add-on to iptables to add recent matching support. */
 #include <stdio.h>
 #include <netdb.h>
 #include <string.h>
 #include <stdlib.h>
 #include <getopt.h>

 #include <xtables.h>
 #include <linux/netfilter/xt_recent.h>

 static const struct option recent_opts[] = {
 	{ .name = "set",      .has_arg = 0, .val = 201 },
 	{ .name = "rcheck",   .has_arg = 0, .val = 202 },
 	{ .name = "update",   .has_arg = 0, .val = 203 },
 	{ .name = "seconds",  .has_arg = 1, .val = 204 },
 	{ .name = "hitcount", .has_arg = 1, .val = 205 },
 	{ .name = "remove",   .has_arg = 0, .val = 206 },
 	{ .name = "rttl",     .has_arg = 0, .val = 207 },
 	{ .name = "name",     .has_arg = 1, .val = 208 },
 	{ .name = "rsource",  .has_arg = 0, .val = 209 },
 	{ .name = "rdest",    .has_arg = 0, .val = 210 },
 	{ .name = NULL }
 };

 static void recent_help(void)
 {
 	printf(
 "recent match options:\n"
 "[!] --set                       Add source address to list, always matches.\n"
 "[!] --rcheck                    Match if source address in list.\n"
 "[!] --update                    Match if source address in list, also update last-seen time.\n"
 "[!] --remove                    Match if source address in list, also removes that address from list.\n"
 "    --seconds seconds           For check and update commands above.\n"
 "                                Specifies that the match will only occur if source address last seen within\n"
 "                                the last 'seconds' seconds.\n"
 "    --hitcount hits             For check and update commands above.\n"
 "                                Specifies that the match will only occur if source address seen hits times.\n"
 "                                May be used in conjunction with the seconds option.\n"
 "    --rttl                      For check and update commands above.\n"
 "                                Specifies that the match will only occur if the source address and the TTL\n"
 "                                match between this packet and the one which was set.\n"
 "                                Useful if you have problems with people spoofing their source address in order\n"
 "                                to DoS you via this module.\n"
 "    --name name                 Name of the recent list to be used.  DEFAULT used if none given.\n"
 "    --rsource                   Match/Save the source address of each packet in the recent list table (default).\n"
 "    --rdest                     Match/Save the destination address of each packet in the recent list table.\n"
 "xt_recent by: Stephen Frost <sfrost@snowman.net>.  http://snowman.net/projects/ipt_recent/\n");
 }

 static void recent_init(struct xt_entry_match *match)
 {
 	struct xt_recent_mtinfo *info = (void *)(match)->data;

 	strncpy(info->name,"DEFAULT", XT_RECENT_NAME_LEN);
 	/* even though XT_RECENT_NAME_LEN is currently defined as 200,
 	 * better be safe, than sorry */
 	info->name[XT_RECENT_NAME_LEN-1] = '\0';
 	info->side = XT_RECENT_SOURCE;
 }

 #define RECENT_CMDS \
 	(XT_RECENT_SET | XT_RECENT_CHECK | \
 	XT_RECENT_UPDATE | XT_RECENT_REMOVE)

 static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
                         const void *entry, struct xt_entry_match **match)
 {
 	struct xt_recent_mtinfo *info = (void *)(*match)->data;

 	switch (c) {
 		case 201:
 			if (*flags & RECENT_CMDS)
 				xtables_error(PARAMETER_PROBLEM,
 					"recent: only one of `--set', `--rcheck' "
 					"`--update' or `--remove' may be set");
 			xtables_check_inverse(optarg, &invert, &optind, 0);
 			info->check_set |= XT_RECENT_SET;
 			if (invert) info->invert = 1;
 			*flags |= XT_RECENT_SET;
 			break;

 		case 202:
 			if (*flags & RECENT_CMDS)
 				xtables_error(PARAMETER_PROBLEM,
 					"recent: only one of `--set', `--rcheck' "
 					"`--update' or `--remove' may be set");
 			xtables_check_inverse(optarg, &invert, &optind, 0);
 			info->check_set |= XT_RECENT_CHECK;
 			if(invert) info->invert = 1;
 			*flags |= XT_RECENT_CHECK;
 			break;

 		case 203:
 			if (*flags & RECENT_CMDS)
 				xtables_error(PARAMETER_PROBLEM,
 					"recent: only one of `--set', `--rcheck' "
 					"`--update' or `--remove' may be set");
 			xtables_check_inverse(optarg, &invert, &optind, 0);
 			info->check_set |= XT_RECENT_UPDATE;
 			if (invert) info->invert = 1;
 			*flags |= XT_RECENT_UPDATE;
 			break;

 		case 206:
 			if (*flags & RECENT_CMDS)
 				xtables_error(PARAMETER_PROBLEM,
 					"recent: only one of `--set', `--rcheck' "
 					"`--update' or `--remove' may be set");
 			xtables_check_inverse(optarg, &invert, &optind, 0);
 			info->check_set |= XT_RECENT_REMOVE;
 			if (invert) info->invert = 1;
 			*flags |= XT_RECENT_REMOVE;
 			break;

 		case 204:
 			info->seconds = atoi(optarg);
 			break;

 		case 205:
 			info->hit_count = atoi(optarg);
 			break;

 		case 207:
 			info->check_set |= XT_RECENT_TTL;
 			*flags |= XT_RECENT_TTL;
 			break;

 		case 208:
 			strncpy(info->name,optarg, XT_RECENT_NAME_LEN);
 			info->name[XT_RECENT_NAME_LEN-1] = '\0';
 			break;

 		case 209:
 			info->side = XT_RECENT_SOURCE;
 			break;

 		case 210:
 			info->side = XT_RECENT_DEST;
 			break;

 		default:
 			return 0;
 	}

 	return 1;
 }

 static void recent_check(unsigned int flags)
 {
 	if (!(flags & RECENT_CMDS))
 		xtables_error(PARAMETER_PROBLEM,
 			"recent: you must specify one of `--set', `--rcheck' "
 			"`--update' or `--remove'");
 	if ((flags & XT_RECENT_TTL) &&
 	    (flags & (XT_RECENT_SET | XT_RECENT_REMOVE)))
 		xtables_error(PARAMETER_PROBLEM,
 		           "recent: --rttl may only be used with --rcheck or "
 		           "--update");
 }

 static void recent_print(const void *ip, const struct xt_entry_match *match,
                          int numeric)
 {
 	const struct xt_recent_mtinfo *info = (const void *)match->data;

 	if (info->invert)
 		fputc('!', stdout);

 	printf("recent: ");
 	if (info->check_set & XT_RECENT_SET)
 		printf("SET ");
 	if (info->check_set & XT_RECENT_CHECK)
 		printf("CHECK ");
 	if (info->check_set & XT_RECENT_UPDATE)
 		printf("UPDATE ");
 	if (info->check_set & XT_RECENT_REMOVE)
 		printf("REMOVE ");
 	if(info->seconds) printf("seconds: %d ",info->seconds);
 	if(info->hit_count) printf("hit_count: %d ",info->hit_count);
 	if (info->check_set & XT_RECENT_TTL)
 		printf("TTL-Match ");
 	if(info->name) printf("name: %s ",info->name);
 	if (info->side == XT_RECENT_SOURCE)
 		printf("side: source ");
 	if (info->side == XT_RECENT_DEST)
 		printf("side: dest");
 }

 static void recent_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_recent_mtinfo *info = (const void *)match->data;

 	if (info->invert)
 		printf("! ");

 	if (info->check_set & XT_RECENT_SET)
 		printf("--set ");
 	if (info->check_set & XT_RECENT_CHECK)
 		printf("--rcheck ");
 	if (info->check_set & XT_RECENT_UPDATE)
 		printf("--update ");
 	if (info->check_set & XT_RECENT_REMOVE)
 		printf("--remove ");
 	if(info->seconds) printf("--seconds %d ",info->seconds);
 	if(info->hit_count) printf("--hitcount %d ",info->hit_count);
 	if (info->check_set & XT_RECENT_TTL)
 		printf("--rttl ");
 	if(info->name) printf("--name %s ",info->name);
 	if (info->side == XT_RECENT_SOURCE)
 		printf("--rsource ");
 	if (info->side == XT_RECENT_DEST)
 		printf("--rdest ");
 }

 static struct xtables_match recent_mt_reg = {
     .name          = "recent",
     .version       = XTABLES_VERSION,
     .family        = NFPROTO_IPV4,
     .size          = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
     .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
     .help          = recent_help,
     .init          = recent_init,
     .parse         = recent_parse,
     .final_check   = recent_check,
     .print         = recent_print,
     .save          = recent_save,
     .extra_opts    = recent_opts,
 };

 static struct xtables_match recent_mt6_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "recent",
 	.revision      = 0,
 	.family        = NFPROTO_IPV6,
 	.size          = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
 	.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
 	.help          = recent_help,
 	.init          = recent_init,
 	.parse         = recent_parse,
 	.final_check   = recent_check,
 	.print         = recent_print,
 	.save          = recent_save,
 	.extra_opts    = recent_opts,
 };

 void _init(void)
 {
 	xtables_register_match(&recent_mt_reg);
 	xtables_register_match(&recent_mt6_reg);
 }
	/* Shared library add-on to iptables to add recent matching support. */
	#include <stdio.h>
	#include <netdb.h>
	#include <string.h>
	#include <stdlib.h>
	#include <getopt.h>

	#include <xtables.h>
	#include <linux/netfilter/xt_recent.h>

	static const struct option recent_opts[] = {
	{ .name = "set", .has_arg = 0, .val = 201 },
	{ .name = "rcheck", .has_arg = 0, .val = 202 },
	{ .name = "update", .has_arg = 0, .val = 203 },
	{ .name = "seconds", .has_arg = 1, .val = 204 },
	{ .name = "hitcount", .has_arg = 1, .val = 205 },
	{ .name = "remove", .has_arg = 0, .val = 206 },
	{ .name = "rttl", .has_arg = 0, .val = 207 },
	{ .name = "name", .has_arg = 1, .val = 208 },
	{ .name = "rsource", .has_arg = 0, .val = 209 },
	{ .name = "rdest", .has_arg = 0, .val = 210 },
	{ .name = NULL }
	};

	static void recent_help(void)
	{
	printf(
	"recent match options:\n"
	"[!] --set Add source address to list, always matches.\n"
	"[!] --rcheck Match if source address in list.\n"
	"[!] --update Match if source address in list, also update last-seen time.\n"
	"[!] --remove Match if source address in list, also removes that address from list.\n"
	" --seconds seconds For check and update commands above.\n"
	" Specifies that the match will only occur if source address last seen within\n"
	" the last 'seconds' seconds.\n"
	" --hitcount hits For check and update commands above.\n"
	" Specifies that the match will only occur if source address seen hits times.\n"
	" May be used in conjunction with the seconds option.\n"
	" --rttl For check and update commands above.\n"
	" Specifies that the match will only occur if the source address and the TTL\n"
	" match between this packet and the one which was set.\n"
	" Useful if you have problems with people spoofing their source address in order\n"
	" to DoS you via this module.\n"
	" --name name Name of the recent list to be used. DEFAULT used if none given.\n"
	" --rsource Match/Save the source address of each packet in the recent list table (default).\n"
	" --rdest Match/Save the destination address of each packet in the recent list table.\n"
	"xt_recent by: Stephen Frost <sfrost@snowman.net>. http://snowman.net/projects/ipt_recent/\n");
	}

	static void recent_init(struct xt_entry_match *match)
	{
	struct xt_recent_mtinfo info = (void )(match)->data;

	strncpy(info->name,"DEFAULT", XT_RECENT_NAME_LEN);
	/* even though XT_RECENT_NAME_LEN is currently defined as 200,
	* better be safe, than sorry */
	info->name[XT_RECENT_NAME_LEN-1] = '\0';
	info->side = XT_RECENT_SOURCE;
	}

	#define RECENT_CMDS \
	(XT_RECENT_SET \| XT_RECENT_CHECK \| \
	XT_RECENT_UPDATE \| XT_RECENT_REMOVE)

	static int recent_parse(int c, char *argv, int invert, unsigned int flags,
	const void entry, struct xt_entry_match *match)
	{
	struct xt_recent_mtinfo info = (void )(*match)->data;

	switch (c) {
	case 201:
	if (*flags & RECENT_CMDS)
	xtables_error(PARAMETER_PROBLEM,
	"recent: only one of `--set', `--rcheck' "
	"`--update' or `--remove' may be set");
	xtables_check_inverse(optarg, &invert, &optind, 0);
	info->check_set \|= XT_RECENT_SET;
	if (invert) info->invert = 1;
	*flags \|= XT_RECENT_SET;
	break;

	case 202:
	if (*flags & RECENT_CMDS)
	xtables_error(PARAMETER_PROBLEM,
	"recent: only one of `--set', `--rcheck' "
	"`--update' or `--remove' may be set");
	xtables_check_inverse(optarg, &invert, &optind, 0);
	info->check_set \|= XT_RECENT_CHECK;
	if(invert) info->invert = 1;
	*flags \|= XT_RECENT_CHECK;
	break;

	case 203:
	if (*flags & RECENT_CMDS)
	xtables_error(PARAMETER_PROBLEM,
	"recent: only one of `--set', `--rcheck' "
	"`--update' or `--remove' may be set");
	xtables_check_inverse(optarg, &invert, &optind, 0);
	info->check_set \|= XT_RECENT_UPDATE;
	if (invert) info->invert = 1;
	*flags \|= XT_RECENT_UPDATE;
	break;

	case 206:
	if (*flags & RECENT_CMDS)
	xtables_error(PARAMETER_PROBLEM,
	"recent: only one of `--set', `--rcheck' "
	"`--update' or `--remove' may be set");
	xtables_check_inverse(optarg, &invert, &optind, 0);
	info->check_set \|= XT_RECENT_REMOVE;
	if (invert) info->invert = 1;
	*flags \|= XT_RECENT_REMOVE;
	break;

	case 204:
	info->seconds = atoi(optarg);
	break;

	case 205:
	info->hit_count = atoi(optarg);
	break;

	case 207:
	info->check_set \|= XT_RECENT_TTL;
	*flags \|= XT_RECENT_TTL;
	break;

	case 208:
	strncpy(info->name,optarg, XT_RECENT_NAME_LEN);
	info->name[XT_RECENT_NAME_LEN-1] = '\0';
	break;

	case 209:
	info->side = XT_RECENT_SOURCE;
	break;

	case 210:
	info->side = XT_RECENT_DEST;
	break;

	default:
	return 0;
	}

	return 1;
	}

	static void recent_check(unsigned int flags)
	{
	if (!(flags & RECENT_CMDS))
	xtables_error(PARAMETER_PROBLEM,
	"recent: you must specify one of `--set', `--rcheck' "
	"`--update' or `--remove'");
	if ((flags & XT_RECENT_TTL) &&
	(flags & (XT_RECENT_SET \| XT_RECENT_REMOVE)))
	xtables_error(PARAMETER_PROBLEM,
	"recent: --rttl may only be used with --rcheck or "
	"--update");
	}

	static void recent_print(const void ip, const struct xt_entry_match match,
	int numeric)
	{
	const struct xt_recent_mtinfo info = (const void )match->data;

	if (info->invert)
	fputc('!', stdout);

	printf("recent: ");
	if (info->check_set & XT_RECENT_SET)
	printf("SET ");
	if (info->check_set & XT_RECENT_CHECK)
	printf("CHECK ");
	if (info->check_set & XT_RECENT_UPDATE)
	printf("UPDATE ");
	if (info->check_set & XT_RECENT_REMOVE)
	printf("REMOVE ");
	if(info->seconds) printf("seconds: %d ",info->seconds);
	if(info->hit_count) printf("hit_count: %d ",info->hit_count);
	if (info->check_set & XT_RECENT_TTL)
	printf("TTL-Match ");
	if(info->name) printf("name: %s ",info->name);
	if (info->side == XT_RECENT_SOURCE)
	printf("side: source ");
	if (info->side == XT_RECENT_DEST)
	printf("side: dest");
	}

	static void recent_save(const void ip, const struct xt_entry_match match)
	{
	const struct xt_recent_mtinfo info = (const void )match->data;

	if (info->invert)
	printf("! ");

	if (info->check_set & XT_RECENT_SET)
	printf("--set ");
	if (info->check_set & XT_RECENT_CHECK)
	printf("--rcheck ");
	if (info->check_set & XT_RECENT_UPDATE)
	printf("--update ");
	if (info->check_set & XT_RECENT_REMOVE)
	printf("--remove ");
	if(info->seconds) printf("--seconds %d ",info->seconds);
	if(info->hit_count) printf("--hitcount %d ",info->hit_count);
	if (info->check_set & XT_RECENT_TTL)
	printf("--rttl ");
	if(info->name) printf("--name %s ",info->name);
	if (info->side == XT_RECENT_SOURCE)
	printf("--rsource ");
	if (info->side == XT_RECENT_DEST)
	printf("--rdest ");
	}

	static struct xtables_match recent_mt_reg = {
	.name = "recent",
	.version = XTABLES_VERSION,
	.family = NFPROTO_IPV4,
	.size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
	.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
	.help = recent_help,
	.init = recent_init,
	.parse = recent_parse,
	.final_check = recent_check,
	.print = recent_print,
	.save = recent_save,
	.extra_opts = recent_opts,
	};

	static struct xtables_match recent_mt6_reg = {
	.version = XTABLES_VERSION,
	.name = "recent",
	.revision = 0,
	.family = NFPROTO_IPV6,
	.size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
	.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
	.help = recent_help,
	.init = recent_init,
	.parse = recent_parse,
	.final_check = recent_check,
	.print = recent_print,
	.save = recent_save,
	.extra_opts = recent_opts,
	};

	void _init(void)
	{
	xtables_register_match(&recent_mt_reg);
	xtables_register_match(&recent_mt6_reg);
	}