libxt_hashlimit.c revision 500f483fff529dcd88ec96b9d5054be6cd6363a0 
1/* ip6tables match extension for limiting packets per destination
2 *
3 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
4 *
5 * Development of this code was funded by Astaro AG, http://www.astaro.com/
6 *
7 * Based on ipt_limit.c by
8 * J�r�me de Vivie   <devivie@info.enserb.u-bordeaux.fr>
9 * Herv� Eychenne    <rv@wallfire.org>
10 *
11 * Error corections by nmalykh@bilim.com (22.01.2005)
12 */
13
14#include <stdio.h>
15#include <string.h>
16#include <stdlib.h>
17#include <getopt.h>
18#include <xtables.h>
19#include <stddef.h>
20#include <linux/netfilter/x_tables.h>
21#include <linux/netfilter/xt_hashlimit.h>
22
23#define XT_HASHLIMIT_BURST	5
24
25/* miliseconds */
26#define XT_HASHLIMIT_GCINTERVAL	1000
27#define XT_HASHLIMIT_EXPIRE	10000
28
29/* Function which prints out usage message. */
30static void
31help(void)
32{
33	printf(
34"hashlimit v%s options:\n"
35"--hashlimit <avg>		max average match rate\n"
36"                                [Packets per second unless followed by \n"
37"                                /sec /minute /hour /day postfixes]\n"
38"--hashlimit-mode <mode>		mode is a comma-separated list of\n"
39"					dstip,srcip,dstport,srcport\n"
40"--hashlimit-name <name>		name for /proc/net/ipt_hashlimit/\n"
41"[--hashlimit-burst <num>]	number to match in a burst, default %u\n"
42"[--hashlimit-htable-size <num>]	number of hashtable buckets\n"
43"[--hashlimit-htable-max <num>]	number of hashtable entries\n"
44"[--hashlimit-htable-gcinterval]	interval between garbage collection runs\n"
45"[--hashlimit-htable-expire]	after which time are idle entries expired?\n"
46"\n", IPTABLES_VERSION, XT_HASHLIMIT_BURST);
47}
48
49static const struct option opts[] = {
50	{ "hashlimit", 1, NULL, '%' },
51	{ "hashlimit-burst", 1, NULL, '$' },
52	{ "hashlimit-htable-size", 1, NULL, '&' },
53	{ "hashlimit-htable-max", 1, NULL, '*' },
54	{ "hashlimit-htable-gcinterval", 1, NULL, '(' },
55	{ "hashlimit-htable-expire", 1, NULL, ')' },
56	{ "hashlimit-mode", 1, NULL, '_' },
57	{ "hashlimit-name", 1, NULL, '"' },
58	{ }
59};
60
61static
62int parse_rate(const char *rate, u_int32_t *val)
63{
64	const char *delim;
65	u_int32_t r;
66	u_int32_t mult = 1;  /* Seconds by default. */
67
68	delim = strchr(rate, '/');
69	if (delim) {
70		if (strlen(delim+1) == 0)
71			return 0;
72
73		if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0)
74			mult = 1;
75		else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0)
76			mult = 60;
77		else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0)
78			mult = 60*60;
79		else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0)
80			mult = 24*60*60;
81		else
82			return 0;
83	}
84	r = atoi(rate);
85	if (!r)
86		return 0;
87
88	/* This would get mapped to infinite (1/day is minimum they
89           can specify, so we're ok at that end). */
90	if (r / mult > XT_HASHLIMIT_SCALE)
91		exit_error(PARAMETER_PROBLEM, "Rate too fast `%s'\n", rate);
92
93	*val = XT_HASHLIMIT_SCALE * mult / r;
94	return 1;
95}
96
97/* Initialize the match. */
98static void
99init(struct xt_entry_match *m)
100{
101	struct xt_hashlimit_info *r = (struct xt_hashlimit_info *)m->data;
102
103	r->cfg.burst = XT_HASHLIMIT_BURST;
104	r->cfg.gc_interval = XT_HASHLIMIT_GCINTERVAL;
105	r->cfg.expire = XT_HASHLIMIT_EXPIRE;
106
107}
108
109
110/* Parse a 'mode' parameter into the required bitmask */
111static int parse_mode(struct xt_hashlimit_info *r, char *optarg)
112{
113	char *tok;
114	char *arg = strdup(optarg);
115
116	if (!arg)
117		return -1;
118
119	r->cfg.mode = 0;
120
121	for (tok = strtok(arg, ",|");
122	     tok;
123	     tok = strtok(NULL, ",|")) {
124		if (!strcmp(tok, "dstip"))
125			r->cfg.mode |= XT_HASHLIMIT_HASH_DIP;
126		else if (!strcmp(tok, "srcip"))
127			r->cfg.mode |= XT_HASHLIMIT_HASH_SIP;
128		else if (!strcmp(tok, "srcport"))
129			r->cfg.mode |= XT_HASHLIMIT_HASH_SPT;
130		else if (!strcmp(tok, "dstport"))
131			r->cfg.mode |= XT_HASHLIMIT_HASH_DPT;
132		else {
133			free(arg);
134			return -1;
135		}
136	}
137	free(arg);
138	return 0;
139}
140
141#define PARAM_LIMIT		0x00000001
142#define PARAM_BURST		0x00000002
143#define PARAM_MODE		0x00000004
144#define PARAM_NAME		0x00000008
145#define PARAM_SIZE		0x00000010
146#define PARAM_MAX		0x00000020
147#define PARAM_GCINTERVAL	0x00000040
148#define PARAM_EXPIRE		0x00000080
149
150/* Function which parses command options; returns true if it
151   ate an option */
152static int
153parse(int c, char **argv, int invert, unsigned int *flags,
154      const void *entry,
155      struct xt_entry_match **match)
156{
157	struct xt_hashlimit_info *r =
158			(struct xt_hashlimit_info *)(*match)->data;
159	unsigned int num;
160
161	switch(c) {
162	case '%':
163		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
164		if (!parse_rate(optarg, &r->cfg.avg))
165			exit_error(PARAMETER_PROBLEM,
166				   "bad rate `%s'", optarg);
167		*flags |= PARAM_LIMIT;
168		break;
169
170	case '$':
171		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
172		if (string_to_number(optarg, 0, 10000, &num) == -1)
173			exit_error(PARAMETER_PROBLEM,
174				   "bad --hashlimit-burst `%s'", optarg);
175		r->cfg.burst = num;
176		*flags |= PARAM_BURST;
177		break;
178	case '&':
179		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
180		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
181			exit_error(PARAMETER_PROBLEM,
182				"bad --hashlimit-htable-size: `%s'", optarg);
183		r->cfg.size = num;
184		*flags |= PARAM_SIZE;
185		break;
186	case '*':
187		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
188		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
189			exit_error(PARAMETER_PROBLEM,
190				"bad --hashlimit-htable-max: `%s'", optarg);
191		r->cfg.max = num;
192		*flags |= PARAM_MAX;
193		break;
194	case '(':
195		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
196		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
197			exit_error(PARAMETER_PROBLEM,
198				"bad --hashlimit-htable-gcinterval: `%s'",
199				optarg);
200		/* FIXME: not HZ dependent!! */
201		r->cfg.gc_interval = num;
202		*flags |= PARAM_GCINTERVAL;
203		break;
204	case ')':
205		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
206		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
207			exit_error(PARAMETER_PROBLEM,
208				"bad --hashlimit-htable-expire: `%s'", optarg);
209		/* FIXME: not HZ dependent */
210		r->cfg.expire = num;
211		*flags |= PARAM_EXPIRE;
212		break;
213	case '_':
214		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
215		if (parse_mode(r, optarg) < 0)
216			exit_error(PARAMETER_PROBLEM,
217				   "bad --hashlimit-mode: `%s'\n", optarg);
218		*flags |= PARAM_MODE;
219		break;
220	case '"':
221		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
222		if (strlen(optarg) == 0)
223			exit_error(PARAMETER_PROBLEM, "Zero-length name?");
224		strncpy(r->name, optarg, sizeof(r->name));
225		*flags |= PARAM_NAME;
226		break;
227	default:
228		return 0;
229	}
230
231	if (invert)
232		exit_error(PARAMETER_PROBLEM,
233			   "hashlimit does not support invert");
234
235	return 1;
236}
237
238/* Final check; nothing. */
239static void final_check(unsigned int flags)
240{
241	if (!(flags & PARAM_LIMIT))
242		exit_error(PARAMETER_PROBLEM,
243				"You have to specify --hashlimit");
244	if (!(flags & PARAM_MODE))
245		exit_error(PARAMETER_PROBLEM,
246				"You have to specify --hashlimit-mode");
247	if (!(flags & PARAM_NAME))
248		exit_error(PARAMETER_PROBLEM,
249				"You have to specify --hashlimit-name");
250}
251
252static struct rates
253{
254	const char *name;
255	u_int32_t mult;
256} rates[] = { { "day", XT_HASHLIMIT_SCALE*24*60*60 },
257	      { "hour", XT_HASHLIMIT_SCALE*60*60 },
258	      { "min", XT_HASHLIMIT_SCALE*60 },
259	      { "sec", XT_HASHLIMIT_SCALE } };
260
261static void print_rate(u_int32_t period)
262{
263	unsigned int i;
264
265	for (i = 1; i < sizeof(rates)/sizeof(struct rates); i++) {
266		if (period > rates[i].mult
267            || rates[i].mult/period < rates[i].mult%period)
268			break;
269	}
270
271	printf("%u/%s ", rates[i-1].mult / period, rates[i-1].name);
272}
273
274static void print_mode(const struct xt_hashlimit_info *r, char separator)
275{
276	int prevmode = 0;
277
278	if (r->cfg.mode & XT_HASHLIMIT_HASH_SIP) {
279		if (prevmode)
280			putchar(separator);
281		fputs("srcip", stdout);
282		prevmode = 1;
283	}
284	if (r->cfg.mode & XT_HASHLIMIT_HASH_SPT) {
285		if (prevmode)
286			putchar(separator);
287		fputs("srcport", stdout);
288		prevmode = 1;
289	}
290	if (r->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
291		if (prevmode)
292			putchar(separator);
293		fputs("dstip", stdout);
294		prevmode = 1;
295	}
296	if (r->cfg.mode & XT_HASHLIMIT_HASH_DPT) {
297		if (prevmode)
298			putchar(separator);
299		fputs("dstport", stdout);
300	}
301	putchar(' ');
302}
303
304/* Prints out the matchinfo. */
305static void
306print(const void *ip,
307      const struct xt_entry_match *match,
308      int numeric)
309{
310	struct xt_hashlimit_info *r =
311		(struct xt_hashlimit_info *)match->data;
312	fputs("limit: avg ", stdout); print_rate(r->cfg.avg);
313	printf("burst %u ", r->cfg.burst);
314	fputs("mode ", stdout);
315	print_mode(r, '-');
316	if (r->cfg.size)
317		printf("htable-size %u ", r->cfg.size);
318	if (r->cfg.max)
319		printf("htable-max %u ", r->cfg.max);
320	if (r->cfg.gc_interval != XT_HASHLIMIT_GCINTERVAL)
321		printf("htable-gcinterval %u ", r->cfg.gc_interval);
322	if (r->cfg.expire != XT_HASHLIMIT_EXPIRE)
323		printf("htable-expire %u ", r->cfg.expire);
324}
325
326/* FIXME: Make minimalist: only print rate if not default --RR */
327static void save(const void *ip, const struct xt_entry_match *match)
328{
329	struct xt_hashlimit_info *r =
330		(struct xt_hashlimit_info *)match->data;
331
332	fputs("--hashlimit ", stdout); print_rate(r->cfg.avg);
333	if (r->cfg.burst != XT_HASHLIMIT_BURST)
334		printf("--hashlimit-burst %u ", r->cfg.burst);
335
336	fputs("--hashlimit-mode ", stdout);
337	print_mode(r, ',');
338
339	printf("--hashlimit-name %s ", r->name);
340
341	if (r->cfg.size)
342		printf("--hashlimit-htable-size %u ", r->cfg.size);
343	if (r->cfg.max)
344		printf("--hashlimit-htable-max %u ", r->cfg.max);
345	if (r->cfg.gc_interval != XT_HASHLIMIT_GCINTERVAL)
346		printf("--hashlimit-htable-gcinterval %u", r->cfg.gc_interval);
347	if (r->cfg.expire != XT_HASHLIMIT_EXPIRE)
348		printf("--hashlimit-htable-expire %u ", r->cfg.expire);
349}
350
351static struct xtables_match hashlimit = {
352	.family		= AF_INET,
353	.name		= "hashlimit",
354	.version	= IPTABLES_VERSION,
355	.size		= XT_ALIGN(sizeof(struct xt_hashlimit_info)),
356	.userspacesize	= offsetof(struct xt_hashlimit_info, hinfo),
357	.help		= &help,
358	.init		= &init,
359	.parse		= &parse,
360	.final_check	= &final_check,
361	.print		= &print,
362	.save		= &save,
363	.extra_opts	= opts,
364};
365
366static struct xtables_match hashlimit6 = {
367	.family		= AF_INET6,
368	.name		= "hashlimit",
369	.version	= IPTABLES_VERSION,
370	.size		= XT_ALIGN(sizeof(struct xt_hashlimit_info)),
371	.userspacesize	= offsetof(struct xt_hashlimit_info, hinfo),
372	.help		= &help,
373	.init		= &init,
374	.parse		= &parse,
375	.final_check	= &final_check,
376	.print		= &print,
377	.save		= &save,
378	.extra_opts	= opts,
379};
380
381void _init(void)
382{
383	xtables_register_match(&hashlimit);
384	xtables_register_match(&hashlimit6);
385}
386