ipt_recent.c 11.7 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
/*
 * Copyright (c) 2006 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * This is a replacement of the old ipt_recent module, which carried the
 * following copyright notice:
 *
 * Author: Stephen Frost <sfrost@snowman.net>
 * Copyright 2002-2003, Stephen Frost, 2.5.x port by laforge@netfilter.org
 */
#include <linux/init.h>
#include <linux/moduleparam.h>
Linus Torvalds's avatar
Linus Torvalds committed
16
#include <linux/proc_fs.h>
17
18
#include <linux/seq_file.h>
#include <linux/string.h>
Linus Torvalds's avatar
Linus Torvalds committed
19
#include <linux/ctype.h>
20
21
22
23
24
25
#include <linux/list.h>
#include <linux/random.h>
#include <linux/jhash.h>
#include <linux/bitops.h>
#include <linux/skbuff.h>
#include <linux/inet.h>
Linus Torvalds's avatar
Linus Torvalds committed
26
27
28
29

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_recent.h>

30
31
32
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_DESCRIPTION("IP tables recently seen matching module");
MODULE_LICENSE("GPL");
Linus Torvalds's avatar
Linus Torvalds committed
33

34
35
36
37
38
39
40
41
static unsigned int ip_list_tot = 100;
static unsigned int ip_pkt_list_tot = 20;
static unsigned int ip_list_hash_size = 0;
static unsigned int ip_list_perms = 0644;
module_param(ip_list_tot, uint, 0400);
module_param(ip_pkt_list_tot, uint, 0400);
module_param(ip_list_hash_size, uint, 0400);
module_param(ip_list_perms, uint, 0400);
42
43
44
45
46
47
48
49
50
51
52
53
54
55
MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP to remember (max. 255)");
MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/ipt_recent/* files");


struct recent_entry {
	struct list_head	list;
	struct list_head	lru_list;
	u_int32_t		addr;
	u_int8_t		ttl;
	u_int8_t		index;
	u_int16_t		nstamps;
	unsigned long		stamps[0];
Linus Torvalds's avatar
Linus Torvalds committed
56
57
};

58
59
60
struct recent_table {
	struct list_head	list;
	char			name[IPT_RECENT_NAME_LEN];
Linus Torvalds's avatar
Linus Torvalds committed
61
#ifdef CONFIG_PROC_FS
62
63
64
65
66
67
	struct proc_dir_entry	*proc;
#endif
	unsigned int		refcnt;
	unsigned int		entries;
	struct list_head	lru_list;
	struct list_head	iphash[0];
Linus Torvalds's avatar
Linus Torvalds committed
68
69
};

70
static LIST_HEAD(tables);
Linus Torvalds's avatar
Linus Torvalds committed
71
static DEFINE_SPINLOCK(recent_lock);
72
static DEFINE_MUTEX(recent_mutex);
Linus Torvalds's avatar
Linus Torvalds committed
73
74

#ifdef CONFIG_PROC_FS
75
76
static struct proc_dir_entry	*proc_dir;
static struct file_operations	recent_fops;
Linus Torvalds's avatar
Linus Torvalds committed
77
78
#endif

79
80
static u_int32_t hash_rnd;
static int hash_rnd_initted;
Linus Torvalds's avatar
Linus Torvalds committed
81

82
static unsigned int recent_entry_hash(u_int32_t addr)
Linus Torvalds's avatar
Linus Torvalds committed
83
{
84
85
86
	if (!hash_rnd_initted) {
		get_random_bytes(&hash_rnd, 4);
		hash_rnd_initted = 1;
Linus Torvalds's avatar
Linus Torvalds committed
87
	}
88
	return jhash_1word(addr, hash_rnd) & (ip_list_hash_size - 1);
Linus Torvalds's avatar
Linus Torvalds committed
89
90
}

91
92
static struct recent_entry *
recent_entry_lookup(const struct recent_table *table, u_int32_t addr, u_int8_t ttl)
Linus Torvalds's avatar
Linus Torvalds committed
93
{
94
95
96
97
98
99
100
101
102
	struct recent_entry *e;
	unsigned int h;

	h = recent_entry_hash(addr);
	list_for_each_entry(e, &table->iphash[h], list)
		if (e->addr == addr && (ttl == e->ttl || !ttl || !e->ttl))
			return e;
	return NULL;
}
Linus Torvalds's avatar
Linus Torvalds committed
103

104
105
106
107
108
109
110
static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
{
	list_del(&e->list);
	list_del(&e->lru_list);
	kfree(e);
	t->entries--;
}
Linus Torvalds's avatar
Linus Torvalds committed
111

112
113
114
115
static struct recent_entry *
recent_entry_init(struct recent_table *t, u_int32_t addr, u_int8_t ttl)
{
	struct recent_entry *e;
Linus Torvalds's avatar
Linus Torvalds committed
116

117
118
119
	if (t->entries >= ip_list_tot) {
		e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
		recent_entry_remove(t, e);
Linus Torvalds's avatar
Linus Torvalds committed
120
	}
121
122
123
124
125
126
127
128
129
130
131
132
133
134
	e = kmalloc(sizeof(*e) + sizeof(e->stamps[0]) * ip_pkt_list_tot,
		    GFP_ATOMIC);
	if (e == NULL)
		return NULL;
	e->addr      = addr;
	e->ttl       = ttl;
	e->stamps[0] = jiffies;
	e->nstamps   = 1;
	e->index     = 1;
	list_add_tail(&e->list, &t->iphash[recent_entry_hash(addr)]);
	list_add_tail(&e->lru_list, &t->lru_list);
	t->entries++;
	return e;
}
Linus Torvalds's avatar
Linus Torvalds committed
135

136
137
138
139
140
141
142
143
static void recent_entry_update(struct recent_table *t, struct recent_entry *e)
{
	e->stamps[e->index++] = jiffies;
	if (e->index > e->nstamps)
		e->nstamps = e->index;
	e->index %= ip_pkt_list_tot;
	list_move_tail(&e->lru_list, &t->lru_list);
}
Linus Torvalds's avatar
Linus Torvalds committed
144

145
146
147
static struct recent_table *recent_table_lookup(const char *name)
{
	struct recent_table *t;
Linus Torvalds's avatar
Linus Torvalds committed
148

149
150
151
152
153
	list_for_each_entry(t, &tables, list)
		if (!strcmp(t->name, name))
			return t;
	return NULL;
}
Linus Torvalds's avatar
Linus Torvalds committed
154

155
156
157
158
static void recent_table_flush(struct recent_table *t)
{
	struct recent_entry *e, *next;
	unsigned int i;
Linus Torvalds's avatar
Linus Torvalds committed
159

160
161
162
	for (i = 0; i < ip_list_hash_size; i++) {
		list_for_each_entry_safe(e, next, &t->iphash[i], list)
			recent_entry_remove(t, e);
Linus Torvalds's avatar
Linus Torvalds committed
163
164
165
166
	}
}

static int
167
168
169
170
ipt_recent_match(const struct sk_buff *skb,
		 const struct net_device *in, const struct net_device *out,
		 const struct xt_match *match, const void *matchinfo,
		 int offset, unsigned int protoff, int *hotdrop)
Linus Torvalds's avatar
Linus Torvalds committed
171
172
{
	const struct ipt_recent_info *info = matchinfo;
173
174
175
176
177
	struct recent_table *t;
	struct recent_entry *e;
	u_int32_t addr;
	u_int8_t ttl;
	int ret = info->invert;
Linus Torvalds's avatar
Linus Torvalds committed
178

179
180
181
182
	if (info->side == IPT_RECENT_DEST)
		addr = skb->nh.iph->daddr;
	else
		addr = skb->nh.iph->saddr;
Linus Torvalds's avatar
Linus Torvalds committed
183

184
185
186
187
	ttl = skb->nh.iph->ttl;
	/* use TTL as seen before forwarding */
	if (out && !skb->sk)
		ttl++;
Linus Torvalds's avatar
Linus Torvalds committed
188
189

	spin_lock_bh(&recent_lock);
190
191
192
193
194
195
196
197
198
199
200
	t = recent_table_lookup(info->name);
	e = recent_entry_lookup(t, addr,
				info->check_set & IPT_RECENT_TTL ? ttl : 0);
	if (e == NULL) {
		if (!(info->check_set & IPT_RECENT_SET))
			goto out;
		e = recent_entry_init(t, addr, ttl);
		if (e == NULL)
			*hotdrop = 1;
		ret ^= 1;
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
201
202
	}

203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
	if (info->check_set & IPT_RECENT_SET)
		ret ^= 1;
	else if (info->check_set & IPT_RECENT_REMOVE) {
		recent_entry_remove(t, e);
		ret ^= 1;
	} else if (info->check_set & (IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) {
		unsigned long t = jiffies - info->seconds * HZ;
		unsigned int i, hits = 0;

		for (i = 0; i < e->nstamps; i++) {
			if (info->seconds && time_after(t, e->stamps[i]))
				continue;
			if (++hits >= info->hit_count) {
				ret ^= 1;
				break;
Linus Torvalds's avatar
Linus Torvalds committed
218
219
220
221
			}
		}
	}

222
223
224
225
226
227
228
229
	if (info->check_set & IPT_RECENT_SET ||
	    (info->check_set & IPT_RECENT_UPDATE && ret)) {
		recent_entry_update(t, e);
		e->ttl = ttl;
	}
out:
	spin_unlock_bh(&recent_lock);
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
230
231
232
}

static int
233
234
235
ipt_recent_checkentry(const char *tablename, const void *ip,
		      const struct xt_match *match, void *matchinfo,
		      unsigned int matchsize, unsigned int hook_mask)
Linus Torvalds's avatar
Linus Torvalds committed
236
237
{
	const struct ipt_recent_info *info = matchinfo;
238
239
240
	struct recent_table *t;
	unsigned i;
	int ret = 0;
Linus Torvalds's avatar
Linus Torvalds committed
241

242
243
244
245
246
247
248
249
250
251
	if (hweight8(info->check_set &
		     (IPT_RECENT_SET | IPT_RECENT_REMOVE |
		      IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) != 1)
		return 0;
	if ((info->check_set & (IPT_RECENT_SET | IPT_RECENT_REMOVE)) &&
	    (info->seconds || info->hit_count))
		return 0;
	if (info->name[0] == '\0' ||
	    strnlen(info->name, IPT_RECENT_NAME_LEN) == IPT_RECENT_NAME_LEN)
		return 0;
Linus Torvalds's avatar
Linus Torvalds committed
252

253
	mutex_lock(&recent_mutex);
254
255
256
257
258
	t = recent_table_lookup(info->name);
	if (t != NULL) {
		t->refcnt++;
		ret = 1;
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
259
260
	}

261
	t = kzalloc(sizeof(*t) + sizeof(t->iphash[0]) * ip_list_hash_size,
262
		    GFP_KERNEL);
263
264
	if (t == NULL)
		goto out;
265
	t->refcnt = 1;
266
267
268
269
270
271
272
273
274
	strcpy(t->name, info->name);
	INIT_LIST_HEAD(&t->lru_list);
	for (i = 0; i < ip_list_hash_size; i++)
		INIT_LIST_HEAD(&t->iphash[i]);
#ifdef CONFIG_PROC_FS
	t->proc = create_proc_entry(t->name, ip_list_perms, proc_dir);
	if (t->proc == NULL) {
		kfree(t);
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
275
	}
276
277
	t->proc->proc_fops = &recent_fops;
	t->proc->data      = t;
Linus Torvalds's avatar
Linus Torvalds committed
278
#endif
279
	spin_lock_bh(&recent_lock);
280
	list_add_tail(&t->list, &tables);
281
	spin_unlock_bh(&recent_lock);
282
283
	ret = 1;
out:
284
	mutex_unlock(&recent_mutex);
285
286
	return ret;
}
Linus Torvalds's avatar
Linus Torvalds committed
287

288
289
290
291
292
293
static void
ipt_recent_destroy(const struct xt_match *match, void *matchinfo,
		   unsigned int matchsize)
{
	const struct ipt_recent_info *info = matchinfo;
	struct recent_table *t;
Linus Torvalds's avatar
Linus Torvalds committed
294

295
	mutex_lock(&recent_mutex);
296
297
	t = recent_table_lookup(info->name);
	if (--t->refcnt == 0) {
298
		spin_lock_bh(&recent_lock);
299
		list_del(&t->list);
300
		spin_unlock_bh(&recent_lock);
301
302
303
		recent_table_flush(t);
#ifdef CONFIG_PROC_FS
		remove_proc_entry(t->name, proc_dir);
Linus Torvalds's avatar
Linus Torvalds committed
304
#endif
305
		kfree(t);
Linus Torvalds's avatar
Linus Torvalds committed
306
	}
307
	mutex_unlock(&recent_mutex);
308
}
Linus Torvalds's avatar
Linus Torvalds committed
309

310
311
312
313
314
#ifdef CONFIG_PROC_FS
struct recent_iter_state {
	struct recent_table	*table;
	unsigned int		bucket;
};
Linus Torvalds's avatar
Linus Torvalds committed
315

316
317
318
319
320
321
static void *recent_seq_start(struct seq_file *seq, loff_t *pos)
{
	struct recent_iter_state *st = seq->private;
	struct recent_table *t = st->table;
	struct recent_entry *e;
	loff_t p = *pos;
Linus Torvalds's avatar
Linus Torvalds committed
322
323
324

	spin_lock_bh(&recent_lock);

325
326
327
328
	for (st->bucket = 0; st->bucket < ip_list_hash_size; st->bucket++) {
		list_for_each_entry(e, &t->iphash[st->bucket], list) {
			if (p-- == 0)
				return e;
Linus Torvalds's avatar
Linus Torvalds committed
329
330
		}
	}
331
332
	return NULL;
}
Linus Torvalds's avatar
Linus Torvalds committed
333

334
335
336
337
338
339
340
341
342
343
344
345
346
347
static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	struct recent_iter_state *st = seq->private;
	struct recent_table *t = st->table;
	struct recent_entry *e = v;
	struct list_head *head = e->list.next;

	while (head == &t->iphash[st->bucket]) {
		if (++st->bucket >= ip_list_hash_size)
			return NULL;
		head = t->iphash[st->bucket].next;
	}
	(*pos)++;
	return list_entry(head, struct recent_entry, list);
Linus Torvalds's avatar
Linus Torvalds committed
348
349
}

350
static void recent_seq_stop(struct seq_file *s, void *v)
Linus Torvalds's avatar
Linus Torvalds committed
351
{
352
353
	spin_unlock_bh(&recent_lock);
}
Linus Torvalds's avatar
Linus Torvalds committed
354

355
356
357
358
359
360
361
362
363
364
365
366
367
static int recent_seq_show(struct seq_file *seq, void *v)
{
	struct recent_entry *e = v;
	unsigned int i;

	i = (e->index - 1) % ip_pkt_list_tot;
	seq_printf(seq, "src=%u.%u.%u.%u ttl: %u last_seen: %lu oldest_pkt: %u",
		   NIPQUAD(e->addr), e->ttl, e->stamps[i], e->index);
	for (i = 0; i < e->nstamps; i++)
		seq_printf(seq, "%s %lu", i ? "," : "", e->stamps[i]);
	seq_printf(seq, "\n");
	return 0;
}
Linus Torvalds's avatar
Linus Torvalds committed
368

369
370
371
372
373
374
static struct seq_operations recent_seq_ops = {
	.start		= recent_seq_start,
	.next		= recent_seq_next,
	.stop		= recent_seq_stop,
	.show		= recent_seq_show,
};
Linus Torvalds's avatar
Linus Torvalds committed
375

376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
static int recent_seq_open(struct inode *inode, struct file *file)
{
	struct proc_dir_entry *pde = PDE(inode);
	struct seq_file *seq;
	struct recent_iter_state *st;
	int ret;

	st = kzalloc(sizeof(*st), GFP_KERNEL);
	if (st == NULL)
		return -ENOMEM;
	ret = seq_open(file, &recent_seq_ops);
	if (ret)
		kfree(st);
	st->table    = pde->data;
	seq          = file->private_data;
	seq->private = st;
	return ret;
}
Linus Torvalds's avatar
Linus Torvalds committed
394

395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
static ssize_t recent_proc_write(struct file *file, const char __user *input,
				 size_t size, loff_t *loff)
{
	struct proc_dir_entry *pde = PDE(file->f_dentry->d_inode);
	struct recent_table *t = pde->data;
	struct recent_entry *e;
	char buf[sizeof("+255.255.255.255")], *c = buf;
	u_int32_t addr;
	int add;

	if (size > sizeof(buf))
		size = sizeof(buf);
	if (copy_from_user(buf, input, size))
		return -EFAULT;
	while (isspace(*c))
		c++;

	if (size - (c - buf) < 5)
		return c - buf;
	if (!strncmp(c, "clear", 5)) {
		c += 5;
		spin_lock_bh(&recent_lock);
		recent_table_flush(t);
Linus Torvalds's avatar
Linus Torvalds committed
418
		spin_unlock_bh(&recent_lock);
419
		return c - buf;
Linus Torvalds's avatar
Linus Torvalds committed
420
421
	}

422
423
424
425
426
427
428
429
430
431
	switch (*c) {
	case '-':
		add = 0;
		c++;
		break;
	case '+':
		c++;
	default:
		add = 1;
		break;
Linus Torvalds's avatar
Linus Torvalds committed
432
	}
433
	addr = in_aton(c);
Linus Torvalds's avatar
Linus Torvalds committed
434

435
436
437
438
439
440
441
442
443
444
	spin_lock_bh(&recent_lock);
	e = recent_entry_lookup(t, addr, 0);
	if (e == NULL) {
		if (add)
			recent_entry_init(t, addr, 0);
	} else {
		if (add)
			recent_entry_update(t, e);
		else
			recent_entry_remove(t, e);
Linus Torvalds's avatar
Linus Torvalds committed
445
446
	}
	spin_unlock_bh(&recent_lock);
447
448
	return size;
}
Linus Torvalds's avatar
Linus Torvalds committed
449

450
451
452
453
454
455
456
static struct file_operations recent_fops = {
	.open		= recent_seq_open,
	.read		= seq_read,
	.write		= recent_proc_write,
	.release	= seq_release_private,
	.owner		= THIS_MODULE,
};
Linus Torvalds's avatar
Linus Torvalds committed
457
458
#endif /* CONFIG_PROC_FS */

459
460
static struct ipt_match recent_match = {
	.name		= "recent",
461
	.match		= ipt_recent_match,
462
	.matchsize	= sizeof(struct ipt_recent_info),
463
464
465
	.checkentry	= ipt_recent_checkentry,
	.destroy	= ipt_recent_destroy,
	.me		= THIS_MODULE,
Linus Torvalds's avatar
Linus Torvalds committed
466
467
};

468
static int __init ipt_recent_init(void)
Linus Torvalds's avatar
Linus Torvalds committed
469
{
470
	int err;
Linus Torvalds's avatar
Linus Torvalds committed
471

472
473
474
	if (!ip_list_tot || !ip_pkt_list_tot || ip_pkt_list_tot > 255)
		return -EINVAL;
	ip_list_hash_size = 1 << fls(ip_list_tot);
Linus Torvalds's avatar
Linus Torvalds committed
475
476

	err = ipt_register_match(&recent_match);
477
#ifdef CONFIG_PROC_FS
Linus Torvalds's avatar
Linus Torvalds committed
478
	if (err)
479
480
481
482
483
484
485
		return err;
	proc_dir = proc_mkdir("ipt_recent", proc_net);
	if (proc_dir == NULL) {
		ipt_unregister_match(&recent_match);
		err = -ENOMEM;
	}
#endif
Linus Torvalds's avatar
Linus Torvalds committed
486
487
488
	return err;
}

489
static void __exit ipt_recent_exit(void)
Linus Torvalds's avatar
Linus Torvalds committed
490
{
491
	BUG_ON(!list_empty(&tables));
Linus Torvalds's avatar
Linus Torvalds committed
492
	ipt_unregister_match(&recent_match);
493
494
495
#ifdef CONFIG_PROC_FS
	remove_proc_entry("ipt_recent", proc_net);
#endif
Linus Torvalds's avatar
Linus Torvalds committed
496
497
}

498
module_init(ipt_recent_init);
499
module_exit(ipt_recent_exit);