From b1f568309a09e61f892dee3c23279cecff0b0ff4 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Wed, 10 Jan 2007 14:53:55 +0000 Subject: Remove extensions for unmaintained/obsolete patchlets --- extensions/libipt_dstlimit.c | 340 ------------------------------------------- 1 file changed, 340 deletions(-) delete mode 100644 extensions/libipt_dstlimit.c (limited to 'extensions/libipt_dstlimit.c') diff --git a/extensions/libipt_dstlimit.c b/extensions/libipt_dstlimit.c deleted file mode 100644 index 3f3b6330..00000000 --- a/extensions/libipt_dstlimit.c +++ /dev/null @@ -1,340 +0,0 @@ -/* iptables match extension for limiting packets per destination - * - * (C) 2003 by Harald Welte - * - * Development of this code was funded by Astaro AG, http://www.astaro.com/ - * - * Based on ipt_limit.c by - * Jérôme de Vivie - * Hervé Eychenne - */ - -#include -#include -#include -#include -#include -#include -#include -#include - -#define IPT_DSTLIMIT_BURST 5 - -/* miliseconds */ -#define IPT_DSTLIMIT_GCINTERVAL 1000 -#define IPT_DSTLIMIT_EXPIRE 10000 - -/* Function which prints out usage message. */ -static void -help(void) -{ - printf( -"dstlimit v%s options:\n" -"--dstlimit max average match rate\n" -" [Packets per second unless followed by \n" -" /sec /minute /hour /day postfixes]\n" -"--dstlimit-mode mode\n" -" dstip\n" -" dstip-dstport\n" -" srcip-dstip\n" -" srcip-dstip-dstport\n" -"--dstlimit-name name for /proc/net/ipt_dstlimit/\n" -"[--dstlimit-burst ] number to match in a burst, default %u\n" -"[--dstlimit-htable-size ] number of hashtable buckets\n" -"[--dstlimit-htable-max ] number of hashtable entries\n" -"[--dstlimit-htable-gcinterval] interval between garbage collection runs\n" -"[--dstlimit-htable-expire] after which time are idle entries expired?\n" -"\n", IPTABLES_VERSION, IPT_DSTLIMIT_BURST); -} - -static struct option opts[] = { - { "dstlimit", 1, 0, '%' }, - { "dstlimit-burst", 1, 0, '$' }, - { "dstlimit-htable-size", 1, 0, '&' }, - { "dstlimit-htable-max", 1, 0, '*' }, - { "dstlimit-htable-gcinterval", 1, 0, '(' }, - { "dstlimit-htable-expire", 1, 0, ')' }, - { "dstlimit-mode", 1, 0, '_' }, - { "dstlimit-name", 1, 0, '"' }, - { 0 } -}; - -static -int parse_rate(const char *rate, u_int32_t *val) -{ - const char *delim; - u_int32_t r; - u_int32_t mult = 1; /* Seconds by default. */ - - delim = strchr(rate, '/'); - if (delim) { - if (strlen(delim+1) == 0) - return 0; - - if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0) - mult = 1; - else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0) - mult = 60; - else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0) - mult = 60*60; - else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0) - mult = 24*60*60; - else - return 0; - } - r = atoi(rate); - if (!r) - return 0; - - /* This would get mapped to infinite (1/day is minimum they - can specify, so we're ok at that end). */ - if (r / mult > IPT_DSTLIMIT_SCALE) - exit_error(PARAMETER_PROBLEM, "Rate too fast `%s'\n", rate); - - *val = IPT_DSTLIMIT_SCALE * mult / r; - return 1; -} - -/* Initialize the match. */ -static void -init(struct ipt_entry_match *m, unsigned int *nfcache) -{ - struct ipt_dstlimit_info *r = (struct ipt_dstlimit_info *)m->data; - - r->cfg.burst = IPT_DSTLIMIT_BURST; - r->cfg.gc_interval = IPT_DSTLIMIT_GCINTERVAL; - r->cfg.expire = IPT_DSTLIMIT_EXPIRE; - -} - -#define PARAM_LIMIT 0x00000001 -#define PARAM_BURST 0x00000002 -#define PARAM_MODE 0x00000004 -#define PARAM_NAME 0x00000008 -#define PARAM_SIZE 0x00000010 -#define PARAM_MAX 0x00000020 -#define PARAM_GCINTERVAL 0x00000040 -#define PARAM_EXPIRE 0x00000080 - -/* Function which parses command options; returns true if it - ate an option */ -static int -parse(int c, char **argv, int invert, unsigned int *flags, - const struct ipt_entry *entry, - unsigned int *nfcache, - struct ipt_entry_match **match) -{ - struct ipt_dstlimit_info *r = - (struct ipt_dstlimit_info *)(*match)->data; - unsigned int num; - - switch(c) { - case '%': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (!parse_rate(optarg, &r->cfg.avg)) - exit_error(PARAMETER_PROBLEM, - "bad rate `%s'", optarg); - *flags |= PARAM_LIMIT; - break; - - case '$': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (string_to_number(optarg, 0, 10000, &num) == -1) - exit_error(PARAMETER_PROBLEM, - "bad --dstlimit-burst `%s'", optarg); - r->cfg.burst = num; - *flags |= PARAM_BURST; - break; - case '&': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) - exit_error(PARAMETER_PROBLEM, - "bad --dstlimit-htable-size: `%s'", optarg); - r->cfg.size = num; - *flags |= PARAM_SIZE; - break; - case '*': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) - exit_error(PARAMETER_PROBLEM, - "bad --dstlimit-htable-max: `%s'", optarg); - r->cfg.max = num; - *flags |= PARAM_MAX; - break; - case '(': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) - exit_error(PARAMETER_PROBLEM, - "bad --dstlimit-htable-gcinterval: `%s'", - optarg); - /* FIXME: not HZ dependent!! */ - r->cfg.gc_interval = num; - *flags |= PARAM_GCINTERVAL; - break; - case ')': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) - exit_error(PARAMETER_PROBLEM, - "bad --dstlimit-htable-expire: `%s'", optarg); - /* FIXME: not HZ dependent */ - r->cfg.expire = num; - *flags |= PARAM_EXPIRE; - break; - case '_': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (!strcmp(optarg, "dstip")) - r->cfg.mode = IPT_DSTLIMIT_HASH_DIP; - else if (!strcmp(optarg, "dstip-destport") || - !strcmp(optarg, "dstip-dstport")) - r->cfg.mode = IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT; - else if (!strcmp(optarg, "srcip-dstip")) - r->cfg.mode = IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP; - else if (!strcmp(optarg, "srcip-dstip-destport") || - !strcmp(optarg, "srcip-dstip-dstport")) - r->cfg.mode = IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT; - else - exit_error(PARAMETER_PROBLEM, - "bad --dstlimit-mode: `%s'\n", optarg); - *flags |= PARAM_MODE; - break; - case '"': - if (check_inverse(argv[optind-1], &invert, &optind, 0)) break; - if (strlen(optarg) == 0) - exit_error(PARAMETER_PROBLEM, "Zero-length name?"); - strncpy(r->name, optarg, sizeof(r->name)); - *flags |= PARAM_NAME; - break; - default: - return 0; - } - - if (invert) - exit_error(PARAMETER_PROBLEM, - "dstlimit does not support invert"); - - return 1; -} - -/* Final check; nothing. */ -static void final_check(unsigned int flags) -{ - if (!(flags & PARAM_LIMIT)) - exit_error(PARAMETER_PROBLEM, - "You have to specify --dstlimit"); - if (!(flags & PARAM_MODE)) - exit_error(PARAMETER_PROBLEM, - "You have to specify --dstlimit-mode"); - if (!(flags & PARAM_NAME)) - exit_error(PARAMETER_PROBLEM, - "You have to specify --dstlimit-name"); -} - -static struct rates -{ - const char *name; - u_int32_t mult; -} rates[] = { { "day", IPT_DSTLIMIT_SCALE*24*60*60 }, - { "hour", IPT_DSTLIMIT_SCALE*60*60 }, - { "min", IPT_DSTLIMIT_SCALE*60 }, - { "sec", IPT_DSTLIMIT_SCALE } }; - -static void print_rate(u_int32_t period) -{ - unsigned int i; - - for (i = 1; i < sizeof(rates)/sizeof(struct rates); i++) { - if (period > rates[i].mult - || rates[i].mult/period < rates[i].mult%period) - break; - } - - printf("%u/%s ", rates[i-1].mult / period, rates[i-1].name); -} - -/* Prints out the matchinfo. */ -static void -print(const struct ipt_ip *ip, - const struct ipt_entry_match *match, - int numeric) -{ - struct ipt_dstlimit_info *r = - (struct ipt_dstlimit_info *)match->data; - printf("limit: avg "); print_rate(r->cfg.avg); - printf("burst %u ", r->cfg.burst); - switch (r->cfg.mode) { - case (IPT_DSTLIMIT_HASH_DIP): - printf("mode dstip "); - break; - case (IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): - printf("mode dstip-dstport "); - break; - case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP): - printf("mode srcip-dstip "); - break; - case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): - printf("mode srcip-dstip-dstport "); - break; - } - if (r->cfg.size) - printf("htable-size %u ", r->cfg.size); - if (r->cfg.max) - printf("htable-max %u ", r->cfg.max); - if (r->cfg.gc_interval != IPT_DSTLIMIT_GCINTERVAL) - printf("htable-gcinterval %u ", r->cfg.gc_interval); - if (r->cfg.expire != IPT_DSTLIMIT_EXPIRE) - printf("htable-expire %u ", r->cfg.expire); -} - -/* FIXME: Make minimalist: only print rate if not default --RR */ -static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match) -{ - struct ipt_dstlimit_info *r = - (struct ipt_dstlimit_info *)match->data; - - printf("--dstlimit "); print_rate(r->cfg.avg); - if (r->cfg.burst != IPT_DSTLIMIT_BURST) - printf("--dstlimit-burst %u ", r->cfg.burst); - switch (r->cfg.mode) { - case (IPT_DSTLIMIT_HASH_DIP): - printf("--mode dstip "); - break; - case (IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): - printf("--mode dstip-dstport "); - break; - case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP): - printf("--mode srcip-dstip "); - break; - case (IPT_DSTLIMIT_HASH_SIP|IPT_DSTLIMIT_HASH_DIP|IPT_DSTLIMIT_HASH_DPT): - printf("--mode srcip-dstip-dstport "); - break; - } - if (r->cfg.size) - printf("--dstlimit-htable-size %u ", r->cfg.size); - if (r->cfg.max) - printf("--dstlimit-htable-max %u ", r->cfg.max); - if (r->cfg.gc_interval != IPT_DSTLIMIT_GCINTERVAL) - printf("--dstlimit-htable-gcinterval %u", r->cfg.gc_interval); - if (r->cfg.expire != IPT_DSTLIMIT_EXPIRE) - printf("--dstlimit-htable-expire %u ", r->cfg.expire); -} - -static struct iptables_match dstlimit = { - .next = NULL, - .name = "dstlimit", - .version = IPTABLES_VERSION, - .size = IPT_ALIGN(sizeof(struct ipt_dstlimit_info)), - .userspacesize = IPT_ALIGN(sizeof(struct ipt_dstlimit_info)), - //offsetof(struct ipt_dstlimit_info, prev), - .help = &help, - .init = &init, - .parse = &parse, - .final_check = &final_check, - .print = &print, - .save = &save, - .extra_opts = opts -}; - -void _init(void) -{ - register_match(&dstlimit); -} -- cgit v1.2.3