From 4fe389f87d5b8be160a6706823d5aa71deb78835 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Thu, 13 Nov 2003 18:29:16 +0000 Subject: add dstlimit extension (kernel code in patch-o-matic soon) --- extensions/libipt_dstlimit.c | 306 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 306 insertions(+) create mode 100644 extensions/libipt_dstlimit.c (limited to 'extensions/libipt_dstlimit.c') diff --git a/extensions/libipt_dstlimit.c b/extensions/libipt_dstlimit.c new file mode 100644 index 00000000..225da4db --- /dev/null +++ b/extensions/libipt_dstlimit.c @@ -0,0 +1,306 @@ +/* iptables match extension for limiting packets per destination + * + * (C) 2003 by Harald Welte + * + * Development of this code was funded by Astaro AG, http://www.astaro.com/ + * + * Based on ipt_limit.c by + * Jérôme de Vivie + * Hervé Eychenne + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#define IPT_DSTLIMIT_BURST 5 + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"dstlimit v%s options:\n" +"--dstlimit max average match rate\n" +" [Packets per second unless followed by \n" +" /sec /minute /hour /day postfixes]\n" +"--dstlimit-mode mode (destip|destip-destport)\n" +"[--dstlimit-burst ] number to match in a burst, default %u\n" +"[--dstlimit-htable-size ] number of hashtable buckets\n" +"[--dstlimit-htable-max ] number of hashtable entries\n" +"[--dstlimit-htable-gcinterval] interval between garbage collection runs\n" +"[--dstlimit-htable-expire] after which time are idle entries expired?\n" +"\n", IPTABLES_VERSION, IPT_DSTLIMIT_BURST); +} + +static struct option opts[] = { + { "dstlimit", 1, 0, '%' }, + { "dstlimit-burst", 1, 0, '$' }, + { "dstlimit-htable-size", 1, 0, '&' }, + { "dstlimit-htable-max", 1, 0, '*' }, + { "dstlimit-htable-gcinterval", 1, 0, '(' }, + { "dstlimit-htable-expire", 1, 0, ')' }, + { "dstlimit-mode", 1, 0, '_' }, + { 0 } +}; + +static +int parse_rate(const char *rate, u_int32_t *val) +{ + const char *delim; + u_int32_t r; + u_int32_t mult = 1; /* Seconds by default. */ + + delim = strchr(rate, '/'); + if (delim) { + if (strlen(delim+1) == 0) + return 0; + + if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0) + mult = 1; + else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0) + mult = 60; + else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0) + mult = 60*60; + else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0) + mult = 24*60*60; + else + return 0; + } + r = atoi(rate); + if (!r) + return 0; + + /* This would get mapped to infinite (1/day is minimum they + can specify, so we're ok at that end). */ + if (r / mult > IPT_DSTLIMIT_SCALE) + exit_error(PARAMETER_PROBLEM, "Rate too fast `%s'\n", rate); + + *val = IPT_DSTLIMIT_SCALE * mult / r; + return 1; +} + +/* Initialize the match. */ +static void +init(struct ipt_entry_match *m, unsigned int *nfcache) +{ + struct ipt_dstlimit_info *r = (struct ipt_dstlimit_info *)m->data; + + r->burst = IPT_DSTLIMIT_BURST; + + /* Can't cache this */ + *nfcache |= NFC_UNKNOWN; +} + +#define PARAM_LIMIT 0x00000001 +#define PARAM_BURST 0x00000002 +#define PARAM_MODE 0x00000004 +#define PARAM_SIZE 0x00000010 +#define PARAM_MAX 0x00000020 +#define PARAM_GCINTERVAL 0x00000040 +#define PARAM_EXPIRE 0x00000080 + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + unsigned int *nfcache, + struct ipt_entry_match **match) +{ + struct ipt_dstlimit_info *r = + (struct ipt_dstlimit_info *)(*match)->data; + unsigned int num; + + switch(c) { + case '%': + if (check_inverse(optarg, &invert, NULL, 0)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --dstlimit"); + if (!parse_rate(optarg, &r->avg)) + exit_error(PARAMETER_PROBLEM, + "bad rate `%s'", optarg); + *flags |= PARAM_LIMIT; + break; + + case '$': + if (check_inverse(optarg, &invert, NULL, 0)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --dstlimit-burst"); + + if (string_to_number(optarg, 0, 10000, &num) == -1) + exit_error(PARAMETER_PROBLEM, + "bad --dstlimit-burst `%s'", optarg); + r->burst = num; + *flags |= PARAM_BURST; + break; + case '&': + if (check_inverse(optarg, &invert, NULL, 0)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --dstlimit-htable-size"); + + if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) + exit_error(PARAMETER_PROBLEM, + "bad --dstlimit-htable-size: `%s'", optarg); + r->hinfo.size = num; + *flags |= PARAM_SIZE; + break; + case '*': + if (check_inverse(optarg, &invert, NULL, 0)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --dstlimit-htable-max"); + if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) + exit_error(PARAMETER_PROBLEM, + "bad --dstlimit-htable-max: `%s'", optarg); + r->hinfo.max = num; + *flags |= PARAM_MAX; + break; + case '(': + if (check_inverse(optarg, &invert, NULL, 0)) + exit_error(PARAMETER_PROBLEM, "Unexpected `!' after " + "--dstlimit-htable-gcinterval"); + if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) + exit_error(PARAMETER_PROBLEM, + "bad --dstlimit-htable-gcinterval: `%s'", + optarg); + /* FIXME: not HZ dependent!! */ + r->hinfo.gc_interval = num; + *flags |= PARAM_GCINTERVAL; + break; + case ')': + if (check_inverse(optarg, &invert, NULL, 0)) + exit_error(PARAMETER_PROBLEM, "Unexpected `!' after " + "--dstlimit-htable-expire"); + if (string_to_number(optarg, 0, 0xffffffff, &num) == -1) + exit_error(PARAMETER_PROBLEM, + "bad --dstlimit-htable-expire: `%s'", optarg); + /* FIXME: not HZ dependent */ + r->hinfo.expire = num; + *flags |= PARAM_EXPIRE; + break; + case '_': + if (check_inverse(optarg, &invert, NULL, 0)) + exit_error(PARAMETER_PROBLEM, "Unexpected `!' after " + "--dstlimit-mode"); + if (!strcmp(optarg, "destip")) + r->mode = IPT_DSTLIMIT_MODE_DIP; + else if (!strcmp(optarg, "destip-destport")) + r->mode = IPT_DSTLIMIT_MODE_DIP_DPT; + else + exit_error(PARAMETER_PROBLEM, + "bad --dstlimit-mode: `%s'\n", optarg); + *flags |= PARAM_MODE; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; nothing. */ +static void final_check(unsigned int flags) +{ + if (!(flags & PARAM_LIMIT)) + exit_error(PARAMETER_PROBLEM, + "You have to specify --dstlimit-rate"); + if (!(flags & PARAM_MODE)) + exit_error(PARAMETER_PROBLEM, + "You have to specify --dstlimit-mode"); +} + +static struct rates +{ + const char *name; + u_int32_t mult; +} rates[] = { { "day", IPT_DSTLIMIT_SCALE*24*60*60 }, + { "hour", IPT_DSTLIMIT_SCALE*60*60 }, + { "min", IPT_DSTLIMIT_SCALE*60 }, + { "sec", IPT_DSTLIMIT_SCALE } }; + +static void print_rate(u_int32_t period) +{ + unsigned int i; + + for (i = 1; i < sizeof(rates)/sizeof(struct rates); i++) { + if (period > rates[i].mult + || rates[i].mult/period < rates[i].mult%period) + break; + } + + printf("%u/%s ", rates[i-1].mult / period, rates[i-1].name); +} + +/* Prints out the matchinfo. */ +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_match *match, + int numeric) +{ + struct ipt_dstlimit_info *r = + (struct ipt_dstlimit_info *)match->data; + printf("limit: avg "); print_rate(r->avg); + printf("burst %u ", r->burst); + switch (r->mode) { + case IPT_DSTLIMIT_MODE_DIP: + printf("mode dstip "); + break; + case IPT_DSTLIMIT_MODE_DIP_DPT: + printf("mode dstip-dstport "); + break; + } + printf("htable-size %u ", r->hinfo.size); + printf("htable-max %u ", r->hinfo.max); + printf("htable-gcinterval %u ", r->hinfo.gc_interval); + printf("htable-expire %u ", r->hinfo.expire); +} + +/* FIXME: Make minimalist: only print rate if not default --RR */ +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match) +{ + struct ipt_dstlimit_info *r = + (struct ipt_dstlimit_info *)match->data; + + printf("--limit "); print_rate(r->avg); + if (r->burst != IPT_DSTLIMIT_BURST) + printf("--limit-burst %u ", r->burst); + switch (r->mode) { + case IPT_DSTLIMIT_MODE_DIP: + printf("--mode dstip "); + break; + case IPT_DSTLIMIT_MODE_DIP_DPT: + printf("--mode dstip-dstport "); + break; + } + printf("--htable-size %u ", r->hinfo.size); + printf("--htable-max %u ", r->hinfo.max); + printf("--htable-gcinterval %u", r->hinfo.gc_interval); + printf("--htable-expire %u ", r->hinfo.expire); +} + +static +struct iptables_match dstlimit += { NULL, + "dstlimit", + IPTABLES_VERSION, + IPT_ALIGN(sizeof(struct ipt_dstlimit_info)), + IPT_ALIGN(sizeof(struct ipt_dstlimit_info)), + //offsetof(struct ipt_dstlimit_info, prev), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void _init(void) +{ + register_match(&dstlimit); +} -- cgit v1.2.3