You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
355 lines
11 KiB
355 lines
11 KiB
#include <stdbool.h> |
|
#include <stdio.h> |
|
#include <string.h> |
|
#include <xtables.h> |
|
#include <linux/netfilter/xt_recent.h> |
|
|
|
enum { |
|
O_SET = 0, |
|
O_RCHECK, |
|
O_UPDATE, |
|
O_REMOVE, |
|
O_SECONDS, |
|
O_REAP, |
|
O_HITCOUNT, |
|
O_RTTL, |
|
O_NAME, |
|
O_RSOURCE, |
|
O_RDEST, |
|
O_MASK, |
|
F_SET = 1 << O_SET, |
|
F_RCHECK = 1 << O_RCHECK, |
|
F_UPDATE = 1 << O_UPDATE, |
|
F_REMOVE = 1 << O_REMOVE, |
|
F_SECONDS = 1 << O_SECONDS, |
|
F_ANY_OP = F_SET | F_RCHECK | F_UPDATE | F_REMOVE, |
|
}; |
|
|
|
#define s struct xt_recent_mtinfo |
|
static const struct xt_option_entry recent_opts_v0[] = { |
|
{.name = "set", .id = O_SET, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "rcheck", .id = O_RCHECK, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "update", .id = O_UPDATE, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "remove", .id = O_REMOVE, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "seconds", .id = O_SECONDS, .type = XTTYPE_UINT32, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, seconds), .min = 1}, |
|
{.name = "reap", .id = O_REAP, .type = XTTYPE_NONE, |
|
.also = F_SECONDS }, |
|
{.name = "hitcount", .id = O_HITCOUNT, .type = XTTYPE_UINT32, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, hit_count)}, |
|
{.name = "rttl", .id = O_RTTL, .type = XTTYPE_NONE, |
|
.excl = F_SET | F_REMOVE}, |
|
{.name = "name", .id = O_NAME, .type = XTTYPE_STRING, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, name)}, |
|
{.name = "rsource", .id = O_RSOURCE, .type = XTTYPE_NONE}, |
|
{.name = "rdest", .id = O_RDEST, .type = XTTYPE_NONE}, |
|
XTOPT_TABLEEND, |
|
}; |
|
#undef s |
|
|
|
#define s struct xt_recent_mtinfo_v1 |
|
static const struct xt_option_entry recent_opts_v1[] = { |
|
{.name = "set", .id = O_SET, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "rcheck", .id = O_RCHECK, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "update", .id = O_UPDATE, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "remove", .id = O_REMOVE, .type = XTTYPE_NONE, |
|
.excl = F_ANY_OP, .flags = XTOPT_INVERT}, |
|
{.name = "seconds", .id = O_SECONDS, .type = XTTYPE_UINT32, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, seconds), .min = 1}, |
|
{.name = "reap", .id = O_REAP, .type = XTTYPE_NONE, |
|
.also = F_SECONDS }, |
|
{.name = "hitcount", .id = O_HITCOUNT, .type = XTTYPE_UINT32, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, hit_count)}, |
|
{.name = "rttl", .id = O_RTTL, .type = XTTYPE_NONE, |
|
.excl = F_SET | F_REMOVE}, |
|
{.name = "name", .id = O_NAME, .type = XTTYPE_STRING, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, name)}, |
|
{.name = "rsource", .id = O_RSOURCE, .type = XTTYPE_NONE}, |
|
{.name = "rdest", .id = O_RDEST, .type = XTTYPE_NONE}, |
|
{.name = "mask", .id = O_MASK, .type = XTTYPE_HOST, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, mask)}, |
|
XTOPT_TABLEEND, |
|
}; |
|
#undef s |
|
|
|
static void recent_help(void) |
|
{ |
|
printf( |
|
"recent match options:\n" |
|
"[!] --set Add source address to list, always matches.\n" |
|
"[!] --rcheck Match if source address in list.\n" |
|
"[!] --update Match if source address in list, also update last-seen time.\n" |
|
"[!] --remove Match if source address in list, also removes that address from list.\n" |
|
" --seconds seconds For check and update commands above.\n" |
|
" Specifies that the match will only occur if source address last seen within\n" |
|
" the last 'seconds' seconds.\n" |
|
" --reap Purge entries older then 'seconds'.\n" |
|
" Can only be used in conjunction with the seconds option.\n" |
|
" --hitcount hits For check and update commands above.\n" |
|
" Specifies that the match will only occur if source address seen hits times.\n" |
|
" May be used in conjunction with the seconds option.\n" |
|
" --rttl For check and update commands above.\n" |
|
" Specifies that the match will only occur if the source address and the TTL\n" |
|
" match between this packet and the one which was set.\n" |
|
" Useful if you have problems with people spoofing their source address in order\n" |
|
" to DoS you via this module.\n" |
|
" --name name Name of the recent list to be used. DEFAULT used if none given.\n" |
|
" --rsource Match/Save the source address of each packet in the recent list table (default).\n" |
|
" --rdest Match/Save the destination address of each packet in the recent list table.\n" |
|
" --mask netmask Netmask that will be applied to this recent list.\n" |
|
"xt_recent by: Stephen Frost <sfrost@snowman.net>.\n"); |
|
} |
|
|
|
enum { |
|
XT_RECENT_REV_0 = 0, |
|
XT_RECENT_REV_1, |
|
}; |
|
|
|
static void recent_init(struct xt_entry_match *match, unsigned int rev) |
|
{ |
|
struct xt_recent_mtinfo *info = (struct xt_recent_mtinfo *)match->data; |
|
struct xt_recent_mtinfo_v1 *info_v1 = |
|
(struct xt_recent_mtinfo_v1 *)match->data; |
|
|
|
strncpy(info->name,"DEFAULT", XT_RECENT_NAME_LEN); |
|
/* even though XT_RECENT_NAME_LEN is currently defined as 200, |
|
* better be safe, than sorry */ |
|
info->name[XT_RECENT_NAME_LEN-1] = '\0'; |
|
info->side = XT_RECENT_SOURCE; |
|
if (rev == XT_RECENT_REV_1) |
|
memset(&info_v1->mask, 0xFF, sizeof(info_v1->mask)); |
|
} |
|
|
|
static void recent_parse(struct xt_option_call *cb) |
|
{ |
|
struct xt_recent_mtinfo *info = cb->data; |
|
|
|
xtables_option_parse(cb); |
|
switch (cb->entry->id) { |
|
case O_SET: |
|
info->check_set |= XT_RECENT_SET; |
|
if (cb->invert) |
|
info->invert = true; |
|
break; |
|
case O_RCHECK: |
|
info->check_set |= XT_RECENT_CHECK; |
|
if (cb->invert) |
|
info->invert = true; |
|
break; |
|
case O_UPDATE: |
|
info->check_set |= XT_RECENT_UPDATE; |
|
if (cb->invert) |
|
info->invert = true; |
|
break; |
|
case O_REMOVE: |
|
info->check_set |= XT_RECENT_REMOVE; |
|
if (cb->invert) |
|
info->invert = true; |
|
break; |
|
case O_RTTL: |
|
info->check_set |= XT_RECENT_TTL; |
|
break; |
|
case O_RSOURCE: |
|
info->side = XT_RECENT_SOURCE; |
|
break; |
|
case O_RDEST: |
|
info->side = XT_RECENT_DEST; |
|
break; |
|
case O_REAP: |
|
info->check_set |= XT_RECENT_REAP; |
|
break; |
|
} |
|
} |
|
|
|
static void recent_check(struct xt_fcheck_call *cb) |
|
{ |
|
if (!(cb->xflags & F_ANY_OP)) |
|
xtables_error(PARAMETER_PROBLEM, |
|
"recent: you must specify one of `--set', `--rcheck' " |
|
"`--update' or `--remove'"); |
|
} |
|
|
|
static void recent_print(const void *ip, const struct xt_entry_match *match, |
|
unsigned int family) |
|
{ |
|
const struct xt_recent_mtinfo_v1 *info = (const void *)match->data; |
|
|
|
if (info->invert) |
|
printf(" !"); |
|
|
|
printf(" recent:"); |
|
if (info->check_set & XT_RECENT_SET) |
|
printf(" SET"); |
|
if (info->check_set & XT_RECENT_CHECK) |
|
printf(" CHECK"); |
|
if (info->check_set & XT_RECENT_UPDATE) |
|
printf(" UPDATE"); |
|
if (info->check_set & XT_RECENT_REMOVE) |
|
printf(" REMOVE"); |
|
if(info->seconds) printf(" seconds: %d", info->seconds); |
|
if (info->check_set & XT_RECENT_REAP) |
|
printf(" reap"); |
|
if(info->hit_count) printf(" hit_count: %d", info->hit_count); |
|
if (info->check_set & XT_RECENT_TTL) |
|
printf(" TTL-Match"); |
|
if(info->name) printf(" name: %s", info->name); |
|
if (info->side == XT_RECENT_SOURCE) |
|
printf(" side: source"); |
|
if (info->side == XT_RECENT_DEST) |
|
printf(" side: dest"); |
|
|
|
switch(family) { |
|
case NFPROTO_IPV4: |
|
printf(" mask: %s", |
|
xtables_ipaddr_to_numeric(&info->mask.in)); |
|
break; |
|
case NFPROTO_IPV6: |
|
printf(" mask: %s", |
|
xtables_ip6addr_to_numeric(&info->mask.in6)); |
|
break; |
|
} |
|
} |
|
|
|
static void recent_save(const void *ip, const struct xt_entry_match *match, |
|
unsigned int family) |
|
{ |
|
const struct xt_recent_mtinfo_v1 *info = (const void *)match->data; |
|
|
|
if (info->invert) |
|
printf(" !"); |
|
|
|
if (info->check_set & XT_RECENT_SET) |
|
printf(" --set"); |
|
if (info->check_set & XT_RECENT_CHECK) |
|
printf(" --rcheck"); |
|
if (info->check_set & XT_RECENT_UPDATE) |
|
printf(" --update"); |
|
if (info->check_set & XT_RECENT_REMOVE) |
|
printf(" --remove"); |
|
if(info->seconds) printf(" --seconds %d", info->seconds); |
|
if (info->check_set & XT_RECENT_REAP) |
|
printf(" --reap"); |
|
if(info->hit_count) printf(" --hitcount %d", info->hit_count); |
|
if (info->check_set & XT_RECENT_TTL) |
|
printf(" --rttl"); |
|
if(info->name) printf(" --name %s",info->name); |
|
|
|
switch(family) { |
|
case NFPROTO_IPV4: |
|
printf(" --mask %s", |
|
xtables_ipaddr_to_numeric(&info->mask.in)); |
|
break; |
|
case NFPROTO_IPV6: |
|
printf(" --mask %s", |
|
xtables_ip6addr_to_numeric(&info->mask.in6)); |
|
break; |
|
} |
|
|
|
if (info->side == XT_RECENT_SOURCE) |
|
printf(" --rsource"); |
|
if (info->side == XT_RECENT_DEST) |
|
printf(" --rdest"); |
|
} |
|
|
|
static void recent_init_v0(struct xt_entry_match *match) |
|
{ |
|
recent_init(match, XT_RECENT_REV_0); |
|
} |
|
|
|
static void recent_init_v1(struct xt_entry_match *match) |
|
{ |
|
recent_init(match, XT_RECENT_REV_1); |
|
} |
|
|
|
static void recent_save_v0(const void *ip, const struct xt_entry_match *match) |
|
{ |
|
recent_save(ip, match, NFPROTO_UNSPEC); |
|
} |
|
|
|
static void recent_save_v4(const void *ip, const struct xt_entry_match *match) |
|
{ |
|
recent_save(ip, match, NFPROTO_IPV4); |
|
} |
|
|
|
static void recent_save_v6(const void *ip, const struct xt_entry_match *match) |
|
{ |
|
recent_save(ip, match, NFPROTO_IPV6); |
|
} |
|
|
|
static void recent_print_v0(const void *ip, const struct xt_entry_match *match, |
|
int numeric) |
|
{ |
|
recent_print(ip, match, NFPROTO_UNSPEC); |
|
} |
|
|
|
static void recent_print_v4(const void *ip, const struct xt_entry_match *match, |
|
int numeric) |
|
{ |
|
recent_print(ip, match, NFPROTO_IPV4); |
|
} |
|
|
|
static void recent_print_v6(const void *ip, const struct xt_entry_match *match, |
|
int numeric) |
|
{ |
|
recent_print(ip, match, NFPROTO_IPV6); |
|
} |
|
|
|
static struct xtables_match recent_mt_reg[] = { |
|
{ |
|
.name = "recent", |
|
.version = XTABLES_VERSION, |
|
.revision = 0, |
|
.family = NFPROTO_UNSPEC, |
|
.size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)), |
|
.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)), |
|
.help = recent_help, |
|
.init = recent_init_v0, |
|
.x6_parse = recent_parse, |
|
.x6_fcheck = recent_check, |
|
.print = recent_print_v0, |
|
.save = recent_save_v0, |
|
.x6_options = recent_opts_v0, |
|
}, |
|
{ |
|
.name = "recent", |
|
.version = XTABLES_VERSION, |
|
.revision = 1, |
|
.family = NFPROTO_IPV4, |
|
.size = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), |
|
.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), |
|
.help = recent_help, |
|
.init = recent_init_v1, |
|
.x6_parse = recent_parse, |
|
.x6_fcheck = recent_check, |
|
.print = recent_print_v4, |
|
.save = recent_save_v4, |
|
.x6_options = recent_opts_v1, |
|
}, |
|
{ |
|
.name = "recent", |
|
.version = XTABLES_VERSION, |
|
.revision = 1, |
|
.family = NFPROTO_IPV6, |
|
.size = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), |
|
.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), |
|
.help = recent_help, |
|
.init = recent_init_v1, |
|
.x6_parse = recent_parse, |
|
.x6_fcheck = recent_check, |
|
.print = recent_print_v6, |
|
.save = recent_save_v6, |
|
.x6_options = recent_opts_v1, |
|
}, |
|
}; |
|
|
|
void _init(void) |
|
{ |
|
xtables_register_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg)); |
|
}
|
|
|