You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
252 lines
7.1 KiB
252 lines
7.1 KiB
#include <stdio.h> |
|
#include <netdb.h> |
|
#include <string.h> |
|
#include <xtables.h> |
|
#include <linux/netfilter/xt_connlimit.h> |
|
|
|
enum { |
|
O_UPTO = 0, |
|
O_ABOVE, |
|
O_MASK, |
|
O_SADDR, |
|
O_DADDR, |
|
F_UPTO = 1 << O_UPTO, |
|
F_ABOVE = 1 << O_ABOVE, |
|
F_MASK = 1 << O_MASK, |
|
F_SADDR = 1 << O_SADDR, |
|
F_DADDR = 1 << O_DADDR, |
|
}; |
|
|
|
static void connlimit_help(void) |
|
{ |
|
printf( |
|
"connlimit match options:\n" |
|
" --connlimit-upto n match if the number of existing connections is 0..n\n" |
|
" --connlimit-above n match if the number of existing connections is >n\n" |
|
" --connlimit-mask n group hosts using prefix length (default: max len)\n" |
|
" --connlimit-saddr select source address for grouping\n" |
|
" --connlimit-daddr select destination addresses for grouping\n"); |
|
} |
|
|
|
#define s struct xt_connlimit_info |
|
static const struct xt_option_entry connlimit_opts[] = { |
|
{.name = "connlimit-upto", .id = O_UPTO, .excl = F_ABOVE, |
|
.type = XTTYPE_UINT32, .flags = XTOPT_INVERT | XTOPT_PUT, |
|
XTOPT_POINTER(s, limit)}, |
|
{.name = "connlimit-above", .id = O_ABOVE, .excl = F_UPTO, |
|
.type = XTTYPE_UINT32, .flags = XTOPT_INVERT | XTOPT_PUT, |
|
XTOPT_POINTER(s, limit)}, |
|
{.name = "connlimit-mask", .id = O_MASK, .type = XTTYPE_PLENMASK, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, mask)}, |
|
{.name = "connlimit-saddr", .id = O_SADDR, .excl = F_DADDR, |
|
.type = XTTYPE_NONE}, |
|
{.name = "connlimit-daddr", .id = O_DADDR, .excl = F_SADDR, |
|
.type = XTTYPE_NONE}, |
|
XTOPT_TABLEEND, |
|
}; |
|
#undef s |
|
|
|
static void connlimit_init(struct xt_entry_match *match) |
|
{ |
|
struct xt_connlimit_info *info = (void *)match->data; |
|
|
|
/* This will also initialize the v4 mask correctly */ |
|
memset(info->v6_mask, 0xFF, sizeof(info->v6_mask)); |
|
} |
|
|
|
static void connlimit_parse(struct xt_option_call *cb, uint8_t family) |
|
{ |
|
struct xt_connlimit_info *info = cb->data; |
|
const unsigned int revision = (*cb->match)->u.user.revision; |
|
|
|
xtables_option_parse(cb); |
|
switch (cb->entry->id) { |
|
case O_ABOVE: |
|
if (cb->invert) |
|
info->flags |= XT_CONNLIMIT_INVERT; |
|
break; |
|
case O_UPTO: |
|
if (!cb->invert) |
|
info->flags |= XT_CONNLIMIT_INVERT; |
|
break; |
|
case O_SADDR: |
|
if (revision < 1) |
|
xtables_error(PARAMETER_PROBLEM, |
|
"xt_connlimit.0 does not support " |
|
"--connlimit-daddr"); |
|
info->flags &= ~XT_CONNLIMIT_DADDR; |
|
break; |
|
case O_DADDR: |
|
if (revision < 1) |
|
xtables_error(PARAMETER_PROBLEM, |
|
"xt_connlimit.0 does not support " |
|
"--connlimit-daddr"); |
|
info->flags |= XT_CONNLIMIT_DADDR; |
|
break; |
|
} |
|
} |
|
|
|
static void connlimit_parse4(struct xt_option_call *cb) |
|
{ |
|
return connlimit_parse(cb, NFPROTO_IPV4); |
|
} |
|
|
|
static void connlimit_parse6(struct xt_option_call *cb) |
|
{ |
|
return connlimit_parse(cb, NFPROTO_IPV6); |
|
} |
|
|
|
static void connlimit_check(struct xt_fcheck_call *cb) |
|
{ |
|
if ((cb->xflags & (F_UPTO | F_ABOVE)) == 0) |
|
xtables_error(PARAMETER_PROBLEM, |
|
"You must specify \"--connlimit-above\" or " |
|
"\"--connlimit-upto\"."); |
|
} |
|
|
|
static unsigned int count_bits4(uint32_t mask) |
|
{ |
|
unsigned int bits = 0; |
|
|
|
for (mask = ~ntohl(mask); mask != 0; mask >>= 1) |
|
++bits; |
|
|
|
return 32 - bits; |
|
} |
|
|
|
static unsigned int count_bits6(const uint32_t *mask) |
|
{ |
|
unsigned int bits = 0, i; |
|
uint32_t tmp[4]; |
|
|
|
for (i = 0; i < 4; ++i) |
|
for (tmp[i] = ~ntohl(mask[i]); tmp[i] != 0; tmp[i] >>= 1) |
|
++bits; |
|
return 128 - bits; |
|
} |
|
|
|
static void connlimit_print4(const void *ip, |
|
const struct xt_entry_match *match, int numeric) |
|
{ |
|
const struct xt_connlimit_info *info = (const void *)match->data; |
|
|
|
printf(" #conn %s/%u %s %u", |
|
(info->flags & XT_CONNLIMIT_DADDR) ? "dst" : "src", |
|
count_bits4(info->v4_mask), |
|
(info->flags & XT_CONNLIMIT_INVERT) ? "<=" : ">", info->limit); |
|
} |
|
|
|
static void connlimit_print6(const void *ip, |
|
const struct xt_entry_match *match, int numeric) |
|
{ |
|
const struct xt_connlimit_info *info = (const void *)match->data; |
|
|
|
printf(" #conn %s/%u %s %u", |
|
(info->flags & XT_CONNLIMIT_DADDR) ? "dst" : "src", |
|
count_bits6(info->v6_mask), |
|
(info->flags & XT_CONNLIMIT_INVERT) ? "<=" : ">", info->limit); |
|
} |
|
|
|
static void connlimit_save4(const void *ip, const struct xt_entry_match *match) |
|
{ |
|
const struct xt_connlimit_info *info = (const void *)match->data; |
|
const int revision = match->u.user.revision; |
|
|
|
if (info->flags & XT_CONNLIMIT_INVERT) |
|
printf(" --connlimit-upto %u", info->limit); |
|
else |
|
printf(" --connlimit-above %u", info->limit); |
|
printf(" --connlimit-mask %u", count_bits4(info->v4_mask)); |
|
if (revision >= 1) { |
|
if (info->flags & XT_CONNLIMIT_DADDR) |
|
printf(" --connlimit-daddr"); |
|
else |
|
printf(" --connlimit-saddr"); |
|
} |
|
} |
|
|
|
static void connlimit_save6(const void *ip, const struct xt_entry_match *match) |
|
{ |
|
const struct xt_connlimit_info *info = (const void *)match->data; |
|
const int revision = match->u.user.revision; |
|
|
|
if (info->flags & XT_CONNLIMIT_INVERT) |
|
printf(" --connlimit-upto %u", info->limit); |
|
else |
|
printf(" --connlimit-above %u", info->limit); |
|
printf(" --connlimit-mask %u", count_bits6(info->v6_mask)); |
|
if (revision >= 1) { |
|
if (info->flags & XT_CONNLIMIT_DADDR) |
|
printf(" --connlimit-daddr"); |
|
else |
|
printf(" --connlimit-saddr"); |
|
} |
|
} |
|
|
|
static struct xtables_match connlimit_mt_reg[] = { |
|
{ |
|
.name = "connlimit", |
|
.revision = 0, |
|
.family = NFPROTO_IPV4, |
|
.version = XTABLES_VERSION, |
|
.size = XT_ALIGN(sizeof(struct xt_connlimit_info)), |
|
.userspacesize = offsetof(struct xt_connlimit_info, data), |
|
.help = connlimit_help, |
|
.init = connlimit_init, |
|
.x6_parse = connlimit_parse4, |
|
.x6_fcheck = connlimit_check, |
|
.print = connlimit_print4, |
|
.save = connlimit_save4, |
|
.x6_options = connlimit_opts, |
|
}, |
|
{ |
|
.name = "connlimit", |
|
.revision = 0, |
|
.family = NFPROTO_IPV6, |
|
.version = XTABLES_VERSION, |
|
.size = XT_ALIGN(sizeof(struct xt_connlimit_info)), |
|
.userspacesize = offsetof(struct xt_connlimit_info, data), |
|
.help = connlimit_help, |
|
.init = connlimit_init, |
|
.x6_parse = connlimit_parse6, |
|
.x6_fcheck = connlimit_check, |
|
.print = connlimit_print6, |
|
.save = connlimit_save6, |
|
.x6_options = connlimit_opts, |
|
}, |
|
{ |
|
.name = "connlimit", |
|
.revision = 1, |
|
.family = NFPROTO_IPV4, |
|
.version = XTABLES_VERSION, |
|
.size = XT_ALIGN(sizeof(struct xt_connlimit_info)), |
|
.userspacesize = offsetof(struct xt_connlimit_info, data), |
|
.help = connlimit_help, |
|
.init = connlimit_init, |
|
.x6_parse = connlimit_parse4, |
|
.x6_fcheck = connlimit_check, |
|
.print = connlimit_print4, |
|
.save = connlimit_save4, |
|
.x6_options = connlimit_opts, |
|
}, |
|
{ |
|
.name = "connlimit", |
|
.revision = 1, |
|
.family = NFPROTO_IPV6, |
|
.version = XTABLES_VERSION, |
|
.size = XT_ALIGN(sizeof(struct xt_connlimit_info)), |
|
.userspacesize = offsetof(struct xt_connlimit_info, data), |
|
.help = connlimit_help, |
|
.init = connlimit_init, |
|
.x6_parse = connlimit_parse6, |
|
.x6_fcheck = connlimit_check, |
|
.print = connlimit_print6, |
|
.save = connlimit_save6, |
|
.x6_options = connlimit_opts, |
|
}, |
|
}; |
|
|
|
void _init(void) |
|
{ |
|
xtables_register_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg)); |
|
}
|
|
|