2 * Copyright (c) 2006 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This is a replacement of the old ipt_recent module, which carried the
9 * following copyright notice:
11 * Author: Stephen Frost <sfrost@snowman.net>
12 * Copyright 2002-2003, Stephen Frost, 2.5.x port by laforge@netfilter.org
14 #include <linux/init.h>
16 #include <linux/moduleparam.h>
17 #include <linux/proc_fs.h>
18 #include <linux/seq_file.h>
19 #include <linux/string.h>
20 #include <linux/ctype.h>
21 #include <linux/list.h>
22 #include <linux/random.h>
23 #include <linux/jhash.h>
24 #include <linux/bitops.h>
25 #include <linux/skbuff.h>
26 #include <linux/inet.h>
27 #include <net/net_namespace.h>
29 #include <linux/netfilter/x_tables.h>
30 #include <linux/netfilter_ipv4/ipt_recent.h>
32 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
33 MODULE_DESCRIPTION("Xtables: \"recently-seen\" host matching for IPv4");
34 MODULE_LICENSE("GPL");
36 static unsigned int ip_list_tot
= 100;
37 static unsigned int ip_pkt_list_tot
= 20;
38 static unsigned int ip_list_hash_size
= 0;
39 static unsigned int ip_list_perms
= 0644;
40 static unsigned int ip_list_uid
= 0;
41 static unsigned int ip_list_gid
= 0;
42 module_param(ip_list_tot
, uint
, 0400);
43 module_param(ip_pkt_list_tot
, uint
, 0400);
44 module_param(ip_list_hash_size
, uint
, 0400);
45 module_param(ip_list_perms
, uint
, 0400);
46 module_param(ip_list_uid
, uint
, 0400);
47 module_param(ip_list_gid
, uint
, 0400);
48 MODULE_PARM_DESC(ip_list_tot
, "number of IPs to remember per list");
49 MODULE_PARM_DESC(ip_pkt_list_tot
, "number of packets per IP to remember (max. 255)");
50 MODULE_PARM_DESC(ip_list_hash_size
, "size of hash table used to look up IPs");
51 MODULE_PARM_DESC(ip_list_perms
, "permissions on /proc/net/ipt_recent/* files");
52 MODULE_PARM_DESC(ip_list_uid
,"owner of /proc/net/ipt_recent/* files");
53 MODULE_PARM_DESC(ip_list_gid
,"owning group of /proc/net/ipt_recent/* files");
56 struct list_head list
;
57 struct list_head lru_list
;
62 unsigned long stamps
[0];
66 struct list_head list
;
67 char name
[IPT_RECENT_NAME_LEN
];
69 struct proc_dir_entry
*proc
;
73 struct list_head lru_list
;
74 struct list_head iphash
[0];
77 static LIST_HEAD(tables
);
78 static DEFINE_SPINLOCK(recent_lock
);
79 static DEFINE_MUTEX(recent_mutex
);
82 static struct proc_dir_entry
*proc_dir
;
83 static const struct file_operations recent_fops
;
86 static u_int32_t hash_rnd
;
87 static int hash_rnd_initted
;
89 static unsigned int recent_entry_hash(__be32 addr
)
91 if (!hash_rnd_initted
) {
92 get_random_bytes(&hash_rnd
, 4);
95 return jhash_1word((__force u32
)addr
, hash_rnd
) & (ip_list_hash_size
- 1);
98 static struct recent_entry
*
99 recent_entry_lookup(const struct recent_table
*table
, __be32 addr
, u_int8_t ttl
)
101 struct recent_entry
*e
;
104 h
= recent_entry_hash(addr
);
105 list_for_each_entry(e
, &table
->iphash
[h
], list
)
106 if (e
->addr
== addr
&& (ttl
== e
->ttl
|| !ttl
|| !e
->ttl
))
111 static void recent_entry_remove(struct recent_table
*t
, struct recent_entry
*e
)
114 list_del(&e
->lru_list
);
119 static struct recent_entry
*
120 recent_entry_init(struct recent_table
*t
, __be32 addr
, u_int8_t ttl
)
122 struct recent_entry
*e
;
124 if (t
->entries
>= ip_list_tot
) {
125 e
= list_entry(t
->lru_list
.next
, struct recent_entry
, lru_list
);
126 recent_entry_remove(t
, e
);
128 e
= kmalloc(sizeof(*e
) + sizeof(e
->stamps
[0]) * ip_pkt_list_tot
,
134 e
->stamps
[0] = jiffies
;
137 list_add_tail(&e
->list
, &t
->iphash
[recent_entry_hash(addr
)]);
138 list_add_tail(&e
->lru_list
, &t
->lru_list
);
143 static void recent_entry_update(struct recent_table
*t
, struct recent_entry
*e
)
145 e
->stamps
[e
->index
++] = jiffies
;
146 if (e
->index
> e
->nstamps
)
147 e
->nstamps
= e
->index
;
148 e
->index
%= ip_pkt_list_tot
;
149 list_move_tail(&e
->lru_list
, &t
->lru_list
);
152 static struct recent_table
*recent_table_lookup(const char *name
)
154 struct recent_table
*t
;
156 list_for_each_entry(t
, &tables
, list
)
157 if (!strcmp(t
->name
, name
))
162 static void recent_table_flush(struct recent_table
*t
)
164 struct recent_entry
*e
, *next
;
167 for (i
= 0; i
< ip_list_hash_size
; i
++)
168 list_for_each_entry_safe(e
, next
, &t
->iphash
[i
], list
)
169 recent_entry_remove(t
, e
);
173 recent_mt(const struct sk_buff
*skb
, const struct net_device
*in
,
174 const struct net_device
*out
, const struct xt_match
*match
,
175 const void *matchinfo
, int offset
, unsigned int protoff
,
178 const struct ipt_recent_info
*info
= matchinfo
;
179 struct recent_table
*t
;
180 struct recent_entry
*e
;
183 bool ret
= info
->invert
;
185 if (info
->side
== IPT_RECENT_DEST
)
186 addr
= ip_hdr(skb
)->daddr
;
188 addr
= ip_hdr(skb
)->saddr
;
190 ttl
= ip_hdr(skb
)->ttl
;
191 /* use TTL as seen before forwarding */
195 spin_lock_bh(&recent_lock
);
196 t
= recent_table_lookup(info
->name
);
197 e
= recent_entry_lookup(t
, addr
,
198 info
->check_set
& IPT_RECENT_TTL
? ttl
: 0);
200 if (!(info
->check_set
& IPT_RECENT_SET
))
202 e
= recent_entry_init(t
, addr
, ttl
);
209 if (info
->check_set
& IPT_RECENT_SET
)
211 else if (info
->check_set
& IPT_RECENT_REMOVE
) {
212 recent_entry_remove(t
, e
);
214 } else if (info
->check_set
& (IPT_RECENT_CHECK
| IPT_RECENT_UPDATE
)) {
215 unsigned long time
= jiffies
- info
->seconds
* HZ
;
216 unsigned int i
, hits
= 0;
218 for (i
= 0; i
< e
->nstamps
; i
++) {
219 if (info
->seconds
&& time_after(time
, e
->stamps
[i
]))
221 if (++hits
>= info
->hit_count
) {
228 if (info
->check_set
& IPT_RECENT_SET
||
229 (info
->check_set
& IPT_RECENT_UPDATE
&& ret
)) {
230 recent_entry_update(t
, e
);
234 spin_unlock_bh(&recent_lock
);
239 recent_mt_check(const char *tablename
, const void *ip
,
240 const struct xt_match
*match
, void *matchinfo
,
241 unsigned int hook_mask
)
243 const struct ipt_recent_info
*info
= matchinfo
;
244 struct recent_table
*t
;
248 if (hweight8(info
->check_set
&
249 (IPT_RECENT_SET
| IPT_RECENT_REMOVE
|
250 IPT_RECENT_CHECK
| IPT_RECENT_UPDATE
)) != 1)
252 if ((info
->check_set
& (IPT_RECENT_SET
| IPT_RECENT_REMOVE
)) &&
253 (info
->seconds
|| info
->hit_count
))
255 if (info
->hit_count
> ip_pkt_list_tot
)
257 if (info
->name
[0] == '\0' ||
258 strnlen(info
->name
, IPT_RECENT_NAME_LEN
) == IPT_RECENT_NAME_LEN
)
261 mutex_lock(&recent_mutex
);
262 t
= recent_table_lookup(info
->name
);
269 t
= kzalloc(sizeof(*t
) + sizeof(t
->iphash
[0]) * ip_list_hash_size
,
274 strcpy(t
->name
, info
->name
);
275 INIT_LIST_HEAD(&t
->lru_list
);
276 for (i
= 0; i
< ip_list_hash_size
; i
++)
277 INIT_LIST_HEAD(&t
->iphash
[i
]);
278 #ifdef CONFIG_PROC_FS
279 t
->proc
= proc_create(t
->name
, ip_list_perms
, proc_dir
, &recent_fops
);
280 if (t
->proc
== NULL
) {
284 t
->proc
->uid
= ip_list_uid
;
285 t
->proc
->gid
= ip_list_gid
;
288 spin_lock_bh(&recent_lock
);
289 list_add_tail(&t
->list
, &tables
);
290 spin_unlock_bh(&recent_lock
);
293 mutex_unlock(&recent_mutex
);
297 static void recent_mt_destroy(const struct xt_match
*match
, void *matchinfo
)
299 const struct ipt_recent_info
*info
= matchinfo
;
300 struct recent_table
*t
;
302 mutex_lock(&recent_mutex
);
303 t
= recent_table_lookup(info
->name
);
304 if (--t
->refcnt
== 0) {
305 spin_lock_bh(&recent_lock
);
307 spin_unlock_bh(&recent_lock
);
308 recent_table_flush(t
);
309 #ifdef CONFIG_PROC_FS
310 remove_proc_entry(t
->name
, proc_dir
);
314 mutex_unlock(&recent_mutex
);
317 #ifdef CONFIG_PROC_FS
318 struct recent_iter_state
{
319 struct recent_table
*table
;
323 static void *recent_seq_start(struct seq_file
*seq
, loff_t
*pos
)
324 __acquires(recent_lock
)
326 struct recent_iter_state
*st
= seq
->private;
327 const struct recent_table
*t
= st
->table
;
328 struct recent_entry
*e
;
331 spin_lock_bh(&recent_lock
);
333 for (st
->bucket
= 0; st
->bucket
< ip_list_hash_size
; st
->bucket
++)
334 list_for_each_entry(e
, &t
->iphash
[st
->bucket
], list
)
340 static void *recent_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
342 struct recent_iter_state
*st
= seq
->private;
343 struct recent_table
*t
= st
->table
;
344 struct recent_entry
*e
= v
;
345 struct list_head
*head
= e
->list
.next
;
347 while (head
== &t
->iphash
[st
->bucket
]) {
348 if (++st
->bucket
>= ip_list_hash_size
)
350 head
= t
->iphash
[st
->bucket
].next
;
353 return list_entry(head
, struct recent_entry
, list
);
356 static void recent_seq_stop(struct seq_file
*s
, void *v
)
357 __releases(recent_lock
)
359 spin_unlock_bh(&recent_lock
);
362 static int recent_seq_show(struct seq_file
*seq
, void *v
)
364 struct recent_entry
*e
= v
;
367 i
= (e
->index
- 1) % ip_pkt_list_tot
;
368 seq_printf(seq
, "src=%u.%u.%u.%u ttl: %u last_seen: %lu oldest_pkt: %u",
369 NIPQUAD(e
->addr
), e
->ttl
, e
->stamps
[i
], e
->index
);
370 for (i
= 0; i
< e
->nstamps
; i
++)
371 seq_printf(seq
, "%s %lu", i
? "," : "", e
->stamps
[i
]);
372 seq_printf(seq
, "\n");
376 static const struct seq_operations recent_seq_ops
= {
377 .start
= recent_seq_start
,
378 .next
= recent_seq_next
,
379 .stop
= recent_seq_stop
,
380 .show
= recent_seq_show
,
383 static int recent_seq_open(struct inode
*inode
, struct file
*file
)
385 struct proc_dir_entry
*pde
= PDE(inode
);
386 struct recent_iter_state
*st
;
388 st
= __seq_open_private(file
, &recent_seq_ops
, sizeof(*st
));
392 st
->table
= pde
->data
;
396 static ssize_t
recent_proc_write(struct file
*file
, const char __user
*input
,
397 size_t size
, loff_t
*loff
)
399 struct proc_dir_entry
*pde
= PDE(file
->f_path
.dentry
->d_inode
);
400 struct recent_table
*t
= pde
->data
;
401 struct recent_entry
*e
;
402 char buf
[sizeof("+255.255.255.255")], *c
= buf
;
406 if (size
> sizeof(buf
))
408 if (copy_from_user(buf
, input
, size
))
413 if (size
- (c
- buf
) < 5)
415 if (!strncmp(c
, "clear", 5)) {
417 spin_lock_bh(&recent_lock
);
418 recent_table_flush(t
);
419 spin_unlock_bh(&recent_lock
);
436 spin_lock_bh(&recent_lock
);
437 e
= recent_entry_lookup(t
, addr
, 0);
440 recent_entry_init(t
, addr
, 0);
443 recent_entry_update(t
, e
);
445 recent_entry_remove(t
, e
);
447 spin_unlock_bh(&recent_lock
);
451 static const struct file_operations recent_fops
= {
452 .open
= recent_seq_open
,
454 .write
= recent_proc_write
,
455 .release
= seq_release_private
,
456 .owner
= THIS_MODULE
,
458 #endif /* CONFIG_PROC_FS */
460 static struct xt_match recent_mt_reg __read_mostly
= {
464 .matchsize
= sizeof(struct ipt_recent_info
),
465 .checkentry
= recent_mt_check
,
466 .destroy
= recent_mt_destroy
,
470 static int __init
recent_mt_init(void)
474 if (!ip_list_tot
|| !ip_pkt_list_tot
|| ip_pkt_list_tot
> 255)
476 ip_list_hash_size
= 1 << fls(ip_list_tot
);
478 err
= xt_register_match(&recent_mt_reg
);
479 #ifdef CONFIG_PROC_FS
482 proc_dir
= proc_mkdir("ipt_recent", init_net
.proc_net
);
483 if (proc_dir
== NULL
) {
484 xt_unregister_match(&recent_mt_reg
);
491 static void __exit
recent_mt_exit(void)
493 BUG_ON(!list_empty(&tables
));
494 xt_unregister_match(&recent_mt_reg
);
495 #ifdef CONFIG_PROC_FS
496 remove_proc_entry("ipt_recent", init_net
.proc_net
);
500 module_init(recent_mt_init
);
501 module_exit(recent_mt_exit
);