2 * Copyright (c) 2006 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This is a replacement of the old ipt_recent module, which carried the
9 * following copyright notice:
11 * Author: Stephen Frost <sfrost@snowman.net>
12 * Copyright 2002-2003, Stephen Frost, 2.5.x port by laforge@netfilter.org
14 #include <linux/init.h>
16 #include <linux/moduleparam.h>
17 #include <linux/proc_fs.h>
18 #include <linux/seq_file.h>
19 #include <linux/string.h>
20 #include <linux/ctype.h>
21 #include <linux/list.h>
22 #include <linux/random.h>
23 #include <linux/jhash.h>
24 #include <linux/bitops.h>
25 #include <linux/skbuff.h>
26 #include <linux/inet.h>
27 #include <net/net_namespace.h>
29 #include <linux/netfilter/x_tables.h>
30 #include <linux/netfilter/xt_recent.h>
32 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
33 MODULE_DESCRIPTION("Xtables: \"recently-seen\" host matching for IPv4");
34 MODULE_LICENSE("GPL");
35 MODULE_ALIAS("ipt_recent");
37 static unsigned int ip_list_tot
= 100;
38 static unsigned int ip_pkt_list_tot
= 20;
39 static unsigned int ip_list_hash_size
= 0;
40 static unsigned int ip_list_perms
= 0644;
41 static unsigned int ip_list_uid
= 0;
42 static unsigned int ip_list_gid
= 0;
43 module_param(ip_list_tot
, uint
, 0400);
44 module_param(ip_pkt_list_tot
, uint
, 0400);
45 module_param(ip_list_hash_size
, uint
, 0400);
46 module_param(ip_list_perms
, uint
, 0400);
47 module_param(ip_list_uid
, uint
, 0400);
48 module_param(ip_list_gid
, uint
, 0400);
49 MODULE_PARM_DESC(ip_list_tot
, "number of IPs to remember per list");
50 MODULE_PARM_DESC(ip_pkt_list_tot
, "number of packets per IP to remember (max. 255)");
51 MODULE_PARM_DESC(ip_list_hash_size
, "size of hash table used to look up IPs");
52 MODULE_PARM_DESC(ip_list_perms
, "permissions on /proc/net/ipt_recent/* files");
53 MODULE_PARM_DESC(ip_list_uid
,"owner of /proc/net/ipt_recent/* files");
54 MODULE_PARM_DESC(ip_list_gid
,"owning group of /proc/net/ipt_recent/* files");
57 struct list_head list
;
58 struct list_head lru_list
;
63 unsigned long stamps
[0];
67 struct list_head list
;
68 char name
[XT_RECENT_NAME_LEN
];
70 struct proc_dir_entry
*proc
;
74 struct list_head lru_list
;
75 struct list_head iphash
[0];
78 static LIST_HEAD(tables
);
79 static DEFINE_SPINLOCK(recent_lock
);
80 static DEFINE_MUTEX(recent_mutex
);
83 static struct proc_dir_entry
*proc_dir
;
84 static const struct file_operations recent_fops
;
87 static u_int32_t hash_rnd
;
88 static int hash_rnd_initted
;
90 static unsigned int recent_entry_hash(__be32 addr
)
92 if (!hash_rnd_initted
) {
93 get_random_bytes(&hash_rnd
, 4);
96 return jhash_1word((__force u32
)addr
, hash_rnd
) & (ip_list_hash_size
- 1);
99 static struct recent_entry
*
100 recent_entry_lookup(const struct recent_table
*table
, __be32 addr
, u_int8_t ttl
)
102 struct recent_entry
*e
;
105 h
= recent_entry_hash(addr
);
106 list_for_each_entry(e
, &table
->iphash
[h
], list
)
107 if (e
->addr
== addr
&& (ttl
== e
->ttl
|| !ttl
|| !e
->ttl
))
112 static void recent_entry_remove(struct recent_table
*t
, struct recent_entry
*e
)
115 list_del(&e
->lru_list
);
120 static struct recent_entry
*
121 recent_entry_init(struct recent_table
*t
, __be32 addr
, u_int8_t ttl
)
123 struct recent_entry
*e
;
125 if (t
->entries
>= ip_list_tot
) {
126 e
= list_entry(t
->lru_list
.next
, struct recent_entry
, lru_list
);
127 recent_entry_remove(t
, e
);
129 e
= kmalloc(sizeof(*e
) + sizeof(e
->stamps
[0]) * ip_pkt_list_tot
,
135 e
->stamps
[0] = jiffies
;
138 list_add_tail(&e
->list
, &t
->iphash
[recent_entry_hash(addr
)]);
139 list_add_tail(&e
->lru_list
, &t
->lru_list
);
144 static void recent_entry_update(struct recent_table
*t
, struct recent_entry
*e
)
146 e
->stamps
[e
->index
++] = jiffies
;
147 if (e
->index
> e
->nstamps
)
148 e
->nstamps
= e
->index
;
149 e
->index
%= ip_pkt_list_tot
;
150 list_move_tail(&e
->lru_list
, &t
->lru_list
);
153 static struct recent_table
*recent_table_lookup(const char *name
)
155 struct recent_table
*t
;
157 list_for_each_entry(t
, &tables
, list
)
158 if (!strcmp(t
->name
, name
))
163 static void recent_table_flush(struct recent_table
*t
)
165 struct recent_entry
*e
, *next
;
168 for (i
= 0; i
< ip_list_hash_size
; i
++)
169 list_for_each_entry_safe(e
, next
, &t
->iphash
[i
], list
)
170 recent_entry_remove(t
, e
);
174 recent_mt(const struct sk_buff
*skb
, const struct net_device
*in
,
175 const struct net_device
*out
, const struct xt_match
*match
,
176 const void *matchinfo
, int offset
, unsigned int protoff
,
179 const struct xt_recent_mtinfo
*info
= matchinfo
;
180 struct recent_table
*t
;
181 struct recent_entry
*e
;
184 bool ret
= info
->invert
;
186 if (info
->side
== XT_RECENT_DEST
)
187 addr
= ip_hdr(skb
)->daddr
;
189 addr
= ip_hdr(skb
)->saddr
;
191 ttl
= ip_hdr(skb
)->ttl
;
192 /* use TTL as seen before forwarding */
196 spin_lock_bh(&recent_lock
);
197 t
= recent_table_lookup(info
->name
);
198 e
= recent_entry_lookup(t
, addr
,
199 info
->check_set
& XT_RECENT_TTL
? ttl
: 0);
201 if (!(info
->check_set
& XT_RECENT_SET
))
203 e
= recent_entry_init(t
, addr
, ttl
);
210 if (info
->check_set
& XT_RECENT_SET
)
212 else if (info
->check_set
& XT_RECENT_REMOVE
) {
213 recent_entry_remove(t
, e
);
215 } else if (info
->check_set
& (XT_RECENT_CHECK
| XT_RECENT_UPDATE
)) {
216 unsigned long time
= jiffies
- info
->seconds
* HZ
;
217 unsigned int i
, hits
= 0;
219 for (i
= 0; i
< e
->nstamps
; i
++) {
220 if (info
->seconds
&& time_after(time
, e
->stamps
[i
]))
222 if (++hits
>= info
->hit_count
) {
229 if (info
->check_set
& XT_RECENT_SET
||
230 (info
->check_set
& XT_RECENT_UPDATE
&& ret
)) {
231 recent_entry_update(t
, e
);
235 spin_unlock_bh(&recent_lock
);
240 recent_mt_check(const char *tablename
, const void *ip
,
241 const struct xt_match
*match
, void *matchinfo
,
242 unsigned int hook_mask
)
244 const struct xt_recent_mtinfo
*info
= matchinfo
;
245 struct recent_table
*t
;
249 if (hweight8(info
->check_set
&
250 (XT_RECENT_SET
| XT_RECENT_REMOVE
|
251 XT_RECENT_CHECK
| XT_RECENT_UPDATE
)) != 1)
253 if ((info
->check_set
& (XT_RECENT_SET
| XT_RECENT_REMOVE
)) &&
254 (info
->seconds
|| info
->hit_count
))
256 if (info
->hit_count
> ip_pkt_list_tot
)
258 if (info
->name
[0] == '\0' ||
259 strnlen(info
->name
, XT_RECENT_NAME_LEN
) == XT_RECENT_NAME_LEN
)
262 mutex_lock(&recent_mutex
);
263 t
= recent_table_lookup(info
->name
);
270 t
= kzalloc(sizeof(*t
) + sizeof(t
->iphash
[0]) * ip_list_hash_size
,
275 strcpy(t
->name
, info
->name
);
276 INIT_LIST_HEAD(&t
->lru_list
);
277 for (i
= 0; i
< ip_list_hash_size
; i
++)
278 INIT_LIST_HEAD(&t
->iphash
[i
]);
279 #ifdef CONFIG_PROC_FS
280 t
->proc
= proc_create(t
->name
, ip_list_perms
, proc_dir
, &recent_fops
);
281 if (t
->proc
== NULL
) {
285 t
->proc
->uid
= ip_list_uid
;
286 t
->proc
->gid
= ip_list_gid
;
289 spin_lock_bh(&recent_lock
);
290 list_add_tail(&t
->list
, &tables
);
291 spin_unlock_bh(&recent_lock
);
294 mutex_unlock(&recent_mutex
);
298 static void recent_mt_destroy(const struct xt_match
*match
, void *matchinfo
)
300 const struct xt_recent_mtinfo
*info
= matchinfo
;
301 struct recent_table
*t
;
303 mutex_lock(&recent_mutex
);
304 t
= recent_table_lookup(info
->name
);
305 if (--t
->refcnt
== 0) {
306 spin_lock_bh(&recent_lock
);
308 spin_unlock_bh(&recent_lock
);
309 #ifdef CONFIG_PROC_FS
310 remove_proc_entry(t
->name
, proc_dir
);
312 recent_table_flush(t
);
315 mutex_unlock(&recent_mutex
);
318 #ifdef CONFIG_PROC_FS
319 struct recent_iter_state
{
320 struct recent_table
*table
;
324 static void *recent_seq_start(struct seq_file
*seq
, loff_t
*pos
)
325 __acquires(recent_lock
)
327 struct recent_iter_state
*st
= seq
->private;
328 const struct recent_table
*t
= st
->table
;
329 struct recent_entry
*e
;
332 spin_lock_bh(&recent_lock
);
334 for (st
->bucket
= 0; st
->bucket
< ip_list_hash_size
; st
->bucket
++)
335 list_for_each_entry(e
, &t
->iphash
[st
->bucket
], list
)
341 static void *recent_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
343 struct recent_iter_state
*st
= seq
->private;
344 const struct recent_table
*t
= st
->table
;
345 struct recent_entry
*e
= v
;
346 struct list_head
*head
= e
->list
.next
;
348 while (head
== &t
->iphash
[st
->bucket
]) {
349 if (++st
->bucket
>= ip_list_hash_size
)
351 head
= t
->iphash
[st
->bucket
].next
;
354 return list_entry(head
, struct recent_entry
, list
);
357 static void recent_seq_stop(struct seq_file
*s
, void *v
)
358 __releases(recent_lock
)
360 spin_unlock_bh(&recent_lock
);
363 static int recent_seq_show(struct seq_file
*seq
, void *v
)
365 const struct recent_entry
*e
= v
;
368 i
= (e
->index
- 1) % ip_pkt_list_tot
;
369 seq_printf(seq
, "src=%u.%u.%u.%u ttl: %u last_seen: %lu oldest_pkt: %u",
370 NIPQUAD(e
->addr
), e
->ttl
, e
->stamps
[i
], e
->index
);
371 for (i
= 0; i
< e
->nstamps
; i
++)
372 seq_printf(seq
, "%s %lu", i
? "," : "", e
->stamps
[i
]);
373 seq_printf(seq
, "\n");
377 static const struct seq_operations recent_seq_ops
= {
378 .start
= recent_seq_start
,
379 .next
= recent_seq_next
,
380 .stop
= recent_seq_stop
,
381 .show
= recent_seq_show
,
384 static int recent_seq_open(struct inode
*inode
, struct file
*file
)
386 struct proc_dir_entry
*pde
= PDE(inode
);
387 struct recent_iter_state
*st
;
389 st
= __seq_open_private(file
, &recent_seq_ops
, sizeof(*st
));
393 st
->table
= pde
->data
;
397 static ssize_t
recent_proc_write(struct file
*file
, const char __user
*input
,
398 size_t size
, loff_t
*loff
)
400 const struct proc_dir_entry
*pde
= PDE(file
->f_path
.dentry
->d_inode
);
401 struct recent_table
*t
= pde
->data
;
402 struct recent_entry
*e
;
403 char buf
[sizeof("+255.255.255.255")], *c
= buf
;
407 if (size
> sizeof(buf
))
409 if (copy_from_user(buf
, input
, size
))
414 if (size
- (c
- buf
) < 5)
416 if (!strncmp(c
, "clear", 5)) {
418 spin_lock_bh(&recent_lock
);
419 recent_table_flush(t
);
420 spin_unlock_bh(&recent_lock
);
437 spin_lock_bh(&recent_lock
);
438 e
= recent_entry_lookup(t
, addr
, 0);
441 recent_entry_init(t
, addr
, 0);
444 recent_entry_update(t
, e
);
446 recent_entry_remove(t
, e
);
448 spin_unlock_bh(&recent_lock
);
452 static const struct file_operations recent_fops
= {
453 .open
= recent_seq_open
,
455 .write
= recent_proc_write
,
456 .release
= seq_release_private
,
457 .owner
= THIS_MODULE
,
459 #endif /* CONFIG_PROC_FS */
461 static struct xt_match recent_mt_reg __read_mostly
= {
465 .matchsize
= sizeof(struct xt_recent_mtinfo
),
466 .checkentry
= recent_mt_check
,
467 .destroy
= recent_mt_destroy
,
471 static int __init
recent_mt_init(void)
475 if (!ip_list_tot
|| !ip_pkt_list_tot
|| ip_pkt_list_tot
> 255)
477 ip_list_hash_size
= 1 << fls(ip_list_tot
);
479 err
= xt_register_match(&recent_mt_reg
);
480 #ifdef CONFIG_PROC_FS
483 proc_dir
= proc_mkdir("ipt_recent", init_net
.proc_net
);
484 if (proc_dir
== NULL
) {
485 xt_unregister_match(&recent_mt_reg
);
492 static void __exit
recent_mt_exit(void)
494 BUG_ON(!list_empty(&tables
));
495 xt_unregister_match(&recent_mt_reg
);
496 #ifdef CONFIG_PROC_FS
497 remove_proc_entry("ipt_recent", init_net
.proc_net
);
501 module_init(recent_mt_init
);
502 module_exit(recent_mt_exit
);