2 * Copyright (c) 2006 Patrick McHardy <kaber@trash.net>
3 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * This is a replacement of the old ipt_recent module, which carried the
10 * following copyright notice:
12 * Author: Stephen Frost <sfrost@snowman.net>
13 * Copyright 2002-2003, Stephen Frost, 2.5.x port by laforge@netfilter.org
15 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16 #include <linux/init.h>
18 #include <linux/ipv6.h>
19 #include <linux/module.h>
20 #include <linux/moduleparam.h>
21 #include <linux/proc_fs.h>
22 #include <linux/seq_file.h>
23 #include <linux/string.h>
24 #include <linux/ctype.h>
25 #include <linux/list.h>
26 #include <linux/random.h>
27 #include <linux/jhash.h>
28 #include <linux/bitops.h>
29 #include <linux/skbuff.h>
30 #include <linux/inet.h>
31 #include <linux/slab.h>
32 #include <net/net_namespace.h>
33 #include <net/netns/generic.h>
35 #include <linux/netfilter/x_tables.h>
36 #include <linux/netfilter/xt_recent.h>
38 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
39 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
40 MODULE_DESCRIPTION("Xtables: \"recently-seen\" host matching");
41 MODULE_LICENSE("GPL");
42 MODULE_ALIAS("ipt_recent");
43 MODULE_ALIAS("ip6t_recent");
45 static unsigned int ip_list_tot
= 100;
46 static unsigned int ip_pkt_list_tot
= 20;
47 static unsigned int ip_list_hash_size
= 0;
48 static unsigned int ip_list_perms
= 0644;
49 static unsigned int ip_list_uid
= 0;
50 static unsigned int ip_list_gid
= 0;
51 module_param(ip_list_tot
, uint
, 0400);
52 module_param(ip_pkt_list_tot
, uint
, 0400);
53 module_param(ip_list_hash_size
, uint
, 0400);
54 module_param(ip_list_perms
, uint
, 0400);
55 module_param(ip_list_uid
, uint
, S_IRUGO
| S_IWUSR
);
56 module_param(ip_list_gid
, uint
, S_IRUGO
| S_IWUSR
);
57 MODULE_PARM_DESC(ip_list_tot
, "number of IPs to remember per list");
58 MODULE_PARM_DESC(ip_pkt_list_tot
, "number of packets per IP address to remember (max. 255)");
59 MODULE_PARM_DESC(ip_list_hash_size
, "size of hash table used to look up IPs");
60 MODULE_PARM_DESC(ip_list_perms
, "permissions on /proc/net/xt_recent/* files");
61 MODULE_PARM_DESC(ip_list_uid
, "default owner of /proc/net/xt_recent/* files");
62 MODULE_PARM_DESC(ip_list_gid
, "default owning group of /proc/net/xt_recent/* files");
65 struct list_head list
;
66 struct list_head lru_list
;
67 union nf_inet_addr addr
;
72 unsigned long stamps
[0];
76 struct list_head list
;
77 char name
[XT_RECENT_NAME_LEN
];
78 union nf_inet_addr mask
;
81 struct list_head lru_list
;
82 struct list_head iphash
[0];
86 struct list_head tables
;
88 struct proc_dir_entry
*xt_recent
;
92 static int recent_net_id
;
93 static inline struct recent_net
*recent_pernet(struct net
*net
)
95 return net_generic(net
, recent_net_id
);
98 static DEFINE_SPINLOCK(recent_lock
);
99 static DEFINE_MUTEX(recent_mutex
);
101 #ifdef CONFIG_PROC_FS
102 static const struct file_operations recent_old_fops
, recent_mt_fops
;
105 static u_int32_t hash_rnd __read_mostly
;
106 static bool hash_rnd_inited __read_mostly
;
108 static inline unsigned int recent_entry_hash4(const union nf_inet_addr
*addr
)
110 return jhash_1word((__force u32
)addr
->ip
, hash_rnd
) &
111 (ip_list_hash_size
- 1);
114 static inline unsigned int recent_entry_hash6(const union nf_inet_addr
*addr
)
116 return jhash2((u32
*)addr
->ip6
, ARRAY_SIZE(addr
->ip6
), hash_rnd
) &
117 (ip_list_hash_size
- 1);
120 static struct recent_entry
*
121 recent_entry_lookup(const struct recent_table
*table
,
122 const union nf_inet_addr
*addrp
, u_int16_t family
,
125 struct recent_entry
*e
;
128 if (family
== NFPROTO_IPV4
)
129 h
= recent_entry_hash4(addrp
);
131 h
= recent_entry_hash6(addrp
);
133 list_for_each_entry(e
, &table
->iphash
[h
], list
)
134 if (e
->family
== family
&&
135 memcmp(&e
->addr
, addrp
, sizeof(e
->addr
)) == 0 &&
136 (ttl
== e
->ttl
|| ttl
== 0 || e
->ttl
== 0))
141 static void recent_entry_remove(struct recent_table
*t
, struct recent_entry
*e
)
144 list_del(&e
->lru_list
);
150 * Drop entries with timestamps older then 'time'.
152 static void recent_entry_reap(struct recent_table
*t
, unsigned long time
)
154 struct recent_entry
*e
;
157 * The head of the LRU list is always the oldest entry.
159 e
= list_entry(t
->lru_list
.next
, struct recent_entry
, lru_list
);
162 * The last time stamp is the most recent.
164 if (time_after(time
, e
->stamps
[e
->index
-1]))
165 recent_entry_remove(t
, e
);
168 static struct recent_entry
*
169 recent_entry_init(struct recent_table
*t
, const union nf_inet_addr
*addr
,
170 u_int16_t family
, u_int8_t ttl
)
172 struct recent_entry
*e
;
174 if (t
->entries
>= ip_list_tot
) {
175 e
= list_entry(t
->lru_list
.next
, struct recent_entry
, lru_list
);
176 recent_entry_remove(t
, e
);
178 e
= kmalloc(sizeof(*e
) + sizeof(e
->stamps
[0]) * ip_pkt_list_tot
,
182 memcpy(&e
->addr
, addr
, sizeof(e
->addr
));
184 e
->stamps
[0] = jiffies
;
188 if (family
== NFPROTO_IPV4
)
189 list_add_tail(&e
->list
, &t
->iphash
[recent_entry_hash4(addr
)]);
191 list_add_tail(&e
->list
, &t
->iphash
[recent_entry_hash6(addr
)]);
192 list_add_tail(&e
->lru_list
, &t
->lru_list
);
197 static void recent_entry_update(struct recent_table
*t
, struct recent_entry
*e
)
199 e
->index
%= ip_pkt_list_tot
;
200 e
->stamps
[e
->index
++] = jiffies
;
201 if (e
->index
> e
->nstamps
)
202 e
->nstamps
= e
->index
;
203 list_move_tail(&e
->lru_list
, &t
->lru_list
);
206 static struct recent_table
*recent_table_lookup(struct recent_net
*recent_net
,
209 struct recent_table
*t
;
211 list_for_each_entry(t
, &recent_net
->tables
, list
)
212 if (!strcmp(t
->name
, name
))
217 static void recent_table_flush(struct recent_table
*t
)
219 struct recent_entry
*e
, *next
;
222 for (i
= 0; i
< ip_list_hash_size
; i
++)
223 list_for_each_entry_safe(e
, next
, &t
->iphash
[i
], list
)
224 recent_entry_remove(t
, e
);
228 recent_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
230 struct net
*net
= dev_net(par
->in
? par
->in
: par
->out
);
231 struct recent_net
*recent_net
= recent_pernet(net
);
232 const struct xt_recent_mtinfo_v1
*info
= par
->matchinfo
;
233 struct recent_table
*t
;
234 struct recent_entry
*e
;
235 union nf_inet_addr addr
= {}, addr_mask
;
237 bool ret
= info
->invert
;
239 if (par
->family
== NFPROTO_IPV4
) {
240 const struct iphdr
*iph
= ip_hdr(skb
);
242 if (info
->side
== XT_RECENT_DEST
)
243 addr
.ip
= iph
->daddr
;
245 addr
.ip
= iph
->saddr
;
249 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
251 if (info
->side
== XT_RECENT_DEST
)
252 memcpy(&addr
.in6
, &iph
->daddr
, sizeof(addr
.in6
));
254 memcpy(&addr
.in6
, &iph
->saddr
, sizeof(addr
.in6
));
256 ttl
= iph
->hop_limit
;
259 /* use TTL as seen before forwarding */
260 if (par
->out
!= NULL
&& skb
->sk
== NULL
)
263 spin_lock_bh(&recent_lock
);
264 t
= recent_table_lookup(recent_net
, info
->name
);
266 nf_inet_addr_mask(&addr
, &addr_mask
, &t
->mask
);
268 e
= recent_entry_lookup(t
, &addr_mask
, par
->family
,
269 (info
->check_set
& XT_RECENT_TTL
) ? ttl
: 0);
271 if (!(info
->check_set
& XT_RECENT_SET
))
273 e
= recent_entry_init(t
, &addr_mask
, par
->family
, ttl
);
280 if (info
->check_set
& XT_RECENT_SET
)
282 else if (info
->check_set
& XT_RECENT_REMOVE
) {
283 recent_entry_remove(t
, e
);
285 } else if (info
->check_set
& (XT_RECENT_CHECK
| XT_RECENT_UPDATE
)) {
286 unsigned long time
= jiffies
- info
->seconds
* HZ
;
287 unsigned int i
, hits
= 0;
289 for (i
= 0; i
< e
->nstamps
; i
++) {
290 if (info
->seconds
&& time_after(time
, e
->stamps
[i
]))
292 if (!info
->hit_count
|| ++hits
>= info
->hit_count
) {
298 /* info->seconds must be non-zero */
299 if (info
->check_set
& XT_RECENT_REAP
)
300 recent_entry_reap(t
, time
);
303 if (info
->check_set
& XT_RECENT_SET
||
304 (info
->check_set
& XT_RECENT_UPDATE
&& ret
)) {
305 recent_entry_update(t
, e
);
309 spin_unlock_bh(&recent_lock
);
313 static int recent_mt_check(const struct xt_mtchk_param
*par
,
314 const struct xt_recent_mtinfo_v1
*info
)
316 struct recent_net
*recent_net
= recent_pernet(par
->net
);
317 struct recent_table
*t
;
318 #ifdef CONFIG_PROC_FS
319 struct proc_dir_entry
*pde
;
324 if (unlikely(!hash_rnd_inited
)) {
325 get_random_bytes(&hash_rnd
, sizeof(hash_rnd
));
326 hash_rnd_inited
= true;
328 if (info
->check_set
& ~XT_RECENT_VALID_FLAGS
) {
329 pr_info("Unsupported user space flags (%08x)\n",
333 if (hweight8(info
->check_set
&
334 (XT_RECENT_SET
| XT_RECENT_REMOVE
|
335 XT_RECENT_CHECK
| XT_RECENT_UPDATE
)) != 1)
337 if ((info
->check_set
& (XT_RECENT_SET
| XT_RECENT_REMOVE
)) &&
338 (info
->seconds
|| info
->hit_count
||
339 (info
->check_set
& XT_RECENT_MODIFIERS
)))
341 if ((info
->check_set
& XT_RECENT_REAP
) && !info
->seconds
)
343 if (info
->hit_count
> ip_pkt_list_tot
) {
344 pr_info("hitcount (%u) is larger than "
345 "packets to be remembered (%u)\n",
346 info
->hit_count
, ip_pkt_list_tot
);
349 if (info
->name
[0] == '\0' ||
350 strnlen(info
->name
, XT_RECENT_NAME_LEN
) == XT_RECENT_NAME_LEN
)
353 mutex_lock(&recent_mutex
);
354 t
= recent_table_lookup(recent_net
, info
->name
);
361 t
= kzalloc(sizeof(*t
) + sizeof(t
->iphash
[0]) * ip_list_hash_size
,
369 memcpy(&t
->mask
, &info
->mask
, sizeof(t
->mask
));
370 strcpy(t
->name
, info
->name
);
371 INIT_LIST_HEAD(&t
->lru_list
);
372 for (i
= 0; i
< ip_list_hash_size
; i
++)
373 INIT_LIST_HEAD(&t
->iphash
[i
]);
374 #ifdef CONFIG_PROC_FS
375 pde
= proc_create_data(t
->name
, ip_list_perms
, recent_net
->xt_recent
,
382 pde
->uid
= ip_list_uid
;
383 pde
->gid
= ip_list_gid
;
385 spin_lock_bh(&recent_lock
);
386 list_add_tail(&t
->list
, &recent_net
->tables
);
387 spin_unlock_bh(&recent_lock
);
390 mutex_unlock(&recent_mutex
);
394 static int recent_mt_check_v0(const struct xt_mtchk_param
*par
)
396 const struct xt_recent_mtinfo_v0
*info_v0
= par
->matchinfo
;
397 struct xt_recent_mtinfo_v1 info_v1
;
399 /* Copy revision 0 structure to revision 1 */
400 memcpy(&info_v1
, info_v0
, sizeof(struct xt_recent_mtinfo
));
401 /* Set default mask to ensure backward compatible behaviour */
402 memset(info_v1
.mask
.all
, 0xFF, sizeof(info_v1
.mask
.all
));
404 return recent_mt_check(par
, &info_v1
);
407 static int recent_mt_check_v1(const struct xt_mtchk_param
*par
)
409 return recent_mt_check(par
, par
->matchinfo
);
412 static void recent_mt_destroy(const struct xt_mtdtor_param
*par
)
414 struct recent_net
*recent_net
= recent_pernet(par
->net
);
415 const struct xt_recent_mtinfo_v1
*info
= par
->matchinfo
;
416 struct recent_table
*t
;
418 mutex_lock(&recent_mutex
);
419 t
= recent_table_lookup(recent_net
, info
->name
);
420 if (--t
->refcnt
== 0) {
421 spin_lock_bh(&recent_lock
);
423 spin_unlock_bh(&recent_lock
);
424 #ifdef CONFIG_PROC_FS
425 remove_proc_entry(t
->name
, recent_net
->xt_recent
);
427 recent_table_flush(t
);
430 mutex_unlock(&recent_mutex
);
433 #ifdef CONFIG_PROC_FS
434 struct recent_iter_state
{
435 const struct recent_table
*table
;
439 static void *recent_seq_start(struct seq_file
*seq
, loff_t
*pos
)
440 __acquires(recent_lock
)
442 struct recent_iter_state
*st
= seq
->private;
443 const struct recent_table
*t
= st
->table
;
444 struct recent_entry
*e
;
447 spin_lock_bh(&recent_lock
);
449 for (st
->bucket
= 0; st
->bucket
< ip_list_hash_size
; st
->bucket
++)
450 list_for_each_entry(e
, &t
->iphash
[st
->bucket
], list
)
456 static void *recent_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
458 struct recent_iter_state
*st
= seq
->private;
459 const struct recent_table
*t
= st
->table
;
460 const struct recent_entry
*e
= v
;
461 const struct list_head
*head
= e
->list
.next
;
463 while (head
== &t
->iphash
[st
->bucket
]) {
464 if (++st
->bucket
>= ip_list_hash_size
)
466 head
= t
->iphash
[st
->bucket
].next
;
469 return list_entry(head
, struct recent_entry
, list
);
472 static void recent_seq_stop(struct seq_file
*s
, void *v
)
473 __releases(recent_lock
)
475 spin_unlock_bh(&recent_lock
);
478 static int recent_seq_show(struct seq_file
*seq
, void *v
)
480 const struct recent_entry
*e
= v
;
483 i
= (e
->index
- 1) % ip_pkt_list_tot
;
484 if (e
->family
== NFPROTO_IPV4
)
485 seq_printf(seq
, "src=%pI4 ttl: %u last_seen: %lu oldest_pkt: %u",
486 &e
->addr
.ip
, e
->ttl
, e
->stamps
[i
], e
->index
);
488 seq_printf(seq
, "src=%pI6 ttl: %u last_seen: %lu oldest_pkt: %u",
489 &e
->addr
.in6
, e
->ttl
, e
->stamps
[i
], e
->index
);
490 for (i
= 0; i
< e
->nstamps
; i
++)
491 seq_printf(seq
, "%s %lu", i
? "," : "", e
->stamps
[i
]);
492 seq_printf(seq
, "\n");
496 static const struct seq_operations recent_seq_ops
= {
497 .start
= recent_seq_start
,
498 .next
= recent_seq_next
,
499 .stop
= recent_seq_stop
,
500 .show
= recent_seq_show
,
503 static int recent_seq_open(struct inode
*inode
, struct file
*file
)
505 struct proc_dir_entry
*pde
= PDE(inode
);
506 struct recent_iter_state
*st
;
508 st
= __seq_open_private(file
, &recent_seq_ops
, sizeof(*st
));
512 st
->table
= pde
->data
;
517 recent_mt_proc_write(struct file
*file
, const char __user
*input
,
518 size_t size
, loff_t
*loff
)
520 const struct proc_dir_entry
*pde
= PDE(file
->f_path
.dentry
->d_inode
);
521 struct recent_table
*t
= pde
->data
;
522 struct recent_entry
*e
;
523 char buf
[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
525 union nf_inet_addr addr
= {};
531 if (size
> sizeof(buf
))
533 if (copy_from_user(buf
, input
, size
) != 0)
536 /* Strict protocol! */
540 case '/': /* flush table */
541 spin_lock_bh(&recent_lock
);
542 recent_table_flush(t
);
543 spin_unlock_bh(&recent_lock
);
545 case '-': /* remove address */
548 case '+': /* add address */
552 pr_info("Need \"+ip\", \"-ip\" or \"/\"\n");
558 if (strnchr(c
, size
, ':') != NULL
) {
559 family
= NFPROTO_IPV6
;
560 succ
= in6_pton(c
, size
, (void *)&addr
, '\n', NULL
);
562 family
= NFPROTO_IPV4
;
563 succ
= in4_pton(c
, size
, (void *)&addr
, '\n', NULL
);
567 pr_info("illegal address written to procfs\n");
571 spin_lock_bh(&recent_lock
);
572 e
= recent_entry_lookup(t
, &addr
, family
, 0);
575 recent_entry_init(t
, &addr
, family
, 0);
578 recent_entry_update(t
, e
);
580 recent_entry_remove(t
, e
);
582 spin_unlock_bh(&recent_lock
);
583 /* Note we removed one above */
588 static const struct file_operations recent_mt_fops
= {
589 .open
= recent_seq_open
,
591 .write
= recent_mt_proc_write
,
592 .release
= seq_release_private
,
593 .owner
= THIS_MODULE
,
597 static int __net_init
recent_proc_net_init(struct net
*net
)
599 struct recent_net
*recent_net
= recent_pernet(net
);
601 recent_net
->xt_recent
= proc_mkdir("xt_recent", net
->proc_net
);
602 if (!recent_net
->xt_recent
)
607 static void __net_exit
recent_proc_net_exit(struct net
*net
)
609 proc_net_remove(net
, "xt_recent");
612 static inline int recent_proc_net_init(struct net
*net
)
617 static inline void recent_proc_net_exit(struct net
*net
)
620 #endif /* CONFIG_PROC_FS */
622 static int __net_init
recent_net_init(struct net
*net
)
624 struct recent_net
*recent_net
= recent_pernet(net
);
626 INIT_LIST_HEAD(&recent_net
->tables
);
627 return recent_proc_net_init(net
);
630 static void __net_exit
recent_net_exit(struct net
*net
)
632 struct recent_net
*recent_net
= recent_pernet(net
);
634 BUG_ON(!list_empty(&recent_net
->tables
));
635 recent_proc_net_exit(net
);
638 static struct pernet_operations recent_net_ops
= {
639 .init
= recent_net_init
,
640 .exit
= recent_net_exit
,
641 .id
= &recent_net_id
,
642 .size
= sizeof(struct recent_net
),
645 static struct xt_match recent_mt_reg
[] __read_mostly
= {
649 .family
= NFPROTO_IPV4
,
651 .matchsize
= sizeof(struct xt_recent_mtinfo
),
652 .checkentry
= recent_mt_check_v0
,
653 .destroy
= recent_mt_destroy
,
659 .family
= NFPROTO_IPV6
,
661 .matchsize
= sizeof(struct xt_recent_mtinfo
),
662 .checkentry
= recent_mt_check_v0
,
663 .destroy
= recent_mt_destroy
,
669 .family
= NFPROTO_IPV4
,
671 .matchsize
= sizeof(struct xt_recent_mtinfo_v1
),
672 .checkentry
= recent_mt_check_v1
,
673 .destroy
= recent_mt_destroy
,
679 .family
= NFPROTO_IPV6
,
681 .matchsize
= sizeof(struct xt_recent_mtinfo_v1
),
682 .checkentry
= recent_mt_check_v1
,
683 .destroy
= recent_mt_destroy
,
688 static int __init
recent_mt_init(void)
692 if (!ip_list_tot
|| !ip_pkt_list_tot
|| ip_pkt_list_tot
> 255)
694 ip_list_hash_size
= 1 << fls(ip_list_tot
);
696 err
= register_pernet_subsys(&recent_net_ops
);
699 err
= xt_register_matches(recent_mt_reg
, ARRAY_SIZE(recent_mt_reg
));
701 unregister_pernet_subsys(&recent_net_ops
);
705 static void __exit
recent_mt_exit(void)
707 xt_unregister_matches(recent_mt_reg
, ARRAY_SIZE(recent_mt_reg
));
708 unregister_pernet_subsys(&recent_net_ops
);
711 module_init(recent_mt_init
);
712 module_exit(recent_mt_exit
);