2 * xt_hashlimit - Netfilter module to limit the number of packets per time
3 * seperately for each hashbucket (sourceip/sourceport/dstip/dstport)
5 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
6 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
8 * Development of this code was funded by Astaro AG, http://www.astaro.com/
10 #include <linux/module.h>
11 #include <linux/spinlock.h>
12 #include <linux/random.h>
13 #include <linux/jhash.h>
14 #include <linux/slab.h>
15 #include <linux/vmalloc.h>
16 #include <linux/proc_fs.h>
17 #include <linux/seq_file.h>
18 #include <linux/list.h>
19 #include <linux/skbuff.h>
23 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
24 #include <linux/ipv6.h>
28 #include <net/net_namespace.h>
30 #include <linux/netfilter/x_tables.h>
31 #include <linux/netfilter_ipv4/ip_tables.h>
32 #include <linux/netfilter_ipv6/ip6_tables.h>
33 #include <linux/netfilter/xt_hashlimit.h>
34 #include <linux/mutex.h>
36 MODULE_LICENSE("GPL");
37 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
38 MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
39 MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
40 MODULE_ALIAS("ipt_hashlimit");
41 MODULE_ALIAS("ip6t_hashlimit");
43 /* need to declare this at the top */
44 static struct proc_dir_entry
*hashlimit_procdir4
;
45 static struct proc_dir_entry
*hashlimit_procdir6
;
46 static const struct file_operations dl_file_ops
;
55 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
67 /* static / read-only parts in the beginning */
68 struct hlist_node node
;
69 struct dsthash_dst dst
;
71 /* modified structure members in the end */
72 unsigned long expires
; /* precalculated expiry time */
74 unsigned long prev
; /* last modification */
76 u_int32_t credit_cap
, cost
;
80 struct xt_hashlimit_htable
{
81 struct hlist_node node
; /* global list of all htables */
85 struct hashlimit_cfg1 cfg
; /* config */
88 spinlock_t lock
; /* lock for list_head */
89 u_int32_t rnd
; /* random seed for hash */
91 unsigned int count
; /* number entries in table */
92 struct timer_list timer
; /* timer for gc */
95 struct proc_dir_entry
*pde
;
97 struct hlist_head hash
[0]; /* hashtable itself */
100 static DEFINE_SPINLOCK(hashlimit_lock
); /* protects htables list */
101 static DEFINE_MUTEX(hlimit_mutex
); /* additional checkentry protection */
102 static HLIST_HEAD(hashlimit_htables
);
103 static struct kmem_cache
*hashlimit_cachep __read_mostly
;
105 static inline bool dst_cmp(const struct dsthash_ent
*ent
,
106 const struct dsthash_dst
*b
)
108 return !memcmp(&ent
->dst
, b
, sizeof(ent
->dst
));
112 hash_dst(const struct xt_hashlimit_htable
*ht
, const struct dsthash_dst
*dst
)
114 u_int32_t hash
= jhash2((const u32
*)dst
,
115 sizeof(*dst
)/sizeof(u32
),
118 * Instead of returning hash % ht->cfg.size (implying a divide)
119 * we return the high 32 bits of the (hash * ht->cfg.size) that will
120 * give results between [0 and cfg.size-1] and same hash distribution,
121 * but using a multiply, less expensive than a divide
123 return ((u64
)hash
* ht
->cfg
.size
) >> 32;
126 static struct dsthash_ent
*
127 dsthash_find(const struct xt_hashlimit_htable
*ht
,
128 const struct dsthash_dst
*dst
)
130 struct dsthash_ent
*ent
;
131 struct hlist_node
*pos
;
132 u_int32_t hash
= hash_dst(ht
, dst
);
134 if (!hlist_empty(&ht
->hash
[hash
])) {
135 hlist_for_each_entry(ent
, pos
, &ht
->hash
[hash
], node
)
136 if (dst_cmp(ent
, dst
))
142 /* allocate dsthash_ent, initialize dst, put in htable and lock it */
143 static struct dsthash_ent
*
144 dsthash_alloc_init(struct xt_hashlimit_htable
*ht
,
145 const struct dsthash_dst
*dst
)
147 struct dsthash_ent
*ent
;
149 /* initialize hash with random val at the time we allocate
150 * the first hashtable entry */
151 if (!ht
->rnd_initialized
) {
152 get_random_bytes(&ht
->rnd
, 4);
153 ht
->rnd_initialized
= 1;
156 if (ht
->cfg
.max
&& ht
->count
>= ht
->cfg
.max
) {
157 /* FIXME: do something. question is what.. */
160 "xt_hashlimit: max count of %u reached\n",
165 ent
= kmem_cache_alloc(hashlimit_cachep
, GFP_ATOMIC
);
169 "xt_hashlimit: can't allocate dsthash_ent\n");
172 memcpy(&ent
->dst
, dst
, sizeof(ent
->dst
));
174 hlist_add_head(&ent
->node
, &ht
->hash
[hash_dst(ht
, dst
)]);
180 dsthash_free(struct xt_hashlimit_htable
*ht
, struct dsthash_ent
*ent
)
182 hlist_del(&ent
->node
);
183 kmem_cache_free(hashlimit_cachep
, ent
);
186 static void htable_gc(unsigned long htlong
);
188 static int htable_create_v0(struct xt_hashlimit_info
*minfo
, int family
)
190 struct xt_hashlimit_htable
*hinfo
;
195 size
= minfo
->cfg
.size
;
197 size
= ((num_physpages
<< PAGE_SHIFT
) / 16384) /
198 sizeof(struct list_head
);
199 if (num_physpages
> (1024 * 1024 * 1024 / PAGE_SIZE
))
204 /* FIXME: don't use vmalloc() here or anywhere else -HW */
205 hinfo
= vmalloc(sizeof(struct xt_hashlimit_htable
) +
206 sizeof(struct list_head
) * size
);
208 printk(KERN_ERR
"xt_hashlimit: unable to create hashtable\n");
211 minfo
->hinfo
= hinfo
;
213 /* copy match config into hashtable config */
214 hinfo
->cfg
.mode
= minfo
->cfg
.mode
;
215 hinfo
->cfg
.avg
= minfo
->cfg
.avg
;
216 hinfo
->cfg
.burst
= minfo
->cfg
.burst
;
217 hinfo
->cfg
.max
= minfo
->cfg
.max
;
218 hinfo
->cfg
.gc_interval
= minfo
->cfg
.gc_interval
;
219 hinfo
->cfg
.expire
= minfo
->cfg
.expire
;
221 if (family
== AF_INET
)
222 hinfo
->cfg
.srcmask
= hinfo
->cfg
.dstmask
= 32;
224 hinfo
->cfg
.srcmask
= hinfo
->cfg
.dstmask
= 128;
226 hinfo
->cfg
.size
= size
;
228 hinfo
->cfg
.max
= 8 * hinfo
->cfg
.size
;
229 else if (hinfo
->cfg
.max
< hinfo
->cfg
.size
)
230 hinfo
->cfg
.max
= hinfo
->cfg
.size
;
232 for (i
= 0; i
< hinfo
->cfg
.size
; i
++)
233 INIT_HLIST_HEAD(&hinfo
->hash
[i
]);
235 atomic_set(&hinfo
->use
, 1);
237 hinfo
->family
= family
;
238 hinfo
->rnd_initialized
= 0;
239 spin_lock_init(&hinfo
->lock
);
241 proc_create_data(minfo
->name
, 0,
242 family
== AF_INET
? hashlimit_procdir4
:
244 &dl_file_ops
, hinfo
);
250 setup_timer(&hinfo
->timer
, htable_gc
, (unsigned long )hinfo
);
251 hinfo
->timer
.expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.gc_interval
);
252 add_timer(&hinfo
->timer
);
254 spin_lock_bh(&hashlimit_lock
);
255 hlist_add_head(&hinfo
->node
, &hashlimit_htables
);
256 spin_unlock_bh(&hashlimit_lock
);
261 static int htable_create(struct xt_hashlimit_mtinfo1
*minfo
,
264 struct xt_hashlimit_htable
*hinfo
;
268 if (minfo
->cfg
.size
) {
269 size
= minfo
->cfg
.size
;
271 size
= (num_physpages
<< PAGE_SHIFT
) / 16384 /
272 sizeof(struct list_head
);
273 if (num_physpages
> 1024 * 1024 * 1024 / PAGE_SIZE
)
278 /* FIXME: don't use vmalloc() here or anywhere else -HW */
279 hinfo
= vmalloc(sizeof(struct xt_hashlimit_htable
) +
280 sizeof(struct list_head
) * size
);
282 printk(KERN_ERR
"xt_hashlimit: unable to create hashtable\n");
285 minfo
->hinfo
= hinfo
;
287 /* copy match config into hashtable config */
288 memcpy(&hinfo
->cfg
, &minfo
->cfg
, sizeof(hinfo
->cfg
));
289 hinfo
->cfg
.size
= size
;
290 if (hinfo
->cfg
.max
== 0)
291 hinfo
->cfg
.max
= 8 * hinfo
->cfg
.size
;
292 else if (hinfo
->cfg
.max
< hinfo
->cfg
.size
)
293 hinfo
->cfg
.max
= hinfo
->cfg
.size
;
295 for (i
= 0; i
< hinfo
->cfg
.size
; i
++)
296 INIT_HLIST_HEAD(&hinfo
->hash
[i
]);
298 atomic_set(&hinfo
->use
, 1);
300 hinfo
->family
= family
;
301 hinfo
->rnd_initialized
= 0;
302 spin_lock_init(&hinfo
->lock
);
305 proc_create_data(minfo
->name
, 0,
306 family
== AF_INET
? hashlimit_procdir4
:
308 &dl_file_ops
, hinfo
);
309 if (hinfo
->pde
== NULL
) {
314 setup_timer(&hinfo
->timer
, htable_gc
, (unsigned long)hinfo
);
315 hinfo
->timer
.expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.gc_interval
);
316 add_timer(&hinfo
->timer
);
318 spin_lock_bh(&hashlimit_lock
);
319 hlist_add_head(&hinfo
->node
, &hashlimit_htables
);
320 spin_unlock_bh(&hashlimit_lock
);
325 static bool select_all(const struct xt_hashlimit_htable
*ht
,
326 const struct dsthash_ent
*he
)
331 static bool select_gc(const struct xt_hashlimit_htable
*ht
,
332 const struct dsthash_ent
*he
)
334 return time_after_eq(jiffies
, he
->expires
);
337 static void htable_selective_cleanup(struct xt_hashlimit_htable
*ht
,
338 bool (*select
)(const struct xt_hashlimit_htable
*ht
,
339 const struct dsthash_ent
*he
))
343 /* lock hash table and iterate over it */
344 spin_lock_bh(&ht
->lock
);
345 for (i
= 0; i
< ht
->cfg
.size
; i
++) {
346 struct dsthash_ent
*dh
;
347 struct hlist_node
*pos
, *n
;
348 hlist_for_each_entry_safe(dh
, pos
, n
, &ht
->hash
[i
], node
) {
349 if ((*select
)(ht
, dh
))
350 dsthash_free(ht
, dh
);
353 spin_unlock_bh(&ht
->lock
);
356 /* hash table garbage collector, run by timer */
357 static void htable_gc(unsigned long htlong
)
359 struct xt_hashlimit_htable
*ht
= (struct xt_hashlimit_htable
*)htlong
;
361 htable_selective_cleanup(ht
, select_gc
);
363 /* re-add the timer accordingly */
364 ht
->timer
.expires
= jiffies
+ msecs_to_jiffies(ht
->cfg
.gc_interval
);
365 add_timer(&ht
->timer
);
368 static void htable_destroy(struct xt_hashlimit_htable
*hinfo
)
370 del_timer_sync(&hinfo
->timer
);
372 /* remove proc entry */
373 remove_proc_entry(hinfo
->pde
->name
,
374 hinfo
->family
== AF_INET
? hashlimit_procdir4
:
376 htable_selective_cleanup(hinfo
, select_all
);
380 static struct xt_hashlimit_htable
*htable_find_get(const char *name
,
383 struct xt_hashlimit_htable
*hinfo
;
384 struct hlist_node
*pos
;
386 spin_lock_bh(&hashlimit_lock
);
387 hlist_for_each_entry(hinfo
, pos
, &hashlimit_htables
, node
) {
388 if (!strcmp(name
, hinfo
->pde
->name
) &&
389 hinfo
->family
== family
) {
390 atomic_inc(&hinfo
->use
);
391 spin_unlock_bh(&hashlimit_lock
);
395 spin_unlock_bh(&hashlimit_lock
);
399 static void htable_put(struct xt_hashlimit_htable
*hinfo
)
401 if (atomic_dec_and_test(&hinfo
->use
)) {
402 spin_lock_bh(&hashlimit_lock
);
403 hlist_del(&hinfo
->node
);
404 spin_unlock_bh(&hashlimit_lock
);
405 htable_destroy(hinfo
);
409 /* The algorithm used is the Simple Token Bucket Filter (TBF)
410 * see net/sched/sch_tbf.c in the linux source tree
413 /* Rusty: This is my (non-mathematically-inclined) understanding of
414 this algorithm. The `average rate' in jiffies becomes your initial
415 amount of credit `credit' and the most credit you can ever have
416 `credit_cap'. The `peak rate' becomes the cost of passing the
419 `prev' tracks the last packet hit: you gain one credit per jiffy.
420 If you get credit balance more than this, the extra credit is
421 discarded. Every time the match passes, you lose `cost' credits;
422 if you don't have that many, the test fails.
424 See Alexey's formal explanation in net/sched/sch_tbf.c.
426 To get the maximum range, we multiply by this factor (ie. you get N
427 credits per jiffy). We want to allow a rate as low as 1 per day
428 (slowest userspace tool allows), which means
429 CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32 ie.
431 #define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
433 /* Repeated shift and or gives us all 1s, final shift and add 1 gives
434 * us the power of 2 below the theoretical max, so GCC simply does a
436 #define _POW2_BELOW2(x) ((x)|((x)>>1))
437 #define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
438 #define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
439 #define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
440 #define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
441 #define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
443 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
445 /* Precision saver. */
446 static inline u_int32_t
447 user2credits(u_int32_t user
)
449 /* If multiplying would overflow... */
450 if (user
> 0xFFFFFFFF / (HZ
*CREDITS_PER_JIFFY
))
452 return (user
/ XT_HASHLIMIT_SCALE
) * HZ
* CREDITS_PER_JIFFY
;
454 return (user
* HZ
* CREDITS_PER_JIFFY
) / XT_HASHLIMIT_SCALE
;
457 static inline void rateinfo_recalc(struct dsthash_ent
*dh
, unsigned long now
)
459 dh
->rateinfo
.credit
+= (now
- dh
->rateinfo
.prev
) * CREDITS_PER_JIFFY
;
460 if (dh
->rateinfo
.credit
> dh
->rateinfo
.credit_cap
)
461 dh
->rateinfo
.credit
= dh
->rateinfo
.credit_cap
;
462 dh
->rateinfo
.prev
= now
;
465 static inline __be32
maskl(__be32 a
, unsigned int l
)
467 return l
? htonl(ntohl(a
) & ~0 << (32 - l
)) : 0;
470 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
471 static void hashlimit_ipv6_mask(__be32
*i
, unsigned int p
)
475 i
[0] = maskl(i
[0], p
);
476 i
[1] = i
[2] = i
[3] = 0;
479 i
[1] = maskl(i
[1], p
- 32);
483 i
[2] = maskl(i
[2], p
- 64);
486 i
[3] = maskl(i
[3], p
- 96);
495 hashlimit_init_dst(const struct xt_hashlimit_htable
*hinfo
,
496 struct dsthash_dst
*dst
,
497 const struct sk_buff
*skb
, unsigned int protoff
)
499 __be16 _ports
[2], *ports
;
502 memset(dst
, 0, sizeof(*dst
));
504 switch (hinfo
->family
) {
506 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
)
507 dst
->ip
.dst
= maskl(ip_hdr(skb
)->daddr
,
509 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
)
510 dst
->ip
.src
= maskl(ip_hdr(skb
)->saddr
,
513 if (!(hinfo
->cfg
.mode
&
514 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
516 nexthdr
= ip_hdr(skb
)->protocol
;
518 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
520 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
) {
521 memcpy(&dst
->ip6
.dst
, &ipv6_hdr(skb
)->daddr
,
522 sizeof(dst
->ip6
.dst
));
523 hashlimit_ipv6_mask(dst
->ip6
.dst
, hinfo
->cfg
.dstmask
);
525 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
) {
526 memcpy(&dst
->ip6
.src
, &ipv6_hdr(skb
)->saddr
,
527 sizeof(dst
->ip6
.src
));
528 hashlimit_ipv6_mask(dst
->ip6
.src
, hinfo
->cfg
.srcmask
);
531 if (!(hinfo
->cfg
.mode
&
532 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
534 nexthdr
= ipv6_hdr(skb
)->nexthdr
;
535 protoff
= ipv6_skip_exthdr(skb
, sizeof(struct ipv6hdr
), &nexthdr
);
536 if ((int)protoff
< 0)
548 case IPPROTO_UDPLITE
:
551 ports
= skb_header_pointer(skb
, protoff
, sizeof(_ports
),
555 _ports
[0] = _ports
[1] = 0;
561 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SPT
)
562 dst
->src_port
= ports
[0];
563 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DPT
)
564 dst
->dst_port
= ports
[1];
569 hashlimit_mt_v0(const struct sk_buff
*skb
, const struct net_device
*in
,
570 const struct net_device
*out
, const struct xt_match
*match
,
571 const void *matchinfo
, int offset
, unsigned int protoff
,
574 const struct xt_hashlimit_info
*r
=
575 ((const struct xt_hashlimit_info
*)matchinfo
)->u
.master
;
576 struct xt_hashlimit_htable
*hinfo
= r
->hinfo
;
577 unsigned long now
= jiffies
;
578 struct dsthash_ent
*dh
;
579 struct dsthash_dst dst
;
581 if (hashlimit_init_dst(hinfo
, &dst
, skb
, protoff
) < 0)
584 spin_lock_bh(&hinfo
->lock
);
585 dh
= dsthash_find(hinfo
, &dst
);
587 dh
= dsthash_alloc_init(hinfo
, &dst
);
589 spin_unlock_bh(&hinfo
->lock
);
593 dh
->expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
594 dh
->rateinfo
.prev
= jiffies
;
595 dh
->rateinfo
.credit
= user2credits(hinfo
->cfg
.avg
*
597 dh
->rateinfo
.credit_cap
= user2credits(hinfo
->cfg
.avg
*
599 dh
->rateinfo
.cost
= user2credits(hinfo
->cfg
.avg
);
601 /* update expiration timeout */
602 dh
->expires
= now
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
603 rateinfo_recalc(dh
, now
);
606 if (dh
->rateinfo
.credit
>= dh
->rateinfo
.cost
) {
607 /* We're underlimit. */
608 dh
->rateinfo
.credit
-= dh
->rateinfo
.cost
;
609 spin_unlock_bh(&hinfo
->lock
);
613 spin_unlock_bh(&hinfo
->lock
);
615 /* default case: we're overlimit, thus don't match */
624 hashlimit_mt(const struct sk_buff
*skb
, const struct net_device
*in
,
625 const struct net_device
*out
, const struct xt_match
*match
,
626 const void *matchinfo
, int offset
, unsigned int protoff
,
629 const struct xt_hashlimit_mtinfo1
*info
= matchinfo
;
630 struct xt_hashlimit_htable
*hinfo
= info
->hinfo
;
631 unsigned long now
= jiffies
;
632 struct dsthash_ent
*dh
;
633 struct dsthash_dst dst
;
635 if (hashlimit_init_dst(hinfo
, &dst
, skb
, protoff
) < 0)
638 spin_lock_bh(&hinfo
->lock
);
639 dh
= dsthash_find(hinfo
, &dst
);
641 dh
= dsthash_alloc_init(hinfo
, &dst
);
643 spin_unlock_bh(&hinfo
->lock
);
647 dh
->expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
648 dh
->rateinfo
.prev
= jiffies
;
649 dh
->rateinfo
.credit
= user2credits(hinfo
->cfg
.avg
*
651 dh
->rateinfo
.credit_cap
= user2credits(hinfo
->cfg
.avg
*
653 dh
->rateinfo
.cost
= user2credits(hinfo
->cfg
.avg
);
655 /* update expiration timeout */
656 dh
->expires
= now
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
657 rateinfo_recalc(dh
, now
);
660 if (dh
->rateinfo
.credit
>= dh
->rateinfo
.cost
) {
661 /* below the limit */
662 dh
->rateinfo
.credit
-= dh
->rateinfo
.cost
;
663 spin_unlock_bh(&hinfo
->lock
);
664 return !(info
->cfg
.mode
& XT_HASHLIMIT_INVERT
);
667 spin_unlock_bh(&hinfo
->lock
);
668 /* default match is underlimit - so over the limit, we need to invert */
669 return info
->cfg
.mode
& XT_HASHLIMIT_INVERT
;
677 hashlimit_mt_check_v0(const char *tablename
, const void *inf
,
678 const struct xt_match
*match
, void *matchinfo
,
679 unsigned int hook_mask
)
681 struct xt_hashlimit_info
*r
= matchinfo
;
683 /* Check for overflow. */
684 if (r
->cfg
.burst
== 0 ||
685 user2credits(r
->cfg
.avg
* r
->cfg
.burst
) < user2credits(r
->cfg
.avg
)) {
686 printk(KERN_ERR
"xt_hashlimit: overflow, try lower: %u/%u\n",
687 r
->cfg
.avg
, r
->cfg
.burst
);
690 if (r
->cfg
.mode
== 0 ||
691 r
->cfg
.mode
> (XT_HASHLIMIT_HASH_DPT
|
692 XT_HASHLIMIT_HASH_DIP
|
693 XT_HASHLIMIT_HASH_SIP
|
694 XT_HASHLIMIT_HASH_SPT
))
696 if (!r
->cfg
.gc_interval
)
700 if (r
->name
[sizeof(r
->name
) - 1] != '\0')
703 /* This is the best we've got: We cannot release and re-grab lock,
704 * since checkentry() is called before x_tables.c grabs xt_mutex.
705 * We also cannot grab the hashtable spinlock, since htable_create will
706 * call vmalloc, and that can sleep. And we cannot just re-search
707 * the list of htable's in htable_create(), since then we would
708 * create duplicate proc files. -HW */
709 mutex_lock(&hlimit_mutex
);
710 r
->hinfo
= htable_find_get(r
->name
, match
->family
);
711 if (!r
->hinfo
&& htable_create_v0(r
, match
->family
) != 0) {
712 mutex_unlock(&hlimit_mutex
);
715 mutex_unlock(&hlimit_mutex
);
717 /* Ugly hack: For SMP, we only want to use one set */
723 hashlimit_mt_check(const char *tablename
, const void *inf
,
724 const struct xt_match
*match
, void *matchinfo
,
725 unsigned int hook_mask
)
727 struct xt_hashlimit_mtinfo1
*info
= matchinfo
;
729 /* Check for overflow. */
730 if (info
->cfg
.burst
== 0 ||
731 user2credits(info
->cfg
.avg
* info
->cfg
.burst
) <
732 user2credits(info
->cfg
.avg
)) {
733 printk(KERN_ERR
"xt_hashlimit: overflow, try lower: %u/%u\n",
734 info
->cfg
.avg
, info
->cfg
.burst
);
737 if (info
->cfg
.gc_interval
== 0 || info
->cfg
.expire
== 0)
739 if (info
->name
[sizeof(info
->name
)-1] != '\0')
741 if (match
->family
== AF_INET
) {
742 if (info
->cfg
.srcmask
> 32 || info
->cfg
.dstmask
> 32)
745 if (info
->cfg
.srcmask
> 128 || info
->cfg
.dstmask
> 128)
749 /* This is the best we've got: We cannot release and re-grab lock,
750 * since checkentry() is called before x_tables.c grabs xt_mutex.
751 * We also cannot grab the hashtable spinlock, since htable_create will
752 * call vmalloc, and that can sleep. And we cannot just re-search
753 * the list of htable's in htable_create(), since then we would
754 * create duplicate proc files. -HW */
755 mutex_lock(&hlimit_mutex
);
756 info
->hinfo
= htable_find_get(info
->name
, match
->family
);
757 if (!info
->hinfo
&& htable_create(info
, match
->family
) != 0) {
758 mutex_unlock(&hlimit_mutex
);
761 mutex_unlock(&hlimit_mutex
);
766 hashlimit_mt_destroy_v0(const struct xt_match
*match
, void *matchinfo
)
768 const struct xt_hashlimit_info
*r
= matchinfo
;
770 htable_put(r
->hinfo
);
774 hashlimit_mt_destroy(const struct xt_match
*match
, void *matchinfo
)
776 const struct xt_hashlimit_mtinfo1
*info
= matchinfo
;
778 htable_put(info
->hinfo
);
782 struct compat_xt_hashlimit_info
{
784 struct hashlimit_cfg cfg
;
786 compat_uptr_t master
;
789 static void hashlimit_mt_compat_from_user(void *dst
, void *src
)
791 int off
= offsetof(struct compat_xt_hashlimit_info
, hinfo
);
793 memcpy(dst
, src
, off
);
794 memset(dst
+ off
, 0, sizeof(struct compat_xt_hashlimit_info
) - off
);
797 static int hashlimit_mt_compat_to_user(void __user
*dst
, void *src
)
799 int off
= offsetof(struct compat_xt_hashlimit_info
, hinfo
);
801 return copy_to_user(dst
, src
, off
) ? -EFAULT
: 0;
805 static struct xt_match hashlimit_mt_reg
[] __read_mostly
= {
810 .match
= hashlimit_mt_v0
,
811 .matchsize
= sizeof(struct xt_hashlimit_info
),
813 .compatsize
= sizeof(struct compat_xt_hashlimit_info
),
814 .compat_from_user
= hashlimit_mt_compat_from_user
,
815 .compat_to_user
= hashlimit_mt_compat_to_user
,
817 .checkentry
= hashlimit_mt_check_v0
,
818 .destroy
= hashlimit_mt_destroy_v0
,
825 .match
= hashlimit_mt
,
826 .matchsize
= sizeof(struct xt_hashlimit_mtinfo1
),
827 .checkentry
= hashlimit_mt_check
,
828 .destroy
= hashlimit_mt_destroy
,
831 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
835 .match
= hashlimit_mt_v0
,
836 .matchsize
= sizeof(struct xt_hashlimit_info
),
838 .compatsize
= sizeof(struct compat_xt_hashlimit_info
),
839 .compat_from_user
= hashlimit_mt_compat_from_user
,
840 .compat_to_user
= hashlimit_mt_compat_to_user
,
842 .checkentry
= hashlimit_mt_check_v0
,
843 .destroy
= hashlimit_mt_destroy_v0
,
850 .match
= hashlimit_mt
,
851 .matchsize
= sizeof(struct xt_hashlimit_mtinfo1
),
852 .checkentry
= hashlimit_mt_check
,
853 .destroy
= hashlimit_mt_destroy
,
860 static void *dl_seq_start(struct seq_file
*s
, loff_t
*pos
)
861 __acquires(htable
->lock
)
863 struct proc_dir_entry
*pde
= s
->private;
864 struct xt_hashlimit_htable
*htable
= pde
->data
;
865 unsigned int *bucket
;
867 spin_lock_bh(&htable
->lock
);
868 if (*pos
>= htable
->cfg
.size
)
871 bucket
= kmalloc(sizeof(unsigned int), GFP_ATOMIC
);
873 return ERR_PTR(-ENOMEM
);
879 static void *dl_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
881 struct proc_dir_entry
*pde
= s
->private;
882 struct xt_hashlimit_htable
*htable
= pde
->data
;
883 unsigned int *bucket
= (unsigned int *)v
;
886 if (*pos
>= htable
->cfg
.size
) {
893 static void dl_seq_stop(struct seq_file
*s
, void *v
)
894 __releases(htable
->lock
)
896 struct proc_dir_entry
*pde
= s
->private;
897 struct xt_hashlimit_htable
*htable
= pde
->data
;
898 unsigned int *bucket
= (unsigned int *)v
;
901 spin_unlock_bh(&htable
->lock
);
904 static int dl_seq_real_show(struct dsthash_ent
*ent
, int family
,
907 /* recalculate to show accurate numbers */
908 rateinfo_recalc(ent
, jiffies
);
912 return seq_printf(s
, "%ld %u.%u.%u.%u:%u->"
913 "%u.%u.%u.%u:%u %u %u %u\n",
914 (long)(ent
->expires
- jiffies
)/HZ
,
915 NIPQUAD(ent
->dst
.ip
.src
),
916 ntohs(ent
->dst
.src_port
),
917 NIPQUAD(ent
->dst
.ip
.dst
),
918 ntohs(ent
->dst
.dst_port
),
919 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
921 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
923 return seq_printf(s
, "%ld " NIP6_FMT
":%u->"
924 NIP6_FMT
":%u %u %u %u\n",
925 (long)(ent
->expires
- jiffies
)/HZ
,
926 NIP6(*(struct in6_addr
*)&ent
->dst
.ip6
.src
),
927 ntohs(ent
->dst
.src_port
),
928 NIP6(*(struct in6_addr
*)&ent
->dst
.ip6
.dst
),
929 ntohs(ent
->dst
.dst_port
),
930 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
939 static int dl_seq_show(struct seq_file
*s
, void *v
)
941 struct proc_dir_entry
*pde
= s
->private;
942 struct xt_hashlimit_htable
*htable
= pde
->data
;
943 unsigned int *bucket
= (unsigned int *)v
;
944 struct dsthash_ent
*ent
;
945 struct hlist_node
*pos
;
947 if (!hlist_empty(&htable
->hash
[*bucket
])) {
948 hlist_for_each_entry(ent
, pos
, &htable
->hash
[*bucket
], node
)
949 if (dl_seq_real_show(ent
, htable
->family
, s
))
955 static const struct seq_operations dl_seq_ops
= {
956 .start
= dl_seq_start
,
962 static int dl_proc_open(struct inode
*inode
, struct file
*file
)
964 int ret
= seq_open(file
, &dl_seq_ops
);
967 struct seq_file
*sf
= file
->private_data
;
968 sf
->private = PDE(inode
);
973 static const struct file_operations dl_file_ops
= {
974 .owner
= THIS_MODULE
,
975 .open
= dl_proc_open
,
978 .release
= seq_release
981 static int __init
hashlimit_mt_init(void)
985 err
= xt_register_matches(hashlimit_mt_reg
,
986 ARRAY_SIZE(hashlimit_mt_reg
));
991 hashlimit_cachep
= kmem_cache_create("xt_hashlimit",
992 sizeof(struct dsthash_ent
), 0, 0,
994 if (!hashlimit_cachep
) {
995 printk(KERN_ERR
"xt_hashlimit: unable to create slab cache\n");
998 hashlimit_procdir4
= proc_mkdir("ipt_hashlimit", init_net
.proc_net
);
999 if (!hashlimit_procdir4
) {
1000 printk(KERN_ERR
"xt_hashlimit: unable to create proc dir "
1005 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
1006 hashlimit_procdir6
= proc_mkdir("ip6t_hashlimit", init_net
.proc_net
);
1007 if (!hashlimit_procdir6
) {
1008 printk(KERN_ERR
"xt_hashlimit: unable to create proc dir "
1015 remove_proc_entry("ipt_hashlimit", init_net
.proc_net
);
1017 kmem_cache_destroy(hashlimit_cachep
);
1019 xt_unregister_matches(hashlimit_mt_reg
, ARRAY_SIZE(hashlimit_mt_reg
));
1025 static void __exit
hashlimit_mt_exit(void)
1027 remove_proc_entry("ipt_hashlimit", init_net
.proc_net
);
1028 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
1029 remove_proc_entry("ip6t_hashlimit", init_net
.proc_net
);
1031 kmem_cache_destroy(hashlimit_cachep
);
1032 xt_unregister_matches(hashlimit_mt_reg
, ARRAY_SIZE(hashlimit_mt_reg
));
1035 module_init(hashlimit_mt_init
);
1036 module_exit(hashlimit_mt_exit
);