2 * xt_hashlimit - Netfilter module to limit the number of packets per time
3 * separately for each hashbucket (sourceip/sourceport/dstip/dstport)
5 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
6 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
8 * Development of this code was funded by Astaro AG, http://www.astaro.com/
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 #include <linux/module.h>
12 #include <linux/spinlock.h>
13 #include <linux/random.h>
14 #include <linux/jhash.h>
15 #include <linux/slab.h>
16 #include <linux/vmalloc.h>
17 #include <linux/proc_fs.h>
18 #include <linux/seq_file.h>
19 #include <linux/list.h>
20 #include <linux/skbuff.h>
24 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
25 #include <linux/ipv6.h>
29 #include <net/net_namespace.h>
30 #include <net/netns/generic.h>
32 #include <linux/netfilter/x_tables.h>
33 #include <linux/netfilter_ipv4/ip_tables.h>
34 #include <linux/netfilter_ipv6/ip6_tables.h>
35 #include <linux/netfilter/xt_hashlimit.h>
36 #include <linux/mutex.h>
38 MODULE_LICENSE("GPL");
39 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
40 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
41 MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
42 MODULE_ALIAS("ipt_hashlimit");
43 MODULE_ALIAS("ip6t_hashlimit");
45 struct hashlimit_net
{
46 struct hlist_head htables
;
47 struct proc_dir_entry
*ipt_hashlimit
;
48 struct proc_dir_entry
*ip6t_hashlimit
;
51 static int hashlimit_net_id
;
52 static inline struct hashlimit_net
*hashlimit_pernet(struct net
*net
)
54 return net_generic(net
, hashlimit_net_id
);
57 /* need to declare this at the top */
58 static const struct file_operations dl_file_ops
;
67 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
79 /* static / read-only parts in the beginning */
80 struct hlist_node node
;
81 struct dsthash_dst dst
;
83 /* modified structure members in the end */
84 unsigned long expires
; /* precalculated expiry time */
86 unsigned long prev
; /* last modification */
88 u_int32_t credit_cap
, cost
;
92 struct xt_hashlimit_htable
{
93 struct hlist_node node
; /* global list of all htables */
98 struct hashlimit_cfg1 cfg
; /* config */
100 /* used internally */
101 spinlock_t lock
; /* lock for list_head */
102 u_int32_t rnd
; /* random seed for hash */
103 unsigned int count
; /* number entries in table */
104 struct timer_list timer
; /* timer for gc */
107 struct proc_dir_entry
*pde
;
110 struct hlist_head hash
[0]; /* hashtable itself */
113 static DEFINE_MUTEX(hashlimit_mutex
); /* protects htables list */
114 static struct kmem_cache
*hashlimit_cachep __read_mostly
;
116 static inline bool dst_cmp(const struct dsthash_ent
*ent
,
117 const struct dsthash_dst
*b
)
119 return !memcmp(&ent
->dst
, b
, sizeof(ent
->dst
));
123 hash_dst(const struct xt_hashlimit_htable
*ht
, const struct dsthash_dst
*dst
)
125 u_int32_t hash
= jhash2((const u32
*)dst
,
126 sizeof(*dst
)/sizeof(u32
),
129 * Instead of returning hash % ht->cfg.size (implying a divide)
130 * we return the high 32 bits of the (hash * ht->cfg.size) that will
131 * give results between [0 and cfg.size-1] and same hash distribution,
132 * but using a multiply, less expensive than a divide
134 return ((u64
)hash
* ht
->cfg
.size
) >> 32;
137 static struct dsthash_ent
*
138 dsthash_find(const struct xt_hashlimit_htable
*ht
,
139 const struct dsthash_dst
*dst
)
141 struct dsthash_ent
*ent
;
142 struct hlist_node
*pos
;
143 u_int32_t hash
= hash_dst(ht
, dst
);
145 if (!hlist_empty(&ht
->hash
[hash
])) {
146 hlist_for_each_entry(ent
, pos
, &ht
->hash
[hash
], node
)
147 if (dst_cmp(ent
, dst
))
153 /* allocate dsthash_ent, initialize dst, put in htable and lock it */
154 static struct dsthash_ent
*
155 dsthash_alloc_init(struct xt_hashlimit_htable
*ht
,
156 const struct dsthash_dst
*dst
)
158 struct dsthash_ent
*ent
;
160 /* initialize hash with random val at the time we allocate
161 * the first hashtable entry */
162 if (!ht
->rnd_initialized
) {
163 get_random_bytes(&ht
->rnd
, sizeof(ht
->rnd
));
164 ht
->rnd_initialized
= true;
167 if (ht
->cfg
.max
&& ht
->count
>= ht
->cfg
.max
) {
168 /* FIXME: do something. question is what.. */
170 pr_err("max count of %u reached\n", ht
->cfg
.max
);
174 ent
= kmem_cache_alloc(hashlimit_cachep
, GFP_ATOMIC
);
177 pr_err("cannot allocate dsthash_ent\n");
180 memcpy(&ent
->dst
, dst
, sizeof(ent
->dst
));
182 hlist_add_head(&ent
->node
, &ht
->hash
[hash_dst(ht
, dst
)]);
188 dsthash_free(struct xt_hashlimit_htable
*ht
, struct dsthash_ent
*ent
)
190 hlist_del(&ent
->node
);
191 kmem_cache_free(hashlimit_cachep
, ent
);
194 static void htable_gc(unsigned long htlong
);
196 static int htable_create_v0(struct net
*net
, struct xt_hashlimit_info
*minfo
, u_int8_t family
)
198 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
199 struct xt_hashlimit_htable
*hinfo
;
204 size
= minfo
->cfg
.size
;
206 size
= ((totalram_pages
<< PAGE_SHIFT
) / 16384) /
207 sizeof(struct list_head
);
208 if (totalram_pages
> (1024 * 1024 * 1024 / PAGE_SIZE
))
213 /* FIXME: don't use vmalloc() here or anywhere else -HW */
214 hinfo
= vmalloc(sizeof(struct xt_hashlimit_htable
) +
215 sizeof(struct list_head
) * size
);
218 minfo
->hinfo
= hinfo
;
220 /* copy match config into hashtable config */
221 hinfo
->cfg
.mode
= minfo
->cfg
.mode
;
222 hinfo
->cfg
.avg
= minfo
->cfg
.avg
;
223 hinfo
->cfg
.burst
= minfo
->cfg
.burst
;
224 hinfo
->cfg
.max
= minfo
->cfg
.max
;
225 hinfo
->cfg
.gc_interval
= minfo
->cfg
.gc_interval
;
226 hinfo
->cfg
.expire
= minfo
->cfg
.expire
;
228 if (family
== NFPROTO_IPV4
)
229 hinfo
->cfg
.srcmask
= hinfo
->cfg
.dstmask
= 32;
231 hinfo
->cfg
.srcmask
= hinfo
->cfg
.dstmask
= 128;
233 hinfo
->cfg
.size
= size
;
235 hinfo
->cfg
.max
= 8 * hinfo
->cfg
.size
;
236 else if (hinfo
->cfg
.max
< hinfo
->cfg
.size
)
237 hinfo
->cfg
.max
= hinfo
->cfg
.size
;
239 for (i
= 0; i
< hinfo
->cfg
.size
; i
++)
240 INIT_HLIST_HEAD(&hinfo
->hash
[i
]);
244 hinfo
->family
= family
;
245 hinfo
->rnd_initialized
= false;
246 spin_lock_init(&hinfo
->lock
);
247 hinfo
->pde
= proc_create_data(minfo
->name
, 0,
248 (family
== NFPROTO_IPV4
) ?
249 hashlimit_net
->ipt_hashlimit
: hashlimit_net
->ip6t_hashlimit
,
250 &dl_file_ops
, hinfo
);
257 setup_timer(&hinfo
->timer
, htable_gc
, (unsigned long )hinfo
);
258 hinfo
->timer
.expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.gc_interval
);
259 add_timer(&hinfo
->timer
);
261 hlist_add_head(&hinfo
->node
, &hashlimit_net
->htables
);
266 static int htable_create(struct net
*net
, struct xt_hashlimit_mtinfo1
*minfo
,
269 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
270 struct xt_hashlimit_htable
*hinfo
;
274 if (minfo
->cfg
.size
) {
275 size
= minfo
->cfg
.size
;
277 size
= (totalram_pages
<< PAGE_SHIFT
) / 16384 /
278 sizeof(struct list_head
);
279 if (totalram_pages
> 1024 * 1024 * 1024 / PAGE_SIZE
)
284 /* FIXME: don't use vmalloc() here or anywhere else -HW */
285 hinfo
= vmalloc(sizeof(struct xt_hashlimit_htable
) +
286 sizeof(struct list_head
) * size
);
289 minfo
->hinfo
= hinfo
;
291 /* copy match config into hashtable config */
292 memcpy(&hinfo
->cfg
, &minfo
->cfg
, sizeof(hinfo
->cfg
));
293 hinfo
->cfg
.size
= size
;
294 if (hinfo
->cfg
.max
== 0)
295 hinfo
->cfg
.max
= 8 * hinfo
->cfg
.size
;
296 else if (hinfo
->cfg
.max
< hinfo
->cfg
.size
)
297 hinfo
->cfg
.max
= hinfo
->cfg
.size
;
299 for (i
= 0; i
< hinfo
->cfg
.size
; i
++)
300 INIT_HLIST_HEAD(&hinfo
->hash
[i
]);
304 hinfo
->family
= family
;
305 hinfo
->rnd_initialized
= false;
306 spin_lock_init(&hinfo
->lock
);
308 hinfo
->pde
= proc_create_data(minfo
->name
, 0,
309 (family
== NFPROTO_IPV4
) ?
310 hashlimit_net
->ipt_hashlimit
: hashlimit_net
->ip6t_hashlimit
,
311 &dl_file_ops
, hinfo
);
312 if (hinfo
->pde
== NULL
) {
318 setup_timer(&hinfo
->timer
, htable_gc
, (unsigned long)hinfo
);
319 hinfo
->timer
.expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.gc_interval
);
320 add_timer(&hinfo
->timer
);
322 hlist_add_head(&hinfo
->node
, &hashlimit_net
->htables
);
327 static bool select_all(const struct xt_hashlimit_htable
*ht
,
328 const struct dsthash_ent
*he
)
333 static bool select_gc(const struct xt_hashlimit_htable
*ht
,
334 const struct dsthash_ent
*he
)
336 return time_after_eq(jiffies
, he
->expires
);
339 static void htable_selective_cleanup(struct xt_hashlimit_htable
*ht
,
340 bool (*select
)(const struct xt_hashlimit_htable
*ht
,
341 const struct dsthash_ent
*he
))
345 /* lock hash table and iterate over it */
346 spin_lock_bh(&ht
->lock
);
347 for (i
= 0; i
< ht
->cfg
.size
; i
++) {
348 struct dsthash_ent
*dh
;
349 struct hlist_node
*pos
, *n
;
350 hlist_for_each_entry_safe(dh
, pos
, n
, &ht
->hash
[i
], node
) {
351 if ((*select
)(ht
, dh
))
352 dsthash_free(ht
, dh
);
355 spin_unlock_bh(&ht
->lock
);
358 /* hash table garbage collector, run by timer */
359 static void htable_gc(unsigned long htlong
)
361 struct xt_hashlimit_htable
*ht
= (struct xt_hashlimit_htable
*)htlong
;
363 htable_selective_cleanup(ht
, select_gc
);
365 /* re-add the timer accordingly */
366 ht
->timer
.expires
= jiffies
+ msecs_to_jiffies(ht
->cfg
.gc_interval
);
367 add_timer(&ht
->timer
);
370 static void htable_destroy(struct xt_hashlimit_htable
*hinfo
)
372 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(hinfo
->net
);
373 struct proc_dir_entry
*parent
;
375 del_timer_sync(&hinfo
->timer
);
377 if (hinfo
->family
== NFPROTO_IPV4
)
378 parent
= hashlimit_net
->ipt_hashlimit
;
380 parent
= hashlimit_net
->ip6t_hashlimit
;
381 remove_proc_entry(hinfo
->pde
->name
, parent
);
382 htable_selective_cleanup(hinfo
, select_all
);
386 static struct xt_hashlimit_htable
*htable_find_get(struct net
*net
,
390 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
391 struct xt_hashlimit_htable
*hinfo
;
392 struct hlist_node
*pos
;
394 hlist_for_each_entry(hinfo
, pos
, &hashlimit_net
->htables
, node
) {
395 if (!strcmp(name
, hinfo
->pde
->name
) &&
396 hinfo
->family
== family
) {
404 static void htable_put(struct xt_hashlimit_htable
*hinfo
)
406 mutex_lock(&hashlimit_mutex
);
407 if (--hinfo
->use
== 0) {
408 hlist_del(&hinfo
->node
);
409 htable_destroy(hinfo
);
411 mutex_unlock(&hashlimit_mutex
);
414 /* The algorithm used is the Simple Token Bucket Filter (TBF)
415 * see net/sched/sch_tbf.c in the linux source tree
418 /* Rusty: This is my (non-mathematically-inclined) understanding of
419 this algorithm. The `average rate' in jiffies becomes your initial
420 amount of credit `credit' and the most credit you can ever have
421 `credit_cap'. The `peak rate' becomes the cost of passing the
424 `prev' tracks the last packet hit: you gain one credit per jiffy.
425 If you get credit balance more than this, the extra credit is
426 discarded. Every time the match passes, you lose `cost' credits;
427 if you don't have that many, the test fails.
429 See Alexey's formal explanation in net/sched/sch_tbf.c.
431 To get the maximum range, we multiply by this factor (ie. you get N
432 credits per jiffy). We want to allow a rate as low as 1 per day
433 (slowest userspace tool allows), which means
434 CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32 ie.
436 #define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
438 /* Repeated shift and or gives us all 1s, final shift and add 1 gives
439 * us the power of 2 below the theoretical max, so GCC simply does a
441 #define _POW2_BELOW2(x) ((x)|((x)>>1))
442 #define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
443 #define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
444 #define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
445 #define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
446 #define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
448 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
450 /* Precision saver. */
451 static inline u_int32_t
452 user2credits(u_int32_t user
)
454 /* If multiplying would overflow... */
455 if (user
> 0xFFFFFFFF / (HZ
*CREDITS_PER_JIFFY
))
457 return (user
/ XT_HASHLIMIT_SCALE
) * HZ
* CREDITS_PER_JIFFY
;
459 return (user
* HZ
* CREDITS_PER_JIFFY
) / XT_HASHLIMIT_SCALE
;
462 static inline void rateinfo_recalc(struct dsthash_ent
*dh
, unsigned long now
)
464 dh
->rateinfo
.credit
+= (now
- dh
->rateinfo
.prev
) * CREDITS_PER_JIFFY
;
465 if (dh
->rateinfo
.credit
> dh
->rateinfo
.credit_cap
)
466 dh
->rateinfo
.credit
= dh
->rateinfo
.credit_cap
;
467 dh
->rateinfo
.prev
= now
;
470 static inline __be32
maskl(__be32 a
, unsigned int l
)
472 return l
? htonl(ntohl(a
) & ~0 << (32 - l
)) : 0;
475 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
476 static void hashlimit_ipv6_mask(__be32
*i
, unsigned int p
)
480 i
[0] = maskl(i
[0], p
);
481 i
[1] = i
[2] = i
[3] = 0;
484 i
[1] = maskl(i
[1], p
- 32);
488 i
[2] = maskl(i
[2], p
- 64);
491 i
[3] = maskl(i
[3], p
- 96);
500 hashlimit_init_dst(const struct xt_hashlimit_htable
*hinfo
,
501 struct dsthash_dst
*dst
,
502 const struct sk_buff
*skb
, unsigned int protoff
)
504 __be16 _ports
[2], *ports
;
507 memset(dst
, 0, sizeof(*dst
));
509 switch (hinfo
->family
) {
511 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
)
512 dst
->ip
.dst
= maskl(ip_hdr(skb
)->daddr
,
514 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
)
515 dst
->ip
.src
= maskl(ip_hdr(skb
)->saddr
,
518 if (!(hinfo
->cfg
.mode
&
519 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
521 nexthdr
= ip_hdr(skb
)->protocol
;
523 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
525 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
) {
526 memcpy(&dst
->ip6
.dst
, &ipv6_hdr(skb
)->daddr
,
527 sizeof(dst
->ip6
.dst
));
528 hashlimit_ipv6_mask(dst
->ip6
.dst
, hinfo
->cfg
.dstmask
);
530 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
) {
531 memcpy(&dst
->ip6
.src
, &ipv6_hdr(skb
)->saddr
,
532 sizeof(dst
->ip6
.src
));
533 hashlimit_ipv6_mask(dst
->ip6
.src
, hinfo
->cfg
.srcmask
);
536 if (!(hinfo
->cfg
.mode
&
537 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
539 nexthdr
= ipv6_hdr(skb
)->nexthdr
;
540 protoff
= ipv6_skip_exthdr(skb
, sizeof(struct ipv6hdr
), &nexthdr
);
541 if ((int)protoff
< 0)
553 case IPPROTO_UDPLITE
:
556 ports
= skb_header_pointer(skb
, protoff
, sizeof(_ports
),
560 _ports
[0] = _ports
[1] = 0;
566 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SPT
)
567 dst
->src_port
= ports
[0];
568 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DPT
)
569 dst
->dst_port
= ports
[1];
574 hashlimit_mt_v0(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
576 const struct xt_hashlimit_info
*r
= par
->matchinfo
;
577 struct xt_hashlimit_htable
*hinfo
= r
->hinfo
;
578 unsigned long now
= jiffies
;
579 struct dsthash_ent
*dh
;
580 struct dsthash_dst dst
;
582 if (hashlimit_init_dst(hinfo
, &dst
, skb
, par
->thoff
) < 0)
585 spin_lock_bh(&hinfo
->lock
);
586 dh
= dsthash_find(hinfo
, &dst
);
588 dh
= dsthash_alloc_init(hinfo
, &dst
);
590 spin_unlock_bh(&hinfo
->lock
);
594 dh
->expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
595 dh
->rateinfo
.prev
= jiffies
;
596 dh
->rateinfo
.credit
= user2credits(hinfo
->cfg
.avg
*
598 dh
->rateinfo
.credit_cap
= user2credits(hinfo
->cfg
.avg
*
600 dh
->rateinfo
.cost
= user2credits(hinfo
->cfg
.avg
);
602 /* update expiration timeout */
603 dh
->expires
= now
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
604 rateinfo_recalc(dh
, now
);
607 if (dh
->rateinfo
.credit
>= dh
->rateinfo
.cost
) {
608 /* We're underlimit. */
609 dh
->rateinfo
.credit
-= dh
->rateinfo
.cost
;
610 spin_unlock_bh(&hinfo
->lock
);
614 spin_unlock_bh(&hinfo
->lock
);
616 /* default case: we're overlimit, thus don't match */
620 *par
->hotdrop
= true;
625 hashlimit_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
627 const struct xt_hashlimit_mtinfo1
*info
= par
->matchinfo
;
628 struct xt_hashlimit_htable
*hinfo
= info
->hinfo
;
629 unsigned long now
= jiffies
;
630 struct dsthash_ent
*dh
;
631 struct dsthash_dst dst
;
633 if (hashlimit_init_dst(hinfo
, &dst
, skb
, par
->thoff
) < 0)
636 spin_lock_bh(&hinfo
->lock
);
637 dh
= dsthash_find(hinfo
, &dst
);
639 dh
= dsthash_alloc_init(hinfo
, &dst
);
641 spin_unlock_bh(&hinfo
->lock
);
645 dh
->expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
646 dh
->rateinfo
.prev
= jiffies
;
647 dh
->rateinfo
.credit
= user2credits(hinfo
->cfg
.avg
*
649 dh
->rateinfo
.credit_cap
= user2credits(hinfo
->cfg
.avg
*
651 dh
->rateinfo
.cost
= user2credits(hinfo
->cfg
.avg
);
653 /* update expiration timeout */
654 dh
->expires
= now
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
655 rateinfo_recalc(dh
, now
);
658 if (dh
->rateinfo
.credit
>= dh
->rateinfo
.cost
) {
659 /* below the limit */
660 dh
->rateinfo
.credit
-= dh
->rateinfo
.cost
;
661 spin_unlock_bh(&hinfo
->lock
);
662 return !(info
->cfg
.mode
& XT_HASHLIMIT_INVERT
);
665 spin_unlock_bh(&hinfo
->lock
);
666 /* default match is underlimit - so over the limit, we need to invert */
667 return info
->cfg
.mode
& XT_HASHLIMIT_INVERT
;
670 *par
->hotdrop
= true;
674 static int hashlimit_mt_check_v0(const struct xt_mtchk_param
*par
)
676 struct net
*net
= par
->net
;
677 struct xt_hashlimit_info
*r
= par
->matchinfo
;
680 /* Check for overflow. */
681 if (r
->cfg
.burst
== 0 ||
682 user2credits(r
->cfg
.avg
* r
->cfg
.burst
) < user2credits(r
->cfg
.avg
)) {
683 pr_info("overflow, try lower: %u/%u\n",
684 r
->cfg
.avg
, r
->cfg
.burst
);
687 if (r
->cfg
.mode
== 0 ||
688 r
->cfg
.mode
> (XT_HASHLIMIT_HASH_DPT
|
689 XT_HASHLIMIT_HASH_DIP
|
690 XT_HASHLIMIT_HASH_SIP
|
691 XT_HASHLIMIT_HASH_SPT
))
693 if (!r
->cfg
.gc_interval
)
697 if (r
->name
[sizeof(r
->name
) - 1] != '\0')
700 mutex_lock(&hashlimit_mutex
);
701 r
->hinfo
= htable_find_get(net
, r
->name
, par
->family
);
702 if (r
->hinfo
== NULL
) {
703 ret
= htable_create_v0(net
, r
, par
->family
);
705 mutex_unlock(&hashlimit_mutex
);
709 mutex_unlock(&hashlimit_mutex
);
713 static int hashlimit_mt_check(const struct xt_mtchk_param
*par
)
715 struct net
*net
= par
->net
;
716 struct xt_hashlimit_mtinfo1
*info
= par
->matchinfo
;
719 /* Check for overflow. */
720 if (info
->cfg
.burst
== 0 ||
721 user2credits(info
->cfg
.avg
* info
->cfg
.burst
) <
722 user2credits(info
->cfg
.avg
)) {
723 pr_info("overflow, try lower: %u/%u\n",
724 info
->cfg
.avg
, info
->cfg
.burst
);
727 if (info
->cfg
.gc_interval
== 0 || info
->cfg
.expire
== 0)
729 if (info
->name
[sizeof(info
->name
)-1] != '\0')
731 if (par
->family
== NFPROTO_IPV4
) {
732 if (info
->cfg
.srcmask
> 32 || info
->cfg
.dstmask
> 32)
735 if (info
->cfg
.srcmask
> 128 || info
->cfg
.dstmask
> 128)
739 mutex_lock(&hashlimit_mutex
);
740 info
->hinfo
= htable_find_get(net
, info
->name
, par
->family
);
741 if (info
->hinfo
== NULL
) {
742 ret
= htable_create(net
, info
, par
->family
);
744 mutex_unlock(&hashlimit_mutex
);
748 mutex_unlock(&hashlimit_mutex
);
753 hashlimit_mt_destroy_v0(const struct xt_mtdtor_param
*par
)
755 const struct xt_hashlimit_info
*r
= par
->matchinfo
;
757 htable_put(r
->hinfo
);
760 static void hashlimit_mt_destroy(const struct xt_mtdtor_param
*par
)
762 const struct xt_hashlimit_mtinfo1
*info
= par
->matchinfo
;
764 htable_put(info
->hinfo
);
768 struct compat_xt_hashlimit_info
{
770 struct hashlimit_cfg cfg
;
772 compat_uptr_t master
;
775 static void hashlimit_mt_compat_from_user(void *dst
, const void *src
)
777 int off
= offsetof(struct compat_xt_hashlimit_info
, hinfo
);
779 memcpy(dst
, src
, off
);
780 memset(dst
+ off
, 0, sizeof(struct compat_xt_hashlimit_info
) - off
);
783 static int hashlimit_mt_compat_to_user(void __user
*dst
, const void *src
)
785 int off
= offsetof(struct compat_xt_hashlimit_info
, hinfo
);
787 return copy_to_user(dst
, src
, off
) ? -EFAULT
: 0;
791 static struct xt_match hashlimit_mt_reg
[] __read_mostly
= {
795 .family
= NFPROTO_IPV4
,
796 .match
= hashlimit_mt_v0
,
797 .matchsize
= sizeof(struct xt_hashlimit_info
),
799 .compatsize
= sizeof(struct compat_xt_hashlimit_info
),
800 .compat_from_user
= hashlimit_mt_compat_from_user
,
801 .compat_to_user
= hashlimit_mt_compat_to_user
,
803 .checkentry
= hashlimit_mt_check_v0
,
804 .destroy
= hashlimit_mt_destroy_v0
,
810 .family
= NFPROTO_IPV4
,
811 .match
= hashlimit_mt
,
812 .matchsize
= sizeof(struct xt_hashlimit_mtinfo1
),
813 .checkentry
= hashlimit_mt_check
,
814 .destroy
= hashlimit_mt_destroy
,
817 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
820 .family
= NFPROTO_IPV6
,
821 .match
= hashlimit_mt_v0
,
822 .matchsize
= sizeof(struct xt_hashlimit_info
),
824 .compatsize
= sizeof(struct compat_xt_hashlimit_info
),
825 .compat_from_user
= hashlimit_mt_compat_from_user
,
826 .compat_to_user
= hashlimit_mt_compat_to_user
,
828 .checkentry
= hashlimit_mt_check_v0
,
829 .destroy
= hashlimit_mt_destroy_v0
,
835 .family
= NFPROTO_IPV6
,
836 .match
= hashlimit_mt
,
837 .matchsize
= sizeof(struct xt_hashlimit_mtinfo1
),
838 .checkentry
= hashlimit_mt_check
,
839 .destroy
= hashlimit_mt_destroy
,
846 static void *dl_seq_start(struct seq_file
*s
, loff_t
*pos
)
847 __acquires(htable
->lock
)
849 struct xt_hashlimit_htable
*htable
= s
->private;
850 unsigned int *bucket
;
852 spin_lock_bh(&htable
->lock
);
853 if (*pos
>= htable
->cfg
.size
)
856 bucket
= kmalloc(sizeof(unsigned int), GFP_ATOMIC
);
858 return ERR_PTR(-ENOMEM
);
864 static void *dl_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
866 struct xt_hashlimit_htable
*htable
= s
->private;
867 unsigned int *bucket
= (unsigned int *)v
;
870 if (*pos
>= htable
->cfg
.size
) {
877 static void dl_seq_stop(struct seq_file
*s
, void *v
)
878 __releases(htable
->lock
)
880 struct xt_hashlimit_htable
*htable
= s
->private;
881 unsigned int *bucket
= (unsigned int *)v
;
884 spin_unlock_bh(&htable
->lock
);
887 static int dl_seq_real_show(struct dsthash_ent
*ent
, u_int8_t family
,
890 /* recalculate to show accurate numbers */
891 rateinfo_recalc(ent
, jiffies
);
895 return seq_printf(s
, "%ld %pI4:%u->%pI4:%u %u %u %u\n",
896 (long)(ent
->expires
- jiffies
)/HZ
,
898 ntohs(ent
->dst
.src_port
),
900 ntohs(ent
->dst
.dst_port
),
901 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
903 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
905 return seq_printf(s
, "%ld %pI6:%u->%pI6:%u %u %u %u\n",
906 (long)(ent
->expires
- jiffies
)/HZ
,
908 ntohs(ent
->dst
.src_port
),
910 ntohs(ent
->dst
.dst_port
),
911 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
920 static int dl_seq_show(struct seq_file
*s
, void *v
)
922 struct xt_hashlimit_htable
*htable
= s
->private;
923 unsigned int *bucket
= (unsigned int *)v
;
924 struct dsthash_ent
*ent
;
925 struct hlist_node
*pos
;
927 if (!hlist_empty(&htable
->hash
[*bucket
])) {
928 hlist_for_each_entry(ent
, pos
, &htable
->hash
[*bucket
], node
)
929 if (dl_seq_real_show(ent
, htable
->family
, s
))
935 static const struct seq_operations dl_seq_ops
= {
936 .start
= dl_seq_start
,
942 static int dl_proc_open(struct inode
*inode
, struct file
*file
)
944 int ret
= seq_open(file
, &dl_seq_ops
);
947 struct seq_file
*sf
= file
->private_data
;
948 sf
->private = PDE(inode
)->data
;
953 static const struct file_operations dl_file_ops
= {
954 .owner
= THIS_MODULE
,
955 .open
= dl_proc_open
,
958 .release
= seq_release
961 static int __net_init
hashlimit_proc_net_init(struct net
*net
)
963 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
965 hashlimit_net
->ipt_hashlimit
= proc_mkdir("ipt_hashlimit", net
->proc_net
);
966 if (!hashlimit_net
->ipt_hashlimit
)
968 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
969 hashlimit_net
->ip6t_hashlimit
= proc_mkdir("ip6t_hashlimit", net
->proc_net
);
970 if (!hashlimit_net
->ip6t_hashlimit
) {
971 proc_net_remove(net
, "ipt_hashlimit");
978 static void __net_exit
hashlimit_proc_net_exit(struct net
*net
)
980 proc_net_remove(net
, "ipt_hashlimit");
981 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
982 proc_net_remove(net
, "ip6t_hashlimit");
986 static int __net_init
hashlimit_net_init(struct net
*net
)
988 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
990 INIT_HLIST_HEAD(&hashlimit_net
->htables
);
991 return hashlimit_proc_net_init(net
);
994 static void __net_exit
hashlimit_net_exit(struct net
*net
)
996 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
998 BUG_ON(!hlist_empty(&hashlimit_net
->htables
));
999 hashlimit_proc_net_exit(net
);
1002 static struct pernet_operations hashlimit_net_ops
= {
1003 .init
= hashlimit_net_init
,
1004 .exit
= hashlimit_net_exit
,
1005 .id
= &hashlimit_net_id
,
1006 .size
= sizeof(struct hashlimit_net
),
1009 static int __init
hashlimit_mt_init(void)
1013 err
= register_pernet_subsys(&hashlimit_net_ops
);
1016 err
= xt_register_matches(hashlimit_mt_reg
,
1017 ARRAY_SIZE(hashlimit_mt_reg
));
1022 hashlimit_cachep
= kmem_cache_create("xt_hashlimit",
1023 sizeof(struct dsthash_ent
), 0, 0,
1025 if (!hashlimit_cachep
) {
1026 pr_warning("unable to create slab cache\n");
1032 xt_unregister_matches(hashlimit_mt_reg
, ARRAY_SIZE(hashlimit_mt_reg
));
1034 unregister_pernet_subsys(&hashlimit_net_ops
);
1039 static void __exit
hashlimit_mt_exit(void)
1041 kmem_cache_destroy(hashlimit_cachep
);
1042 xt_unregister_matches(hashlimit_mt_reg
, ARRAY_SIZE(hashlimit_mt_reg
));
1043 unregister_pernet_subsys(&hashlimit_net_ops
);
1046 module_init(hashlimit_mt_init
);
1047 module_exit(hashlimit_mt_exit
);