release/src-rt-6.x/linux/linux-2.6/net/netfilter/xt_connlimit.c

   1 /*
   2  * netfilter module to limit the number of parallel tcp
   3  * connections per IP address.
   4  *   (c) 2000 Gerd Knorr <kraxel@bytesex.org>
   5  *   Nov 2002: Martin Bene <martin.bene@icomedias.com>:
   6  *              only ignore TIME_WAIT or gone connections
   7  *   (C) CC Computer Consultants GmbH, 2007
   8  *   Contact: <jengelh@computergmbh.de>
   9  *
  10  * based on ...
  11  *
  12  * Kernel module to match connection tracking information.
  13  * GPL (C) 1999  Rusty Russell (rusty@rustcorp.com.au).
  14  */
  15 #include <linux/in.h>
  16 #include <linux/in6.h>
  17 #include <linux/ip.h>
  18 #include <linux/ipv6.h>
  19 #include <linux/jhash.h>
  20 #include <linux/list.h>
  21 #include <linux/module.h>
  22 #include <linux/random.h>
  23 #include <linux/skbuff.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/netfilter/nf_conntrack_tcp.h>
  26 #include <linux/netfilter/x_tables.h>
  27 #include <linux/netfilter/xt_connlimit.h>
  28 #include <net/netfilter/nf_conntrack.h>
  29 #include <net/netfilter/nf_conntrack_core.h>
  30 #include <net/netfilter/nf_conntrack_tuple.h>
  31
  32 /* we will save the tuples of all connections we care about */
  33 struct xt_connlimit_conn {
  34         struct list_head list;
  35         struct nf_conntrack_tuple tuple;
  36 };
  37
  38 struct xt_connlimit_data {
  39         struct list_head iphash[256];
  40         spinlock_t lock;
  41 };
  42
  43 static u_int32_t connlimit_rnd __read_mostly;
  44 static bool connlimit_rnd_inited __read_mostly;
  45
  46 static inline unsigned int connlimit_iphash(u_int32_t addr)
  47 {
  48         return jhash_1word(addr, connlimit_rnd) & 0xFF;
  49 }
  50
  51 static inline unsigned int
  52 connlimit_iphash6(const union nf_inet_addr *addr,
  53                   const union nf_inet_addr *mask)
  54 {
  55         union nf_inet_addr res;
  56         unsigned int i;
  57
  58         for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i)
  59                 res.ip6[i] = addr->ip6[i] & mask->ip6[i];
  60
  61         return jhash2(res.ip6, ARRAY_SIZE(res.ip6), connlimit_rnd) & 0xFF;
  62 }
  63
  64 static inline bool already_closed(const struct nf_conn *conn)
  65 {
  66         u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum;
  67
  68         if (proto == IPPROTO_TCP)
  69                 return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
  70                        conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
  71         else
  72                 return 0;
  73 }
  74
  75 static inline unsigned int
  76 same_source_net(const union nf_inet_addr *addr,
  77                 const union nf_inet_addr *mask,
  78                 const union nf_inet_addr *u3, unsigned int family)
  79 {
  80         if (family == AF_INET) {
  81                 return (addr->ip & mask->ip) == (u3->ip & mask->ip);
  82         } else {
  83                 union nf_inet_addr lh, rh;
  84                 unsigned int i;
  85
  86                 for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i) {
  87                         lh.ip6[i] = addr->ip6[i] & mask->ip6[i];
  88                         rh.ip6[i] = u3->ip6[i] & mask->ip6[i];
  89                 }
  90
  91                 return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6)) == 0;
  92         }
  93 }
  94
  95 static int count_them(struct xt_connlimit_data *data,
  96                       const struct nf_conntrack_tuple *tuple,
  97                       const union nf_inet_addr *addr,
  98                       const union nf_inet_addr *mask,
  99                       const struct xt_match *match)
 100 {
 101         struct nf_conntrack_tuple_hash *found;
 102         struct xt_connlimit_conn *conn;
 103         struct xt_connlimit_conn *tmp;
 104         struct nf_conn *found_ct;
 105         struct list_head *hash;
 106         bool addit = true;
 107         int matches = 0;
 108
 109
 110         if (match->family == AF_INET6)
 111                 hash = &data->iphash[connlimit_iphash6(addr, mask)];
 112         else
 113                 hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
 114
 115         read_lock_bh(&nf_conntrack_lock);
 116
 117         /* check the saved connections */
 118         list_for_each_entry_safe(conn, tmp, hash, list) {
 119                 found    = __nf_conntrack_find(&conn->tuple);
 120                 found_ct = NULL;
 121
 122                 if (found != NULL)
 123                         found_ct = nf_ct_tuplehash_to_ctrack(found);
 124
 125                 if (found_ct != NULL &&
 126                     nf_ct_tuple_equal(&conn->tuple, tuple) &&
 127                     !already_closed(found_ct))
 128                         /*
 129                          * Just to be sure we have it only once in the list.
 130                          * We should not see tuples twice unless someone hooks
 131                          * this into a table without "-p tcp --syn".
 132                          */
 133                         addit = false;
 134
 135                 if (found == NULL) {
 136                         /* this one is gone */
 137                         list_del(&conn->list);
 138                         kfree(conn);
 139                         continue;
 140                 }
 141
 142                 if (already_closed(found_ct)) {
 143                         /*
 144                          * we do not care about connections which are
 145                          * closed already -> ditch it
 146                          */
 147                         list_del(&conn->list);
 148                         kfree(conn);
 149                         continue;
 150                 }
 151
 152                 if (same_source_net(addr, mask, &conn->tuple.src.u3,
 153                     match->family))
 154                         /* same source network -> be counted! */
 155                         ++matches;
 156         }
 157
 158         read_unlock_bh(&nf_conntrack_lock);
 159
 160         if (addit) {
 161                 /* save the new connection in our list */
 162                 conn = kzalloc(sizeof(*conn), GFP_ATOMIC);
 163                 if (conn == NULL)
 164                         return -ENOMEM;
 165                 conn->tuple = *tuple;
 166                 list_add(&conn->list, hash);
 167                 ++matches;
 168         }
 169
 170         return matches;
 171 }
 172
 173 static int
 174 connlimit_mt(const struct sk_buff *skb, const struct net_device *in,
 175              const struct net_device *out, const struct xt_match *match,
 176              const void *matchinfo, int offset, unsigned int protoff,
 177              int *hotdrop)
 178 {
 179         const struct xt_connlimit_info *info = matchinfo;
 180         union nf_inet_addr addr;
 181         struct nf_conntrack_tuple tuple;
 182         const struct nf_conntrack_tuple *tuple_ptr = &tuple;
 183         enum ip_conntrack_info ctinfo;
 184         const struct nf_conn *ct;
 185         int connections;
 186
 187         ct = nf_ct_get(skb, &ctinfo);
 188         if (ct != NULL)
 189                 tuple_ptr = &ct->tuplehash[0].tuple;
 190         else {
 191                 struct nf_conntrack_l3proto *l3proto;
 192                 struct nf_conntrack_l4proto *l4proto;
 193
 194                 l3proto = __nf_ct_l3proto_find(match->family);
 195                 if (l3proto == NULL)
 196                         goto hotdrop;
 197                 l4proto = __nf_ct_l4proto_find(match->family, match->proto);
 198                 if (l4proto == NULL)
 199                         goto hotdrop;
 200                 if (nf_ct_get_tuple(skb, 0, 0, match->family, match->proto,
 201                     &tuple, NULL, NULL) != 0)
 202                         goto hotdrop;
 203         }
 204
 205         if (match->family == AF_INET6) {
 206                 const struct ipv6hdr *iph = ipv6_hdr(skb);
 207                 memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));
 208         } else {
 209                 const struct iphdr *iph = ip_hdr(skb);
 210                 addr.ip = iph->saddr;
 211         }
 212
 213         spin_lock_bh(&info->data->lock);
 214         connections = count_them(info->data, tuple_ptr, &addr,
 215                                  &info->_mask, match);
 216         spin_unlock_bh(&info->data->lock);
 217
 218         if (connections < 0) {
 219                 /* kmalloc failed, drop it entirely */
 220                 *hotdrop = true;
 221                 return 0;
 222         }
 223
 224         return (connections > info->limit) ^ info->inverse;
 225
 226  hotdrop:
 227         rcu_read_unlock();
 228         *hotdrop = true;
 229         return 0;
 230 }
 231
 232 static int
 233 connlimit_mt_check(const char *tablename, const void *ip,
 234                    const struct xt_match *match, void *matchinfo,
 235                    unsigned int hook_mask)
 236 {
 237         struct xt_connlimit_info *info = matchinfo;
 238         unsigned int i;
 239
 240         if (unlikely(!connlimit_rnd_inited)) {
 241                 get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
 242                 connlimit_rnd_inited = true;
 243         }
 244         if (nf_ct_l3proto_try_module_get(match->family) < 0) {
 245                 printk(KERN_WARNING "cannot load conntrack support for "
 246                        "address family %u\n", match->family);
 247                 return 0;
 248         }
 249
 250         /* init private data */
 251         info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);
 252         if (info->data == NULL) {
 253                 nf_ct_l3proto_module_put(match->family);
 254                 return 0;
 255         }
 256
 257         spin_lock_init(&info->data->lock);
 258         for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i)
 259                 INIT_LIST_HEAD(&info->data->iphash[i]);
 260
 261         return 1;
 262 }
 263
 264 static void
 265 connlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
 266 {
 267         struct xt_connlimit_info *info = matchinfo;
 268         struct xt_connlimit_conn *conn;
 269         struct xt_connlimit_conn *tmp;
 270         struct list_head *hash = info->data->iphash;
 271         unsigned int i;
 272
 273         nf_ct_l3proto_module_put(match->family);
 274
 275         for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
 276                 list_for_each_entry_safe(conn, tmp, &hash[i], list) {
 277                         list_del(&conn->list);
 278                         kfree(conn);
 279                 }
 280         }
 281
 282         kfree(info->data);
 283 }
 284
 285 static struct xt_match connlimit_mt_reg[] __read_mostly = {
 286         {
 287                 .name       = "connlimit",
 288                 .family     = AF_INET,
 289                 .checkentry = connlimit_mt_check,
 290                 .match      = connlimit_mt,
 291                 .matchsize  = sizeof(struct xt_connlimit_info),
 292                 .destroy    = connlimit_mt_destroy,
 293                 .me         = THIS_MODULE,
 294         },
 295         {
 296                 .name       = "connlimit",
 297                 .family     = AF_INET6,
 298                 .checkentry = connlimit_mt_check,
 299                 .match      = connlimit_mt,
 300                 .matchsize  = sizeof(struct xt_connlimit_info),
 301                 .destroy    = connlimit_mt_destroy,
 302                 .me         = THIS_MODULE,
 303         },
 304 };
 305
 306 static int __init connlimit_mt_init(void)
 307 {
 308         return xt_register_matches(connlimit_mt_reg,
 309                ARRAY_SIZE(connlimit_mt_reg));
 310 }
 311
 312 static void __exit connlimit_mt_exit(void)
 313 {
 314         xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
 315 }
 316
 317 module_init(connlimit_mt_init);
 318 module_exit(connlimit_mt_exit);
 319 MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
 320 MODULE_DESCRIPTION("netfilter xt_connlimit match module");
 321 MODULE_LICENSE("GPL");
 322 MODULE_ALIAS("ipt_connlimit");
 323 MODULE_ALIAS("ip6t_connlimit");