1 /* iptables match extension for limiting packets per destination
3 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
5 * Development of this code was funded by Astaro AG, http://www.astaro.com/
7 * Based on ipt_limit.c by
8 * Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr>
9 * Hervé Eychenne <rv@wallfire.org>
11 * Error corections by nmalykh@bilim.com (22.01.2005)
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv4/ipt_hashlimit.h>
23 #define IPT_HASHLIMIT_BURST 5
26 #define IPT_HASHLIMIT_GCINTERVAL 1000
27 #define IPT_HASHLIMIT_EXPIRE 10000
29 /* Function which prints out usage message. */
34 "hashlimit v%s options:\n"
35 "--hashlimit <avg> max average match rate\n"
36 " [Packets per second unless followed by \n"
37 " /sec /minute /hour /day postfixes]\n"
38 "--hashlimit-mode <mode> mode is a comma-separated list of\n"
39 " dstip,srcip,dstport,srcport\n"
40 "--hashlimit-name <name> name for /proc/net/ipt_hashlimit/\n"
41 "[--hashlimit-burst <num>] number to match in a burst, default %u\n"
42 "[--hashlimit-htable-size <num>] number of hashtable buckets\n"
43 "[--hashlimit-htable-max <num>] number of hashtable entries\n"
44 "[--hashlimit-htable-gcinterval] interval between garbage collection runs\n"
45 "[--hashlimit-htable-expire] after which time are idle entries expired?\n"
46 "\n", IPTABLES_VERSION
, IPT_HASHLIMIT_BURST
);
49 static struct option opts
[] = {
50 { "hashlimit", 1, 0, '%' },
51 { "hashlimit-burst", 1, 0, '$' },
52 { "hashlimit-htable-size", 1, 0, '&' },
53 { "hashlimit-htable-max", 1, 0, '*' },
54 { "hashlimit-htable-gcinterval", 1, 0, '(' },
55 { "hashlimit-htable-expire", 1, 0, ')' },
56 { "hashlimit-mode", 1, 0, '_' },
57 { "hashlimit-name", 1, 0, '"' },
62 int parse_rate(const char *rate
, u_int32_t
*val
)
66 u_int32_t mult
= 1; /* Seconds by default. */
68 delim
= strchr(rate
, '/');
70 if (strlen(delim
+1) == 0)
73 if (strncasecmp(delim
+1, "second", strlen(delim
+1)) == 0)
75 else if (strncasecmp(delim
+1, "minute", strlen(delim
+1)) == 0)
77 else if (strncasecmp(delim
+1, "hour", strlen(delim
+1)) == 0)
79 else if (strncasecmp(delim
+1, "day", strlen(delim
+1)) == 0)
88 /* This would get mapped to infinite (1/day is minimum they
89 can specify, so we're ok at that end). */
90 if (r
/ mult
> IPT_HASHLIMIT_SCALE
)
91 exit_error(PARAMETER_PROBLEM
, "Rate too fast `%s'\n", rate
);
93 *val
= IPT_HASHLIMIT_SCALE
* mult
/ r
;
97 /* Initialize the match. */
99 init(struct ipt_entry_match
*m
, unsigned int *nfcache
)
101 struct ipt_hashlimit_info
*r
= (struct ipt_hashlimit_info
*)m
->data
;
103 r
->cfg
.burst
= IPT_HASHLIMIT_BURST
;
104 r
->cfg
.gc_interval
= IPT_HASHLIMIT_GCINTERVAL
;
105 r
->cfg
.expire
= IPT_HASHLIMIT_EXPIRE
;
110 /* Parse a 'mode' parameter into the required bitmask */
111 static int parse_mode(struct ipt_hashlimit_info
*r
, char *optarg
)
114 char *arg
= strdup(optarg
);
121 for (tok
= strtok(arg
, ",|");
123 tok
= strtok(NULL
, ",|")) {
124 if (!strcmp(tok
, "dstip"))
125 r
->cfg
.mode
|= IPT_HASHLIMIT_HASH_DIP
;
126 else if (!strcmp(tok
, "srcip"))
127 r
->cfg
.mode
|= IPT_HASHLIMIT_HASH_SIP
;
128 else if (!strcmp(tok
, "srcport"))
129 r
->cfg
.mode
|= IPT_HASHLIMIT_HASH_SPT
;
130 else if (!strcmp(tok
, "dstport"))
131 r
->cfg
.mode
|= IPT_HASHLIMIT_HASH_DPT
;
141 #define PARAM_LIMIT 0x00000001
142 #define PARAM_BURST 0x00000002
143 #define PARAM_MODE 0x00000004
144 #define PARAM_NAME 0x00000008
145 #define PARAM_SIZE 0x00000010
146 #define PARAM_MAX 0x00000020
147 #define PARAM_GCINTERVAL 0x00000040
148 #define PARAM_EXPIRE 0x00000080
150 /* Function which parses command options; returns true if it
153 parse(int c
, char **argv
, int invert
, unsigned int *flags
,
154 const struct ipt_entry
*entry
,
155 unsigned int *nfcache
,
156 struct ipt_entry_match
**match
)
158 struct ipt_hashlimit_info
*r
=
159 (struct ipt_hashlimit_info
*)(*match
)->data
;
164 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
165 if (!parse_rate(optarg
, &r
->cfg
.avg
))
166 exit_error(PARAMETER_PROBLEM
,
167 "bad rate `%s'", optarg
);
168 *flags
|= PARAM_LIMIT
;
172 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
173 if (string_to_number(optarg
, 0, 10000, &num
) == -1)
174 exit_error(PARAMETER_PROBLEM
,
175 "bad --hashlimit-burst `%s'", optarg
);
177 *flags
|= PARAM_BURST
;
180 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
181 if (string_to_number(optarg
, 0, 0xffffffff, &num
) == -1)
182 exit_error(PARAMETER_PROBLEM
,
183 "bad --hashlimit-htable-size: `%s'", optarg
);
185 *flags
|= PARAM_SIZE
;
188 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
189 if (string_to_number(optarg
, 0, 0xffffffff, &num
) == -1)
190 exit_error(PARAMETER_PROBLEM
,
191 "bad --hashlimit-htable-max: `%s'", optarg
);
196 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
197 if (string_to_number(optarg
, 0, 0xffffffff, &num
) == -1)
198 exit_error(PARAMETER_PROBLEM
,
199 "bad --hashlimit-htable-gcinterval: `%s'",
201 /* FIXME: not HZ dependent!! */
202 r
->cfg
.gc_interval
= num
;
203 *flags
|= PARAM_GCINTERVAL
;
206 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
207 if (string_to_number(optarg
, 0, 0xffffffff, &num
) == -1)
208 exit_error(PARAMETER_PROBLEM
,
209 "bad --hashlimit-htable-expire: `%s'", optarg
);
210 /* FIXME: not HZ dependent */
212 *flags
|= PARAM_EXPIRE
;
215 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
216 if (parse_mode(r
, optarg
) < 0)
217 exit_error(PARAMETER_PROBLEM
,
218 "bad --hashlimit-mode: `%s'\n", optarg
);
219 *flags
|= PARAM_MODE
;
222 if (check_inverse(argv
[optind
-1], &invert
, &optind
, 0)) break;
223 if (strlen(optarg
) == 0)
224 exit_error(PARAMETER_PROBLEM
, "Zero-length name?");
225 strncpy(r
->name
, optarg
, sizeof(r
->name
));
226 *flags
|= PARAM_NAME
;
233 exit_error(PARAMETER_PROBLEM
,
234 "hashlimit does not support invert");
239 /* Final check; nothing. */
240 static void final_check(unsigned int flags
)
242 if (!(flags
& PARAM_LIMIT
))
243 exit_error(PARAMETER_PROBLEM
,
244 "You have to specify --hashlimit");
245 if (!(flags
& PARAM_MODE
))
246 exit_error(PARAMETER_PROBLEM
,
247 "You have to specify --hashlimit-mode");
248 if (!(flags
& PARAM_NAME
))
249 exit_error(PARAMETER_PROBLEM
,
250 "You have to specify --hashlimit-name");
257 } rates
[] = { { "day", IPT_HASHLIMIT_SCALE
*24*60*60 },
258 { "hour", IPT_HASHLIMIT_SCALE
*60*60 },
259 { "min", IPT_HASHLIMIT_SCALE
*60 },
260 { "sec", IPT_HASHLIMIT_SCALE
} };
262 static void print_rate(u_int32_t period
)
266 for (i
= 1; i
< sizeof(rates
)/sizeof(struct rates
); i
++) {
267 if (period
> rates
[i
].mult
268 || rates
[i
].mult
/period
< rates
[i
].mult
%period
)
272 printf("%u/%s ", rates
[i
-1].mult
/ period
, rates
[i
-1].name
);
275 static void print_mode(const struct ipt_hashlimit_info
*r
, char separator
)
279 if (r
->cfg
.mode
& IPT_HASHLIMIT_HASH_SIP
) {
282 fputs("srcip", stdout
);
285 if (r
->cfg
.mode
& IPT_HASHLIMIT_HASH_SPT
) {
288 fputs("srcport", stdout
);
291 if (r
->cfg
.mode
& IPT_HASHLIMIT_HASH_DIP
) {
294 fputs("dstip", stdout
);
297 if (r
->cfg
.mode
& IPT_HASHLIMIT_HASH_DPT
) {
300 fputs("dstport", stdout
);
305 /* Prints out the matchinfo. */
307 print(const struct ipt_ip
*ip
,
308 const struct ipt_entry_match
*match
,
311 struct ipt_hashlimit_info
*r
=
312 (struct ipt_hashlimit_info
*)match
->data
;
313 fputs("limit: avg ", stdout
); print_rate(r
->cfg
.avg
);
314 printf("burst %u ", r
->cfg
.burst
);
315 fputs("mode ", stdout
);
318 printf("htable-size %u ", r
->cfg
.size
);
320 printf("htable-max %u ", r
->cfg
.max
);
321 if (r
->cfg
.gc_interval
!= IPT_HASHLIMIT_GCINTERVAL
)
322 printf("htable-gcinterval %u ", r
->cfg
.gc_interval
);
323 if (r
->cfg
.expire
!= IPT_HASHLIMIT_EXPIRE
)
324 printf("htable-expire %u ", r
->cfg
.expire
);
327 /* FIXME: Make minimalist: only print rate if not default --RR */
328 static void save(const struct ipt_ip
*ip
, const struct ipt_entry_match
*match
)
330 struct ipt_hashlimit_info
*r
=
331 (struct ipt_hashlimit_info
*)match
->data
;
333 fputs("--hashlimit ", stdout
); print_rate(r
->cfg
.avg
);
334 if (r
->cfg
.burst
!= IPT_HASHLIMIT_BURST
)
335 printf("--hashlimit-burst %u ", r
->cfg
.burst
);
337 fputs("--hashlimit-mode ", stdout
);
340 printf("--hashlimit-name %s ", r
->name
);
343 printf("--hashlimit-htable-size %u ", r
->cfg
.size
);
345 printf("--hashlimit-htable-max %u ", r
->cfg
.max
);
346 if (r
->cfg
.gc_interval
!= IPT_HASHLIMIT_GCINTERVAL
)
347 printf("--hashlimit-htable-gcinterval %u", r
->cfg
.gc_interval
);
348 if (r
->cfg
.expire
!= IPT_HASHLIMIT_EXPIRE
)
349 printf("--hashlimit-htable-expire %u ", r
->cfg
.expire
);
352 static struct iptables_match hashlimit
= { NULL
,
354 .version
= IPTABLES_VERSION
,
355 .size
= IPT_ALIGN(sizeof(struct ipt_hashlimit_info
)),
356 .userspacesize
= offsetof(struct ipt_hashlimit_info
, hinfo
),
360 .final_check
= &final_check
,
368 register_match(&hashlimit
);