1/* 2 * xt_time 3 * Copyright �� CC Computer Consultants GmbH, 2007 4 * 5 * based on ipt_time by Fabrice MARIE <fabrice@netfilter.org> 6 * This is a module which is used for time matching 7 * It is using some modified code from dietlibc (localtime() function) 8 * that you can find at http://www.fefe.de/dietlibc/ 9 * This file is distributed under the terms of the GNU General Public 10 * License (GPL). Copies of the GPL can be obtained from gnu.org/gpl. 11 */ 12#include <linux/ktime.h> 13#include <linux/module.h> 14#include <linux/skbuff.h> 15#include <linux/types.h> 16#include <linux/netfilter/x_tables.h> 17#include <linux/netfilter/xt_time.h> 18 19struct xtm { 20 u_int8_t month; /* (1-12) */ 21 u_int8_t monthday; /* (1-31) */ 22 u_int8_t weekday; /* (1-7) */ 23 u_int8_t hour; /* (0-23) */ 24 u_int8_t minute; /* (0-59) */ 25 u_int8_t second; /* (0-59) */ 26 unsigned int dse; 27}; 28 29extern struct timezone sys_tz; /* ouch */ 30 31static const u_int16_t days_since_year[] = { 32 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334, 33}; 34 35static const u_int16_t days_since_leapyear[] = { 36 0, 31, 60, 91, 121, 152, 182, 213, 244, 274, 305, 335, 37}; 38 39/* 40 * Since time progresses forward, it is best to organize this array in reverse, 41 * to minimize lookup time. 42 */ 43enum { 44 DSE_FIRST = 2039, 45}; 46static const u_int16_t days_since_epoch[] = { 47 /* 2039 - 2030 */ 48 25202, 24837, 24472, 24106, 23741, 23376, 23011, 22645, 22280, 21915, 49 /* 2029 - 2020 */ 50 21550, 21184, 20819, 20454, 20089, 19723, 19358, 18993, 18628, 18262, 51 /* 2019 - 2010 */ 52 17897, 17532, 17167, 16801, 16436, 16071, 15706, 15340, 14975, 14610, 53 /* 2009 - 2000 */ 54 14245, 13879, 13514, 13149, 12784, 12418, 12053, 11688, 11323, 10957, 55 /* 1999 - 1990 */ 56 10592, 10227, 9862, 9496, 9131, 8766, 8401, 8035, 7670, 7305, 57 /* 1989 - 1980 */ 58 6940, 6574, 6209, 5844, 5479, 5113, 4748, 4383, 4018, 3652, 59 /* 1979 - 1970 */ 60 3287, 2922, 2557, 2191, 1826, 1461, 1096, 730, 365, 0, 61}; 62 63static inline bool is_leap(unsigned int y) 64{ 65 return y % 4 == 0 && (y % 100 != 0 || y % 400 == 0); 66} 67 68/* 69 * Each network packet has a (nano)seconds-since-the-epoch (SSTE) timestamp. 70 * Since we match against days and daytime, the SSTE value needs to be 71 * computed back into human-readable dates. 72 * 73 * This is done in three separate functions so that the most expensive 74 * calculations are done last, in case a "simple match" can be found earlier. 75 */ 76static inline unsigned int localtime_1(struct xtm *r, time_t time) 77{ 78 unsigned int v, w; 79 80 /* Each day has 86400s, so finding the hour/minute is actually easy. */ 81 v = time % 86400; 82 r->second = v % 60; 83 w = v / 60; 84 r->minute = w % 60; 85 r->hour = w / 60; 86 return v; 87} 88 89static inline void localtime_2(struct xtm *r, time_t time) 90{ 91 /* 92 * Here comes the rest (weekday, monthday). First, divide the SSTE 93 * by seconds-per-day to get the number of _days_ since the epoch. 94 */ 95 r->dse = time / 86400; 96 97 /* 98 * 1970-01-01 (w=0) was a Thursday (4). 99 * -1 and +1 map Sunday properly onto 7. 100 */ 101 r->weekday = (4 + r->dse - 1) % 7 + 1; 102} 103 104static void localtime_3(struct xtm *r, time_t time) 105{ 106 unsigned int year, i, w = r->dse; 107 108 /* 109 * In each year, a certain number of days-since-the-epoch have passed. 110 * Find the year that is closest to said days. 111 * 112 * Consider, for example, w=21612 (2029-03-04). Loop will abort on 113 * dse[i] <= w, which happens when dse[i] == 21550. This implies 114 * year == 2009. w will then be 62. 115 */ 116 for (i = 0, year = DSE_FIRST; days_since_epoch[i] > w; 117 ++i, --year) 118 /* just loop */; 119 120 w -= days_since_epoch[i]; 121 122 /* 123 * By now we have the current year, and the day of the year. 124 * r->yearday = w; 125 * 126 * On to finding the month (like above). In each month, a certain 127 * number of days-since-New Year have passed, and find the closest 128 * one. 129 * 130 * Consider w=62 (in a non-leap year). Loop will abort on 131 * dsy[i] < w, which happens when dsy[i] == 31+28 (i == 2). 132 * Concludes i == 2, i.e. 3rd month => March. 133 * 134 * (A different approach to use would be to subtract a monthlength 135 * from w repeatedly while counting.) 136 */ 137 if (is_leap(year)) { 138 /* use days_since_leapyear[] in a leap year */ 139 for (i = ARRAY_SIZE(days_since_leapyear) - 1; 140 i > 0 && days_since_leapyear[i] > w; --i) 141 /* just loop */; 142 r->monthday = w - days_since_leapyear[i] + 1; 143 } else { 144 for (i = ARRAY_SIZE(days_since_year) - 1; 145 i > 0 && days_since_year[i] > w; --i) 146 /* just loop */; 147 r->monthday = w - days_since_year[i] + 1; 148 } 149 150 r->month = i + 1; 151} 152 153static bool 154time_mt(const struct sk_buff *skb, struct xt_action_param *par) 155{ 156 const struct xt_time_info *info = par->matchinfo; 157 unsigned int packet_time; 158 struct xtm current_time; 159 s64 stamp; 160 161 /* 162 * We cannot use get_seconds() instead of __net_timestamp() here. 163 * Suppose you have two rules: 164 * 1. match before 13:00 165 * 2. match after 13:00 166 * If you match against processing time (get_seconds) it 167 * may happen that the same packet matches both rules if 168 * it arrived at the right moment before 13:00. 169 */ 170 if (skb->tstamp.tv64 == 0) 171 __net_timestamp((struct sk_buff *)skb); 172 173 stamp = ktime_to_ns(skb->tstamp); 174 stamp = div_s64(stamp, NSEC_PER_SEC); 175 176 if (info->flags & XT_TIME_LOCAL_TZ) 177 /* Adjust for local timezone */ 178 stamp -= 60 * sys_tz.tz_minuteswest; 179 180 /* 181 * xt_time will match when _all_ of the following hold: 182 * - 'now' is in the global time range date_start..date_end 183 * - 'now' is in the monthday mask 184 * - 'now' is in the weekday mask 185 * - 'now' is in the daytime range time_start..time_end 186 * (and by default, libxt_time will set these so as to match) 187 */ 188 189 if (stamp < info->date_start || stamp > info->date_stop) 190 return false; 191 192#ifdef CONFIG_BCM947XX 193 /* Do not spend time computing monthday if all days match anyway */ 194 if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS) { 195 localtime_3(¤t_time, stamp); 196 if (!(info->monthdays_match & (1 << current_time.monthday))) 197 return false; 198 } 199 200 localtime_2(¤t_time, stamp); 201 if (!(info->weekdays_match & (1 << current_time.weekday))) 202 return false; 203 204 packet_time = localtime_1(¤t_time, stamp); 205 if (info->daytime_start < info->daytime_stop) { 206 if (packet_time < info->daytime_start || 207 packet_time > info->daytime_stop) 208 return false; 209 } else { 210 if (packet_time < info->daytime_start && 211 packet_time > info->daytime_stop) 212 return false; 213 } 214#else 215 packet_time = localtime_1(¤t_time, stamp); 216 217 if (info->daytime_start < info->daytime_stop) { 218 if (packet_time < info->daytime_start || 219 packet_time > info->daytime_stop) 220 return false; 221 } else { 222 if (packet_time < info->daytime_start && 223 packet_time > info->daytime_stop) 224 return false; 225 } 226 227 localtime_2(¤t_time, stamp); 228 229 if (!(info->weekdays_match & (1 << current_time.weekday))) 230 return false; 231 232 /* Do not spend time computing monthday if all days match anyway */ 233 if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS) { 234 localtime_3(¤t_time, stamp); 235 if (!(info->monthdays_match & (1 << current_time.monthday))) 236 return false; 237 } 238#endif /* CONFIG_BCM947XX */ 239 240 return true; 241} 242 243static int time_mt_check(const struct xt_mtchk_param *par) 244{ 245 const struct xt_time_info *info = par->matchinfo; 246 247 if (info->daytime_start > XT_TIME_MAX_DAYTIME || 248 info->daytime_stop > XT_TIME_MAX_DAYTIME) { 249 pr_info("invalid argument - start or " 250 "stop time greater than 23:59:59\n"); 251 return -EDOM; 252 } 253 254 return 0; 255} 256 257static struct xt_match xt_time_mt_reg __read_mostly = { 258 .name = "time", 259 .family = NFPROTO_UNSPEC, 260 .match = time_mt, 261 .checkentry = time_mt_check, 262 .matchsize = sizeof(struct xt_time_info), 263 .me = THIS_MODULE, 264}; 265 266static int __init time_mt_init(void) 267{ 268 int minutes = sys_tz.tz_minuteswest; 269 270 if (minutes < 0) /* east of Greenwich */ 271 printk(KERN_INFO KBUILD_MODNAME 272 ": kernel timezone is +%02d%02d\n", 273 -minutes / 60, -minutes % 60); 274 else /* west of Greenwich */ 275 printk(KERN_INFO KBUILD_MODNAME 276 ": kernel timezone is -%02d%02d\n", 277 minutes / 60, minutes % 60); 278 279 return xt_register_match(&xt_time_mt_reg); 280} 281 282static void __exit time_mt_exit(void) 283{ 284 xt_unregister_match(&xt_time_mt_reg); 285} 286 287module_init(time_mt_init); 288module_exit(time_mt_exit); 289MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); 290MODULE_DESCRIPTION("Xtables: time-based matching"); 291MODULE_LICENSE("GPL"); 292MODULE_ALIAS("ipt_time"); 293MODULE_ALIAS("ip6t_time"); 294