1/* ip6tables match extension for limiting packets per destination
2 *
3 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
4 *
5 * Development of this code was funded by Astaro AG, http://www.astaro.com/
6 *
7 * Based on ipt_limit.c by
8 * J�r�me de Vivie   <devivie@info.enserb.u-bordeaux.fr>
9 * Herv� Eychenne    <rv@wallfire.org>
10 *
11 * Error corections by nmalykh@bilim.com (22.01.2005)
12 */
13
14#include <stdio.h>
15#include <string.h>
16#include <stdlib.h>
17#include <getopt.h>
18#include <ip6tables.h>
19#include <stddef.h>
20#include <linux/netfilter_ipv6/ip6_tables.h>
21#include <linux/netfilter/xt_hashlimit.h>
22
23#define XT_HASHLIMIT_BURST	5
24
25/* miliseconds */
26#define XT_HASHLIMIT_GCINTERVAL	1000
27#define XT_HASHLIMIT_EXPIRE	10000
28
29/* Function which prints out usage message. */
30static void
31help(void)
32{
33	printf(
34"hashlimit v%s options:\n"
35"--hashlimit <avg>		max average match rate\n"
36"                                [Packets per second unless followed by \n"
37"                                /sec /minute /hour /day postfixes]\n"
38"--hashlimit-mode <mode>		mode is a comma-separated list of\n"
39"					dstip,srcip,dstport,srcport\n"
40"--hashlimit-name <name>		name for /proc/net/ipt_hashlimit/\n"
41"[--hashlimit-burst <num>]	number to match in a burst, default %u\n"
42"[--hashlimit-htable-size <num>]	number of hashtable buckets\n"
43"[--hashlimit-htable-max <num>]	number of hashtable entries\n"
44"[--hashlimit-htable-gcinterval]	interval between garbage collection runs\n"
45"[--hashlimit-htable-expire]	after which time are idle entries expired?\n"
46"\n", IPTABLES_VERSION, XT_HASHLIMIT_BURST);
47}
48
49static struct option opts[] = {
50	{ "hashlimit", 1, 0, '%' },
51	{ "hashlimit-burst", 1, 0, '$' },
52	{ "hashlimit-htable-size", 1, 0, '&' },
53	{ "hashlimit-htable-max", 1, 0, '*' },
54	{ "hashlimit-htable-gcinterval", 1, 0, '(' },
55	{ "hashlimit-htable-expire", 1, 0, ')' },
56	{ "hashlimit-mode", 1, 0, '_' },
57	{ "hashlimit-name", 1, 0, '"' },
58	{ 0 }
59};
60
61static
62int parse_rate(const char *rate, u_int32_t *val)
63{
64	const char *delim;
65	u_int32_t r;
66	u_int32_t mult = 1;  /* Seconds by default. */
67
68	delim = strchr(rate, '/');
69	if (delim) {
70		if (strlen(delim+1) == 0)
71			return 0;
72
73		if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0)
74			mult = 1;
75		else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0)
76			mult = 60;
77		else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0)
78			mult = 60*60;
79		else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0)
80			mult = 24*60*60;
81		else
82			return 0;
83	}
84	r = atoi(rate);
85	if (!r)
86		return 0;
87
88	/* This would get mapped to infinite (1/day is minimum they
89           can specify, so we're ok at that end). */
90	if (r / mult > XT_HASHLIMIT_SCALE)
91		exit_error(PARAMETER_PROBLEM, "Rate too fast `%s'\n", rate);
92
93	*val = XT_HASHLIMIT_SCALE * mult / r;
94	return 1;
95}
96
97/* Initialize the match. */
98static void
99init(struct ip6t_entry_match *m, unsigned int *nfcache)
100{
101	struct xt_hashlimit_info *r = (struct xt_hashlimit_info *)m->data;
102
103	r->cfg.burst = XT_HASHLIMIT_BURST;
104	r->cfg.gc_interval = XT_HASHLIMIT_GCINTERVAL;
105	r->cfg.expire = XT_HASHLIMIT_EXPIRE;
106
107}
108
109
110/* Parse a 'mode' parameter into the required bitmask */
111static int parse_mode(struct xt_hashlimit_info *r, char *optarg)
112{
113	char *tok;
114	char *arg = strdup(optarg);
115
116	if (!arg)
117		return -1;
118
119	r->cfg.mode = 0;
120
121	for (tok = strtok(arg, ",|");
122	     tok;
123	     tok = strtok(NULL, ",|")) {
124		if (!strcmp(tok, "dstip"))
125			r->cfg.mode |= XT_HASHLIMIT_HASH_DIP;
126		else if (!strcmp(tok, "srcip"))
127			r->cfg.mode |= XT_HASHLIMIT_HASH_SIP;
128		else if (!strcmp(tok, "srcport"))
129			r->cfg.mode |= XT_HASHLIMIT_HASH_SPT;
130		else if (!strcmp(tok, "dstport"))
131			r->cfg.mode |= XT_HASHLIMIT_HASH_DPT;
132		else {
133			free(arg);
134			return -1;
135		}
136	}
137	free(arg);
138	return 0;
139}
140
141#define PARAM_LIMIT		0x00000001
142#define PARAM_BURST		0x00000002
143#define PARAM_MODE		0x00000004
144#define PARAM_NAME		0x00000008
145#define PARAM_SIZE		0x00000010
146#define PARAM_MAX		0x00000020
147#define PARAM_GCINTERVAL	0x00000040
148#define PARAM_EXPIRE		0x00000080
149
150/* Function which parses command options; returns true if it
151   ate an option */
152static int
153parse(int c, char **argv, int invert, unsigned int *flags,
154      const struct ip6t_entry *entry,
155      unsigned int *nfcache,
156      struct ip6t_entry_match **match)
157{
158	struct xt_hashlimit_info *r =
159			(struct xt_hashlimit_info *)(*match)->data;
160	unsigned int num;
161
162	switch(c) {
163	case '%':
164		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
165		if (!parse_rate(optarg, &r->cfg.avg))
166			exit_error(PARAMETER_PROBLEM,
167				   "bad rate `%s'", optarg);
168		*flags |= PARAM_LIMIT;
169		break;
170
171	case '$':
172		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
173		if (string_to_number(optarg, 0, 10000, &num) == -1)
174			exit_error(PARAMETER_PROBLEM,
175				   "bad --hashlimit-burst `%s'", optarg);
176		r->cfg.burst = num;
177		*flags |= PARAM_BURST;
178		break;
179	case '&':
180		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
181		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
182			exit_error(PARAMETER_PROBLEM,
183				"bad --hashlimit-htable-size: `%s'", optarg);
184		r->cfg.size = num;
185		*flags |= PARAM_SIZE;
186		break;
187	case '*':
188		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
189		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
190			exit_error(PARAMETER_PROBLEM,
191				"bad --hashlimit-htable-max: `%s'", optarg);
192		r->cfg.max = num;
193		*flags |= PARAM_MAX;
194		break;
195	case '(':
196		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
197		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
198			exit_error(PARAMETER_PROBLEM,
199				"bad --hashlimit-htable-gcinterval: `%s'",
200				optarg);
201		/* FIXME: not HZ dependent!! */
202		r->cfg.gc_interval = num;
203		*flags |= PARAM_GCINTERVAL;
204		break;
205	case ')':
206		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
207		if (string_to_number(optarg, 0, 0xffffffff, &num) == -1)
208			exit_error(PARAMETER_PROBLEM,
209				"bad --hashlimit-htable-expire: `%s'", optarg);
210		/* FIXME: not HZ dependent */
211		r->cfg.expire = num;
212		*flags |= PARAM_EXPIRE;
213		break;
214	case '_':
215		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
216		if (parse_mode(r, optarg) < 0)
217			exit_error(PARAMETER_PROBLEM,
218				   "bad --hashlimit-mode: `%s'\n", optarg);
219		*flags |= PARAM_MODE;
220		break;
221	case '"':
222		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
223		if (strlen(optarg) == 0)
224			exit_error(PARAMETER_PROBLEM, "Zero-length name?");
225		strncpy(r->name, optarg, sizeof(r->name));
226		*flags |= PARAM_NAME;
227		break;
228	default:
229		return 0;
230	}
231
232	if (invert)
233		exit_error(PARAMETER_PROBLEM,
234			   "hashlimit does not support invert");
235
236	return 1;
237}
238
239/* Final check; nothing. */
240static void final_check(unsigned int flags)
241{
242	if (!(flags & PARAM_LIMIT))
243		exit_error(PARAMETER_PROBLEM,
244				"You have to specify --hashlimit");
245	if (!(flags & PARAM_MODE))
246		exit_error(PARAMETER_PROBLEM,
247				"You have to specify --hashlimit-mode");
248	if (!(flags & PARAM_NAME))
249		exit_error(PARAMETER_PROBLEM,
250				"You have to specify --hashlimit-name");
251}
252
253static struct rates
254{
255	const char *name;
256	u_int32_t mult;
257} rates[] = { { "day", XT_HASHLIMIT_SCALE*24*60*60 },
258	      { "hour", XT_HASHLIMIT_SCALE*60*60 },
259	      { "min", XT_HASHLIMIT_SCALE*60 },
260	      { "sec", XT_HASHLIMIT_SCALE } };
261
262static void print_rate(u_int32_t period)
263{
264	unsigned int i;
265
266	for (i = 1; i < sizeof(rates)/sizeof(struct rates); i++) {
267		if (period > rates[i].mult
268            || rates[i].mult/period < rates[i].mult%period)
269			break;
270	}
271
272	printf("%u/%s ", rates[i-1].mult / period, rates[i-1].name);
273}
274
275static void print_mode(const struct xt_hashlimit_info *r, char separator)
276{
277	int prevmode = 0;
278
279	if (r->cfg.mode & XT_HASHLIMIT_HASH_SIP) {
280		if (prevmode)
281			putchar(separator);
282		fputs("srcip", stdout);
283		prevmode = 1;
284	}
285	if (r->cfg.mode & XT_HASHLIMIT_HASH_SPT) {
286		if (prevmode)
287			putchar(separator);
288		fputs("srcport", stdout);
289		prevmode = 1;
290	}
291	if (r->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
292		if (prevmode)
293			putchar(separator);
294		fputs("dstip", stdout);
295		prevmode = 1;
296	}
297	if (r->cfg.mode & XT_HASHLIMIT_HASH_DPT) {
298		if (prevmode)
299			putchar(separator);
300		fputs("dstport", stdout);
301	}
302	putchar(' ');
303}
304
305/* Prints out the matchinfo. */
306static void
307print(const struct ip6t_ip6 *ip,
308      const struct ip6t_entry_match *match,
309      int numeric)
310{
311	struct xt_hashlimit_info *r =
312		(struct xt_hashlimit_info *)match->data;
313	fputs("limit: avg ", stdout); print_rate(r->cfg.avg);
314	printf("burst %u ", r->cfg.burst);
315	fputs("mode ", stdout);
316	print_mode(r, '-');
317	if (r->cfg.size)
318		printf("htable-size %u ", r->cfg.size);
319	if (r->cfg.max)
320		printf("htable-max %u ", r->cfg.max);
321	if (r->cfg.gc_interval != XT_HASHLIMIT_GCINTERVAL)
322		printf("htable-gcinterval %u ", r->cfg.gc_interval);
323	if (r->cfg.expire != XT_HASHLIMIT_EXPIRE)
324		printf("htable-expire %u ", r->cfg.expire);
325}
326
327/* FIXME: Make minimalist: only print rate if not default --RR */
328static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
329{
330	struct xt_hashlimit_info *r =
331		(struct xt_hashlimit_info *)match->data;
332
333	fputs("--hashlimit ", stdout); print_rate(r->cfg.avg);
334	if (r->cfg.burst != XT_HASHLIMIT_BURST)
335		printf("--hashlimit-burst %u ", r->cfg.burst);
336
337	fputs("--hashlimit-mode ", stdout);
338	print_mode(r, ',');
339
340	printf("--hashlimit-name %s ", r->name);
341
342	if (r->cfg.size)
343		printf("--hashlimit-htable-size %u ", r->cfg.size);
344	if (r->cfg.max)
345		printf("--hashlimit-htable-max %u ", r->cfg.max);
346	if (r->cfg.gc_interval != XT_HASHLIMIT_GCINTERVAL)
347		printf("--hashlimit-htable-gcinterval %u", r->cfg.gc_interval);
348	if (r->cfg.expire != XT_HASHLIMIT_EXPIRE)
349		printf("--hashlimit-htable-expire %u ", r->cfg.expire);
350}
351
352static struct ip6tables_match hashlimit = { NULL,
353	.name		= "hashlimit",
354	.version	= IPTABLES_VERSION,
355	.size		= IP6T_ALIGN(sizeof(struct xt_hashlimit_info)),
356	.userspacesize	= offsetof(struct xt_hashlimit_info, hinfo),
357	.help		= &help,
358	.init		= &init,
359	.parse		= &parse,
360	.final_check	= &final_check,
361	.print		= &print,
362	.save		= &save,
363	.extra_opts	= opts
364};
365
366void _init(void)
367{
368	register_match6(&hashlimit);
369}
370