1/*
2 * Copyright (c) 2006 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * This is a replacement of the old ipt_recent module, which carried the
9 * following copyright notice:
10 *
11 * Author: Stephen Frost <sfrost@snowman.net>
12 * Copyright 2002-2003, Stephen Frost, 2.5.x port by laforge@netfilter.org
13 */
14#include <linux/init.h>
15#include <linux/ip.h>
16#include <linux/moduleparam.h>
17#include <linux/proc_fs.h>
18#include <linux/seq_file.h>
19#include <linux/string.h>
20#include <linux/ctype.h>
21#include <linux/list.h>
22#include <linux/random.h>
23#include <linux/jhash.h>
24#include <linux/bitops.h>
25#include <linux/skbuff.h>
26#include <linux/inet.h>
27
28#include <linux/netfilter/x_tables.h>
29#include <linux/netfilter_ipv4/ipt_recent.h>
30
31MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
32MODULE_DESCRIPTION("IP tables recently seen matching module");
33MODULE_LICENSE("GPL");
34
35static unsigned int ip_list_tot = 100;
36static unsigned int ip_pkt_list_tot = 20;
37static unsigned int ip_list_hash_size = 0;
38static unsigned int ip_list_perms = 0644;
39static unsigned int ip_list_uid = 0;
40static unsigned int ip_list_gid = 0;
41module_param(ip_list_tot, uint, 0400);
42module_param(ip_pkt_list_tot, uint, 0400);
43module_param(ip_list_hash_size, uint, 0400);
44module_param(ip_list_perms, uint, 0400);
45module_param(ip_list_uid, uint, 0400);
46module_param(ip_list_gid, uint, 0400);
47MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
48MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP to remember (max. 255)");
49MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
50MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/ipt_recent/* files");
51MODULE_PARM_DESC(ip_list_uid,"owner of /proc/net/ipt_recent/* files");
52MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/ipt_recent/* files");
53
54struct recent_entry {
55	struct list_head	list;
56	struct list_head	lru_list;
57	__be32			addr;
58	u_int8_t		ttl;
59	u_int8_t		index;
60	u_int16_t		nstamps;
61	unsigned long		stamps[0];
62};
63
64struct recent_table {
65	struct list_head	list;
66	char			name[IPT_RECENT_NAME_LEN];
67#ifdef CONFIG_PROC_FS
68	struct proc_dir_entry	*proc;
69#endif
70	unsigned int		refcnt;
71	unsigned int		entries;
72	struct list_head	lru_list;
73	struct list_head	iphash[0];
74};
75
76static LIST_HEAD(tables);
77static DEFINE_SPINLOCK(recent_lock);
78static DEFINE_MUTEX(recent_mutex);
79
80#ifdef CONFIG_PROC_FS
81static struct proc_dir_entry	*proc_dir;
82static const struct file_operations	recent_fops;
83#endif
84
85static u_int32_t hash_rnd;
86static int hash_rnd_initted;
87
88static unsigned int recent_entry_hash(__be32 addr)
89{
90	if (!hash_rnd_initted) {
91		get_random_bytes(&hash_rnd, 4);
92		hash_rnd_initted = 1;
93	}
94	return jhash_1word((__force u32)addr, hash_rnd) & (ip_list_hash_size - 1);
95}
96
97static struct recent_entry *
98recent_entry_lookup(const struct recent_table *table, __be32 addr, u_int8_t ttl)
99{
100	struct recent_entry *e;
101	unsigned int h;
102
103	h = recent_entry_hash(addr);
104	list_for_each_entry(e, &table->iphash[h], list)
105		if (e->addr == addr && (ttl == e->ttl || !ttl || !e->ttl))
106			return e;
107	return NULL;
108}
109
110static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
111{
112	list_del(&e->list);
113	list_del(&e->lru_list);
114	kfree(e);
115	t->entries--;
116}
117
118static struct recent_entry *
119recent_entry_init(struct recent_table *t, __be32 addr, u_int8_t ttl)
120{
121	struct recent_entry *e;
122
123	if (t->entries >= ip_list_tot) {
124		e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
125		recent_entry_remove(t, e);
126	}
127	e = kmalloc(sizeof(*e) + sizeof(e->stamps[0]) * ip_pkt_list_tot,
128		    GFP_ATOMIC);
129	if (e == NULL)
130		return NULL;
131	e->addr      = addr;
132	e->ttl       = ttl;
133	e->stamps[0] = jiffies;
134	e->nstamps   = 1;
135	e->index     = 1;
136	list_add_tail(&e->list, &t->iphash[recent_entry_hash(addr)]);
137	list_add_tail(&e->lru_list, &t->lru_list);
138	t->entries++;
139	return e;
140}
141
142static void recent_entry_update(struct recent_table *t, struct recent_entry *e)
143{
144	e->stamps[e->index++] = jiffies;
145	if (e->index > e->nstamps)
146		e->nstamps = e->index;
147	e->index %= ip_pkt_list_tot;
148	list_move_tail(&e->lru_list, &t->lru_list);
149}
150
151static struct recent_table *recent_table_lookup(const char *name)
152{
153	struct recent_table *t;
154
155	list_for_each_entry(t, &tables, list)
156		if (!strcmp(t->name, name))
157			return t;
158	return NULL;
159}
160
161static void recent_table_flush(struct recent_table *t)
162{
163	struct recent_entry *e, *next;
164	unsigned int i;
165
166	for (i = 0; i < ip_list_hash_size; i++) {
167		list_for_each_entry_safe(e, next, &t->iphash[i], list)
168			recent_entry_remove(t, e);
169	}
170}
171
172static int
173ipt_recent_match(const struct sk_buff *skb,
174		 const struct net_device *in, const struct net_device *out,
175		 const struct xt_match *match, const void *matchinfo,
176		 int offset, unsigned int protoff, int *hotdrop)
177{
178	const struct ipt_recent_info *info = matchinfo;
179	struct recent_table *t;
180	struct recent_entry *e;
181	__be32 addr;
182	u_int8_t ttl;
183	int ret = info->invert;
184
185	if (info->side == IPT_RECENT_DEST)
186		addr = ip_hdr(skb)->daddr;
187	else
188		addr = ip_hdr(skb)->saddr;
189
190	ttl = ip_hdr(skb)->ttl;
191	/* use TTL as seen before forwarding */
192	if (out && !skb->sk)
193		ttl++;
194
195	spin_lock_bh(&recent_lock);
196	t = recent_table_lookup(info->name);
197	e = recent_entry_lookup(t, addr,
198				info->check_set & IPT_RECENT_TTL ? ttl : 0);
199	if (e == NULL) {
200		if (!(info->check_set & IPT_RECENT_SET))
201			goto out;
202		e = recent_entry_init(t, addr, ttl);
203		if (e == NULL)
204			*hotdrop = 1;
205		ret ^= 1;
206		goto out;
207	}
208
209	if (info->check_set & IPT_RECENT_SET)
210		ret ^= 1;
211	else if (info->check_set & IPT_RECENT_REMOVE) {
212		recent_entry_remove(t, e);
213		ret ^= 1;
214	} else if (info->check_set & (IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) {
215		unsigned long t = jiffies - info->seconds * HZ;
216		unsigned int i, hits = 0;
217
218		for (i = 0; i < e->nstamps; i++) {
219			if (info->seconds && time_after(t, e->stamps[i]))
220				continue;
221			if (++hits >= info->hit_count) {
222				ret ^= 1;
223				break;
224			}
225		}
226	}
227
228	if (info->check_set & IPT_RECENT_SET ||
229	    (info->check_set & IPT_RECENT_UPDATE && ret)) {
230		recent_entry_update(t, e);
231		e->ttl = ttl;
232	}
233out:
234	spin_unlock_bh(&recent_lock);
235	return ret;
236}
237
238static int
239ipt_recent_checkentry(const char *tablename, const void *ip,
240		      const struct xt_match *match, void *matchinfo,
241		      unsigned int hook_mask)
242{
243	const struct ipt_recent_info *info = matchinfo;
244	struct recent_table *t;
245	unsigned i;
246	int ret = 0;
247
248	if (hweight8(info->check_set &
249		     (IPT_RECENT_SET | IPT_RECENT_REMOVE |
250		      IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) != 1)
251		return 0;
252	if ((info->check_set & (IPT_RECENT_SET | IPT_RECENT_REMOVE)) &&
253	    (info->seconds || info->hit_count))
254		return 0;
255	if (info->name[0] == '\0' ||
256	    strnlen(info->name, IPT_RECENT_NAME_LEN) == IPT_RECENT_NAME_LEN)
257		return 0;
258
259	mutex_lock(&recent_mutex);
260	t = recent_table_lookup(info->name);
261	if (t != NULL) {
262		t->refcnt++;
263		ret = 1;
264		goto out;
265	}
266
267	t = kzalloc(sizeof(*t) + sizeof(t->iphash[0]) * ip_list_hash_size,
268		    GFP_KERNEL);
269	if (t == NULL)
270		goto out;
271	t->refcnt = 1;
272	strcpy(t->name, info->name);
273	INIT_LIST_HEAD(&t->lru_list);
274	for (i = 0; i < ip_list_hash_size; i++)
275		INIT_LIST_HEAD(&t->iphash[i]);
276#ifdef CONFIG_PROC_FS
277	t->proc = create_proc_entry(t->name, ip_list_perms, proc_dir);
278	if (t->proc == NULL) {
279		kfree(t);
280		goto out;
281	}
282	t->proc->proc_fops = &recent_fops;
283	t->proc->uid       = ip_list_uid;
284	t->proc->gid       = ip_list_gid;
285	t->proc->data      = t;
286#endif
287	spin_lock_bh(&recent_lock);
288	list_add_tail(&t->list, &tables);
289	spin_unlock_bh(&recent_lock);
290	ret = 1;
291out:
292	mutex_unlock(&recent_mutex);
293	return ret;
294}
295
296static void
297ipt_recent_destroy(const struct xt_match *match, void *matchinfo)
298{
299	const struct ipt_recent_info *info = matchinfo;
300	struct recent_table *t;
301
302	mutex_lock(&recent_mutex);
303	t = recent_table_lookup(info->name);
304	if (--t->refcnt == 0) {
305		spin_lock_bh(&recent_lock);
306		list_del(&t->list);
307		spin_unlock_bh(&recent_lock);
308		recent_table_flush(t);
309#ifdef CONFIG_PROC_FS
310		remove_proc_entry(t->name, proc_dir);
311#endif
312		kfree(t);
313	}
314	mutex_unlock(&recent_mutex);
315}
316
317#ifdef CONFIG_PROC_FS
318struct recent_iter_state {
319	struct recent_table	*table;
320	unsigned int		bucket;
321};
322
323static void *recent_seq_start(struct seq_file *seq, loff_t *pos)
324{
325	struct recent_iter_state *st = seq->private;
326	struct recent_table *t = st->table;
327	struct recent_entry *e;
328	loff_t p = *pos;
329
330	spin_lock_bh(&recent_lock);
331
332	for (st->bucket = 0; st->bucket < ip_list_hash_size; st->bucket++) {
333		list_for_each_entry(e, &t->iphash[st->bucket], list) {
334			if (p-- == 0)
335				return e;
336		}
337	}
338	return NULL;
339}
340
341static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
342{
343	struct recent_iter_state *st = seq->private;
344	struct recent_table *t = st->table;
345	struct recent_entry *e = v;
346	struct list_head *head = e->list.next;
347
348	while (head == &t->iphash[st->bucket]) {
349		if (++st->bucket >= ip_list_hash_size)
350			return NULL;
351		head = t->iphash[st->bucket].next;
352	}
353	(*pos)++;
354	return list_entry(head, struct recent_entry, list);
355}
356
357static void recent_seq_stop(struct seq_file *s, void *v)
358{
359	spin_unlock_bh(&recent_lock);
360}
361
362static int recent_seq_show(struct seq_file *seq, void *v)
363{
364	struct recent_entry *e = v;
365	unsigned int i;
366
367	i = (e->index - 1) % ip_pkt_list_tot;
368	seq_printf(seq, "src=%u.%u.%u.%u ttl: %u last_seen: %lu oldest_pkt: %u",
369		   NIPQUAD(e->addr), e->ttl, e->stamps[i], e->index);
370	for (i = 0; i < e->nstamps; i++)
371		seq_printf(seq, "%s %lu", i ? "," : "", e->stamps[i]);
372	seq_printf(seq, "\n");
373	return 0;
374}
375
376static struct seq_operations recent_seq_ops = {
377	.start		= recent_seq_start,
378	.next		= recent_seq_next,
379	.stop		= recent_seq_stop,
380	.show		= recent_seq_show,
381};
382
383static int recent_seq_open(struct inode *inode, struct file *file)
384{
385	struct proc_dir_entry *pde = PDE(inode);
386	struct seq_file *seq;
387	struct recent_iter_state *st;
388	int ret;
389
390	st = kzalloc(sizeof(*st), GFP_KERNEL);
391	if (st == NULL)
392		return -ENOMEM;
393	ret = seq_open(file, &recent_seq_ops);
394	if (ret)
395		kfree(st);
396	st->table    = pde->data;
397	seq          = file->private_data;
398	seq->private = st;
399	return ret;
400}
401
402static ssize_t recent_proc_write(struct file *file, const char __user *input,
403				 size_t size, loff_t *loff)
404{
405	struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
406	struct recent_table *t = pde->data;
407	struct recent_entry *e;
408	char buf[sizeof("+255.255.255.255")], *c = buf;
409	__be32 addr;
410	int add;
411
412	if (size > sizeof(buf))
413		size = sizeof(buf);
414	if (copy_from_user(buf, input, size))
415		return -EFAULT;
416	while (isspace(*c))
417		c++;
418
419	if (size - (c - buf) < 5)
420		return c - buf;
421	if (!strncmp(c, "clear", 5)) {
422		c += 5;
423		spin_lock_bh(&recent_lock);
424		recent_table_flush(t);
425		spin_unlock_bh(&recent_lock);
426		return c - buf;
427	}
428
429	switch (*c) {
430	case '-':
431		add = 0;
432		c++;
433		break;
434	case '+':
435		c++;
436	default:
437		add = 1;
438		break;
439	}
440	addr = in_aton(c);
441
442	spin_lock_bh(&recent_lock);
443	e = recent_entry_lookup(t, addr, 0);
444	if (e == NULL) {
445		if (add)
446			recent_entry_init(t, addr, 0);
447	} else {
448		if (add)
449			recent_entry_update(t, e);
450		else
451			recent_entry_remove(t, e);
452	}
453	spin_unlock_bh(&recent_lock);
454	return size;
455}
456
457static const struct file_operations recent_fops = {
458	.open		= recent_seq_open,
459	.read		= seq_read,
460	.write		= recent_proc_write,
461	.release	= seq_release_private,
462	.owner		= THIS_MODULE,
463};
464#endif /* CONFIG_PROC_FS */
465
466static struct xt_match recent_match = {
467	.name		= "recent",
468	.family		= AF_INET,
469	.match		= ipt_recent_match,
470	.matchsize	= sizeof(struct ipt_recent_info),
471	.checkentry	= ipt_recent_checkentry,
472	.destroy	= ipt_recent_destroy,
473	.me		= THIS_MODULE,
474};
475
476static int __init ipt_recent_init(void)
477{
478	int err;
479
480	if (!ip_list_tot || !ip_pkt_list_tot || ip_pkt_list_tot > 255)
481		return -EINVAL;
482	ip_list_hash_size = 1 << fls(ip_list_tot);
483
484	err = xt_register_match(&recent_match);
485#ifdef CONFIG_PROC_FS
486	if (err)
487		return err;
488	proc_dir = proc_mkdir("ipt_recent", proc_net);
489	if (proc_dir == NULL) {
490		xt_unregister_match(&recent_match);
491		err = -ENOMEM;
492	}
493#endif
494	return err;
495}
496
497static void __exit ipt_recent_exit(void)
498{
499	BUG_ON(!list_empty(&tables));
500	xt_unregister_match(&recent_match);
501#ifdef CONFIG_PROC_FS
502	remove_proc_entry("ipt_recent", proc_net);
503#endif
504}
505
506module_init(ipt_recent_init);
507module_exit(ipt_recent_exit);
508