1 #include <stdio.h>
2 #include <netdb.h>
3 #include <string.h>
4 #include <xtables.h>
5 #include <arpa/inet.h>
6
7 #include <linux/netfilter/xt_connlimit.h>
8
9 enum {
10 O_UPTO = 0,
11 O_ABOVE,
12 O_MASK,
13 O_SADDR,
14 O_DADDR,
15 F_UPTO = 1 << O_UPTO,
16 F_ABOVE = 1 << O_ABOVE,
17 F_MASK = 1 << O_MASK,
18 F_SADDR = 1 << O_SADDR,
19 F_DADDR = 1 << O_DADDR,
20 };
21
connlimit_help(void)22 static void connlimit_help(void)
23 {
24 printf(
25 "connlimit match options:\n"
26 " --connlimit-upto n match if the number of existing connections is 0..n\n"
27 " --connlimit-above n match if the number of existing connections is >n\n"
28 " --connlimit-mask n group hosts using prefix length (default: max len)\n"
29 " --connlimit-saddr select source address for grouping\n"
30 " --connlimit-daddr select destination addresses for grouping\n");
31 }
32
33 #define s struct xt_connlimit_info
34 static const struct xt_option_entry connlimit_opts[] = {
35 {.name = "connlimit-upto", .id = O_UPTO, .excl = F_ABOVE,
36 .type = XTTYPE_UINT32, .flags = XTOPT_INVERT | XTOPT_PUT,
37 XTOPT_POINTER(s, limit)},
38 {.name = "connlimit-above", .id = O_ABOVE, .excl = F_UPTO,
39 .type = XTTYPE_UINT32, .flags = XTOPT_INVERT | XTOPT_PUT,
40 XTOPT_POINTER(s, limit)},
41 {.name = "connlimit-mask", .id = O_MASK, .type = XTTYPE_PLENMASK,
42 .flags = XTOPT_PUT, XTOPT_POINTER(s, mask)},
43 {.name = "connlimit-saddr", .id = O_SADDR, .excl = F_DADDR,
44 .type = XTTYPE_NONE},
45 {.name = "connlimit-daddr", .id = O_DADDR, .excl = F_SADDR,
46 .type = XTTYPE_NONE},
47 XTOPT_TABLEEND,
48 };
49 #undef s
50
connlimit_init(struct xt_entry_match * match)51 static void connlimit_init(struct xt_entry_match *match)
52 {
53 struct xt_connlimit_info *info = (void *)match->data;
54
55 /* This will also initialize the v4 mask correctly */
56 memset(info->v6_mask, 0xFF, sizeof(info->v6_mask));
57 }
58
connlimit_parse(struct xt_option_call * cb,uint8_t family)59 static void connlimit_parse(struct xt_option_call *cb, uint8_t family)
60 {
61 struct xt_connlimit_info *info = cb->data;
62 const unsigned int revision = (*cb->match)->u.user.revision;
63
64 xtables_option_parse(cb);
65 switch (cb->entry->id) {
66 case O_ABOVE:
67 if (cb->invert)
68 info->flags |= XT_CONNLIMIT_INVERT;
69 break;
70 case O_UPTO:
71 if (!cb->invert)
72 info->flags |= XT_CONNLIMIT_INVERT;
73 break;
74 case O_SADDR:
75 if (revision < 1)
76 xtables_error(PARAMETER_PROBLEM,
77 "xt_connlimit.0 does not support "
78 "--connlimit-daddr");
79 info->flags &= ~XT_CONNLIMIT_DADDR;
80 break;
81 case O_DADDR:
82 if (revision < 1)
83 xtables_error(PARAMETER_PROBLEM,
84 "xt_connlimit.0 does not support "
85 "--connlimit-daddr");
86 info->flags |= XT_CONNLIMIT_DADDR;
87 break;
88 }
89 }
90
connlimit_parse4(struct xt_option_call * cb)91 static void connlimit_parse4(struct xt_option_call *cb)
92 {
93 return connlimit_parse(cb, NFPROTO_IPV4);
94 }
95
connlimit_parse6(struct xt_option_call * cb)96 static void connlimit_parse6(struct xt_option_call *cb)
97 {
98 return connlimit_parse(cb, NFPROTO_IPV6);
99 }
100
connlimit_check(struct xt_fcheck_call * cb)101 static void connlimit_check(struct xt_fcheck_call *cb)
102 {
103 if ((cb->xflags & (F_UPTO | F_ABOVE)) == 0)
104 xtables_error(PARAMETER_PROBLEM,
105 "You must specify \"--connlimit-above\" or "
106 "\"--connlimit-upto\".");
107 }
108
count_bits4(uint32_t mask)109 static unsigned int count_bits4(uint32_t mask)
110 {
111 unsigned int bits = 0;
112
113 for (mask = ~ntohl(mask); mask != 0; mask >>= 1)
114 ++bits;
115
116 return 32 - bits;
117 }
118
count_bits6(const uint32_t * mask)119 static unsigned int count_bits6(const uint32_t *mask)
120 {
121 unsigned int bits = 0, i;
122 uint32_t tmp[4];
123
124 for (i = 0; i < 4; ++i)
125 for (tmp[i] = ~ntohl(mask[i]); tmp[i] != 0; tmp[i] >>= 1)
126 ++bits;
127 return 128 - bits;
128 }
129
connlimit_print4(const void * ip,const struct xt_entry_match * match,int numeric)130 static void connlimit_print4(const void *ip,
131 const struct xt_entry_match *match, int numeric)
132 {
133 const struct xt_connlimit_info *info = (const void *)match->data;
134
135 printf(" #conn %s/%u %s %u",
136 (info->flags & XT_CONNLIMIT_DADDR) ? "dst" : "src",
137 count_bits4(info->v4_mask),
138 (info->flags & XT_CONNLIMIT_INVERT) ? "<=" : ">", info->limit);
139 }
140
connlimit_print6(const void * ip,const struct xt_entry_match * match,int numeric)141 static void connlimit_print6(const void *ip,
142 const struct xt_entry_match *match, int numeric)
143 {
144 const struct xt_connlimit_info *info = (const void *)match->data;
145
146 printf(" #conn %s/%u %s %u",
147 (info->flags & XT_CONNLIMIT_DADDR) ? "dst" : "src",
148 count_bits6(info->v6_mask),
149 (info->flags & XT_CONNLIMIT_INVERT) ? "<=" : ">", info->limit);
150 }
151
connlimit_save4(const void * ip,const struct xt_entry_match * match)152 static void connlimit_save4(const void *ip, const struct xt_entry_match *match)
153 {
154 const struct xt_connlimit_info *info = (const void *)match->data;
155 const int revision = match->u.user.revision;
156
157 if (info->flags & XT_CONNLIMIT_INVERT)
158 printf(" --connlimit-upto %u", info->limit);
159 else
160 printf(" --connlimit-above %u", info->limit);
161 printf(" --connlimit-mask %u", count_bits4(info->v4_mask));
162 if (revision >= 1) {
163 if (info->flags & XT_CONNLIMIT_DADDR)
164 printf(" --connlimit-daddr");
165 else
166 printf(" --connlimit-saddr");
167 }
168 }
169
connlimit_save6(const void * ip,const struct xt_entry_match * match)170 static void connlimit_save6(const void *ip, const struct xt_entry_match *match)
171 {
172 const struct xt_connlimit_info *info = (const void *)match->data;
173 const int revision = match->u.user.revision;
174
175 if (info->flags & XT_CONNLIMIT_INVERT)
176 printf(" --connlimit-upto %u", info->limit);
177 else
178 printf(" --connlimit-above %u", info->limit);
179 printf(" --connlimit-mask %u", count_bits6(info->v6_mask));
180 if (revision >= 1) {
181 if (info->flags & XT_CONNLIMIT_DADDR)
182 printf(" --connlimit-daddr");
183 else
184 printf(" --connlimit-saddr");
185 }
186 }
187
connlimit_xlate(struct xt_xlate * xl,const struct xt_xlate_mt_params * params)188 static int connlimit_xlate(struct xt_xlate *xl,
189 const struct xt_xlate_mt_params *params)
190 {
191 const struct xt_connlimit_info *info = (const void *)params->match->data;
192 static uint32_t connlimit_id;
193 char netmask[128] = {};
194 char addr[64] = {};
195 uint32_t mask;
196
197 switch (xt_xlate_get_family(xl)) {
198 case AF_INET:
199 mask = count_bits4(info->v4_mask);
200 if (mask != 32) {
201 struct in_addr *in = (struct in_addr *)&info->v4_mask;
202
203 inet_ntop(AF_INET, in, addr, sizeof(addr));
204 snprintf(netmask, sizeof(netmask), "and %s ", addr);
205 }
206 break;
207 case AF_INET6:
208 mask = count_bits6(info->v6_mask);
209 if (mask != 128) {
210 struct in6_addr *in6 = (struct in6_addr *)&info->v6_mask;
211
212 inet_ntop(AF_INET6, in6, addr, sizeof(addr));
213 snprintf(netmask, sizeof(netmask), "and %s ", addr);
214 }
215 break;
216 default:
217 return 0;
218 }
219
220 xt_xlate_set_add(xl, "connlimit%u { type ipv4_addr; flags dynamic; }",
221 connlimit_id);
222 xt_xlate_rule_add(xl, "add @connlimit%u { %s %s %sct count %s%u }",
223 connlimit_id++,
224 xt_xlate_get_family(xl) == AF_INET ? "ip" : "ip6",
225 info->flags & XT_CONNLIMIT_DADDR ? "daddr" : "saddr",
226 netmask,
227 info->flags & XT_CONNLIMIT_INVERT ? "" : "over ",
228 info->limit);
229
230 return 1;
231 }
232
233 static struct xtables_match connlimit_mt_reg[] = {
234 {
235 .name = "connlimit",
236 .revision = 0,
237 .family = NFPROTO_IPV4,
238 .version = XTABLES_VERSION,
239 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
240 .userspacesize = offsetof(struct xt_connlimit_info, data),
241 .help = connlimit_help,
242 .init = connlimit_init,
243 .x6_parse = connlimit_parse4,
244 .x6_fcheck = connlimit_check,
245 .print = connlimit_print4,
246 .save = connlimit_save4,
247 .x6_options = connlimit_opts,
248 },
249 {
250 .name = "connlimit",
251 .revision = 0,
252 .family = NFPROTO_IPV6,
253 .version = XTABLES_VERSION,
254 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
255 .userspacesize = offsetof(struct xt_connlimit_info, data),
256 .help = connlimit_help,
257 .init = connlimit_init,
258 .x6_parse = connlimit_parse6,
259 .x6_fcheck = connlimit_check,
260 .print = connlimit_print6,
261 .save = connlimit_save6,
262 .x6_options = connlimit_opts,
263 },
264 {
265 .name = "connlimit",
266 .revision = 1,
267 .family = NFPROTO_IPV4,
268 .version = XTABLES_VERSION,
269 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
270 .userspacesize = offsetof(struct xt_connlimit_info, data),
271 .help = connlimit_help,
272 .init = connlimit_init,
273 .x6_parse = connlimit_parse4,
274 .x6_fcheck = connlimit_check,
275 .print = connlimit_print4,
276 .save = connlimit_save4,
277 .x6_options = connlimit_opts,
278 .xlate = connlimit_xlate,
279 },
280 {
281 .name = "connlimit",
282 .revision = 1,
283 .family = NFPROTO_IPV6,
284 .version = XTABLES_VERSION,
285 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
286 .userspacesize = offsetof(struct xt_connlimit_info, data),
287 .help = connlimit_help,
288 .init = connlimit_init,
289 .x6_parse = connlimit_parse6,
290 .x6_fcheck = connlimit_check,
291 .print = connlimit_print6,
292 .save = connlimit_save6,
293 .x6_options = connlimit_opts,
294 .xlate = connlimit_xlate,
295 },
296 };
297
_init(void)298 void _init(void)
299 {
300 xtables_register_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
301 }
302