1 #include <stdio.h>
2 #include <netdb.h>
3 #include <string.h>
4 #include <xtables.h>
5 #include <linux/netfilter/xt_connlimit.h>
6
7 enum {
8 O_UPTO = 0,
9 O_ABOVE,
10 O_MASK,
11 O_SADDR,
12 O_DADDR,
13 F_UPTO = 1 << O_UPTO,
14 F_ABOVE = 1 << O_ABOVE,
15 F_MASK = 1 << O_MASK,
16 F_SADDR = 1 << O_SADDR,
17 F_DADDR = 1 << O_DADDR,
18 };
19
connlimit_help(void)20 static void connlimit_help(void)
21 {
22 printf(
23 "connlimit match options:\n"
24 " --connlimit-upto n match if the number of existing connections is 0..n\n"
25 " --connlimit-above n match if the number of existing connections is >n\n"
26 " --connlimit-mask n group hosts using prefix length (default: max len)\n"
27 " --connlimit-saddr select source address for grouping\n"
28 " --connlimit-daddr select destination addresses for grouping\n");
29 }
30
31 #define s struct xt_connlimit_info
32 static const struct xt_option_entry connlimit_opts[] = {
33 {.name = "connlimit-upto", .id = O_UPTO, .excl = F_ABOVE,
34 .type = XTTYPE_UINT32, .flags = XTOPT_INVERT | XTOPT_PUT,
35 XTOPT_POINTER(s, limit)},
36 {.name = "connlimit-above", .id = O_ABOVE, .excl = F_UPTO,
37 .type = XTTYPE_UINT32, .flags = XTOPT_INVERT | XTOPT_PUT,
38 XTOPT_POINTER(s, limit)},
39 {.name = "connlimit-mask", .id = O_MASK, .type = XTTYPE_PLENMASK,
40 .flags = XTOPT_PUT, XTOPT_POINTER(s, mask)},
41 {.name = "connlimit-saddr", .id = O_SADDR, .excl = F_DADDR,
42 .type = XTTYPE_NONE},
43 {.name = "connlimit-daddr", .id = O_DADDR, .excl = F_SADDR,
44 .type = XTTYPE_NONE},
45 XTOPT_TABLEEND,
46 };
47 #undef s
48
connlimit_init(struct xt_entry_match * match)49 static void connlimit_init(struct xt_entry_match *match)
50 {
51 struct xt_connlimit_info *info = (void *)match->data;
52
53 /* This will also initialize the v4 mask correctly */
54 memset(info->v6_mask, 0xFF, sizeof(info->v6_mask));
55 }
56
connlimit_parse(struct xt_option_call * cb,uint8_t family)57 static void connlimit_parse(struct xt_option_call *cb, uint8_t family)
58 {
59 struct xt_connlimit_info *info = cb->data;
60 const unsigned int revision = (*cb->match)->u.user.revision;
61
62 xtables_option_parse(cb);
63 switch (cb->entry->id) {
64 case O_ABOVE:
65 if (cb->invert)
66 info->flags |= XT_CONNLIMIT_INVERT;
67 break;
68 case O_UPTO:
69 if (!cb->invert)
70 info->flags |= XT_CONNLIMIT_INVERT;
71 break;
72 case O_SADDR:
73 if (revision < 1)
74 xtables_error(PARAMETER_PROBLEM,
75 "xt_connlimit.0 does not support "
76 "--connlimit-daddr");
77 info->flags &= ~XT_CONNLIMIT_DADDR;
78 break;
79 case O_DADDR:
80 if (revision < 1)
81 xtables_error(PARAMETER_PROBLEM,
82 "xt_connlimit.0 does not support "
83 "--connlimit-daddr");
84 info->flags |= XT_CONNLIMIT_DADDR;
85 break;
86 }
87 }
88
connlimit_parse4(struct xt_option_call * cb)89 static void connlimit_parse4(struct xt_option_call *cb)
90 {
91 return connlimit_parse(cb, NFPROTO_IPV4);
92 }
93
connlimit_parse6(struct xt_option_call * cb)94 static void connlimit_parse6(struct xt_option_call *cb)
95 {
96 return connlimit_parse(cb, NFPROTO_IPV6);
97 }
98
connlimit_check(struct xt_fcheck_call * cb)99 static void connlimit_check(struct xt_fcheck_call *cb)
100 {
101 if ((cb->xflags & (F_UPTO | F_ABOVE)) == 0)
102 xtables_error(PARAMETER_PROBLEM,
103 "You must specify \"--connlimit-above\" or "
104 "\"--connlimit-upto\".");
105 }
106
count_bits4(uint32_t mask)107 static unsigned int count_bits4(uint32_t mask)
108 {
109 unsigned int bits = 0;
110
111 for (mask = ~ntohl(mask); mask != 0; mask >>= 1)
112 ++bits;
113
114 return 32 - bits;
115 }
116
count_bits6(const uint32_t * mask)117 static unsigned int count_bits6(const uint32_t *mask)
118 {
119 unsigned int bits = 0, i;
120 uint32_t tmp[4];
121
122 for (i = 0; i < 4; ++i)
123 for (tmp[i] = ~ntohl(mask[i]); tmp[i] != 0; tmp[i] >>= 1)
124 ++bits;
125 return 128 - bits;
126 }
127
connlimit_print4(const void * ip,const struct xt_entry_match * match,int numeric)128 static void connlimit_print4(const void *ip,
129 const struct xt_entry_match *match, int numeric)
130 {
131 const struct xt_connlimit_info *info = (const void *)match->data;
132
133 printf(" #conn %s/%u %s %u",
134 (info->flags & XT_CONNLIMIT_DADDR) ? "dst" : "src",
135 count_bits4(info->v4_mask),
136 (info->flags & XT_CONNLIMIT_INVERT) ? "<=" : ">", info->limit);
137 }
138
connlimit_print6(const void * ip,const struct xt_entry_match * match,int numeric)139 static void connlimit_print6(const void *ip,
140 const struct xt_entry_match *match, int numeric)
141 {
142 const struct xt_connlimit_info *info = (const void *)match->data;
143
144 printf(" #conn %s/%u %s %u",
145 (info->flags & XT_CONNLIMIT_DADDR) ? "dst" : "src",
146 count_bits6(info->v6_mask),
147 (info->flags & XT_CONNLIMIT_INVERT) ? "<=" : ">", info->limit);
148 }
149
connlimit_save4(const void * ip,const struct xt_entry_match * match)150 static void connlimit_save4(const void *ip, const struct xt_entry_match *match)
151 {
152 const struct xt_connlimit_info *info = (const void *)match->data;
153 const int revision = match->u.user.revision;
154
155 if (info->flags & XT_CONNLIMIT_INVERT)
156 printf(" --connlimit-upto %u", info->limit);
157 else
158 printf(" --connlimit-above %u", info->limit);
159 printf(" --connlimit-mask %u", count_bits4(info->v4_mask));
160 if (revision >= 1) {
161 if (info->flags & XT_CONNLIMIT_DADDR)
162 printf(" --connlimit-daddr");
163 else
164 printf(" --connlimit-saddr");
165 }
166 }
167
connlimit_save6(const void * ip,const struct xt_entry_match * match)168 static void connlimit_save6(const void *ip, const struct xt_entry_match *match)
169 {
170 const struct xt_connlimit_info *info = (const void *)match->data;
171 const int revision = match->u.user.revision;
172
173 if (info->flags & XT_CONNLIMIT_INVERT)
174 printf(" --connlimit-upto %u", info->limit);
175 else
176 printf(" --connlimit-above %u", info->limit);
177 printf(" --connlimit-mask %u", count_bits6(info->v6_mask));
178 if (revision >= 1) {
179 if (info->flags & XT_CONNLIMIT_DADDR)
180 printf(" --connlimit-daddr");
181 else
182 printf(" --connlimit-saddr");
183 }
184 }
185
186 static struct xtables_match connlimit_mt_reg[] = {
187 {
188 .name = "connlimit",
189 .revision = 0,
190 .family = NFPROTO_IPV4,
191 .version = XTABLES_VERSION,
192 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
193 .userspacesize = offsetof(struct xt_connlimit_info, data),
194 .help = connlimit_help,
195 .init = connlimit_init,
196 .x6_parse = connlimit_parse4,
197 .x6_fcheck = connlimit_check,
198 .print = connlimit_print4,
199 .save = connlimit_save4,
200 .x6_options = connlimit_opts,
201 },
202 {
203 .name = "connlimit",
204 .revision = 0,
205 .family = NFPROTO_IPV6,
206 .version = XTABLES_VERSION,
207 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
208 .userspacesize = offsetof(struct xt_connlimit_info, data),
209 .help = connlimit_help,
210 .init = connlimit_init,
211 .x6_parse = connlimit_parse6,
212 .x6_fcheck = connlimit_check,
213 .print = connlimit_print6,
214 .save = connlimit_save6,
215 .x6_options = connlimit_opts,
216 },
217 {
218 .name = "connlimit",
219 .revision = 1,
220 .family = NFPROTO_IPV4,
221 .version = XTABLES_VERSION,
222 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
223 .userspacesize = offsetof(struct xt_connlimit_info, data),
224 .help = connlimit_help,
225 .init = connlimit_init,
226 .x6_parse = connlimit_parse4,
227 .x6_fcheck = connlimit_check,
228 .print = connlimit_print4,
229 .save = connlimit_save4,
230 .x6_options = connlimit_opts,
231 },
232 {
233 .name = "connlimit",
234 .revision = 1,
235 .family = NFPROTO_IPV6,
236 .version = XTABLES_VERSION,
237 .size = XT_ALIGN(sizeof(struct xt_connlimit_info)),
238 .userspacesize = offsetof(struct xt_connlimit_info, data),
239 .help = connlimit_help,
240 .init = connlimit_init,
241 .x6_parse = connlimit_parse6,
242 .x6_fcheck = connlimit_check,
243 .print = connlimit_print6,
244 .save = connlimit_save6,
245 .x6_options = connlimit_opts,
246 },
247 };
248
_init(void)249 void _init(void)
250 {
251 xtables_register_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
252 }
253