Skip to content

GitLab

Commit dab1e98e authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

New upstream version 1.8.1

parent f1f129da
Hide whitespace changes
Inline Side-by-side
extensions/libxt_hashlimit.c
View file @ dab1e98e
......@@ -7,14 +7,15 @@
* Based on ipt_limit.c by
* Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr>
* Hervé Eychenne <rv@wallfire.org>
*
*
* Error corections by nmalykh@bilim.com (22.01.2005)
*/
#define _BSD_SOURCE 1
#define _DEFAULT_SOURCE 1
#define _ISOC99_SOURCE 1
#include <inttypes.h>
#include <math.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
......@@ -68,10 +69,13 @@ enum {
O_HTABLE_MAX,
O_HTABLE_GCINT,
O_HTABLE_EXPIRE,
O_RATEMATCH,
O_INTERVAL,
F_BURST = 1 << O_BURST,
F_UPTO = 1 << O_UPTO,
F_ABOVE = 1 << O_ABOVE,
F_HTABLE_EXPIRE = 1 << O_HTABLE_EXPIRE,
F_RATEMATCH = 1 << O_RATEMATCH,
};
static void hashlimit_mt_help(void)
......@@ -95,6 +99,29 @@ static void hashlimit_mt_help(void)
"\n", XT_HASHLIMIT_BURST);
}
static void hashlimit_mt_help_v3(void)
{
printf(
"hashlimit match options:\n"
" --hashlimit-upto <avg> max average match rate\n"
" [Packets per second unless followed by \n"
" /sec /minute /hour /day postfixes]\n"
" --hashlimit-above <avg> min average match rate\n"
" --hashlimit-mode <mode> mode is a comma-separated list of\n"
" dstip,srcip,dstport,srcport (or none)\n"
" --hashlimit-srcmask <length> source address grouping prefix length\n"
" --hashlimit-dstmask <length> destination address grouping prefix length\n"
" --hashlimit-name <name> name for /proc/net/ipt_hashlimit\n"
" --hashlimit-burst <num> number to match in a burst, default %u\n"
" --hashlimit-htable-size <num> number of hashtable buckets\n"
" --hashlimit-htable-max <num> number of hashtable entries\n"
" --hashlimit-htable-gcinterval interval between garbage collection runs\n"
" --hashlimit-htable-expire after which time are idle entries expired?\n"
" --hashlimit-rate-match rate match the flow without rate-limiting it\n"
" --hashlimit-rate-interval interval in seconds for hashlimit-rate-match\n"
"\n", XT_HASHLIMIT_BURST);
}
#define s struct xt_hashlimit_info
static const struct xt_option_entry hashlimit_opts[] = {
{.name = "hashlimit", .id = O_UPTO, .excl = F_ABOVE,
......@@ -153,6 +180,36 @@ static const struct xt_option_entry hashlimit_mt_opts_v1[] = {
#undef s
#define s struct xt_hashlimit_mtinfo2
static const struct xt_option_entry hashlimit_mt_opts_v2[] = {
{.name = "hashlimit-upto", .id = O_UPTO, .excl = F_ABOVE,
.type = XTTYPE_STRING, .flags = XTOPT_INVERT},
{.name = "hashlimit-above", .id = O_ABOVE, .excl = F_UPTO,
.type = XTTYPE_STRING, .flags = XTOPT_INVERT},
{.name = "hashlimit", .id = O_UPTO, .excl = F_ABOVE,
.type = XTTYPE_STRING, .flags = XTOPT_INVERT}, /* old name */
{.name = "hashlimit-srcmask", .id = O_SRCMASK, .type = XTTYPE_PLEN},
{.name = "hashlimit-dstmask", .id = O_DSTMASK, .type = XTTYPE_PLEN},
{.name = "hashlimit-burst", .id = O_BURST, .type = XTTYPE_STRING},
{.name = "hashlimit-htable-size", .id = O_HTABLE_SIZE,
.type = XTTYPE_UINT32, .flags = XTOPT_PUT,
XTOPT_POINTER(s, cfg.size)},
{.name = "hashlimit-htable-max", .id = O_HTABLE_MAX,
.type = XTTYPE_UINT32, .flags = XTOPT_PUT,
XTOPT_POINTER(s, cfg.max)},
{.name = "hashlimit-htable-gcinterval", .id = O_HTABLE_GCINT,
.type = XTTYPE_UINT32, .flags = XTOPT_PUT,
XTOPT_POINTER(s, cfg.gc_interval)},
{.name = "hashlimit-htable-expire", .id = O_HTABLE_EXPIRE,
.type = XTTYPE_UINT32, .flags = XTOPT_PUT,
XTOPT_POINTER(s, cfg.expire)},
{.name = "hashlimit-mode", .id = O_MODE, .type = XTTYPE_STRING},
{.name = "hashlimit-name", .id = O_NAME, .type = XTTYPE_STRING,
.flags = XTOPT_MAND | XTOPT_PUT, XTOPT_POINTER(s, name), .min = 1},
XTOPT_TABLEEND,
};
#undef s
#define s struct xt_hashlimit_mtinfo3
static const struct xt_option_entry hashlimit_mt_opts[] = {
{.name = "hashlimit-upto", .id = O_UPTO, .excl = F_ABOVE,
.type = XTTYPE_STRING, .flags = XTOPT_INVERT},
......@@ -178,12 +235,14 @@ static const struct xt_option_entry hashlimit_mt_opts[] = {
{.name = "hashlimit-mode", .id = O_MODE, .type = XTTYPE_STRING},
{.name = "hashlimit-name", .id = O_NAME, .type = XTTYPE_STRING,
.flags = XTOPT_MAND | XTOPT_PUT, XTOPT_POINTER(s, name), .min = 1},
{.name = "hashlimit-rate-match", .id = O_RATEMATCH, .type = XTTYPE_NONE},
{.name = "hashlimit-rate-interval", .id = O_INTERVAL, .type = XTTYPE_STRING},
XTOPT_TABLEEND,
};
#undef s
static int
cfg_copy(struct hashlimit_cfg2 *to, const void *from, int revision)
cfg_copy(struct hashlimit_cfg3 *to, const void *from, int revision)
{
if (revision == 1) {
struct hashlimit_cfg1 *cfg = (struct hashlimit_cfg1 *)from;
......@@ -198,7 +257,19 @@ cfg_copy(struct hashlimit_cfg2 *to, const void *from, int revision)
to->srcmask = cfg->srcmask;
to->dstmask = cfg->dstmask;
} else if (revision == 2) {
memcpy(to, from, sizeof(struct hashlimit_cfg2));
struct hashlimit_cfg2 *cfg = (struct hashlimit_cfg2 *)from;
to->mode = cfg->mode;
to->avg = cfg->avg;
to->burst = cfg->burst;
to->size = cfg->size;
to->max = cfg->max;
to->gc_interval = cfg->gc_interval;
to->expire = cfg->expire;
to->srcmask = cfg->srcmask;
to->dstmask = cfg->dstmask;
} else if (revision == 3) {
memcpy(to, from, sizeof(struct hashlimit_cfg3));
} else {
return -EINVAL;
}
......@@ -262,7 +333,7 @@ static uint64_t parse_burst(const char *burst, int revision)
if (v > max)
xtables_error(PARAMETER_PROBLEM, "bad value for option "
"\"--hashlimit-burst\", value \"%s\" too large "
"(max %lumb).", burst, max/1024/1024);
"(max %"PRIu64"mb).", burst, max/1024/1024);
return v;
}
......@@ -285,8 +356,8 @@ static bool parse_bytes(const char *rate, void *val, struct hashlimit_mt_udata *
tmp = (uint64_t) r * factor;
if (tmp > max)
xtables_error(PARAMETER_PROBLEM,
"Rate value too large \"%llu\" (max %lu)\n",
(unsigned long long)tmp, max);
"Rate value too large \"%"PRIu64"\" (max %"PRIu64")\n",
tmp, max);
tmp = bytes_to_cost(tmp);
if (tmp == 0)
......@@ -346,6 +417,16 @@ int parse_rate(const char *rate, void *val, struct hashlimit_mt_udata *ud, int r
return 1;
}
static int parse_interval(const char *rate, uint32_t *val)
{
int r = atoi(rate);
if (r <= 0)
return 0;
*val = r;
return 1;
}
static void hashlimit_init(struct xt_entry_match *m)
{
struct xt_hashlimit_info *r = (struct xt_hashlimit_info *)m->data;
......@@ -377,7 +458,7 @@ static void hashlimit_mt6_init_v1(struct xt_entry_match *match)
info->cfg.dstmask = 128;
}
static void hashlimit_mt4_init(struct xt_entry_match *match)
static void hashlimit_mt4_init_v2(struct xt_entry_match *match)
{
struct xt_hashlimit_mtinfo2 *info = (void *)match->data;
......@@ -388,7 +469,7 @@ static void hashlimit_mt4_init(struct xt_entry_match *match)
info->cfg.dstmask = 32;
}
static void hashlimit_mt6_init(struct xt_entry_match *match)
static void hashlimit_mt6_init_v2(struct xt_entry_match *match)
{
struct xt_hashlimit_mtinfo2 *info = (void *)match->data;
......@@ -399,6 +480,30 @@ static void hashlimit_mt6_init(struct xt_entry_match *match)
info->cfg.dstmask = 128;
}
static void hashlimit_mt4_init(struct xt_entry_match *match)
{
struct xt_hashlimit_mtinfo3 *info = (void *)match->data;
info->cfg.mode = 0;
info->cfg.burst = XT_HASHLIMIT_BURST;
info->cfg.gc_interval = XT_HASHLIMIT_GCINTERVAL;
info->cfg.srcmask = 32;
info->cfg.dstmask = 32;
info->cfg.interval = 0;
}
static void hashlimit_mt6_init(struct xt_entry_match *match)
{
struct xt_hashlimit_mtinfo3 *info = (void *)match->data;
info->cfg.mode = 0;
info->cfg.burst = XT_HASHLIMIT_BURST;
info->cfg.gc_interval = XT_HASHLIMIT_GCINTERVAL;
info->cfg.srcmask = 128;
info->cfg.dstmask = 128;
info->cfg.interval = 0;
}
/* Parse a 'mode' parameter into the required bitmask */
static int parse_mode(uint32_t *mode, const char *option_arg)
{
......@@ -488,7 +593,7 @@ static void hashlimit_mt_parse_v1(struct xt_option_call *cb)
}
}
static void hashlimit_mt_parse(struct xt_option_call *cb)
static void hashlimit_mt_parse_v2(struct xt_option_call *cb)
{
struct xt_hashlimit_mtinfo2 *info = cb->data;
......@@ -529,6 +634,54 @@ static void hashlimit_mt_parse(struct xt_option_call *cb)
}
}
static void hashlimit_mt_parse(struct xt_option_call *cb)
{
struct xt_hashlimit_mtinfo3 *info = cb->data;
xtables_option_parse(cb);
switch (cb->entry->id) {
case O_BURST:
info->cfg.burst = parse_burst(cb->arg, 2);
break;
case O_UPTO:
if (cb->invert)
info->cfg.mode |= XT_HASHLIMIT_INVERT;
if (parse_bytes(cb->arg, &info->cfg.avg, cb->udata, 2))
info->cfg.mode |= XT_HASHLIMIT_BYTES;
else if (!parse_rate(cb->arg, &info->cfg.avg, cb->udata, 2))
xtables_param_act(XTF_BAD_VALUE, "hashlimit",
"--hashlimit-upto", cb->arg);
break;
case O_ABOVE:
if (!cb->invert)
info->cfg.mode |= XT_HASHLIMIT_INVERT;
if (parse_bytes(cb->arg, &info->cfg.avg, cb->udata, 2))
info->cfg.mode |= XT_HASHLIMIT_BYTES;
else if (!parse_rate(cb->arg, &info->cfg.avg, cb->udata, 2))
xtables_param_act(XTF_BAD_VALUE, "hashlimit",
"--hashlimit-above", cb->arg);
break;
case O_MODE:
if (parse_mode(&info->cfg.mode, cb->arg) < 0)
xtables_param_act(XTF_BAD_VALUE, "hashlimit",
"--hashlimit-mode", cb->arg);
break;
case O_SRCMASK:
info->cfg.srcmask = cb->val.hlen;
break;
case O_DSTMASK:
info->cfg.dstmask = cb->val.hlen;
break;
case O_RATEMATCH:
info->cfg.mode |= XT_HASHLIMIT_RATE_MATCH;
break;
case O_INTERVAL:
if (!parse_interval(cb->arg, &info->cfg.interval))
xtables_param_act(XTF_BAD_VALUE, "hashlimit",
"--hashlimit-rate-interval", cb->arg);
}
}
static void hashlimit_check(struct xt_fcheck_call *cb)
{
const struct hashlimit_mt_udata *udata = cb->udata;
......@@ -557,7 +710,8 @@ static void hashlimit_mt_check_v1(struct xt_fcheck_call *cb)
if (cb->xflags & F_BURST) {
if (info->cfg.burst < cost_to_bytes(info->cfg.avg))
xtables_error(PARAMETER_PROBLEM,
"burst cannot be smaller than %lub", cost_to_bytes(info->cfg.avg));
"burst cannot be smaller than %"PRIu64"b",
cost_to_bytes(info->cfg.avg));
burst = info->cfg.burst;
burst /= cost_to_bytes(info->cfg.avg);
......@@ -571,11 +725,42 @@ static void hashlimit_mt_check_v1(struct xt_fcheck_call *cb)
burst_error_v1();
}
static void hashlimit_mt_check(struct xt_fcheck_call *cb)
static void hashlimit_mt_check_v2(struct xt_fcheck_call *cb)
{
const struct hashlimit_mt_udata *udata = cb->udata;
struct xt_hashlimit_mtinfo2 *info = cb->data;
if (!(cb->xflags & (F_UPTO | F_ABOVE)))
xtables_error(PARAMETER_PROBLEM,
"You have to specify --hashlimit");
if (!(cb->xflags & F_HTABLE_EXPIRE))
info->cfg.expire = udata->mult * 1000; /* from s to msec */
if (info->cfg.mode & XT_HASHLIMIT_BYTES) {
uint32_t burst = 0;
if (cb->xflags & F_BURST) {
if (info->cfg.burst < cost_to_bytes(info->cfg.avg))
xtables_error(PARAMETER_PROBLEM,
"burst cannot be smaller than %"PRIu64"b",
cost_to_bytes(info->cfg.avg));
burst = info->cfg.burst;
burst /= cost_to_bytes(info->cfg.avg);
if (info->cfg.burst % cost_to_bytes(info->cfg.avg))
burst++;
if (!(cb->xflags & F_HTABLE_EXPIRE))
info->cfg.expire = XT_HASHLIMIT_BYTE_EXPIRE_BURST * 1000;
}
info->cfg.burst = burst;
} else if (info->cfg.burst > XT_HASHLIMIT_BURST_MAX)
burst_error();
}
static void hashlimit_mt_check(struct xt_fcheck_call *cb)
{
const struct hashlimit_mt_udata *udata = cb->udata;
struct xt_hashlimit_mtinfo3 *info = cb->data;
if (!(cb->xflags & (F_UPTO | F_ABOVE)))
xtables_error(PARAMETER_PROBLEM,
"You have to specify --hashlimit");
......@@ -599,6 +784,18 @@ static void hashlimit_mt_check(struct xt_fcheck_call *cb)
info->cfg.burst = burst;
} else if (info->cfg.burst > XT_HASHLIMIT_BURST_MAX)
burst_error();
if (cb->xflags & F_RATEMATCH) {
if (!(info->cfg.mode & XT_HASHLIMIT_BYTES))
info->cfg.avg /= udata->mult;
if (info->cfg.interval == 0) {
if (info->cfg.mode & XT_HASHLIMIT_BYTES)
info->cfg.interval = 1;
else
info->cfg.interval = udata->mult;
}
}
}
struct rates {
......@@ -615,7 +812,7 @@ static const struct rates rates[] = {
{ "min", XT_HASHLIMIT_SCALE_v2*60 },
{ "sec", XT_HASHLIMIT_SCALE_v2 } };
static uint32_t print_rate(uint32_t period, int revision)
static uint32_t print_rate(uint64_t period, int revision)
{
unsigned int i;
const struct rates *_rates = (revision == 1) ? rates_v1 : rates;
......@@ -631,7 +828,7 @@ static uint32_t print_rate(uint32_t period, int revision)
|| _rates[i].mult/period < _rates[i].mult%period)
break;
printf(" %lu/%s", _rates[i-1].mult / period, _rates[i-1].name);
printf(" %"PRIu64"/%s", _rates[i-1].mult / period, _rates[i-1].name);
/* return in msec */
return _rates[i-1].mult / scale * 1000;
}
......@@ -721,9 +918,10 @@ static void hashlimit_print(const void *ip,
}
static void
hashlimit_mt_print(const struct hashlimit_cfg2 *cfg, unsigned int dmask, int revision)
hashlimit_mt_print(const struct hashlimit_cfg3 *cfg, unsigned int dmask, int revision)
{
uint32_t quantum;
uint64_t quantum;
uint64_t period;
if (cfg->mode & XT_HASHLIMIT_INVERT)
fputs(" limit: above", stdout);
......@@ -733,7 +931,15 @@ hashlimit_mt_print(const struct hashlimit_cfg2 *cfg, unsigned int dmask, int rev
if (cfg->mode & XT_HASHLIMIT_BYTES) {
quantum = print_bytes(cfg->avg, cfg->burst, "");
} else {
quantum = print_rate(cfg->avg, revision);
if (revision == 3) {
period = cfg->avg;
if (cfg->interval != 0)
period *= cfg->interval;
quantum = print_rate(period, revision);
} else {
quantum = print_rate(cfg->avg, revision);
}
printf(" burst %llu", cfg->burst);
}
if (cfg->mode & (XT_HASHLIMIT_HASH_SIP | XT_HASHLIMIT_HASH_SPT |
......@@ -754,6 +960,13 @@ hashlimit_mt_print(const struct hashlimit_cfg2 *cfg, unsigned int dmask, int rev
printf(" srcmask %u", cfg->srcmask);
if (cfg->dstmask != dmask)
printf(" dstmask %u", cfg->dstmask);
if ((revision == 3) && (cfg->mode & XT_HASHLIMIT_RATE_MATCH))
printf(" rate-match");
if ((revision == 3) && (cfg->mode & XT_HASHLIMIT_RATE_MATCH))
if (cfg->interval != 1)
printf(" rate-interval %u", cfg->interval);
}
static void
......@@ -761,7 +974,7 @@ hashlimit_mt4_print_v1(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct xt_hashlimit_mtinfo1 *info = (const void *)match->data;
struct hashlimit_cfg2 cfg;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 1);
......@@ -777,7 +990,7 @@ hashlimit_mt6_print_v1(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct xt_hashlimit_mtinfo1 *info = (const void *)match->data;
struct hashlimit_cfg2 cfg;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 1);
......@@ -789,21 +1002,52 @@ hashlimit_mt6_print_v1(const void *ip, const struct xt_entry_match *match,
}
static void
hashlimit_mt4_print(const void *ip, const struct xt_entry_match *match,
hashlimit_mt4_print_v2(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct xt_hashlimit_mtinfo2 *info = (const void *)match->data;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 2);
if (ret)
xtables_error(OTHER_PROBLEM, "unknown revision");
hashlimit_mt_print(&info->cfg, 32, 2);
hashlimit_mt_print(&cfg, 32, 2);
}
static void
hashlimit_mt6_print(const void *ip, const struct xt_entry_match *match,
hashlimit_mt6_print_v2(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct xt_hashlimit_mtinfo2 *info = (const void *)match->data;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 2);
if (ret)
xtables_error(OTHER_PROBLEM, "unknown revision");
hashlimit_mt_print(&cfg, 128, 2);
}
static void
hashlimit_mt4_print(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct xt_hashlimit_mtinfo3 *info = (const void *)match->data;
hashlimit_mt_print(&info->cfg, 32, 3);
}
static void
hashlimit_mt6_print(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct xt_hashlimit_mtinfo3 *info = (const void *)match->data;
hashlimit_mt_print(&info->cfg, 128, 2);
hashlimit_mt_print(&info->cfg, 128, 3);
}
static void hashlimit_save(const void *ip, const struct xt_entry_match *match)
......@@ -831,7 +1075,7 @@ static void hashlimit_save(const void *ip, const struct xt_entry_match *match)
}
static void
hashlimit_mt_save(const struct hashlimit_cfg2 *cfg, const char* name, unsigned int dmask, int revision)
hashlimit_mt_save(const struct hashlimit_cfg3 *cfg, const char* name, unsigned int dmask, int revision)
{
uint32_t quantum;
......@@ -868,13 +1112,20 @@ hashlimit_mt_save(const struct hashlimit_cfg2 *cfg, const char* name, unsigned i
printf(" --hashlimit-srcmask %u", cfg->srcmask);
if (cfg->dstmask != dmask)
printf(" --hashlimit-dstmask %u", cfg->dstmask);
if ((revision == 3) && (cfg->mode & XT_HASHLIMIT_RATE_MATCH))
printf(" --hashlimit-rate-match");
if ((revision == 3) && (cfg->mode & XT_HASHLIMIT_RATE_MATCH))
if (cfg->interval != 1)
printf(" --hashlimit-rate-interval %u", cfg->interval);
}
static void
hashlimit_mt4_save_v1(const void *ip, const struct xt_entry_match *match)
{
const struct xt_hashlimit_mtinfo1 *info = (const void *)match->data;
struct hashlimit_cfg2 cfg;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 1);
......@@ -889,7 +1140,7 @@ static void
hashlimit_mt6_save_v1(const void *ip, const struct xt_entry_match *match)
{
const struct xt_hashlimit_mtinfo1 *info = (const void *)match->data;
struct hashlimit_cfg2 cfg;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 1);
......@@ -901,19 +1152,300 @@ hashlimit_mt6_save_v1(const void *ip, const struct xt_entry_match *match)
}
static void
hashlimit_mt4_save(const void *ip, const struct xt_entry_match *match)
hashlimit_mt4_save_v2(const void *ip, const struct xt_entry_match *match)
{
const struct xt_hashlimit_mtinfo2 *info = (const void *)match->data;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 2);
hashlimit_mt_save(&info->cfg, info->name, 32, 2);
if (ret)
xtables_error(OTHER_PROBLEM, "unknown revision");
hashlimit_mt_save(&cfg, info->name, 32, 2);
}
static void
hashlimit_mt6_save(const void *ip, const struct xt_entry_match *match)
hashlimit_mt6_save_v2(const void *ip, const struct xt_entry_match *match)
{
const struct xt_hashlimit_mtinfo2 *info = (const void *)match->data;
struct hashlimit_cfg3 cfg;
int ret;
ret = cfg_copy(&cfg, (const void *)&info->cfg, 2);
if (ret)
xtables_error(OTHER_PROBLEM, "unknown revision");
hashlimit_mt_save(&cfg, info->name, 128, 2);
}
static void
hashlimit_mt4_save(const void *ip, const struct xt_entry_match *match)
{
const struct xt_hashlimit_mtinfo3 *info = (const void *)match->data;
hashlimit_mt_save(&info->cfg, info->name, 32, 3);
}
static void
hashlimit_mt6_save(const void *ip, const struct xt_entry_match *match)
{
const struct xt_hashlimit_mtinfo3 *info = (const void *)match->data;
hashlimit_mt_save(&info->cfg, info->name, 128, 3);
}
static const struct rates rates_v1_xlate[] = {
{ "day", XT_HASHLIMIT_SCALE * 24 * 60 * 60 },
{ "hour", XT_HASHLIMIT_SCALE * 60 * 60 },
{ "minute", XT_HASHLIMIT_SCALE * 60 },
{ "second", XT_HASHLIMIT_SCALE } };
static const struct rates rates_xlate[] = {
{ "day", XT_HASHLIMIT_SCALE_v2 * 24 * 60 * 60 },
{ "hour", XT_HASHLIMIT_SCALE_v2 * 60 * 60 },
{ "minute", XT_HASHLIMIT_SCALE_v2 * 60 },
{ "second", XT_HASHLIMIT_SCALE_v2 } };
static void print_packets_rate_xlate(struct xt_xlate *xl, uint64_t avg,
int revision)
{
unsigned int i;
const struct rates *_rates = (revision == 1) ?
rates_v1_xlate : rates_xlate;
for (i = 1; i < ARRAY_SIZE(rates); ++i)
if (avg > _rates[i].mult ||
_rates[i].mult / avg < _rates[i].mult % avg)
break;
xt_xlate_add(xl, " %llu/%s ",
_rates[i-1].mult / avg, _rates[i-1].name);
}
static void print_bytes_rate_xlate(struct xt_xlate *xl,
const struct hashlimit_cfg3 *cfg)
{
unsigned int i;
unsigned long long r;
r = cost_to_bytes(cfg->avg);
for (i = 0; i < ARRAY_SIZE(units) -1; ++i)
if (r >= units[i].thresh &&
bytes_to_cost(r & ~(units[i].thresh - 1)) == cfg->avg)
break;
xt_xlate_add(xl, " %llu %sbytes/second", r / units[i].thresh,
units[i].name);
r *= cfg->burst;
for (i = 0; i < ARRAY_SIZE(units) -1; ++i)
if (r >= units[i].thresh)
break;
if (cfg->burst > 0)
xt_xlate_add(xl, " burst %llu %sbytes", r / units[i].thresh,
units[i].name);
}
static void hashlimit_print_subnet_xlate(struct xt_xlate *xl,
uint32_t nsub, int family)
{
char sep = (family == NFPROTO_IPV4) ? '.' : ':';
char *fmt = (family == NFPROTO_IPV4) ? "%u" : "%04x";
unsigned int nblocks = (family == NFPROTO_IPV4) ? 4 : 8;
unsigned int nbits = (family == NFPROTO_IPV4) ? 8 : 16;
unsigned int acm, i;
xt_xlate_add(xl, " and ");
while (nblocks--) {
acm = 0;
for (i = 0; i < nbits; i++) {
acm <<= 1;
if (nsub > 0) {
acm++;
nsub--;
}
}
xt_xlate_add(xl, fmt, acm);
if (nblocks > 0)
xt_xlate_add(xl, "%c", sep);
}
}
static const char *const hashlimit_modes4_xlate[] = {
[XT_HASHLIMIT_HASH_DIP] = "ip daddr",
[XT_HASHLIMIT_HASH_DPT] = "tcp dport",
[XT_HASHLIMIT_HASH_SIP] = "ip saddr",
[XT_HASHLIMIT_HASH_SPT] = "tcp sport",
};
static const char *const hashlimit_modes6_xlate[] = {
[XT_HASHLIMIT_HASH_DIP] = "ip6 daddr",
[XT_HASHLIMIT_HASH_DPT] = "tcp dport",
[XT_HASHLIMIT_HASH_SIP] = "ip6 saddr",
[XT_HASHLIMIT_HASH_SPT] = "tcp sport",
};
static int hashlimit_mode_xlate(struct xt_xlate *xl,
uint32_t mode, int family,
unsigned int nsrc, unsigned int ndst)
{
const char * const *_modes = (family == NFPROTO_IPV4) ?
hashlimit_modes4_xlate : hashlimit_modes6_xlate;
bool prevopt = false;
unsigned int mask;
mode &= ~XT_HASHLIMIT_INVERT & ~XT_HASHLIMIT_BYTES;
for (mask = 1; mode > 0; mask <<= 1) {
if (!(mode & mask))
continue;
if (!prevopt) {
xt_xlate_add(xl, " ");
prevopt = true;
}
else {
xt_xlate_add(xl, " . ");
}
xt_xlate_add(xl, "%s", _modes[mask]);
if (mask == XT_HASHLIMIT_HASH_DIP &&
((family == NFPROTO_IPV4 && ndst != 32) ||
(family == NFPROTO_IPV6 && ndst != 128)))
hashlimit_print_subnet_xlate(xl, ndst, family);
else if (mask == XT_HASHLIMIT_HASH_SIP &&
((family == NFPROTO_IPV4 && nsrc != 32) ||
(family == NFPROTO_IPV6 && nsrc != 128)))
hashlimit_print_subnet_xlate(xl, nsrc, family);
mode &= ~mask;
}
return prevopt;
}
static int hashlimit_mt_xlate(struct xt_xlate *xl, const char *name,
const struct hashlimit_cfg3 *cfg,
int revision, int family)
{
int ret = 1;
xt_xlate_add(xl, "meter %s {", name);
ret = hashlimit_mode_xlate(xl, cfg->mode, family,
cfg->srcmask, cfg->dstmask);
if (cfg->expire != 1000)
xt_xlate_add(xl, " timeout %us", cfg->expire / 1000);
xt_xlate_add(xl, " limit rate");
if (cfg->mode & XT_HASHLIMIT_INVERT)
xt_xlate_add(xl, " over");
if (cfg->mode & XT_HASHLIMIT_BYTES)
print_bytes_rate_xlate(xl, cfg);
else {
print_packets_rate_xlate(xl, cfg->avg, revision);
if (cfg->burst != XT_HASHLIMIT_BURST)
xt_xlate_add(xl, "burst %lu packets", cfg->burst);
}
xt_xlate_add(xl, "}");
return ret;
}
static int hashlimit_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_hashlimit_info *info = (const void *)params->match->data;
int ret = 1;
xt_xlate_add(xl, "meter %s {", info->name);
ret = hashlimit_mode_xlate(xl, info->cfg.mode, NFPROTO_IPV4, 32, 32);
xt_xlate_add(xl, " timeout %us limit rate", info->cfg.expire / 1000);
print_packets_rate_xlate(xl, info->cfg.avg, 1);
xt_xlate_add(xl, " burst %lu packets", info->cfg.burst);
xt_xlate_add(xl, "}");
return ret;
}
static int hashlimit_mt4_xlate_v1(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_hashlimit_mtinfo1 *info =
(const void *)params->match->data;
struct hashlimit_cfg3 cfg;
if (cfg_copy(&cfg, (const void *)&info->cfg, 1))
xtables_error(OTHER_PROBLEM, "unknown revision");
return hashlimit_mt_xlate(xl, info->name, &cfg, 1, NFPROTO_IPV4);
}
static int hashlimit_mt6_xlate_v1(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_hashlimit_mtinfo1 *info =
(const void *)params->match->data;
struct hashlimit_cfg3 cfg;
hashlimit_mt_save(&info->cfg, info->name, 128, 2);
if (cfg_copy(&cfg, (const void *)&info->cfg, 1))
xtables_error(OTHER_PROBLEM, "unknown revision");
return hashlimit_mt_xlate(xl, info->name, &cfg, 1, NFPROTO_IPV6);
}
static int hashlimit_mt4_xlate_v2(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_hashlimit_mtinfo2 *info =
(const void *)params->match->data;
struct hashlimit_cfg3 cfg;
if (cfg_copy(&cfg, (const void *)&info->cfg, 2))
xtables_error(OTHER_PROBLEM, "unknown revision");
return hashlimit_mt_xlate(xl, info->name, &cfg, 2, NFPROTO_IPV4);
}
static int hashlimit_mt6_xlate_v2(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_hashlimit_mtinfo2 *info =
(const void *)params->match->data;
struct hashlimit_cfg3 cfg;
if (cfg_copy(&cfg, (const void *)&info->cfg, 2))
xtables_error(OTHER_PROBLEM, "unknown revision");
return hashlimit_mt_xlate(xl, info->name, &cfg, 2, NFPROTO_IPV6);
}
static int hashlimit_mt4_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_hashlimit_mtinfo3 *info =
(const void *)params->match->data;
return hashlimit_mt_xlate(xl, info->name, &info->cfg, 3, NFPROTO_IPV4);
}
static int hashlimit_mt6_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_hashlimit_mtinfo3 *info =
(const void *)params->match->data;
return hashlimit_mt_xlate(xl, info->name, &info->cfg, 3, NFPROTO_IPV6);
}
static struct xtables_match hashlimit_mt_reg[] = {
......@@ -932,6 +1464,7 @@ static struct xtables_match hashlimit_mt_reg[] = {
.save = hashlimit_save,
.x6_options = hashlimit_opts,
.udata_size = sizeof(struct hashlimit_mt_udata),
.xlate = hashlimit_xlate,
},
{
.version = XTABLES_VERSION,
......@@ -948,6 +1481,7 @@ static struct xtables_match hashlimit_mt_reg[] = {
.save = hashlimit_mt4_save_v1,
.x6_options = hashlimit_mt_opts_v1,
.udata_size = sizeof(struct hashlimit_mt_udata),
.xlate = hashlimit_mt4_xlate_v1,
},
{
.version = XTABLES_VERSION,
......@@ -964,6 +1498,7 @@ static struct xtables_match hashlimit_mt_reg[] = {
.save = hashlimit_mt6_save_v1,
.x6_options = hashlimit_mt_opts_v1,
.udata_size = sizeof(struct hashlimit_mt_udata),
.xlate = hashlimit_mt6_xlate_v1,
},
{
.version = XTABLES_VERSION,
......@@ -973,6 +1508,40 @@ static struct xtables_match hashlimit_mt_reg[] = {
.size = XT_ALIGN(sizeof(struct xt_hashlimit_mtinfo2)),
.userspacesize = offsetof(struct xt_hashlimit_mtinfo2, hinfo),
.help = hashlimit_mt_help,
.init = hashlimit_mt4_init_v2,
.x6_parse = hashlimit_mt_parse_v2,
.x6_fcheck = hashlimit_mt_check_v2,
.print = hashlimit_mt4_print_v2,
.save = hashlimit_mt4_save_v2,
.x6_options = hashlimit_mt_opts_v2,
.udata_size = sizeof(struct hashlimit_mt_udata),
.xlate = hashlimit_mt4_xlate_v2,
},
{
.version = XTABLES_VERSION,
.name = "hashlimit",
.revision = 2,
.family = NFPROTO_IPV6,
.size = XT_ALIGN(sizeof(struct xt_hashlimit_mtinfo2)),
.userspacesize = offsetof(struct xt_hashlimit_mtinfo2, hinfo),
.help = hashlimit_mt_help,
.init = hashlimit_mt6_init_v2,
.x6_parse = hashlimit_mt_parse_v2,
.x6_fcheck = hashlimit_mt_check_v2,
.print = hashlimit_mt6_print_v2,
.save = hashlimit_mt6_save_v2,
.x6_options = hashlimit_mt_opts_v2,
.udata_size = sizeof(struct hashlimit_mt_udata),
.xlate = hashlimit_mt6_xlate_v2,
},
{
.version = XTABLES_VERSION,
.name = "hashlimit",
.revision = 3,
.family = NFPROTO_IPV4,
.size = XT_ALIGN(sizeof(struct xt_hashlimit_mtinfo3)),
.userspacesize = offsetof(struct xt_hashlimit_mtinfo3, hinfo),
.help = hashlimit_mt_help_v3,
.init = hashlimit_mt4_init,
.x6_parse = hashlimit_mt_parse,
.x6_fcheck = hashlimit_mt_check,
......@@ -980,15 +1549,16 @@ static struct xtables_match hashlimit_mt_reg[] = {
.save = hashlimit_mt4_save,
.x6_options = hashlimit_mt_opts,
.udata_size = sizeof(struct hashlimit_mt_udata),
.xlate = hashlimit_mt4_xlate,
},
{
.version = XTABLES_VERSION,
.name = "hashlimit",
.revision = 2,
.revision = 3,
.family = NFPROTO_IPV6,
.size = XT_ALIGN(sizeof(struct xt_hashlimit_mtinfo2)),
.userspacesize = offsetof(struct xt_hashlimit_mtinfo2, hinfo),
.help = hashlimit_mt_help,
.size = XT_ALIGN(sizeof(struct xt_hashlimit_mtinfo3)),
.userspacesize = offsetof(struct xt_hashlimit_mtinfo3, hinfo),
.help = hashlimit_mt_help_v3,
.init = hashlimit_mt6_init,
.x6_parse = hashlimit_mt_parse,
.x6_fcheck = hashlimit_mt_check,
......@@ -996,6 +1566,7 @@ static struct xtables_match hashlimit_mt_reg[] = {
.save = hashlimit_mt6_save,
.x6_options = hashlimit_mt_opts,
.udata_size = sizeof(struct hashlimit_mt_udata),
.xlate = hashlimit_mt6_xlate,
},
};
......
extensions/libxt_hashlimit.man
View file @ dab1e98e
......@@ -51,6 +51,14 @@ After how many milliseconds do hash entries expire.
.TP
\fB\-\-hashlimit\-htable\-gcinterval\fP \fImsec\fP
How many milliseconds between garbage collection intervals.
.TP
\fB\-\-hashlimit\-rate\-match\fP
Classify the flow instead of rate-limiting it. This acts like a
true/false match on whether the rate is above/below a certain number
.TP
\fB\-\-hashlimit\-rate\-interval\fP \fIsec\fP
Can be used with \-\-hashlimit\-rate\-match to specify the interval
at which the rate should be sampled
.PP
Examples:
.TP
......
extensions/libxt_hashlimit.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-above 20kb/s --hashlimit-burst 1mb --hashlimit-mode dstip --hashlimit-name https --hashlimit-dstmask 24 -m state --state NEW -j DROP
nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes} ct state new counter drop
iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 -m state --state NEW -j DROP
nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop
extensions/libxt_helper.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A FORWARD -m helper --helper sip
nft add rule ip filter FORWARD ct helper \"sip\" counter
iptables-translate -A FORWARD -m helper ! --helper ftp
nft add rule ip filter FORWARD ct helper != \"ftp\" counter
extensions/libxt_icmp.h 0 → 100644
View file @ dab1e98e
struct xt_icmp_names {
const char *name;
uint8_t type;
uint8_t code_min, code_max;
};
static void xt_print_icmp_types(const struct xt_icmp_names *icmp_codes,
unsigned int n_codes)
{
unsigned int i;
for (i = 0; i < n_codes; ++i) {
if (i && icmp_codes[i].type == icmp_codes[i-1].type) {
if (icmp_codes[i].code_min == icmp_codes[i-1].code_min
&& (icmp_codes[i].code_max
== icmp_codes[i-1].code_max))
printf(" (%s)", icmp_codes[i].name);
else
printf("\n %s", icmp_codes[i].name);
}
else
printf("\n%s", icmp_codes[i].name);
}
printf("\n");
}
extensions/libxt_ipcomp.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -t filter -A INPUT -m ipcomp --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi 18 counter accept
iptables-translate -t filter -A INPUT -m ipcomp ! --ipcompspi 0x12 -j ACCEPT
nft add rule ip filter INPUT comp cpi != 18 counter accept
extensions/libxt_iprange.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -m iprange --src-range 192.168.25.149-192.168.25.151 -j ACCEPT
nft add rule ip filter INPUT ip saddr 192.168.25.149-192.168.25.151 counter accept
iptables-translate -A INPUT -m iprange --dst-range 192.168.25.149-192.168.25.151 -j ACCEPT
nft add rule ip filter INPUT ip daddr 192.168.25.149-192.168.25.151 counter accept
iptables-translate -A INPUT -m iprange --dst-range 3.3.3.3-6.6.6.6 --src-range 4.4.4.4-7.7.7.7 -j ACCEPT
nft add rule ip filter INPUT ip saddr 4.4.4.4-7.7.7.7 ip daddr 3.3.3.3-6.6.6.6 counter accept
ip6tables-translate -A INPUT -m iprange ! --dst-range ::2d01-::2d03 -j ACCEPT
nft add rule ip6 filter INPUT ip6 daddr != ::2d01-::2d03 counter accept
ip6tables-translate -A INPUT -m iprange ! --dst-range ::2d01-::2d03 --src-range ::2d01-::2d03 -j ACCEPT
nft add rule ip6 filter INPUT ip6 saddr ::2d01-::2d03 ip6 daddr != ::2d01-::2d03 counter accept
extensions/libxt_ipvs.c
View file @ dab1e98e
......@@ -126,19 +126,19 @@ static void ipvs_mt_dump_addr(const union nf_inet_addr *addr,
const union nf_inet_addr *mask,
unsigned int family, bool numeric)
{
char buf[BUFSIZ];
if (family == NFPROTO_IPV4) {
if (!numeric && addr->ip == 0) {
printf(" anywhere");
return;
}
if (numeric)
strcpy(buf, xtables_ipaddr_to_numeric(&addr->in));
printf(" %s%s",
xtables_ipaddr_to_numeric(&addr->in),
xtables_ipmask_to_numeric(&mask->in));
else
strcpy(buf, xtables_ipaddr_to_anyname(&addr->in));
strcat(buf, xtables_ipmask_to_numeric(&mask->in));
printf(" %s", buf);
printf(" %s%s",
xtables_ipaddr_to_anyname(&addr->in),
xtables_ipmask_to_numeric(&mask->in));
} else if (family == NFPROTO_IPV6) {
if (!numeric && addr->ip6[0] == 0 && addr->ip6[1] == 0 &&
addr->ip6[2] == 0 && addr->ip6[3] == 0) {
......@@ -146,11 +146,13 @@ static void ipvs_mt_dump_addr(const union nf_inet_addr *addr,
return;
}
if (numeric)
strcpy(buf, xtables_ip6addr_to_numeric(&addr->in6));
printf(" %s%s",
xtables_ip6addr_to_numeric(&addr->in6),
xtables_ip6mask_to_numeric(&mask->in6));
else
strcpy(buf, xtables_ip6addr_to_anyname(&addr->in6));
strcat(buf, xtables_ip6mask_to_numeric(&mask->in6));
printf(" %s", buf);
printf(" %s%s",
xtables_ip6addr_to_anyname(&addr->in6),
xtables_ip6mask_to_numeric(&mask->in6));
}
}
......
extensions/libxt_length.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -p icmp -m length --length 86:0xffff -j DROP
nft add rule ip filter INPUT ip protocol icmp meta length 86-65535 counter drop
iptables-translate -A INPUT -p udp -m length --length :400
nft add rule ip filter INPUT ip protocol udp meta length 0-400 counter
iptables-translate -A INPUT -p udp -m length --length 40
nft add rule ip filter INPUT ip protocol udp meta length 40 counter
iptables-translate -A INPUT -p udp -m length ! --length 40
nft add rule ip filter INPUT ip protocol udp meta length != 40 counter
extensions/libxt_limit.c
View file @ dab1e98e
......@@ -4,7 +4,10 @@
* Hervé Eychenne <rv@wallfire.org>
*/
#define _BSD_SOURCE 1
#define _DEFAULT_SOURCE 1
#define _ISOC99_SOURCE 1
#include <errno.h>
#include <getopt.h>
#include <math.h>
#include <stdio.h>
#include <string.h>
......@@ -12,6 +15,8 @@
#include <xtables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_limit.h>
#include "iptables/nft.h"
#include "iptables/nft-bridge.h"
#define XT_LIMIT_AVG "3/hour"
#define XT_LIMIT_BURST 5
......@@ -190,22 +195,100 @@ static int limit_xlate(struct xt_xlate *xl,
return 1;
}
static struct xtables_match limit_match = {
.family = NFPROTO_UNSPEC,
.name = "limit",
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_rateinfo)),
.userspacesize = offsetof(struct xt_rateinfo, prev),
.help = limit_help,
.init = limit_init,
.x6_parse = limit_parse,
.print = limit_print,
.save = limit_save,
.x6_options = limit_opts,
.xlate = limit_xlate,
static int limit_xlate_eb(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
limit_xlate(xl, params);
xt_xlate_add(xl, " ");
return 1;
}
#define FLAG_LIMIT 0x01
#define FLAG_LIMIT_BURST 0x02
#define ARG_LIMIT '1'
#define ARG_LIMIT_BURST '2'
static int brlimit_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match)
{
struct xt_rateinfo *r = (struct xt_rateinfo *)(*match)->data;
uintmax_t num;
switch (c) {
case ARG_LIMIT:
EBT_CHECK_OPTION(flags, FLAG_LIMIT);
if (invert)
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --limit");
if (!parse_rate(optarg, &r->avg))
xtables_error(PARAMETER_PROBLEM,
"bad rate `%s'", optarg);
break;
case ARG_LIMIT_BURST:
EBT_CHECK_OPTION(flags, FLAG_LIMIT_BURST);
if (invert)
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --limit-burst");
if (!xtables_strtoul(optarg, NULL, &num, 0, 10000))
xtables_error(PARAMETER_PROBLEM,
"bad --limit-burst `%s'", optarg);
r->burst = num;
break;
default:
return 0;
}
return 1;
}
static void brlimit_print(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct xt_rateinfo *r = (struct xt_rateinfo *)match->data;
printf("--limit");
print_rate(r->avg);
printf(" --limit-burst %u ", r->burst);
}
static const struct option brlimit_opts[] =
{
{ .name = "limit", .has_arg = true, .val = ARG_LIMIT },
{ .name = "limit-burst",.has_arg = true, .val = ARG_LIMIT_BURST },
XT_GETOPT_TABLEEND,
};
static struct xtables_match limit_match[] = {
{
.family = NFPROTO_UNSPEC,
.name = "limit",
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_rateinfo)),
.userspacesize = offsetof(struct xt_rateinfo, prev),
.help = limit_help,
.init = limit_init,
.x6_parse = limit_parse,
.print = limit_print,
.save = limit_save,
.x6_options = limit_opts,
.xlate = limit_xlate,
},
{
.family = NFPROTO_BRIDGE,
.name = "limit",
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_rateinfo)),
.userspacesize = offsetof(struct xt_rateinfo, prev),
.help = limit_help,
.init = limit_init,
.parse = brlimit_parse,
.print = brlimit_print,
.extra_opts = brlimit_opts,
.xlate = limit_xlate_eb,
},
};
void _init(void)
{
xtables_register_match(&limit_match);
xtables_register_matches(limit_match, ARRAY_SIZE(limit_match));
}
extensions/libxt_limit.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -m limit --limit 3/m --limit-burst 3
nft add rule ip filter INPUT limit rate 3/minute burst 3 packets counter
iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 5
nft add rule ip filter INPUT limit rate 10/second burst 5 packets counter
iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 0
nft add rule ip filter INPUT limit rate 10/second counter
extensions/libxt_mac.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -m mac --mac-source 0a:12:3e:4f:b2:c6 -j DROP
nft add rule ip filter INPUT ether saddr 0a:12:3e:4f:b2:c6 counter drop
iptables-translate -A INPUT -p tcp --dport 80 -m mac --mac-source 0a:12:3e:4f:b2:c6 -j ACCEPT
nft add rule ip filter INPUT tcp dport 80 ether saddr 0a:12:3e:4f:b2:c6 counter accept
extensions/libxt_mangle.c deleted 100644 → 0
View file @ f1f129da
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published
* by the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* Authors:
* Libarptc code from: Bart De Schuymer <bdschuym@pandora.be>
* Port to libxtables: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
*/
#include <stdio.h>
#include <netdb.h>
#include <string.h>
#include <stdlib.h>
#include <limits.h>
#include <getopt.h>
#include <errno.h>
#include <netinet/ether.h>
#include <xtables.h>
#include <linux/netfilter_arp/arpt_mangle.h>
static void mangle_help(void)
{
printf(
"mangle target options:\n"
"--mangle-ip-s IP address\n"
"--mangle-ip-d IP address\n"
"--mangle-mac-s MAC address\n"
"--mangle-mac-d MAC address\n"
"--mangle-target target (DROP, CONTINUE or ACCEPT -- default is ACCEPT)\n"
);
}
enum {
MANGLE_IPS = 0,
MANGLE_IPT = 1,
MANGLE_DEVS = 2,
MANGLE_DEVT = 3,
MANGLE_TARGET = 4,
};
static const struct xt_option_entry mangle_opts[] = {
{ .name = "mangle-ip-s", .id = MANGLE_IPS, .type = XTTYPE_STRING },
{ .name = "mangle-ip-d", .id = MANGLE_IPT, .type = XTTYPE_STRING },
{ .name = "mangle-mac-s", .id = MANGLE_DEVS, .type = XTTYPE_STRING },
{ .name = "mangle-mac-d", .id = MANGLE_DEVT, .type = XTTYPE_STRING },
{ .name = "mangle-target", .id = MANGLE_TARGET,
.type = XTTYPE_STRING },
XTOPT_TABLEEND,
};
static struct in_addr *network_to_addr(const char *name)
{
struct netent *net;
static struct in_addr addr;
if ((net = getnetbyname(name)) != NULL) {
if (net->n_addrtype != AF_INET)
return (struct in_addr *) NULL;
addr.s_addr = htonl((unsigned long) net->n_net);
return &addr;
}
return (struct in_addr *) NULL;
}
static void inaddrcpy(struct in_addr *dst, struct in_addr *src)
{
dst->s_addr = src->s_addr;
}
static struct in_addr *host_to_addr(const char *name, unsigned int *naddr)
{
struct in_addr *addr;
struct addrinfo hints;
struct addrinfo *res, *p;
int err;
unsigned int i;
memset(&hints, 0, sizeof(hints));
hints.ai_flags = AI_CANONNAME;
hints.ai_family = AF_INET;
hints.ai_socktype = SOCK_RAW;
*naddr = 0;
err = getaddrinfo(name, NULL, &hints, &res);
if (err != 0)
return NULL;
else {
for (p = res; p != NULL; p = p->ai_next)
(*naddr)++;
addr = xtables_calloc(*naddr, sizeof(struct in_addr));
for (i = 0, p = res; p != NULL; p = p->ai_next)
memcpy(&addr[i++],
&((const struct sockaddr_in *)p->ai_addr)->sin_addr,
sizeof(struct in_addr));
freeaddrinfo(res);
return addr;
}
return (struct in_addr *) NULL;
}
static int string_to_number(const char *s, unsigned int min,
unsigned int max, unsigned int *ret)
{
long number;
char *end;
/* Handle hex, octal, etc. */
errno = 0;
number = strtol(s, &end, 0);
if (*end == '\0' && end != s) {
/* we parsed a number, let's see if we want this */
if (errno != ERANGE && min <= number && number <= max) {
*ret = number;
return 0;
}
}
return -1;
}
static struct in_addr *dotted_to_addr(const char *dotted)
{
static struct in_addr addr;
unsigned char *addrp;
char *p, *q;
unsigned int onebyte;
int i;
char buf[20];
/* copy dotted string, because we need to modify it */
strncpy(buf, dotted, sizeof(buf) - 1);
addrp = (unsigned char *) &(addr.s_addr);
p = buf;
for (i = 0; i < 3; i++) {
if ((q = strchr(p, '.')) == NULL)
return (struct in_addr *) NULL;
*q = '\0';
if (string_to_number(p, 0, 255, &onebyte) == -1)
return (struct in_addr *) NULL;
addrp[i] = (unsigned char) onebyte;
p = q + 1;
}
/* we've checked 3 bytes, now we check the last one */
if (string_to_number(p, 0, 255, &onebyte) == -1)
return (struct in_addr *) NULL;
addrp[3] = (unsigned char) onebyte;
return &addr;
}
static struct in_addr *parse_hostnetwork(const char *name,
unsigned int *naddrs)
{
struct in_addr *addrp, *addrptmp;
if ((addrptmp = dotted_to_addr(name)) != NULL ||
(addrptmp = network_to_addr(name)) != NULL) {
addrp = xtables_malloc(sizeof(struct in_addr));
inaddrcpy(addrp, addrptmp);
*naddrs = 1;
return addrp;
}
if ((addrp = host_to_addr(name, naddrs)) != NULL)
return addrp;
xtables_error(PARAMETER_PROBLEM, "host/network `%s' not found", name);
}
static void mangle_parse(struct xt_option_call *cb)
{
const struct arpt_entry *e = cb->xt_entry;
struct arpt_mangle *mangle = cb->data;
struct in_addr *ipaddr;
struct ether_addr *macaddr;
/* mangle target is by default "ACCEPT". Setting it here,
* since original arpt_mangle.c init() no longer exists*/
mangle->target = NF_ACCEPT;
xtables_option_parse(cb);
switch (cb->entry->id) {
case MANGLE_IPS:
/*
if (e->arp.arpln_mask == 0)
xtables_error(PARAMETER_PROBLEM, "no pln defined");
if (e->arp.invflags & ARPT_INV_ARPPLN)
xtables_error(PARAMETER_PROBLEM,
"! pln not allowed for --mangle-ip-s");
*/
/*
if (e->arp.arpln != 4)
xtables_error(PARAMETER_PROBLEM, "only pln=4 supported");
*/
{
unsigned int nr;
ipaddr = parse_hostnetwork(cb->arg, &nr);
}
mangle->u_s.src_ip.s_addr = ipaddr->s_addr;
free(ipaddr);
mangle->flags |= ARPT_MANGLE_SIP;
break;
case MANGLE_IPT:
/*
if (e->arp.arpln_mask == 0)
xtables_error(PARAMETER_PROBLEM, "no pln defined");
if (e->arp.invflags & ARPT_INV_ARPPLN)
xtables_error(PARAMETER_PROBLEM,
"! pln not allowed for --mangle-ip-d");
*/
/*
if (e->arp.arpln != 4)
xtables_error(PARAMETER_PROBLEM, "only pln=4 supported");
*/
{
unsigned int nr;
ipaddr = parse_hostnetwork(cb->arg, &nr);
}
mangle->u_t.tgt_ip.s_addr = ipaddr->s_addr;
free(ipaddr);
mangle->flags |= ARPT_MANGLE_TIP;
break;
case MANGLE_DEVS:
if (e->arp.arhln_mask == 0)
xtables_error(PARAMETER_PROBLEM,
"no --h-length defined");
if (e->arp.invflags & ARPT_INV_ARPHLN)
xtables_error(PARAMETER_PROBLEM,
"! --h-length not allowed for "
"--mangle-mac-s");
if (e->arp.arhln != 6)
xtables_error(PARAMETER_PROBLEM,
"only --h-length 6 supported");
macaddr = ether_aton(cb->arg);
if (macaddr == NULL)
xtables_error(PARAMETER_PROBLEM, "invalid source MAC");
memcpy(mangle->src_devaddr, macaddr, e->arp.arhln);
mangle->flags |= ARPT_MANGLE_SDEV;
break;
case MANGLE_DEVT:
if (e->arp.arhln_mask == 0)
xtables_error(PARAMETER_PROBLEM,
"no --h-length defined");
if (e->arp.invflags & ARPT_INV_ARPHLN)
xtables_error(PARAMETER_PROBLEM,
"! hln not allowed for --mangle-mac-d");
if (e->arp.arhln != 6)
xtables_error(PARAMETER_PROBLEM,
"only --h-length 6 supported");
macaddr = ether_aton(cb->arg);
if (macaddr == NULL)
xtables_error(PARAMETER_PROBLEM, "invalid target MAC");
memcpy(mangle->tgt_devaddr, macaddr, e->arp.arhln);
mangle->flags |= ARPT_MANGLE_TDEV;
break;
case MANGLE_TARGET:
if (!strcmp(cb->arg, "DROP"))
mangle->target = NF_DROP;
else if (!strcmp(cb->arg, "ACCEPT"))
mangle->target = NF_ACCEPT;
else if (!strcmp(cb->arg, "CONTINUE"))
mangle->target = ARPT_CONTINUE;
else
xtables_error(PARAMETER_PROBLEM,
"bad target for --mangle-target");
break;
}
}
static void mangle_fcheck(struct xt_fcheck_call *cb)
{
}
static char *addr_to_dotted(const struct in_addr *addrp)
{
static char buf[20];
const unsigned char *bytep;
bytep = (const unsigned char *) &(addrp->s_addr);
sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
return buf;
}
static char *addr_to_host(const struct in_addr *addr)
{
struct hostent *host;
if ((host = gethostbyaddr((char *) addr,
sizeof(struct in_addr), AF_INET)) != NULL)
return (char *) host->h_name;
return (char *) NULL;
}
static char *addr_to_network(const struct in_addr *addr)
{
struct netent *net;
if ((net = getnetbyaddr((long) ntohl(addr->s_addr), AF_INET)) != NULL)
return (char *) net->n_name;
return (char *) NULL;
}
static char *addr_to_anyname(const struct in_addr *addr)
{
char *name;
if ((name = addr_to_host(addr)) != NULL ||
(name = addr_to_network(addr)) != NULL)
return name;
return addr_to_dotted(addr);
}
static void print_mac(const unsigned char *mac, int l)
{
int j;
for (j = 0; j < l; j++)
printf("%02x%s", mac[j],
(j==l-1) ? "" : ":");
}
static void mangle_print(const void *ip, const struct xt_entry_target *target,
int numeric)
{
const struct arpt_mangle *m = (const void *)target;
char buf[100];
if (m->flags & ARPT_MANGLE_SIP) {
if (numeric)
sprintf(buf, "%s", addr_to_dotted(&(m->u_s.src_ip)));
else
sprintf(buf, "%s", addr_to_anyname(&(m->u_s.src_ip)));
printf("--mangle-ip-s %s ", buf);
}
if (m->flags & ARPT_MANGLE_SDEV) {
printf("--mangle-mac-s ");
print_mac((unsigned char *)m->src_devaddr, 6);
printf(" ");
}
if (m->flags & ARPT_MANGLE_TIP) {
if (numeric)
sprintf(buf, "%s", addr_to_dotted(&(m->u_t.tgt_ip)));
else
sprintf(buf, "%s", addr_to_anyname(&(m->u_t.tgt_ip)));
printf("--mangle-ip-d %s ", buf);
}
if (m->flags & ARPT_MANGLE_TDEV) {
printf("--mangle-mac-d ");
print_mac((unsigned char *)m->tgt_devaddr, 6);
printf(" ");
}
if (m->target != NF_ACCEPT) {
printf("--mangle-target ");
if (m->target == NF_DROP)
printf("DROP ");
else
printf("CONTINUE ");
}
}
static void mangle_save(const void *ip, const struct xt_entry_target *target)
{
}
static struct xtables_target mangle_tg_reg = {
.family = NFPROTO_ARP,
.name = "mangle",
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct arpt_mangle)),
.userspacesize = XT_ALIGN(sizeof(struct arpt_mangle)),
.help = mangle_help,
.x6_parse = mangle_parse,
.x6_fcheck = mangle_fcheck,
.print = mangle_print,
.save = mangle_save,
.x6_options = mangle_opts,
};
void _init(void)
{
xtables_register_target(&mangle_tg_reg);
}
extensions/libxt_mark.c
View file @ dab1e98e
......@@ -47,14 +47,6 @@ static void mark_parse(struct xt_option_call *cb)
markinfo->mask = cb->val.mask;
}
static void print_mark(unsigned int mark, unsigned int mask)
{
if (mask != 0xffffffffU)
printf(" 0x%x/0x%x", mark, mask);
else
printf(" 0x%x", mark);
}
static void
mark_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
{
......@@ -63,7 +55,8 @@ mark_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
printf(" mark match");
if (info->invert)
printf(" !");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......@@ -76,7 +69,7 @@ mark_print(const void *ip, const struct xt_entry_match *match, int numeric)
if (info->invert)
printf(" !");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void mark_mt_save(const void *ip, const struct xt_entry_match *match)
......@@ -87,7 +80,7 @@ static void mark_mt_save(const void *ip, const struct xt_entry_match *match)
printf(" !");
printf(" --mark");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......@@ -99,7 +92,7 @@ mark_save(const void *ip, const struct xt_entry_match *match)
printf(" !");
printf(" --mark");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......
extensions/libxt_mark.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -I INPUT -p tcp -m mark ! --mark 0xa/0xa
nft insert rule ip filter INPUT ip protocol tcp mark and 0xa != 0xa counter
iptables-translate -I INPUT -p tcp -m mark ! --mark 0x1
nft insert rule ip filter INPUT ip protocol tcp mark != 0x1 counter
extensions/libxt_multiport.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept
iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport 80-88 counter accept
iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept
iptables-translate -t filter -A INPUT -p tcp -m multiport --sports 50 -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp tcp sport 50 counter accept
extensions/libxt_owner.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT
nft add rule ip nat OUTPUT tcp dport 80 skuid 0 counter accept
iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner 0-10 -j ACCEPT
nft add rule ip nat OUTPUT tcp dport 80 skgid 0-10 counter accept
iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner 1000 -j ACCEPT
nft add rule ip nat OUTPUT tcp dport 80 skuid != 1000 counter accept
extensions/libxt_pkttype.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -m pkttype --pkt-type broadcast -j DROP
nft add rule ip filter INPUT pkttype broadcast counter drop
iptables-translate -A INPUT -m pkttype ! --pkt-type unicast -j DROP
nft add rule ip filter INPUT pkttype != unicast counter drop
iptables-translate -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
nft add rule ip filter INPUT pkttype multicast counter accept
extensions/libxt_policy.c
View file @ dab1e98e
......@@ -376,6 +376,31 @@ static void policy6_save(const void *ip, const struct xt_entry_match *match)
}
}
static int policy_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
static const unsigned int allowed = XT_POLICY_MATCH_STRICT |
XT_POLICY_MATCH_NONE |
XT_POLICY_MATCH_IN;
static const struct xt_policy_elem empty;
const struct xt_policy_info *info = (const void *)params->match->data;
if ((info->flags & ~allowed) || info->len > 1)
return 0;
if (memcmp(&info->pol[0], &empty, sizeof(empty)))
return 0;
xt_xlate_add(xl, "meta secpath ");
if (info->flags & XT_POLICY_MATCH_NONE)
xt_xlate_add(xl, "missing");
else
xt_xlate_add(xl, "exists");
return 1;
}
static struct xtables_match policy_mt_reg[] = {
{
.name = "policy",
......@@ -389,6 +414,7 @@ static struct xtables_match policy_mt_reg[] = {
.print = policy4_print,
.save = policy4_save,
.x6_options = policy_opts,
.xlate = policy_xlate,
},
{
.name = "policy",
......@@ -402,6 +428,7 @@ static struct xtables_match policy_mt_reg[] = {
.print = policy6_print,
.save = policy6_save,
.x6_options = policy_opts,
.xlate = policy_xlate,
},
};
......
extensions/libxt_policy.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -m policy --pol ipsec --dir in
nft add rule ip filter INPUT meta secpath exists counter
iptables-translate -A INPUT -m policy --pol none --dir in
nft add rule ip filter INPUT meta secpath missing counter
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment