1 /* Shared library add-on to iptables to add limit support.
2 *
3 * Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr>
4 * Hervé Eychenne <rv@wallfire.org>
5 */
6 #define _BSD_SOURCE 1
7 #define _DEFAULT_SOURCE 1
8 #define _ISOC99_SOURCE 1
9 #include <errno.h>
10 #include <math.h>
11 #include <stdio.h>
12 #include <string.h>
13 #include <stdlib.h>
14 #include <xtables.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <linux/netfilter/xt_limit.h>
17 #include "iptables/nft-bridge.h"
18
19 #define XT_LIMIT_AVG "3/hour"
20 #define XT_LIMIT_BURST 5
21
22 enum {
23 O_LIMIT = 0,
24 O_BURST,
25 };
26
limit_help(void)27 static void limit_help(void)
28 {
29 printf(
30 "limit match options:\n"
31 "--limit avg max average match rate: default "XT_LIMIT_AVG"\n"
32 " [Packets per second unless followed by \n"
33 " /sec /minute /hour /day postfixes]\n"
34 "--limit-burst number number to match in a burst, default %u\n",
35 XT_LIMIT_BURST);
36 }
37
38 static const struct xt_option_entry limit_opts[] = {
39 {.name = "limit", .id = O_LIMIT, .type = XTTYPE_STRING},
40 {.name = "limit-burst", .id = O_BURST, .type = XTTYPE_UINT32,
41 .flags = XTOPT_PUT, XTOPT_POINTER(struct xt_rateinfo, burst),
42 .min = 0, .max = 10000},
43 XTOPT_TABLEEND,
44 };
45
46 static
parse_rate(const char * rate,uint32_t * val)47 int parse_rate(const char *rate, uint32_t *val)
48 {
49 const char *delim;
50 uint32_t r;
51 uint32_t mult = 1; /* Seconds by default. */
52
53 delim = strchr(rate, '/');
54 if (delim) {
55 if (strlen(delim+1) == 0)
56 return 0;
57
58 if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0)
59 mult = 1;
60 else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0)
61 mult = 60;
62 else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0)
63 mult = 60*60;
64 else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0)
65 mult = 24*60*60;
66 else
67 return 0;
68 }
69 r = atoi(rate);
70 if (!r)
71 return 0;
72
73 *val = XT_LIMIT_SCALE * mult / r;
74 if (*val == 0)
75 /*
76 * The rate maps to infinity. (1/day is the minimum they can
77 * specify, so we are ok at that end).
78 */
79 xtables_error(PARAMETER_PROBLEM, "Rate too fast \"%s\"", rate);
80 return 1;
81 }
82
limit_init(struct xt_entry_match * m)83 static void limit_init(struct xt_entry_match *m)
84 {
85 struct xt_rateinfo *r = (struct xt_rateinfo *)m->data;
86
87 parse_rate(XT_LIMIT_AVG, &r->avg);
88 r->burst = XT_LIMIT_BURST;
89
90 }
91
92 /* FIXME: handle overflow:
93 if (r->avg*r->burst/r->burst != r->avg)
94 xtables_error(PARAMETER_PROBLEM,
95 "Sorry: burst too large for that avg rate.");
96 */
97
limit_parse(struct xt_option_call * cb)98 static void limit_parse(struct xt_option_call *cb)
99 {
100 struct xt_rateinfo *r = cb->data;
101
102 xtables_option_parse(cb);
103 switch (cb->entry->id) {
104 case O_LIMIT:
105 if (!parse_rate(cb->arg, &r->avg))
106 xtables_error(PARAMETER_PROBLEM,
107 "bad rate \"%s\"'", cb->arg);
108 break;
109 }
110 if (cb->invert)
111 xtables_error(PARAMETER_PROBLEM,
112 "limit does not support invert");
113 }
114
115 static const struct rates
116 {
117 const char *name;
118 uint32_t mult;
119 } rates[] = { { "day", XT_LIMIT_SCALE*24*60*60 },
120 { "hour", XT_LIMIT_SCALE*60*60 },
121 { "min", XT_LIMIT_SCALE*60 },
122 { "sec", XT_LIMIT_SCALE } };
123
print_rate(uint32_t period)124 static void print_rate(uint32_t period)
125 {
126 unsigned int i;
127
128 if (period == 0) {
129 printf(" %f", INFINITY);
130 return;
131 }
132
133 for (i = 1; i < ARRAY_SIZE(rates); ++i)
134 if (period > rates[i].mult
135 || rates[i].mult/period < rates[i].mult%period)
136 break;
137
138 printf(" %u/%s", rates[i-1].mult / period, rates[i-1].name);
139 }
140
141 static void
limit_print(const void * ip,const struct xt_entry_match * match,int numeric)142 limit_print(const void *ip, const struct xt_entry_match *match, int numeric)
143 {
144 const struct xt_rateinfo *r = (const void *)match->data;
145 printf(" limit: avg"); print_rate(r->avg);
146 printf(" burst %u", r->burst);
147 }
148
limit_save(const void * ip,const struct xt_entry_match * match)149 static void limit_save(const void *ip, const struct xt_entry_match *match)
150 {
151 const struct xt_rateinfo *r = (const void *)match->data;
152
153 printf(" --limit"); print_rate(r->avg);
154 if (r->burst != XT_LIMIT_BURST)
155 printf(" --limit-burst %u", r->burst);
156 }
157
158 static const struct rates rates_xlate[] = {
159 { "day", XT_LIMIT_SCALE * 24 * 60 * 60 },
160 { "hour", XT_LIMIT_SCALE * 60 * 60 },
161 { "minute", XT_LIMIT_SCALE * 60 },
162 { "second", XT_LIMIT_SCALE }
163 };
164
print_rate_xlate(uint32_t period,struct xt_xlate * xl)165 static void print_rate_xlate(uint32_t period, struct xt_xlate *xl)
166 {
167 unsigned int i;
168
169 if (period == 0) {
170 xt_xlate_add(xl, " %f", INFINITY);
171 return;
172 }
173
174 for (i = 1; i < ARRAY_SIZE(rates); ++i)
175 if (period > rates_xlate[i].mult ||
176 rates_xlate[i].mult / period < rates_xlate[i].mult % period)
177 break;
178
179 xt_xlate_add(xl, " %u/%s", rates_xlate[i - 1].mult / period,
180 rates_xlate[i - 1].name);
181 }
182
limit_xlate(struct xt_xlate * xl,const struct xt_xlate_mt_params * params)183 static int limit_xlate(struct xt_xlate *xl,
184 const struct xt_xlate_mt_params *params)
185 {
186 const struct xt_rateinfo *r = (const void *)params->match->data;
187
188 xt_xlate_add(xl, "limit rate");
189 print_rate_xlate(r->avg, xl);
190 if (r->burst != 0)
191 xt_xlate_add(xl, " burst %u packets", r->burst);
192
193 return 1;
194 }
195
limit_xlate_eb(struct xt_xlate * xl,const struct xt_xlate_mt_params * params)196 static int limit_xlate_eb(struct xt_xlate *xl,
197 const struct xt_xlate_mt_params *params)
198 {
199 limit_xlate(xl, params);
200 xt_xlate_add(xl, " ");
201 return 1;
202 }
203
brlimit_print(const void * ip,const struct xt_entry_match * match,int numeric)204 static void brlimit_print(const void *ip, const struct xt_entry_match *match,
205 int numeric)
206 {
207 const struct xt_rateinfo *r = (struct xt_rateinfo *)match->data;
208
209 printf("--limit");
210 print_rate(r->avg);
211 printf(" --limit-burst %u ", r->burst);
212 }
213
214 static struct xtables_match limit_match[] = {
215 {
216 .family = NFPROTO_UNSPEC,
217 .name = "limit",
218 .version = XTABLES_VERSION,
219 .size = XT_ALIGN(sizeof(struct xt_rateinfo)),
220 .userspacesize = offsetof(struct xt_rateinfo, prev),
221 .help = limit_help,
222 .init = limit_init,
223 .x6_parse = limit_parse,
224 .print = limit_print,
225 .save = limit_save,
226 .x6_options = limit_opts,
227 .xlate = limit_xlate,
228 },
229 {
230 .family = NFPROTO_BRIDGE,
231 .name = "limit",
232 .version = XTABLES_VERSION,
233 .size = XT_ALIGN(sizeof(struct xt_rateinfo)),
234 .userspacesize = offsetof(struct xt_rateinfo, prev),
235 .help = limit_help,
236 .init = limit_init,
237 .x6_parse = limit_parse,
238 .print = brlimit_print,
239 .x6_options = limit_opts,
240 .xlate = limit_xlate_eb,
241 },
242 };
243
_init(void)244 void _init(void)
245 {
246 xtables_register_matches(limit_match, ARRAY_SIZE(limit_match));
247 }
248