blob: 2e89a00df92cfe223f93158099cf53713ebcf449 [file] [log] [blame]
Jan Engelhardt370786f2007-07-14 20:47:26 -07001/*
2 * netfilter module to limit the number of parallel tcp
3 * connections per IP address.
4 * (c) 2000 Gerd Knorr <kraxel@bytesex.org>
5 * Nov 2002: Martin Bene <martin.bene@icomedias.com>:
6 * only ignore TIME_WAIT or gone connections
Jan Engelhardtba5dc272007-11-05 20:35:56 -08007 * (C) CC Computer Consultants GmbH, 2007
8 * Contact: <jengelh@computergmbh.de>
Jan Engelhardt370786f2007-07-14 20:47:26 -07009 *
10 * based on ...
11 *
12 * Kernel module to match connection tracking information.
13 * GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
14 */
15#include <linux/in.h>
16#include <linux/in6.h>
17#include <linux/ip.h>
18#include <linux/ipv6.h>
19#include <linux/jhash.h>
20#include <linux/list.h>
21#include <linux/module.h>
22#include <linux/random.h>
23#include <linux/skbuff.h>
24#include <linux/spinlock.h>
25#include <linux/netfilter/nf_conntrack_tcp.h>
26#include <linux/netfilter/x_tables.h>
27#include <linux/netfilter/xt_connlimit.h>
28#include <net/netfilter/nf_conntrack.h>
29#include <net/netfilter/nf_conntrack_core.h>
30#include <net/netfilter/nf_conntrack_tuple.h>
31
32/* we will save the tuples of all connections we care about */
33struct xt_connlimit_conn {
34 struct list_head list;
35 struct nf_conntrack_tuple tuple;
36};
37
38struct xt_connlimit_data {
39 struct list_head iphash[256];
40 spinlock_t lock;
41};
42
43static u_int32_t connlimit_rnd;
44static bool connlimit_rnd_inited;
45
Al Viroa34c4582007-07-26 17:33:19 +010046static inline unsigned int connlimit_iphash(__be32 addr)
Jan Engelhardt370786f2007-07-14 20:47:26 -070047{
48 if (unlikely(!connlimit_rnd_inited)) {
49 get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
50 connlimit_rnd_inited = true;
51 }
Al Viroa34c4582007-07-26 17:33:19 +010052 return jhash_1word((__force __u32)addr, connlimit_rnd) & 0xFF;
Jan Engelhardt370786f2007-07-14 20:47:26 -070053}
54
55static inline unsigned int
Jan Engelhardt643a2c12007-12-17 22:43:50 -080056connlimit_iphash6(const union nf_inet_addr *addr,
57 const union nf_inet_addr *mask)
Jan Engelhardt370786f2007-07-14 20:47:26 -070058{
Jan Engelhardt643a2c12007-12-17 22:43:50 -080059 union nf_inet_addr res;
Jan Engelhardt370786f2007-07-14 20:47:26 -070060 unsigned int i;
61
62 if (unlikely(!connlimit_rnd_inited)) {
63 get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
64 connlimit_rnd_inited = true;
65 }
66
67 for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i)
68 res.ip6[i] = addr->ip6[i] & mask->ip6[i];
69
Al Viroa34c4582007-07-26 17:33:19 +010070 return jhash2((u32 *)res.ip6, ARRAY_SIZE(res.ip6), connlimit_rnd) & 0xFF;
Jan Engelhardt370786f2007-07-14 20:47:26 -070071}
72
73static inline bool already_closed(const struct nf_conn *conn)
74{
Patrick McHardy5e8fbe22008-04-14 11:15:52 +020075 if (nf_ct_protonum(conn) == IPPROTO_TCP)
Jan Engelhardt370786f2007-07-14 20:47:26 -070076 return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
77 else
78 return 0;
79}
80
81static inline unsigned int
Jan Engelhardt643a2c12007-12-17 22:43:50 -080082same_source_net(const union nf_inet_addr *addr,
83 const union nf_inet_addr *mask,
84 const union nf_inet_addr *u3, unsigned int family)
Jan Engelhardt370786f2007-07-14 20:47:26 -070085{
86 if (family == AF_INET) {
87 return (addr->ip & mask->ip) == (u3->ip & mask->ip);
88 } else {
Jan Engelhardt643a2c12007-12-17 22:43:50 -080089 union nf_inet_addr lh, rh;
Jan Engelhardt370786f2007-07-14 20:47:26 -070090 unsigned int i;
91
92 for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i) {
93 lh.ip6[i] = addr->ip6[i] & mask->ip6[i];
94 rh.ip6[i] = u3->ip6[i] & mask->ip6[i];
95 }
96
97 return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6)) == 0;
98 }
99}
100
101static int count_them(struct xt_connlimit_data *data,
102 const struct nf_conntrack_tuple *tuple,
Jan Engelhardt643a2c12007-12-17 22:43:50 -0800103 const union nf_inet_addr *addr,
104 const union nf_inet_addr *mask,
Jan Engelhardt370786f2007-07-14 20:47:26 -0700105 const struct xt_match *match)
106{
Jan Engelhardt3cf93c92008-04-14 09:56:05 +0200107 const struct nf_conntrack_tuple_hash *found;
Jan Engelhardt370786f2007-07-14 20:47:26 -0700108 struct xt_connlimit_conn *conn;
109 struct xt_connlimit_conn *tmp;
Jan Engelhardt3cf93c92008-04-14 09:56:05 +0200110 const struct nf_conn *found_ct;
Jan Engelhardt370786f2007-07-14 20:47:26 -0700111 struct list_head *hash;
112 bool addit = true;
113 int matches = 0;
114
115
116 if (match->family == AF_INET6)
117 hash = &data->iphash[connlimit_iphash6(addr, mask)];
118 else
119 hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
120
Patrick McHardy76507f62008-01-31 04:38:38 -0800121 rcu_read_lock();
Jan Engelhardt370786f2007-07-14 20:47:26 -0700122
123 /* check the saved connections */
124 list_for_each_entry_safe(conn, tmp, hash, list) {
Patrick McHardyba419af2008-01-31 04:39:23 -0800125 found = __nf_conntrack_find(&conn->tuple);
Jan Engelhardt370786f2007-07-14 20:47:26 -0700126 found_ct = NULL;
127
128 if (found != NULL)
129 found_ct = nf_ct_tuplehash_to_ctrack(found);
130
131 if (found_ct != NULL &&
132 nf_ct_tuple_equal(&conn->tuple, tuple) &&
133 !already_closed(found_ct))
134 /*
135 * Just to be sure we have it only once in the list.
136 * We should not see tuples twice unless someone hooks
137 * this into a table without "-p tcp --syn".
138 */
139 addit = false;
140
141 if (found == NULL) {
142 /* this one is gone */
143 list_del(&conn->list);
144 kfree(conn);
145 continue;
146 }
147
148 if (already_closed(found_ct)) {
149 /*
150 * we do not care about connections which are
151 * closed already -> ditch it
152 */
153 list_del(&conn->list);
154 kfree(conn);
155 continue;
156 }
157
158 if (same_source_net(addr, mask, &conn->tuple.src.u3,
159 match->family))
160 /* same source network -> be counted! */
161 ++matches;
162 }
163
Patrick McHardy76507f62008-01-31 04:38:38 -0800164 rcu_read_unlock();
Jan Engelhardt370786f2007-07-14 20:47:26 -0700165
166 if (addit) {
167 /* save the new connection in our list */
168 conn = kzalloc(sizeof(*conn), GFP_ATOMIC);
169 if (conn == NULL)
170 return -ENOMEM;
171 conn->tuple = *tuple;
172 list_add(&conn->list, hash);
173 ++matches;
174 }
175
176 return matches;
177}
178
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800179static bool
180connlimit_mt(const struct sk_buff *skb, const struct net_device *in,
181 const struct net_device *out, const struct xt_match *match,
182 const void *matchinfo, int offset, unsigned int protoff,
183 bool *hotdrop)
Jan Engelhardt370786f2007-07-14 20:47:26 -0700184{
185 const struct xt_connlimit_info *info = matchinfo;
Jan Engelhardt22c2d8b2007-12-17 22:44:47 -0800186 union nf_inet_addr addr;
Jan Engelhardt370786f2007-07-14 20:47:26 -0700187 struct nf_conntrack_tuple tuple;
188 const struct nf_conntrack_tuple *tuple_ptr = &tuple;
189 enum ip_conntrack_info ctinfo;
190 const struct nf_conn *ct;
191 int connections;
192
193 ct = nf_ct_get(skb, &ctinfo);
194 if (ct != NULL)
195 tuple_ptr = &ct->tuplehash[0].tuple;
196 else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
197 match->family, &tuple))
198 goto hotdrop;
199
200 if (match->family == AF_INET6) {
201 const struct ipv6hdr *iph = ipv6_hdr(skb);
202 memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));
Jan Engelhardt370786f2007-07-14 20:47:26 -0700203 } else {
204 const struct iphdr *iph = ip_hdr(skb);
205 addr.ip = iph->saddr;
Jan Engelhardt370786f2007-07-14 20:47:26 -0700206 }
207
208 spin_lock_bh(&info->data->lock);
Jan Engelhardt22c2d8b2007-12-17 22:44:47 -0800209 connections = count_them(info->data, tuple_ptr, &addr,
210 &info->mask, match);
Jan Engelhardt370786f2007-07-14 20:47:26 -0700211 spin_unlock_bh(&info->data->lock);
212
213 if (connections < 0) {
214 /* kmalloc failed, drop it entirely */
215 *hotdrop = true;
216 return false;
217 }
218
219 return (connections > info->limit) ^ info->inverse;
220
221 hotdrop:
222 *hotdrop = true;
223 return false;
224}
225
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800226static bool
227connlimit_mt_check(const char *tablename, const void *ip,
228 const struct xt_match *match, void *matchinfo,
229 unsigned int hook_mask)
Jan Engelhardt370786f2007-07-14 20:47:26 -0700230{
231 struct xt_connlimit_info *info = matchinfo;
232 unsigned int i;
233
234 if (nf_ct_l3proto_try_module_get(match->family) < 0) {
235 printk(KERN_WARNING "cannot load conntrack support for "
236 "address family %u\n", match->family);
237 return false;
238 }
239
240 /* init private data */
241 info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);
242 if (info->data == NULL) {
243 nf_ct_l3proto_module_put(match->family);
244 return false;
245 }
246
247 spin_lock_init(&info->data->lock);
248 for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i)
249 INIT_LIST_HEAD(&info->data->iphash[i]);
250
251 return true;
252}
253
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800254static void
255connlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
Jan Engelhardt370786f2007-07-14 20:47:26 -0700256{
Jan Engelhardt3cf93c92008-04-14 09:56:05 +0200257 const struct xt_connlimit_info *info = matchinfo;
Jan Engelhardt370786f2007-07-14 20:47:26 -0700258 struct xt_connlimit_conn *conn;
259 struct xt_connlimit_conn *tmp;
260 struct list_head *hash = info->data->iphash;
261 unsigned int i;
262
263 nf_ct_l3proto_module_put(match->family);
264
265 for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
266 list_for_each_entry_safe(conn, tmp, &hash[i], list) {
267 list_del(&conn->list);
268 kfree(conn);
269 }
270 }
271
272 kfree(info->data);
273}
274
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800275static struct xt_match connlimit_mt_reg[] __read_mostly = {
Jan Engelhardt370786f2007-07-14 20:47:26 -0700276 {
277 .name = "connlimit",
278 .family = AF_INET,
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800279 .checkentry = connlimit_mt_check,
280 .match = connlimit_mt,
Jan Engelhardt370786f2007-07-14 20:47:26 -0700281 .matchsize = sizeof(struct xt_connlimit_info),
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800282 .destroy = connlimit_mt_destroy,
Jan Engelhardt370786f2007-07-14 20:47:26 -0700283 .me = THIS_MODULE,
284 },
285 {
286 .name = "connlimit",
287 .family = AF_INET6,
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800288 .checkentry = connlimit_mt_check,
289 .match = connlimit_mt,
Jan Engelhardt370786f2007-07-14 20:47:26 -0700290 .matchsize = sizeof(struct xt_connlimit_info),
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800291 .destroy = connlimit_mt_destroy,
Jan Engelhardt370786f2007-07-14 20:47:26 -0700292 .me = THIS_MODULE,
293 },
294};
295
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800296static int __init connlimit_mt_init(void)
Jan Engelhardt370786f2007-07-14 20:47:26 -0700297{
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800298 return xt_register_matches(connlimit_mt_reg,
299 ARRAY_SIZE(connlimit_mt_reg));
Jan Engelhardt370786f2007-07-14 20:47:26 -0700300}
301
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800302static void __exit connlimit_mt_exit(void)
Jan Engelhardt370786f2007-07-14 20:47:26 -0700303{
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800304 xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
Jan Engelhardt370786f2007-07-14 20:47:26 -0700305}
306
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800307module_init(connlimit_mt_init);
308module_exit(connlimit_mt_exit);
Jan Engelhardtba5dc272007-11-05 20:35:56 -0800309MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
Jan Engelhardt2ae15b62008-01-14 23:42:28 -0800310MODULE_DESCRIPTION("Xtables: Number of connections matching");
Jan Engelhardt370786f2007-07-14 20:47:26 -0700311MODULE_LICENSE("GPL");
312MODULE_ALIAS("ipt_connlimit");
313MODULE_ALIAS("ip6t_connlimit");